System and method for partially encrypted multimedia stream

I. Field of the Invention

The present invention relates generally to encrypted multimedia streams.

II. Background of the Invention

Multimedia streams that are sought to be protected (e. g., pay-per-view sporting events, movies, and the like) can be encrypted at the transmitter (colloquially referred to as the "head end") with keys in a way that receiving television set-top boxes (STBs) that have complementary keys can decrypt the content for viewing. Accordingly, cable service providers must use head end conditional access (CA) devices that encrypt multimedia streams in accordance with the capabilities of the set-top boxes of the viewers. Many of these capabilities, including decryption capabilities, are proprietary to the makers of the set-top boxes.

It happens that only a very few "incumbent" companies sell most of the set-top boxes. Accordingly, competitors seeking to enter the cable television set-top box market must license the proprietary keys from the incumbents, often at high prices. This reduces competition.

A straightforward alternative way to permit competitive STB makers to enter the market without paying licensing fees to the incumbents would be to encourage the cable service providers, at their head ends, to completely encrypt each stream with as many CA devices (using respective sets of keys) as there are set-top box providers. This, however, would plainly undesirably multiply the amount of bandwidth necessary to carry a program. Accordingly, Sony has developed an encryption scheme whereby only "critical" portions, such as I-frames or headers, of a stream are encrypted, with the remainder of the stream being sent in the clear but being useless without being able to decrypt the "critical" portions. In this way, only the critical portions need be duplicated in encrypted form, not the entire stream. With more specificity, only the critical portions are encrypted both by the existing ("legacy") CA devices using the incumbents' keys and by a secondary conditional access process using a competitor's keys. Published <patcit id="pcit0001" dnum="US03821702A" dnum-type="L"><text>U.S. patent application serial no. 10/038, 217, filed January 2, 2002</text></patcit>, discloses such a scheme.

As understood herein, the legacy CA components that are made by the incumbent providers can be programmed by the incumbent providers to detect that the above-mentioned process is ongoing. Consequently, the legacy components might be programmed by the incumbents to defeat the process and, thus, to maintain a de facto monopoly. Having recognized this possibility, the solution below is provided.

<patcit id="pcit0002" dnum="US20020196939A"><text>US 2002/0196939</text></patcit> discloses a conditioned access system which provides an arrangement for multiple encryption of television programs.

SUMMARY OF THE INVENTION

The invention is defined by the appended claims.

The details of the present invention, both as to its structure and operation, can best be understood in reference to the accompanying drawings, in which like reference numerals refer to like parts, and in which:

BRIEF DESCRIPTION OF THE DRAWINGS

<ul id="ul0001" list-style="none" compact="compact"><li><figref idref="f0001">Figure 1</figref> is an architectural block diagram; and</li><li><figref idref="f0001">Figure 2</figref> is a flow chart of the present logic.</li></ul>

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

Referring initially to <figref idref="f0001">Figure 1</figref>, a system is shown, generally designated 10, that includes a source 12 of digital data streams, such as multimedia streams. The streams are sent to a critical packet locator and offset detector 14 which determines which packets in the stream are "critical". The critical packet locator and offset detector 14 also determines the offset (in integer numbers of packets from one or more packet identifiers (PID)) of each critical packet from a reference packet, e.g., the start of frame packet. The above-referenced patent application discusses critical packet selection. For clarity and completeness, critical packets may be information frames ("I-frames") in MPEG streams, or packetized elementary stream (PES) headers, or "action zones" of video, or other key packets that contain information which is essential to the successful recovery of picture and/or audio data. Preferably, packets containing references to program clock references (PCR) in the picture data (including presentation timestamp (PTS) and decoding timestamp (DTS) information) are never designated as "critical" packets.

As shown in <figref idref="f0001">Figure 1</figref>, the offsets of the critical packets are stored in a critical packet offset table 16 or other data structure. Also, the stream is sent from the locator 14 to a stream copier 18 that makes a copy of the data stream. It is to be understood that the stream could be copied before critical packets and their offsets are identified.

As can be appreciated in reference to <figref idref="f0001">Figure 1</figref>, one version of the stream is sent to a legacy conditional access (CA) device 20. The legacy CA device 20 can be considered to be a device provided by an incumbent that can process the stream by, e.g., encoding the stream with encryption keys, in accordance with the incumbent's proprietary CA scheme. The legacy CA device 20 completely encrypts the stream in accordance with conventional incumbent CA principles to render a fully encrypted stream.

Additionally, a version of the stream is sent from the stream copier to a buffer, preferably a circular first in first out (FIFO) buffer 22. The length of the buffer 22 should be of sufficient length (potentially a fixed length) to account for the delay caused by the processing time of the legacy CA device 20 in accordance with principles discussed below. The length of the FIFO buffer 22 may be established in increments of frame/picture or sequence/GOP for management purposes.

<figref idref="f0001">Figure 1</figref> shows that a secondary CA and reconstitution device 24 receives the clear stream from the FIFO buffer and the fully encrypted stream from the legacy CA device 20. The secondary CA and reconstitution device 24 includes a CA component, which encrypts only the critical packets in the clear stream received from the buffer 22, leaving the remaining portions of the stream unencrypted to render a partially encrypted stream. The secondary CA device 24 uses encryption keys that are different from those used by the legacy CA device 20. If desired, the pass through the secondary CA device 24 may slave to a new PCR value output by the legacy CA device 20, with the resulting corresponding value generated by the secondary CA device 24 differing by a fixed offset.

Also, the secondary CA and reconstitution device 24 includes a reconstitution component, which copies or strips or otherwise obtains only the now-encrypted critical packets from the fully encrypted stream received from the legacy CA device 20 and inserts the packets into the partially encrypted stream in accordance with principles below. The partially encrypted stream, now with two encrypted versions of each critical packet (one generated by the legacy CA device 20 and one generated by the secondary CA device 24) can be transmitted by a transmission system 26 over, e.g., cable, or terrestrial broadcast, or satellite broadcast.

It is to be understood that the functions of the secondary CA and reconstitution device 24 can be undertaken by separate components. It is to be further understood that the functions of the components 16, 18, 22, and 24 can be executed by a single secondary CA computing device or system or by separate devices/systems, and that the principles set forth herein apply to an overall system 10 that can have plural secondary CA systems.

The logic that is implemented by the system 10 shown in <figref idref="f0001">Figure 1</figref> can be seen in <figref idref="f0001">Figure 2</figref>. Commencing at block 28, critical packets in the stream are identified, along with their offsets from a predetermined packet or packets, in accordance with principles set forth above. The offsets are stored (e.g., in the offset table 16) at block 30, and the stream is copied at block 32 by the stream copier 18.

A first clear version of the stream is sent to the legacy CA device 20 at block 34. At block 36, the legacy CA device 20 fully encrypts the stream in accordance with incumbent CA principles. In parallel, a second clear version of the stream is buffered at block 38 and then partially encrypted at block 40 by the secondary CA device 24. As mentioned above, the secondary CA device 24 encrypts only the critical packets.

Block 42 represents the reconstitution function. The encrypted critical packets from the legacy CA device 20 are obtained by accessing the critical packet offset table 16, obtaining the offsets, and counting through the fully encrypted stream using the offsets from the reference PID or PIDS. At each indicated critical packet offset location, the encrypted packet at that location is obtained by, e.g., copying the packet from the stream. The critical packets are then inserted into the partially encrypted stream immediately next to the corresponding preexisting critical packets in the stream that were generated by the secondary CA device 24. The partially encrypted stream with two encrypted versions of each critical packet, one from the legacy CA device 20 and one from the secondary CA device 24, is transmitted at block 44.

While the particular SYSTEM AND METHOD FOR PARTIALLY ENCRYPTED MULTIMEDIA STREAM as herein shown and described in detail is fully capable of attaining the above-described objects of the invention, it is to be understood that it is the presently preferred embodiment of the present invention and is thus representative of the subject matter which is broadly contemplated by the present invention. For example, in a less elegant solution, the secondary CA device 24 could completely encrypt the stream, and the critical packets from the fully encrypted versions from the legacy and secondary CA devices could be copied and inserted into a third clear version of the stream from which the unencrypted critical packets have been removed. The scope of the present invention thus fully encompasses other embodiments which may become obvious to those skilled in the art, and that the scope of the present invention is accordingly to be limited by nothing other than the appended claims.