A partial dual-encrypted stream utilizing program map tables

0001The present application relates to <patcit id="pcit0001" dnum="US62983903A" dnum-type="L"><text>US application serial no. 10/629,839</text></patcit> entitled "Methods and Apparatus for Providing a Partial Dual-Encrypted Stream in a Conditional Access Overlay System" filed 7/30/03, which is a continuation-in-part of copending application serial no. <patcit id="pcit0002" dnum="US10602986B"><text>10/602,986</text></patcit> entitled "Method for Partially Encrypting Program Data" filed 6/25/03, which was filed simultaneously with applications having serial nos. <patcit id="pcit0003" dnum="US10602988B"><text>10/602,988 </text></patcit>and <patcit id="pcit0004" dnum="US10602987B"><text>10/602,987</text></patcit>, which were a continuation of App. No. <patcit id="pcit0005" dnum="US09930901B"><text>09/930,901 filed 8/16/2001</text></patcit>, which is a continuation of App. No. <patcit id="pcit0006" dnum="US09487076B"><text>09/487,076, filed 1/19/2000</text></patcit>, now <patcit id="pcit0007" dnum="US6292568B"><text>U.S. Pat. No. 6,292,568</text></patcit>, which is a continuation of App. No. <patcit id="pcit0008" dnum="US09126783B"><text>09/126,783, filed 7/31/1998</text></patcit>, presently abandoned, which claims the benefit of <patcit id="pcit0009" dnum="US05457597P" dnum-type="L"><text>U.S. Prov. App. No. 60/054,575, filed 8/1/1997</text></patcit>; and is a CIP of App. No. <patcit id="pcit0010" dnum="US09111958B"><text>09/111,958, filed 7/8/1998</text></patcit>, now abandoned, which claims the benefit of <patcit id="pcit0011" dnum="US05457897P" dnum-type="L"><text>U.S. Prov. App. No. 60/054,578, filed 8/1/1997</text></patcit>; and is CIP of App. No. <patcit id="pcit0012" dnum="US08767535B"><text>08/767,535, filed 12/16/1996</text></patcit>, now <patcit id="pcit0013" dnum="US6005938A"><text>U. S. Pat. No. 6,005,938</text></patcit>; and is a CIP of App. No. <patcit id="pcit0014" dnum="US08580759B"><text>08/580,759 filed 12/29/1995</text></patcit>, now <patcit id="pcit0015" dnum="US5870474A"><text>U.S. Pat. No. 5,870,474</text></patcit>, which claims the benefit of <patcit id="pcit0016" dnum="US00796295P" dnum-type="L"><text>U.S. Prov. App. No. 60/007,962, filed 12/4/1995</text></patcit>; and is CIP of App. No. <patcit id="pcit0017" dnum="US08415617B"><text>08/415,617, filed 4/3/1995</text></patcit>, now <patcit id="pcit0018" dnum="US5742677A"><text>U.S. Pat. No. 5,742,677</text></patcit>.

0002The present application descends from an application, which was one of seven original applications with identical Detailed Descriptions. All of these applications have the same filing date and the same assignee. The serial numbers and filing dates of the six applications follow: <ul id="ul0001" list-style="none" compact="compact"><li>Ser. No. <patcit id="pcit0019" dnum="US09127352B"><text>09/127,352, filed 7/31/98</text></patcit>, presently abandoned, for which a continuation Ser. No. <patcit id="pcit0020" dnum="US09488230B"><text>09/488,230 was filed on 1/20/2000</text></patcit>, which issued as <patcit id="pcit0021" dnum="US6252964B"><text>U.S. Pat. No. 6,252,964</text></patcit>, and continuation Ser. No. <patcit id="pcit0022" dnum="US09811085B"><text>09/811,085 was filed on 3/16/2001</text></patcit>, which issued as <patcit id="pcit0023" dnum="US6516412B"><text>U.S. Pat. No. 6,516,412</text></patcit>, and continuation Ser. No. <patcit id="pcit0024" dnum="US10287913B"><text>10/287,913 was filed on 11/5/2002</text></patcit>, currently pending;</li><li>Ser. No. <patcit id="pcit0025" dnum="US09126921B"><text>09/126,921, filed 7/31/1998</text></patcit>, which issued as <patcit id="pcit0026" dnum="US6157719A"><text>U.S. Pat. No. 6,157,719</text></patcit>, for which a continuation Ser. No. <patcit id="pcit0027" dnum="US09135615B"><text>09/135,615 was filed on 8/18/1998</text></patcit>, which issued as <patcit id="pcit0028" dnum="US6424714B"><text>U.S. Pat. No. 6,424,714</text></patcit>;</li><li>Ser. No. <patcit id="pcit0029" dnum="US09127273B"><text>09/127,273, filed 7/31/1998</text></patcit>, presently abandoned, for which a continuation Ser. No. <patcit id="pcit0030" dnum="US09493409B"><text>09/493,409 was filed on 1/28/2000</text></patcit>, which issued as <patcit id="pcit0031" dnum="US6560340B"><text>U.S. Pat. No. 6,560,340</text></patcit>, and for which continuation <patcit id="pcit0032" dnum="US10377416B"><text>10/377,416 was filed on 3/3/2003</text></patcit>, which is currently pending;</li><li>Ser. No. <patcit id="pcit0033" dnum="US09127152B"><text>09/127,152, filed 7/31/1998</text></patcit>, presently abandoned, for which a continuation Ser. No. <patcit id="pcit0034" dnum="US09488104B"><text>09/488,104 was filed on Jan. 20, 2000</text></patcit>, which issued as <patcit id="pcit0035" dnum="US6246767B"><text>U.S. Pat. No. 6,246,767</text></patcit>; for which continuation Ser. No. <patcit id="pcit0036" dnum="US09748313B"><text>09/748,313 was filed on 12/26/2000</text></patcit>, which issued as <patcit id="pcit0037" dnum="US6526508B"><text>U.S. Pat. No. 6,526,508</text></patcit>; and for which continuation Ser. No. <patcit id="pcit0038" dnum="US09881428B"><text>09/881,428 was filed on 6/14/2001</text></patcit>, currently pending;</li><li>Ser. No. <patcit id="pcit0039" dnum="US09126888B"><text>09/126,888, filed 7/31/1998</text></patcit>, presently abandoned, for which a continuation Ser. No. <patcit id="pcit0040" dnum="US09464794B"><text>09/464,794 was filed on 12/16/1999</text></patcit>, which issued as <patcit id="pcit0041" dnum="US6424717B"><text>U.S. Pat. No. 6,424,717</text></patcit>; and</li><li>Ser. No. <patcit id="pcit0042" dnum="US09126795B"><text>09/126,795, filed 7/31/1998</text></patcit>, which issued as <patcit id="pcit0043" dnum="US6105134A"><text>U.S. Pat. No. 6,105,134</text></patcit>.</li></ul>

FIELD OF THE INVENTION

0003The present invention relates generally to the field of encrypted streams in a communications system, and more specifically towards utilizing program map tables for transmitting and identifying dual encrypted streams in a communications system.

BACKGROUND OF THE INVENTION

0004The control of the content is important in order to protect the programming from, for example, nonpaying customers. A conventional communications system, such as a cable television system, therefore, typically applies an encryption scheme to television content in order to prevent unrestricted access. Once a system operator chooses an encryption scheme, the operator installs all of the necessary headend equipment (e.g., Scientific-Atlanta's conditional access software and associated equipment). The receiving devices (e.g., set-tops) located at the subscriber's premises must be compatible with the encryption scheme in order to decrypt the content for viewing. Due to the proprietary encryption systems, however, an operator is prevented from installing different set-tops that do not have the proper decryption keys. If the operator wishes to install different set-tops that decrypt a different conditional access system, the operator would also have to install a second proprietary encryption system to overlay the incumbent encryption system in order to use both set-tops.

0005It would be to the operator's advantage to be able to select set-tops from any manufacturer and easily implement different encryption/decryption schemes in the system without duplicating the headend equipment and utilizing extra bandwidth. The present application is directed towards a conditional access system that enables different proprietary set-tops to decrypt content using different decryption keys.

BRIEF DESCRIPTION OF THE DRAWINGS

0006<ul id="ul0002" list-style="none" compact="compact"><li><figref idref="f0001">FIG. 1</figref> is a block diagram of a prior art dual encryption process.</li><li><figref idref="f0002">FIG. 2</figref> is an illustration of a program including a critical packet.</li><li><figref idref="f0002">FIG. 3</figref> is an illustration of the critical packet and the duplicated packet of <figref idref="f0002">FIG. 2</figref>.</li><li><figref idref="f0003">FIG. 4</figref> is a block diagram of a first embodiment of a dual encryption scheme.</li><li><figref idref="f0004">FIG. 5</figref> is an illustration of one program aligner, identifier, and remapper (AIR) device in accordance with the present invention that is suitable for use in an AIR device of <figref idref="f0003">FIG. 4</figref>.</li><li><figref idref="f0005">FIG. 6</figref> is an illustration of a second embodiment of a dual encryption scheme in accordance with the present invention.</li><li><figref idref="f0006">FIG. 7</figref> is an illustration of one program aligner, identifier, and remapper (AIR) device in accordance with the present invention that is suitable for use in the AIR device of <figref idref="f0005">FIG. 6</figref>.</li><li><figref idref="f0007">FIG. 8</figref> provides an example table illustrating the single programs that may be provided to an output port of demultiplexers.</li><li><figref idref="f0008">FIG. 9</figref> is a state diagram illustrating the comparing of the packets by the packet comparator of <figref idref="f0004">FIG. 5</figref>.</li><li><figref idref="f0009">FIG. 10</figref> illustrates a Program Association Table (PAT) that is suitable for use by the first and second set-tops in a dual-encrypted system in accordance with the present invention.</li></ul>

DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT

0007The invention is set out in the claims appended hereto.

0008The present invention will be described more fully hereinafter with reference to the accompanying drawings in which like numerals represent like elements throughout the several figures, and in which an exemplary embodiment of the invention is shown. This invention may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein; rather, the embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. The present invention is described more fully hereinbelow.

0009The present invention is suitable for use in a partial dual encrypted system. The present invention allows for two different decryption devices (e.g., an incumbent, or first, set-top and an overlay, or second, set-top) to be located in a single system having an incumbent encryption scheme and a second encryption scheme. Each set-top is designed to decrypt the first or second proprietary encryption schemes, respectively. The second set-top may utilize a novel program map table to ensure that the second set-top chooses correct elementary streams in the partial dual-encrypted stream (i.e., a combined stream including a first encrypted stream, a second encrypted stream, and a clear stream) for a desired program.

0010More specifically, a clear multiprogram transport stream (MPTS) is provided to a headend facility. It will be appreciated that the clear MPTS includes several streams of unencrypted programs each including video, audio, and data packets. The packets each have a packet identifier (PID). Typically, an encryption scheme encrypts some or all of the packets (herein referred to as critical packets) of some or all of the programs depending upon the level of desired security. Further information regarding a conditional access system can be found in <patcit id="pcit0044" dnum="US60298603A" dnum-type="L"><text>U.S. Pat. App. Ser. No. 10/602,986</text></patcit> entitled "Method for Partially Encrypting Program Data" filed 6/25/03 and <patcit id="pcit0045" dnum="US6424717B"><text>U.S. Pat. No. 6,424,717</text></patcit> entitled "Conditional Access System" filed 12/16/1999, which are commonly assigned.

0011<figref idref="f0001">FIG. 1</figref> is directed towards a dual encryption scheme, and is taught in U.S. Pat. Application Publication No. <patcit id="pcit0046" dnum="US20030026423A1"><text>US 2003/0026423 Al by Unger. A</text></patcit> clear stream 105 is provided to a critical packet identifier, duplicator, and remapper device (IDR) 110. The identifier device 100 identifies a critical packet in a program. <figref idref="f0002">FIG. 2</figref> is an illustration of a stream including a critical packet 205 having a PID no. 21 0 (e.g., PID 100). The predetermined critical packet 205 is identified from the stream and duplicated. <figref idref="f0002">FIG. 3</figref> is an illustration of the critical packet and the duplicated packet of <figref idref="f0002">FIG. 2</figref>. The IDR 110 of <figref idref="f0001">FIG. 1</figref> then remaps the two critical packets (i.e., the critical packet 205 and the duplicated packet 305) to have differing PID values 310, 315. If, for example, the PID has an original value of 100, the IDR 100 may remap the critical packet 205 to have a PID value of 101 (310) and the duplicated packet 305 to have a PID value of 102 (315). It is also noted that the duplicated packet 305 is placed immediately following the critical packet 205 as taught by Unger.

0012Referring again to <figref idref="f0001">FIG. 1</figref>, Scrambler A 115 is then programmed to detect the PID values of the critical packets (e.g., PID 101) and scramble them with a first encryption scheme.

0013Scrambler B 120 then detects the duplicated packets having the remapped PID value (e.g., PID 102) and scrambles them according to a second encryption scheme. The transport stream including the clear stream (C) and the two encryption streams (A and B) are subsequently provided to a PID remapper 125. The PID remapper 125 remaps the clear stream (C) to have the same PID value as the first encryption stream A (e.g., PID 100 to PID 101). The transported stream may then include, for example, a percentage, such as 98%, of the clear stream C and a percentage, such as 2%, of both of the encrypted streams A and B. In this manner, an incumbent set-top, which is designed to decrypt encryption scheme A, receives 98% of the clear stream and 2% of the encrypted stream A. The remaining 2% of the encrypted stream B is simply not processed and discarded.

0014There are, however, several disadvantages with the teachings of Unger. More specifically, Unger relies on controlling the incumbent headend encryption equipment to the level of specifying exactly which PIDs to encrypt, which would be extremely difficult to accomplish in some existing encryption systems. For example, a Scientific-Atlanta encryption system, as described in <patcit id="pcit0047" dnum="US6424717B"><text>U.S. Pat. No. 6,424,717</text></patcit>, does not provide a control interface to encrypt a specific PID. The encryption schemes are performed at the program level and would require extensive recreations of a program mapping table and its associated sessions. In contrast, the present invention does not require any changes to the incumbent headend equipment or require any special control. More specifically, the present invention simply utilizes the output of the existing headend equipment without modifications. Another disadvantage, is that the teachings of Unger require two operations on the clear stream by the overlayed headend equipment; specifically, a first time for the critical packet selection and again for the PID remapping. The present invention, however, only processes the streams once using one piece of equipment. Advantageously, this is an improvement that reduces the cost and the complexity of the system.

0015A further advantage of the present invention is that modification of the encryption percentage is accomplished as a function of available bandwidth in the system. For example, if there is additional bandwidth available, the present invention can increase the encrypted percentage from, for example, 2% to 6%. Notably, this feature is important to the system operators who need to be sensitive of both the required bandwidth and the security level of the programs.

0016Referring now to <figref idref="f0003">FIG. 4</figref>, a block diagram is illustrated depicting a first embodiment of a partial dual encryption scheme. An MPTS, which is a clear stream C that includes a plurality of programs, is provided to scrambler A 410 and scrambler B 415. Scrambler A 410 and scrambler B 415 encrypts the clear stream C and respectively provides encrypted stream A and encrypted stream B. In a typical application, scrambler A 410 is the existing scrambler of the incumbent encryption scheme, and scrambler B is the additional scrambler required for the additional encryption scheme. A demultiplexer 420 is coupled to scrambler A 410 to demultiplex the encrypted stream A, which as mentioned includes a combination of programs, to provide a single program to a single output port. Similarly, demultiplexers 425 and 430 demultiplex the programs to provide the same single programs to an output port.

0017<figref idref="f0007">FIG. 8</figref> provides an example table illustrating the single programs that may be provided to an output port of the demultiplexers 420,425,430 for further processing. For example, a first Program PI 805, which may include video PID 100, audio PID 110, and other PID 120, (which may be a data PID or second audio PID), may be sent to a first output port of demultiplexers 420, 425,430. Similarly, a second Program P2 810, which may include video PID 200, audio PID 210, and other PID 220, may be sent to a second output port of demultiplexers 420,425,430. It will be appreciated that there can be any number of programs that can be provided to an output port.

0018Referring again to <figref idref="f0003">FIG. 4</figref>, an aligner, identifier, and remapper (AIR) device 435 receives the programs from the output ports of the demultiplexers 420, 425, 430, where the programs, or streams, (PI, P2, Pn) are grouped at the input of the AIR device 435, and is discussed below. The output streams of the AIR device 435 are provided to a multiplexer 440 that then provides a multiplexed partial dual encrypted transport stream. Additionally, the demultiplexer 420 coupled to scrambler A, which in this embodiment is assumed to be the incumbent scrambling scheme, also includes an output port 442 that provides undefined packets directly to the multiplexer 440. Due to the fact that there may be packets that are intended for purposes that are specific to the incumbent set-tops, these packets should be allowed to continue through the system without any potential alterations or deletion.

0019<figref idref="f0004">FIG. 5</figref> is an illustration of one program aligner, identifier, and remapper (AIR) device 500 that is suitable for use in the AIR device 435 of <figref idref="f0003">FIG. 4</figref>. It will be appreciated that embodiments disclosed herein in comparison with the prior art does not duplicate or remap critical packets. Additionally, it will be appreciated that more than one program AIR device 500 can be implemented in the AIR device 435 depending upon the number of programs (e.g., PI, P2, Pn) to be processed. Buffer A 505, buffer B 510, and buffer C 515 receive the streams A, B, and C from the output the demultiplexers 420, 425, 430. The buffers 505,510,515 allow a packet comparator 520 to monitor the streams A, B, and C and align them in time. Alignment may be necessary since the encrypted streams A and B may be somewhat delayed and out of synchronization due to the scramblers 410, 415.

0020<figref idref="f0008">FIG. 9</figref> is a state diagram illustrating the comparing and aligning of the packets by the packet comparator 520. In the initial state 905, the buffers 505, 510, 515 are filled with packets, and the packet comparator 520 begins searching, in state 910, for a reference packet (ref pkt) in the clear stream, which is provided by buffer C 515. The reference packet may be, for example, a video PID with a payload_unit_start_indicator (PUSI) bit equal to one (1). It will be appreciated that the specifications for this reference packet may have other specifications, such as an audio PID and the PUSI bit may be equal to o. The basis for comparison however must be valid for packets in the clear or scrambled state. Further information regarding the PUSI bit can be found in <patcit id="pcit0048" dnum="US6424714B"><text>U.S. Pat. No. 6,424,714</text></patcit> entitled "Conditional Access System." If the reference packet is not found, the clear stream C passes, and the encrypted streams A and B drop in state 915. The searching state 910 continues until the reference packet is found in the clear stream C. Subsequently, in state 920, the encrypted streams A and B are compared to the found reference packet. The basis for comparison is again the video PID, and the presence of the PUSI bit equal to one (1). The basis for comparison is not affected by the fact that scrambler A 410 or B 415 has scrambled the packet. If the packets in either of the streams A and B do not match, the non-matching packet(s) drop in state 925. If buffers A 505 and B 510 are empty, the state returns to state 910 and begins searching. Otherwise, state 920 continues comparing the packets in streams A and B with the reference packet until a match is found, and the streams are then considered aligned.

0021In the aligned state 928, state 930 waits until buffers A 505, B 510, and C 515 have greater than one packet. Subsequently, the head packets are verified to have the same PID value, in state 935. If not, in state 940, the packet in stream C passes and packets in streams A and B drop, and state 935 continues verifying the packets. At times, packets in a program can be swapped in their position and are essentially out of order. In that case, passing the packets in the clear stream C ensure that the packets are passed rather than stalling in the buffers. If the head packet PID values are the same, the values of the continuity_counter field of the packets are then verified to be the same, in state 945. If not, the assumption is that there is an error in the alignment, and the comparator 520 returns to the initial state 905. It will be appreciated that the continuity counter of the clear stream C is used as the reference number. If the continuity counters are the same for the all the packets in the streams, state 950 releases the packets from the buffers A, B, and C, and returns to the aligned state 930 to continue ensuring alignment of the packets. It will be appreciated that there are other methods for verifying alignment, other than the use of the continuity_count value, such as the presence and length of an adaptation_field, or the presence and value of a program_clock Jeference (PCR) value.

0022It should be noted that MPEG packet processing equipment typically modifies the Program Clock Reference (PCR) of programs being processed, to correct for any PCR jitter that would otherwise be introduced. In this embodiment, the PCRs of clear stream C are regarded as the primary PCRs, and all PCR modifications are performed on the values in stream C. If the PCR-bearing packet is also a critical packet, the corrected PCR value from stream C is placed into the PCR field in the packet from streams A and B.

0023Referring again to <figref idref="f0004">FIG. 5</figref>, a remapper 525 remaps the PID value of the released packet from stream B to a new PID value, for example, PID 100 to PID 101 and/or PID 110 to PID 111, depending upon whether the critical packet selection includes just video or audio packets or includes both video and audio packets. A switch 535, 540,545 then gates the released packets of stream A, B, and C.

0024A selector 530 also receives the released packet of clear stream C, which it uses as a reference stream to control the switches 535, 540, 545. In an embodiment, the selector 530 allows the packets of the clear stream C to pass through to a multiplexer 550 until such time as a critical packet is detected. Again, it will be appreciated that the critical packet can be a video, audio, and/or data packet. When the critical packet is detected, the switch 545 opens and switches 535, 540 are closed, thereby allowing the released packets of encrypted streams A and B, which each have the aligned critical packet, to simultaneously pass through to the multiplexer 550. The multiplexer 550 then combines the packets to provide a partial dual-encrypted transport stream where the dual encryption includes packets encrypted by both scrambler A 410 and scrambler B 415. The multiplexed stream is then provided to multiplexer 440 (<figref idref="f0003">FIG. 4</figref>) to be combined with additional partial dual-encrypted program streams. It will be appreciated that multiplexer 550 provides only a portion of the packet stream to the overall multiplexer 440 of <figref idref="f0003">FIG. 4</figref>. In this manner, when bandwidth becomes available in multiplexer 440, a signal indicating an increase in encrypted packets is allowable is provided to multiplexer 550 via feedback loop 560. The multiplexer 550 then relays this information to the selector 530 via feedback loop 565, and the selector 530 can then increase the percentage of critical packets, for example, from 2% to 6% of the packets that are considered critical.

0025<figref idref="f0005">FIG. 6</figref> is an illustration of a second embodiment of a partial dual encryption scheme in accordance with the present invention. The advantage of the configuration shown in <figref idref="f0005">FIG. 6</figref> is that all the elements required to add an additional encryption scheme (Demux 607, 608, AIR devices 615, and Mux 640) can be implemented in a single piece of equipment. An MPTS C is provided to scrambler A 605 that provides a first encrypted stream A. A first demultiplexer 607 receives the encrypted stream A and a second demultiplexer 608 receives the clear stream C in order to demultiplex the plurality of programs into single programs. Again, assuming the scrambler A 605 is the incumbent encryption scheme, an output port 609 of the demultiplexer 607 is provided for unidentified packets and is provided directly to a multiplexer 640 for delivery along with the partial dual-encrypted transport stream. The common programs from the demultiplexers 607, 608 are then provided to an aligner, identifier, and remapper (AIR) device 615.

0026<figref idref="f0006">FIG. 7</figref> is an illustration of one program aligner, identifier, and remapper (AIR) device 700 in accordance with the present invention that is suitable for use in the AIR device 615 of <figref idref="f0005">FIG. 6</figref>. For a first program P1, the encrypted stream A is buffered in buffer A 710, and buffer C 715 receives the clear stream C. A packet comparator 720 compares the packets to ensure they are aligned due to any delays introduced by scrambler A 705. It will be appreciated that the packet comparator 720 operates in a similar manner to the packet comparator 520 of <figref idref="f0004">FIG. 5</figref> and in accordance with the state diagram of <figref idref="f0008">FIG. 9</figref> for just encrypted stream A. A critical packet selector 725 uses the clear stream C as a reference stream and controls two switches 730, 735 accordingly. More specifically, switch 730 allows the packets of clear stream C to pass through to a multiplexer 740 until a critical packet is detected. When the critical packet is detected, switch 730 provides the packet of clear stream C to scrambler B 745 and switch 735 is also switched, thereby allowing the critical packet of encrypted stream A to pass through to the multiplexer 740. The scrambler B 745 encrypts the packet of clear stream C according to a second encryption method and provides the encrypted packet to a PID remapper 750. The PID remapper 750 remaps the packet's PID value to a new PID value (e.g., PID 100 to PID 101 and/or PID 110 to 111). The remapped packet is subsequently provided to the multiplexer 740 for transmitting along with the packet of the encrypted stream A. The scrambler B 745 also controls the PID comparator 720 in order to prevent packets from being transmitted until the scrambler B 745 and the remapper 750 have completed their steps, thereby maintaining proper ordering of packets.

0027A partial dual-encrypted transport stream is then provided to the multiplexer 640 (<figref idref="f0005">FIG. 6</figref>) to be combined with other partial dual-encrypted programs. The combined partial dual-encrypted transport stream is then provided to the set-tops and decrypted according to the decryption methods (Le., encryption method A or encryption method B) of the set-top. Similar to the first disclosed embodiment, multiplexer 740 provides only a portion of the packet stream to the overall multiplexer 640 of <figref idref="f0005">FIG. 6</figref>. In this manner, when bandwidth becomes available in multiplexer 640, a signal indicating an increase in encrypted packets is allowable is provided to multiplexer 740 via feedback loop 650. The multiplexer 740 then relays this information to the critical packet selector 725 via feedback look 765, and the critical packet selector 725 can then increase the percentage of critical packets, for example, from 2% to 6% of the packets that are considered critical.

0028<figref idref="f0009">FIG. 10</figref> illustrates a Program Association Table (PAT) 1005 that is suitable for use by the first and second set-tops in a dual-encrypted system in accordance with the present invention. It is known in the art that the PAT is periodically transmitted along with the program stream that the set-tops access in order to locate a desired program in the stream. The PAT contains a list of program numbers and their associated PID values for each program. Each program PID value in the PAT is then associated with a program map table (PMT). Included in the PMT are the PID numbers identifying the video, audio, and data packets for each associated program. It will be appreciated that the PAT PID values correspond with the PID values assigned by the remapper 525, 750 in order to ensure that the set-tops referencing the PAT for PID values are in line with the actual transmitted PID values of the packets.

0029By way of example and in accordance with the present invention, the PAT 1005 includes incumbent program numbers 1015 (i.e., 0x1, 0x2, 0x3), which point to programs that have been encrypted with the incumbent encryption scheme. Additionally, the PAT 1005 also provides second program numbers 1018 (i.e., 0x8001, 0x8002, 0x8003), which point to programs that have been encrypted with the second encryption scheme. Accordingly, the incumbent, or first, set-tops are designed to search for and receive the intended program numbers (i.e., 0x1, 0x2, 0x3) using their associated PMT, and the second set-tops are designed to search for and receive the second program numbers (i.e., 0x8001, 0x8002, 0x8003) using their associated PMT. In this manner, the incumbent set-tops work properly under any condition regardless of any manipulations that may be made to the transport stream. As previously mentioned, the present invention does not require any recreations of a program mapping table related to any incumbent set-tops in the system.

0030The second encrypted programs 1018, which are intended for the second set-tops, each have a different program map table (PMT) in accordance with the present invention, and one PMT 1010 is shown as an example. It will be appreciated that the PMTs 1012 for the incumbent encrypted programs 1015 remain unchanged having the original PID numbers to ensure that incumbent set-tops can properly decrypt their encrypted programs. The PMTs for the second encryption program numbers 1018 include the incumbent PMT 1020 plus additional overlay information 1025, 1030 for each PID number (e.g., 0x1010). In this manner, the second set-tops. are directed to receive any of the desired packets that were sent in the clear having an incumbent PID value 1020 and also the second encrypted packets having an overlay PID 1030. It will be appreciated that all of the encrypted packets having the incumbent PID values 1020 are disregarded. In other words, the second encrypted PID values 1030 and the clear packets included in the first encrypted PID 1020 are necessary for the second set-top to properly decrypt and display the service. Additionally, in the PMT 1010 a conditional access descriptor 1025 signifies whether or not a conditional access overlay encryption scheme is used for the program.