Tv set top box using gps

ES 2 367 243 T3

DESCRIPTION

TV terminal equipment with GPS with regional restrictions.

Background of the invention

The present invention relates to a video signal access control system, often referred to as a TV or television terminal box or equipment. More specifically, it refers to such a system, in which access to video signals from a distant or remote source is allowed only if the system is in an authorized position. Additionally, access to some video signals is more geographically restricted than access to other video signals.

Boxes or terminal equipment with integrated receiver decoder (IRD) are now being used to make people receive a subscription directly and pay for video transmissions from satellites using small outdoor antennas. Decoding equipment may also be used for overhead, encoded or remixed video signals (that is, broadcast or broadcast from a terrestrial transmitter to the customer / viewer without there being an intermediate pass through a satellite) or for cable video signals (ie i.e. conductive cable or fiber optic). (Since the functions of the terminal equipment can also be carried out by components integrated in a television set, a video tape recorder or other devices, the terms “customer access control” will be used here for the components located at the customer's location controlling access.)

Satellite transmissions can be digitally compressed to accommodate many programs on a single carrier and multiple carriers on a single satellite. Many of the programs are licensed for distribution and reception only in certain geographic regions, particularly in certain countries where program rights have been obtained for transmission and reception. Additionally, a box or terminal equipment may have been authorized solely for personal, non-commercial use by customers, and not for hotels, theaters or other commercial activities. It is therefore useful to operators of a video distribution system (whether via satellite, overhead broadcast or cable) that their terminal equipment can be operated only in authorized locations and that the equipment inhibits or denies authorization for reversal of program remixing by teams at unauthorized locations.

Various Patents have been issued on IRDs. While client access controls, such as set-top boxes, are generally independent of the television receiver (hence the common name for terminal equipment), it should be understood that they can also be integral (arranged in a common housing) with a television receiver, monitor, or video tape recorder.

The following North American patents stand out, of which only a few are discussed below, regarding access control for video signals or communication signals:

<td>Inventor</td><td>Patent No.</td><td>Expedition date</td>

<td>Teare et al.</td><td> 5.243.652</td><td>September 07, 1993</td>

<td>Daniel et al.</td><td> 5.224.161</td><td>June 29, 1993</td>

<td>Cohen et al.</td><td> 5.282.249</td><td>January 25, 1994</td>

<td>West, Jr.</td><td> 5.345.504</td><td>September 06, 1994</td>

<td>Mason</td><td> 4.736.422</td><td>April 05, 1988</td>

<td>Jeffers et al.</td><td> 4.739.510</td><td>April 19, 1988</td>

<td>Mason</td><td> 4.802.215</td><td>January 31, 1989</td>

<td>Kudelsky et al.</td><td> 5.144.663</td><td>September 01, 1992</td>

<td>Leduc et al.</td><td> 5.208.856</td><td>May 04, 1993</td>

<td>Wilson et al.</td><td> 5.295.188</td><td>March 15, 1994</td>

<td>Naccache et al.</td><td> 5.347.581</td><td>September 13, 1994</td>

<td>Diehl et al.</td><td> 5.373.557</td><td>December 13, 1994</td>

The Teare patent teaches the use of a Global Position System (GPS) receiver to authorize the release of an encryption or encryption key only when a track or trace is

ES 2 367 243 T3 position versus time corresponds to proper use. If this key is released, it allows the remote unit to view a remixed videotape, which is on the remote unit. The remote unit is on an aircraft that is allowed to show the videotape when it is in a given location or country and its position changes are consistent with the anticipated flight path.

Daniel shows the reversal of the video remix using a smart card and a pseudo-random generator.

Cohen discloses the reversal of video remixing through the use of a smart card.

West shows cable television access regulated by an intentional jamming signal.

As for other developments, NAVSTAR's GPS achieved its initial full operational capability in 1993 and provides time-precisely regulated radio frequency signals from twenty-four orbital satellites. A GPS receiver uses the transmission delay time from the multiple orbital satellites to perform a determination of the position of the GPS receiver. The receiver must have a clock with good short-term precision to couple to, and track, a code message sent by a GPS satellite, and additionally to make accurate pseudo-range measurements. It is possible to eliminate an error of time offset or offset between the conventional high precision atomic clock existing in each satellite and a receiver, by acting on the signal codes sent from four satellites instead of from only three. The additional satellite signal allows a mathematical solution for the temporal offset as well as for the intervals or distances between the satellites and the receiver.

Some GPS receivers currently cost as little as a few hundred dollars, making them satisfactory for ships, aircraft, and other vehicles for which position determination is desired. The GPS receiver includes a microprocessor to perform calculations on measured data, special circuitry to calculate correlations, and requires a display device, packaging, power supply, etc. Some of these elements are already in the box or terminal equipment for other purposes, and other functions can be simplified by carrying out a part of the treatment at the uplink location and transmitting the results together with the orders through the same communication system. which provides the video, audio and data programming to the IRDs. It is then possible to reduce the complexity of IRD processing to accommodate physical position validation, to a degree where the cost of electronic circuits to implement these functions is acceptably small.

In normal operation of a GPS receiver, time of arrival measurements of code division multiplexed radio signals from multiple GPS satellites are performed by the receiver. These measurements are then converted into pseudo-random measurements using the propagation speed of radio waves. The distance measurements are called pseudo-random due to a time skew error introduced by the imperfect time synchronization of the receiver with the precise timing of the satellites, controlled by atomic clocks.

Time bias is treated as an additional variable in position calculations, and an additional pseudorange measurement is performed to provide an additional equation to solve for this additional variable. Although the calculations to be carried out are direct or immediate, a position solution must be iteratively calculated to converge on a solution. Additionally, corrections for propagation effects must be calculated in order to produce an accurate determination of position, as is normally required for airplanes, ships, watercraft, or other vehicles.

The following US Patents show various GPS receivers and / or methods:

Document US-A-5,565,909 discloses a signal receiver, for example a radio receiver, that receives broadcast signals that are complemented by geographic identifiers. The receiver can be tuned to select signals that have the desired identifiers, such that the user only receives signals that are of interest to users of a geographic location. A GPS system can be used to update the position of the receiver so that it receives signals that have geographic identifiers appropriate to the geographic position of the receiver.

Document WO 96/35293 discloses a box or terminal equipment with a video signal access control system comprising a client access control having: a signal input, intended to receive at least one video signal from a distant or remote source; a video signal processor, operatively connected to receive video signals from the signal input; a conditional access device, operatively connected to the video signal processor; a signal output, operatively connected to the video signal processor and providing a usable video output signal, by authorizing the conditional access device to access one or more video signals from the remote source; and a GPS signal receiver, operable to receive position information from remote sources and that is operatively connected to the conditional access device, such that the conditional access device authorizes access only if the signal receiver from GPS receives signals consistent with the fact

ES 2 367 243 T3 that the customer access control is in an authorized location.

<td>Inventor</td><td>Patent No.</td><td>Expedition date</td>

<td>Holmes et al.</td><td> 4.807.256</td><td>February 21, 1989</td>

<td>Allison et al.</td><td> 5.359.332</td><td>October 25, 1994</td>

<td>Gilbert et al.</td><td> 5.379.045</td><td>January 03, 1995</td>

<td>The document</td><td>US 5,036,537 discloses a</td><td>subscriber unit used to describe television signals</td>

broadcast or broadcast. Each unit includes an indication of a geographical area, and the unit blocks the broadcast television signal in the event that the signal specifies a geographical area that matches the geographical area stored in the unit.

Purposes and summary of the invention

Accordingly, it is a fundamental purpose of the present invention to provide a new and improved video signal access control system.

A more specific purpose of the present invention is to provide a video signal access control that authorizes access to the signal only if the user access control is in the authorized location.

A further purpose of the present invention is to provide client access control that takes advantage of the location where a gPs receiver is being used.

A further purpose of the present invention is to provide customer access control in which access to different signals can be geographically restricted to a given region.

Still another purpose of the present invention is to provide customer access control in which access to different signals can be geographically restricted to different degrees. For example, some signals are accessible over a large area, while other signals are only accessible in a particular limited region. Other signals are excluded from access in certain regions.

A further purpose of the present invention is to provide a client access control that takes advantage of the position in which a GpS receiver is being used.

Yet another purpose of the present invention is to provide a simple and low-cost customer access control that makes use of a location using a simple GPS receiver or a single channel GPS receiver, such as a receiver. which is suitable for authorization at a single fixed location.

A further purpose of the present invention is to provide a video signal access control using a central access control located at a source of the video signals and distant or remote from the consumers.

Yet another purpose of the present invention is to provide a video signal access control system having a central access control using a GPS receiver and in such a way that the central access control supplies position information to the means of transmission for transmission to clients.

A further purpose of the present invention is to provide a video signal access control system that uses multiple criteria for authorization, including position and other factors such as payment for service rendered, no blackout or blackout ( that is, signal blocking) as a result of parental restrictions on the programming offered to children, and no blackout as a result of regional restrictions (for example, a sporting event may only be offered in areas outside the city, region or state in which the event takes place).

Still another purpose of the present invention is to provide a video signal access control system in which customer access control, at a customer location, does not require the ability to transmit information to a central access control and you do not need a central access control that sends a remix rollback key or otherwise responds to communications from client access control.

Still another purpose of the present invention is to provide a video signal access control system that has a customer access control located at a customer's location, such that the customer access control is highly resistant to attempts to force access control.

It would be desirable to have each and every terminal equipment carry out a remix rollback only if they are located in the physical location for which they have been authorized. Described herein is a system using the nAvSTAR Global Positioning System (GPS).

ES 2 367 243 T3 already existing to help validate the position of each box or terminal equipment and authorize it to reverse the remix of program services requested by the client, together with other criteria that include the payment of the services, only if this is It is located in the physical place for which it was authorized. As used herein, GPS means a system that uses a plurality of radio transmitters at different locations and a receiver that uses transmissions from the transmitters to determine or validate the position of the receiver. Of particular concern is the ability of a positioning device within terminal equipment not to be forced by someone wishing to use the equipment in a location for which it is not intended. The present system is resistant to the insertion of false data that would cause the position to be determined as the authorized one, at the same time that it is in an unauthorized position. Finally, the position determining device is required to be as cheap as possible.

This Application addresses additional geographic requirements, beyond the unique fixed position requirement of the preferred embodiment of the originating Application. The present invention provides implementation methods for a flexible set of geographically restrictive reception conditions for broadcast signals via satellite. These conditions may be associated with certain program distribution rights associated with certain specific programs, and these rights cover certain geographical areas, or, conversely, these may exclude certain geographical areas. As an example of programming that can cover only a specific geographic area, television networks authorize each of their affiliated network stations to use network material only in a specific geographic area, usually a region around a city. concrete. Separate contractual provisions are developed with different entities for different geographic areas. As a result, it is not permissible for one entity to broadcast or broadcast its signals within the region of another entity. While these geographically restricted area conditions are contractual, the typical case for terrestrial broadcast transmitters will generally be geographically limited simply as a consequence of the transmitter itself. That is, a terrestrial transmitter transmits a signal that can only be received in a reception area close enough to the transmitter. However, when the broadcast transmitter is on a satellite, a similar contractual geographic limitation can be maintained. That is, the satellite transmitter that rebroadcasts the terrestrial transmitter signal may be similarly restricted by an existing legal contract. Signal reception from a terrestrial broadcast transmitter is physically limited in distance from the transmitter by the curvature of the Earth. The signal reception area for a satellite transmitter is largely determined by the beam configuration of the satellite's transmitting antenna, often covering an entire country, or more. Satellites can provide spot or spot beams, which cover narrower regions of the Earth than normal satellite transmission configurations. However, such spot beams generally still cover a larger area than that covered by terrestrial transmitters. An additional mechanism is needed to make the coverage area of ​​the satellite transmitter more closely match that of the terrestrial transmitter. Customer access control or terminal equipment employing GPS can be made to provide this additional mechanism.

The present invention can be described as a video signal access control system as set out in the accompanying claims, comprising a customer access control, capable of being operated at a customer location and having:

a signal input, intended to receive at least one video signal from a distant or remote source;

a video signal processor, operatively connected to receive video signals from the signal input;

a conditional access device, operatively connected to the video signal processor;

a signal output, operatively connected to the video signal processor and providing a video output signal usable only by authorizing the conditional access device access to the one or more video signals from the remote source;

a GPS signal receiver, operable at the customer's location to receive position information from remote sources, and operably connected to the conditional access device, such that the conditional access device authorizes access only if the GPS signal receiver receives signals consistent with the fact that the client access control is in an authorized position; and a region comparator, adapted to compare a received region code with the at least one video signal from the remote source, with a region index stored at the customer's location and operable to output an output region comparator, such that the code is representative of a geographic region authorized to receive a signal, and the region index is representative of a geographic region of the client access control, so that there are different region codes for different geographic regions; and in such a way that the conditional access device receives the output of the region comparator and conditions the access to a given (s) of the video signals from the remote source to the fact that the output of the

ES 2 367 243 T3 region comparator indicates that given (s) of the video signals are authorized for a client access control access region.

The conditional access device authorizes access only if the GPS signal receiver receives signals consistent with the fact that the client access control is in a single fixed location authorized for service.

The conditional access device authorizes access to signals known as position-specific signals only if the GPS signal receiver receives signals consistent with the fact that the customer access control is in a single fixed position authorized for service. ; and in such a way that the conditional access device authorizes access to signals known as regional signals, even in the event that the GPS signal receiver receives signals inconsistent with the fact that the customer access control is in a only fixed position authorized for service, as long as the region comparer output indicates that the video signals are authorized for the access region of the customer access control.

The access region of the client access control is an access region in which the client access control is actually located where it is detected through the use of the GPS signal receiver, and the region index represents the region in the client access control is actually located.

The access region of the client access control is an access region in which the client access control is authorized to be placed, and the region index represents the region in which the client access control is authorized to be placed .

The conditional access device accesses signals known as position specific signals only if the GPS signal receiver receives signals consistent with the fact that the customer access control is in a single fixed position authorized for service; and such that the conditional access device authorizes access to signals known as regional signals, even if the GPS signal receiver receives signals inconsistent with the fact that the client access control is in a single authorized fixed position for service as long as the region comparer output indicates that the video signals have been authorized for the customer access control access region.

The access region of the client access control is an access region in which the client access control is actually located as detected by the use of the GPS signal receiver, and the region index represents the region in the that customer access control is actually located.

Alternatively, the access region of the client access control is an access region in which the client access control is authorized to locate, and the region index represents the region in which the client access control is authorized. to be placed.

The signal access control system may additionally include a central access control, located remotely or remotely from the clients and operable to transmit the region index for each client, such that the region index for that client is stored in client access control; and so that the region index represents the region in which the client access control is authorized to be placed.

The client access control includes a region determining device to which GPS data is supplied from the signal receiver and to which contour data corresponding to the boundaries or contours of one or more of several access regions is supplied, from such that the region determining device outputs the region index based on the access region in which the client access control is currently located, as determined by the use of the GPS signal receiver, and the region index represents the region in which the client access control is actually located.

The client access control is capable of being operated in different regions among a plurality of access regions, such that the client access control grants access to signals corresponding to each access region when the access control of customer is in that region.

A large area or zone includes the plurality of regions and in it the conditional access device authorizes access to signals known as large area signals, as long as the client access control is within a large area that includes a plurality of the regions. The large area includes, in addition to the plurality of regions, an open area; and, in it, the conditional access device authorizes access to signals known as region exclusion signals, as long as the client access control is within the large area and outside one or more of the regions from which the particular signal is excluded.

The conditional access device authorizes access to signals known as region exclusion tokens as long as the client access control is within the large area and outside the one or more regions from which the particular signal is excluded. Client Access Control is a non-transmitting unit.

ES 2 367 243 T3

Brief description of the drawings

The foregoing and other features of the present invention will be more readily understood when the following detailed description is considered in conjunction with the accompanying drawings, in which the same characters represent analogous or like parts throughout the various views, and in which:

Figure 1 is a simplified block diagram of a central access control used with a video signal access control system in accordance with the present invention;

Figure 2 is a simplified block diagram of a client access control used with the video signal access control system;

Figure 3 is a flow chart of the client access control of a first embodiment, calculating its position;

Figure 4 is a client access control flow chart of a second embodiment, validating its position;

Figure 5 is a block diagram of a customer access control having a tamper resistant feature and making use of the techniques of one of Figures 3 and 4;

Figure 6 shows a sequence of correlation results for different Gold codes generated in a part of Figure 5;

Figure 7 is a simplified block diagram of a supplementary part of the central access control of Figure 1;

Figure 8 is a simplified block diagram of a further supplemental part of the central access control of Figure 1;

Figure 9 is a simplified block diagram of a supplemental part of the client access control of Figure 2;

Figure 10 is a simplified block diagram of a further supplemental part of the client access control of Figure 2, which part constitutes a first embodiment of geographically flexible client access control;

Figure 11 is a simplified block diagram of a second geographically flexible client access control embodiment;

Figure 12 is a region determination arrangement that can be used with any of several geographically flexible client access control embodiments;

Figure 13 is a flow chart for a third geographically flexible client access control embodiment;

Figure 14 is an illustration of geographic regions within a large area or zone, used for explanation of operations of the present invention;

Figure 15 is another illustration of geographic regions used to explain operations of the present invention; and Figure 16 is a simplified block diagram of the third geographically flexible client access control embodiment.

Detailed description

Referring to Figures 1 and 2, a video signal access control system includes a central access control or system 10 of Figure 1, and a client access control or system 12 of Figure 2.

The central access control 10 is remote or remote from the clients who subscribe to the various programs. An antenna 14 receives global positioning system (GPS) information from GPS satellites (not shown) and is connected to a central data processor / GPS receiver 16 (ie, distant or remote from to customers / subscribers), which may function in a known manner to provide GPS data messages 18 to a central conditional access control or system 20. Specifically, the GPS receiver / processor 16 is preferably a code division multiplex multiple channel receiver. The received signals are all on the same radio frequency, but each of the GPS satellite signals has a different repetition code than the other signals.

ES 2 367 243 T3

The GPS receiver / processor 16 is a high quality conventional unit, but it determines which GPS satellites are best used for position fixation at the locations where the customer access control systems 12 are located. That is, a normal GPS receiver determines which satellites should be used for position determination. The GPS receiver / processor 16 determines instead which satellites should be used at customer sites. If the geographic coverage area of ​​the various customer locations is large enough, the GPS receiver / processor 16 will provide multiple determinations for the different regions. For example, given geographic regions A and B, the best satellites to receive GPS data in region A may be different at any given time from the best satellites to receive GPS data in region B. Accordingly, the GPS receiver / processor 16 can, using a known central or average geographic position in region A, easily determine the best satellites to receive GPS data in region A. In the same way, the GPS receiver GPS / processor 16 can, using a known central or average geographic position in region B, easily determine the best satellites to receive GPS data in region B. Given the knowledge of the position of said central or middle geographical location of a given region, known techniques easily allow the determination of the best satellites to use in a given position.

The transmitters of GPS satellites send data at 50 bits per second, superimposed on their output signals, which are also called Gold codes (named after a person), corresponding to a particular satellite. As is known, these Gold or GPS codes are usually one megabit per second codes. The data is decoded using known techniques, in order to determine precise position and velocity information (vector), collectively called ephemeris data, for each satellite, which will be used to verify or determine the position of the control system 12 client access in a way that will be explained in detail later. (As is known per se, the velocity vector is the rate of change in time of the position vector.) The correlation data for the expected velocity of propagation is also decoded in a known way.

GPS data messages 18 (i.e., signals over power lines 18), including position, velocity, and correlation data with respect to the various satellites are supplied by receiver / processor 16, to a monitoring system. central conditional access 20, which may also be called a central conditional access device. Depending on the bandwidth at the output of the system 10 as well as other considerations, the GPS data messages 18 may simultaneously include data across all satellites used for all regions, or time multiplexed data from from one of the satellites and / or groups of satellites (for example, all satellite data from satellites used for region A, for a short time interval, followed by all satellite data from satellites used in region B, for a short time interval). In the example with regions A and B, data from satellites to be used for region A can be forwarded or routed to the various customer access control systems 12 (Figure 2 only) located within the region A, while data from satellites to be used for region B can be directed to the various customer access control systems 12 within region B.

The system 20 also receives source-supplied program data messages 22 and user authorization data messages 24 (not shown) in a known manner. Central conditional access system 20 supplies combined data messages 26 (the various inputs to system 20 are provided as output in encrypted or encrypted form) and a remix key 28 to multiplexer / remixer / transmitter 30, which may be named output unit. The output unit 30 receives audio, video and data signals from program sources 32, and supplies the output data 34 to a transmission medium. In known fashion, the output data 34 includes remixed versions of the various audio, video, and data program signals. The output data 34 also incorporates the data input to the system 20 such that it is located on the transmission medium, in a reverse but encrypted remix form. The data messages 26 and the output data 34, combined, will incorporate the various GPS data as discussed and using known techniques.

While the output data 34 is shown as provided to an uplink for a communication satellite, the output data can be applied to any transmission medium, for transmission (directly or indirectly) to clients. For example, the central access control system 10 may alternatively supply the output data 34 over the air (non-satellite television broadcasts) and / or over cable (lead or fiber optic cables). In either case, the signals will be remixed and the remix reversal will only take place if one of the customer access control systems 12 of Figure 2 is in an authorized position, as will be explained later.

The multiplexer / remixer / transmitter 30 may be, for example, a standard MPEG2 system multiplexer, which operates on a packet basis, receiving audio, video and data packets and combining them to obtain a serially formatted data stream, for processing. handover to the communication satellite uplink. As is well known, MPEG2 is a particular digital video compression system or technique that accommodates multiple video, audio and data signals to be combined and transmitted on a single radio frequency carrier.

ES 2 367 243 T3

By having the important features associated with the high-quality, multi-channel GPS receiver / processor 16 in the system 10, the system 12 discussed below may be simpler than otherwise. Specifically, the advantageous feature of relaying the referred GPS data, while not a necessary part of the present invention in its broader respects, makes possible a much simpler and less expensive system 12. Since there must be at each customer / subscriber location a customer access control system 12, it is helpful to keep the costs and complexity of the customer access control system 12 low, while making the customer access control system More complex central access 10 does not involve a great expense, since there will be only one or a relatively low number. Since the conditional access system 20 operates in a known manner (except for the reception and incorporation into its output of the GPS data messages 18), it is not necessary to present the details of the system 20, including the components of the systems Known conditional access that ordinarily causes the remix keys to be changed and their encryption reverted by authorized IRDs (such as the customer access control system 12).

As an alternative to transmitting the described GPS data, the system 10 may alternatively send only the identity of the satellites to be used by the customer access control 12, instead of including the position information and speed. However, that will require more complex operations on the part of the client access control 12.

Returning, next, to the customer access control system 12 of Figure 2, an antenna 36 receives both direct GPS signals 38 (i.e., not re-broadcast or repeated from a central system such as 10 of Figure 1) coming from a satellite, such as communications satellite signals 40 that include the indirect GPS signals (i.e., re-broadcast or repeated through the central system 10, and in correspondence with the signals 34 of Figure 1 that follow their uplink to one or more communication satellites and their downlink to the customer access control system 12. In theory, a single satellite (not shown) can provide both the direct GPS signals and the communication signals 40, but satellites typically do not combine GPS and communications functions. The antenna 36 may be a small dish or satellite dish type antenna. Although not shown, separate antennas can be used for the direct GPS signals and for the communication signals, instead of the single receive antenna 36.

The signals received by antenna 36 are sent to an integrated receiver decoder (IRD) 37 and filtered (filter not shown) using known techniques, such that direct GPS signals 38 go to the GPS signal receiver 42 and communications signals 40 go to communications satellite receiver / decoder 44 (which serves as a signal input device). The output of the receiver / decoder 44 is a demodulated and decoded baseband signal corresponding to the signals 34 of Figure 1, and this output is supplied to the demixer / demultiplexer 46. The demixer / demultiplexer 46 operates in a known manner to demultiplex and direct signal packets to a client conditional access system 48, in conjunction with a connection 50 to the client conditional access system 48. The packets corresponding to the audio, video and data are reverted in their remix by the component 46 in the event that a re-mix revert key is supplied on the connection 52, by the system 48. The system 48 provides the correct key for remix rollback only if all criteria for authorization are met. Known IRDs allow access when criteria are satisfied, based on the program data messages 22 and authorization data messages 24 illustrated in Figure 1. The common or conventional details of the operation of the known components 44, 46 and 48 need not be explained, but emphasis will be placed later herein on the availability of GPS data as one of the criteria for the release of the remix reversion key, as well as in other respects where components 44, 46, and 48 differ from common systems above.

System 12 will not cause conditional access system 48 to release the correct key as indicated by reference 52, unless (in addition to criteria based on other factors such as payment for services, no obscuration or pass-through) black as a consequence of parental restrictions on the programming offered to children, and the absence of switching to black as a consequence of regional restrictions), the IRD 37 is in an authorized geographical position. Whether it is in an appropriate geographic position is determined by a GPS data processor 54, connected to the GPS signal receiver 42 by means of a time delay correlation device 56. Processor 54 performs time skew and pseudorange calculations as discussed later herein, and will provide an authorized binary position signal on line 92 only if the geographic position of IRD 37 is consistent with the expected position. or previously authorized.

The GPS processor 54 works in conjunction with the time delay autocorrelation device 56. Device 56 uses a known comparison technique involving a locally generated code for the satellite to be used. (Indirect GPS data is supplied to the satellites to be used, which is passed, via line or pipeline 60, to processor 54.) The locally generated code is supplied by pipeline 62 to the device 56 for its displacement or shift in time until it coincides in time with that same code, transmitted from the GPS satellite. The time offset value is passed back to processor 54 on line 64 for

ES 2 367 243 T3 pseudointervals, which use the interval equation:

(Xs - Xi)² + (Ys - Yi)² + (Zs - Zi)² = (R - Rb)² where Xs, Ys and Zs represent satellite position coordinates and Xi, Yi and Zi represent IRD 37 position coordinates. The distance between the satellite and IRD 37 at a particular time is represented by R, while Rb is the distance bias due to IRD clock instability (not shown separately).

Since the indirect GPS data preferably supplied to IRD 37 includes the position of the satellite, the coordinates at a given time, and the three components of the velocity at that time, Xs, Ys and Zs can be easily determined by the processor 54 at a time. later (relatively short time delay). Alternatively, if a more complex IRD is used, the direct GPS data can generate these values ​​independently of any indirect GPS data other than the identity of the satellites to be used.

The evaluation of the interval or distance equation for two different satellites (doing the equation twice) allows to check the consistency with the authorized position. As used herein, such a consistency check will be referred to as position validation. Considering that Xi, Yi and Zi, which represent the coordinates of IRD 37, can be taken as the authorized position, which means that the appropriate interval or distance R will be known, a first application of the equation yields a value for Rb, the bias away, due to the IRG clock offset from the satellite clock. A second application of the equation is that performed by processor 54 using a different satellite to check if the right and left members of the equation are equal. In the case that the left and right sides of the equation are equal, the distance is adequate and the position is very likely to be valid, since an equal distance is unlikely. (Even if a distance is equal to the appropriate distance at a given time, the movement of the IRD satellites means that soon after, the distance will not be valid unless the IRD is in an authorized position.) If the right limbs and left of the equation are not equal, processor 54 will not supply verification by conduction 58, such that conditional access 48 does not provide the remix revert key by line 52 and no usable program output (s) is supplied by component 46.

Rather than simply validating the IRD position as described above, an alternative causes the IRD 37 to operate in a position determination mode. In this mode, the above equation is calculated four times in order to solve four unknowns: the distance bias Rb and Xi, Yi and Zi, which represent the position coordinates of the IRD 37. A Taylor series or other technique can be used known iterative to solve the four unknowns. The determined IRD position coordinates can then be compared to previously stored authorized IRD coordinates. If they are equal (or within a certain tolerance interval), the verification will be provided by line 52. If they are not the same (or are not within a given tolerance range), verification is not supplied, such that conditional access 48 does not provide the remix rollback key 52 and no (n) is supplied by component 46 usable program output (s).

The advantage of using the position validation technique is that it can be simpler (with lower associated costs and lower processing power requirements) than doing position determination at the IRD. An advantage of position determination by the IRD is that it can be used for its own initialization at the clients location. That is, the authorized position can be initialized in the place where the customer first adjusts the IRD. This will avoid the need for the company to provide the IRD to determine and initialize the IRD values ​​for a suitable position. This prevents the remix from being reversed in other positions, but the company may still have to check in some way to make sure the customer did not initially take the IRD to an unauthorized position. On the other hand, this position auto-initialization technique can be quite useful if a company employee supplies the IRD to the customer.

Still further details of a first embodiment are shown in Figure 3. The processing shown here is limited to the operation of the GPS and its interface with MPEG2 or other program delivery system. GPS processing of four pseudorange measurements is included in this embodiment in order to explicitly determine the position of the IRD. Figure 4 differs from Figure 3 in that the GPS treatment in the IRD of Figure 4 performs only one distance validation (which, over time, is position validation) once the Programming supply system has provided the IRD with the GPS coordinates of the authorized position.

In Figure 3, a start block 100 leads to a block 110 in which the demultiplexer provides the portion of the programming signal that is oriented to GPS commands and data, on a line or pipeline 111 that goes to a block 120 . In block 120, the GPS receiver receives the command from lines 111 (this could be via the conditional access system of Figure 2) to carry out a pseudorange measurement and identify the particular GPS satellite. As indicated by reference 120, the receiver performs the correlation required to obtain the pseudorange and passes the pseudorange to the GPS processor at block 125. The GPS coordinates of the GPS satellite used for the measurement are supplied

ES 2 367 243 T3 from the demultiplexer block 110 located at the input 127 of a block 125. The contribution through the programming channel helps the system because the GPS receiver 42 of Figure 2 does not necessarily need to demodulate these data obtained directly from the GPS signal and is therefore able to quickly move to the next GPS satellite signal to be processed. It also avoids the need for the GPS receiver to require more than a single GPS signal to be handled at any one time, thereby saving on the amount of hardware or hardware required.

At the time of IRD initialization, a first position determination is stored in an authorized location memory, as indicated in block 130, via data path 135. Subsequent position determinations will compare the new position determinations with the position stored in memory. This comparison is carried out in a block 140 in which the present measured position is received from the GPS processor 54 of Figure 2. The authorized position is normally received via path 138. However, the system allows a position check to be made with a position communicated through the programming channel, via path 142. The system operator has choosing to validate the position against a position that you submit to the IRD if you wish. This system of Figure 3 is capable of carrying out a determination of the initial position itself, in such a way that this does not have to be provided by the programming channel. The ability to further validate this home position provides assurance that the home position measurement was made at the authorized position and not at some unauthorized position.

The output of block 140 is the interval or distance error between the currently measured position and the authorized position, and is supplied to a block 145. Block 145 carries out the treatment that determines, for the first time, whether the error distance is less than a preset threshold value, alpha. The value of alpha, and also the subsequently used threshold beta, is provided from the scheduling channel through a path 144. A binary result of this operation is produced, such that a "one" is produced for a distance error equal to or less than alpha and a binary zero is produced for a distance error that is greater than alpha.

So any individual distance errors produced by the GPS measurement procedure will not disable the IRD from reversing the remixing of program material when a second threshold value called beta is used. This procedure requires a predetermined percentage of the distance errors to be within the alpha threshold. Said predetermined percentage is governed by the beta threshold value.

The output of the processing block 145 is the binary position authorization signal, as indicated by reference 147. The signal indicated by reference 147 is an input component to the authorization logic block 115. Other authorization criteria are supplied to 115 through a 113 road. The logic contained in block 115 essentially requires that the signal 147 authorize the remix revert, in conjunction with the other criteria of 113 for authorization 118 for the reversion of the remix to be asserted, and the programming allowed to be viewed.

The logic block 113 is more complex than a simple AND gate because the programming channel can make the authorization for the reversion of the remix to be enabled or disabled regardless of the state of the authorization signal 147 of the position. This gives the system flexibility not to need position verification in certain cases.

An additional capability of this system allows certain geographic areas to be excluded or exempted from providing a position authorization. In this case, demultiplexer 110 provides the excluded area in terms of GPS coordinates to processor 140, via path 142. Processor 140 then compares the excluded area or zone with the position held in memory 130. If the memory location 130 is within the excluded area sent by path 142, block 140 sends the maximum possible distance error to block 145, which responds by not authorizing the position at its output 147.

Figure 4 shows a second embodiment of the invention in which the IRD does not carry out any position determination. In this embodiment, only distance checks are performed using pseudo-range measurements made at the IRD, and an authorized position is supplied to the IRD through the programming channel. An advantage of this embodiment is the hardware and software savings associated with processing pseudorange measurements iteratively, using four simultaneous nonlinear equations. GPS receiver operation 220 shown in Figure 4 is the same as receiver operation 120 shown in Figure 3. Also identical between Figures 3 and 4 are blocks 100 and 200, blocks 110 and 210 , blocks 115 and 215, and blocks 145 and 245.

In particular, in Figure 4, the block 230 involving the authorized position memory differs from that shown in Figure 3 in that the authorized position can only be entered from the programming channel illustrated in Figure 4, and where the processing carried out in block 240 performs only distance checks. The processor 140 of Figure 4 performs a distance computation between the GPS satellite that is measured and the IRD based on the coordinates of the authorized position contained in the memory 230 and the coordinates that have been passed to it through the path 242 , from demultiplexer operation block 210. Alternatively, the GPS satellite position coordinates can be demodulated to

ES 2 367 243 T3 from the GPS data, but this requires the single channel receiver 220 to remain synchronized with an individual GPS satellite for a longer period of time. The result of the distance calculation is then subtracted from the interval or distance determined from the measured data. This provides the distance offset value directly, which is the necessary output data to send to block 245. The remaining treatment in Figure 4 corresponds to that already illustrated in Figure 3.

An important aspect of the invention is that the terminal equipment will not be misled to believe that it is in an authorized position when, in fact, it has moved to an unauthorized position. The IRD may be in the hands of someone who wants to make the GPS receiver believe that it is receiving time lag measurements consistent with the cleared position, when in reality it is receiving artificial time lag measurements consistent with the cleared location but not with your actual position. It should be assumed that the general design of the IRD will become known to those of ordinary skill in the electronic circuit design art (as a consequence of any commercial delivery of the IRD), and particularly to those with experience in terminal equipment and conditional access systems. If terminal equipment is opened to expose or expose circuit components, then electronic signals moving between components, such as integrated circuits, can be easily observed with test measurement equipment. On the other hand, it is possible to interrupt certain connections and substitute other signals. Referring to Figure 2, it can be seen that the authorization system shown can be easily tampered with (in the absence of a feature explained below) by tampering with the verification signal 92. If the signal connection 92 to the conditional access system 85 were interrupted and instead tied to the magnitude or voltage level corresponding to the correct position verification, then the GPS system would be totally bypassed or circumvented and its purpose forced.

The terminal equipment system employing GPS can be made tamper resistant by placing all circuits related to the conditional access system and GPS within a sealed container. Such a container can be, for example, an integrated circuit or a smart card. The container has been designed in such a way that an attempt to penetrate it for internal signal measurement purposes in effect destroys the internal circuitry of the container. This implementation allows visibility of only encrypted or encrypted data passing into the container, and only the remix reversion keys, which are quickly changed, appear on the output pins of the container. It is desirable to have the possibility of renewing the conditional access system in the event that the security of the system is violated by one technique or another, by the direct method of replacing only the smart card. However, it is relatively expensive to dispose of all the GPS circuits if they are co-located within a smart card that is replaced. A method in which certain of the GPS circuits are located inside a sealed container, such as a smart card, and other parts of the GPS circuits are located outside the sealed container, is explained below. Circuit parts outside the sealed container are not replaced when the smart card is changed.

Figure 5 shows the method of using the GPS circuits in such a way that they resist being forced by tampering methods, and yet certain parts of the GPS circuits are permanently located in the terminal equipment, so that they do not they need to be replaced when a smart card is replaced. Some elements in Figure 5 perform the same functions as in Figure 2. Specifically, elements 350, 355, 360, 370, 375, 380 and 387 of Figure 5 correspond, respectively, to elements 38, 40, 36, 44, 42, 46 and 52 of Figure 2. Since the functions performed are the same, these items will not be described a second time.

In Figure 5, the dashed line 340 shows the elements that are located in common within the sealed container. The signs that are visible when passing in and out of the sealed container are as follows. First, the encrypted GPS and conditional access data 332, from the remix reverter and demultiplexer 380, passes into the container 340. Second, the stable clock 382, ​​which resides within the terminal equipment or the IRD, sends signals to the container 340 along the path 338. This clock has sufficient short-term stability to operate the receiver's processing system. GPS. Third, the key 387 for remix reversion of video, audio and data programming exits the container. This key is the correct key only if all authorization criteria, including GPS position criteria, have been satisfied.

Next, the baseband W code, 334, exits the container 340 to operate the correlation and demodulator device, 345. This is the one megabit per second GPS code corresponding to the code for one of the GPS satellites. . It is a desirable countermeasure to place the circuits that create the code sequence for a particular GPS satellite within the container. This has the effect of requiring a system attacker to determine which satellite is being interrogated by correlating the bit stream with various GPS satellite bit streams that are visible. An additional problem for the attacker is to also measure the particular time delay of the code that is being used. Both of these procedures require measurement equipment and time for measurement. If code generator 388 were outside of canister 340, presumably the attacker could easily determine the particular code and code time delay being used by the IRD. The attacker would be aided by observing the generator's state machine

ES 2 367 243 T3 of code 388, either directly or by the loaded word that is used to load an initial state into said generator. Since the GpS code generator uses the well-known Gold codes to generate matching satellite codes, knowledge of the state of the state machine provides the attacker with information regarding the particular code that is being used. It is, therefore, desirable to conceal code generator 388 within container 340.

It is beneficial, from a safety standpoint, to also place the correlation device 345 within the container 340 illustrated in Figure 5, where this is represented by the dashed lines around it. This therefore excludes the visibility of the W code, as indicated by reference 334, and of the output correlation result Z, as indicated by reference 336, by the attacker. This provides a very high degree of security as regards the disturbance of the GPS system to disorient it. This embodiment of the invention can be used especially in systems where the container 340 is rarely removed from the terminal equipment 365.

In a more cost-sensitive embodiment and / or where the container 340 can be expected to be renewed more often, the correlator and demodulator device 345 may be placed outside the container 340. This allows the radio frequency (RF) treatment indicated by reference 345 to take place outside of the container 340, and eliminates the need for the RF signal from the GPS signal receiver 375 to be passed through a pin. container connection 340. It also allows the local RF oscillator that is modulated by the W code, as indicated by reference 334, and treats the RF signal heterodynely by reducing it in frequency to a frequency that can be demodulated by a blocking loop. phase and Costas signal demodulator, or equivalent device, is placed outside said container. In order to minimize spending on the renewable portion of the IRD, the circuitry in block 345 will be located within the IRD box 365, outside of said container.

Two methods of the invention are explained below to greatly reduce visibility with respect to the fact that the GPS satellite is correlated with a locally generated code. The first method randomly changes the profile or waveform W, as indicated by reference 334 in Figure 5, between the GPS satellites. In this way, the satellites are not appealed in any particular order, which increases the difficulty for someone trying to interfere with the system to disorient it. Satellites that are not visible are also included, in order to cause the attacker even more effort and additional confusion in their attempt to discern what the IRD system is doing. It is practical to add such diversionary tactics, since it is not necessary to repeatedly validate the position at that time, which does not lead to great inconvenience.

The second method involves the random order testing of specific time delays from a GPS code to a particular GPS satellite. This procedure will cause the successful temporal correlation between the locally generated code W, as indicated by reference 334 in Figure 5, and the signal from the GPS satellite to occur at random time intervals. The result of the temporal correlation, Z, as indicated by reference 336 in Figure 5, is forwarded back to the common processor 385 located within the container 340. This is the last of the five signals that pass into or out of the container. 340. This signal is checked by said processor at all possible correlation result times in order to determine whether or not a correlation match has occurred. If a successful match occurs when it should not occur, or when it is consistent with the authorized IRD position, the processor registers an incorrect position. In this way, the Z signal is dynamic in that successful correlations are produced at random times. Likewise, the instants in which the processor expects a non-positive correlation are checked are checked for the negative result. A positive correlation at a time when none is expected is recorded as an error.

Figure 6 shows a sequence of correlations in which different Gold codes generated in W, as indicated by reference 334 in Figure 5, corresponding to real different GPS satellites and to some fictitious satellites or satellites that are not at that time visible on the same side of the earth, are produced, and the resulting correlations are reported back by the Z signal, as indicated by reference 336 in Figure 5. The timeline 400 illustrated in Figure 6 represents time, advancing from left to right. The line is divided into a plurality of individual correlation periods. Four of these periods give rise to positive correlations and have been labeled, respectively, D732, S89, K77, and G955. The letter of each designation corresponds to the particular GPS satellite. The number in each designation corresponds to the time delay used for the GPS satellite code. The other correlation periods in Figure 6 do not result in positive correlations but include various time delays for the codes from other GPS satellites.

Timeline 410 of Figure 6 shows the results of the correlations carried out along line 400 and shows those that result in positive correlations. These positive correlations correspond to the periods along line 400 in which the satellite and time delay designations occur. Both the absence of a positive correlation and the presence of a positive correlation are checked, and reported by means of the Z signal, as indicated by reference 336 in Figure 5. Anyone trying to cause the position to be recorded authorized with processor 385 inside canister 385,

ES 2 367 243 T3 has to produce this randomly varying waveform.

In Figure 5 a common processor 385 is shown, which performs the tasks of storing the authorized position in GPS coordinates as well as the GPS processing, and the known conditional access. Processor 385 works in conjunction with GPS real-time controller 385, to which the processor can provide instructions in terms of data words. The controller will implement the sequential operations in real time, according to states regulated in time by the clock 338. The controller 383, the processor 385 and the code generator 388 can be implemented on the same integrated circuit chip to achieve a processor with minimal cost.

The figures explained above are those shown and described in the original application, while the figures numbered 7 and higher do not appear in the original application. These figures will be explained later herein, and should be understood to complement the arrangements of Figures 1-6.

It will be found that the preferred embodiment of the Originating Application provided a geographic restriction to a given individual fixed location. The provisions set forth hereinafter are modifications of client or terminal access control that make it possible for some of the signals to be accessible with different geographic restrictions. The provisions provide the geographic restrictions on reception for satellite signals, consistent with the various contractual restrictions for territories or regions associated with the signals. In the following, three different arrangements or methods are described that provide terminal equipment with this capability with varying degrees of flexibility.

A first method for providing flexible geographic conditional access has a first part of the method that is carried out at the location of the Service Provider, as shown in Figures 7 and 8, and a second part, so that the remaining The second part is carried out in the terminal equipment, as shown in Figures 9 and 10.

Referring first to Figure 7, the Service Provider is required to have in its possession the address of each new subscriber 410, which it enters into its database 412 of subscribers and addresses. The Subscriber Database 412 becomes a database in which the geographic coordinates for each subscriber 414 are created. This geographic position information for each terminal equipment must be accurate enough to determine to which of the various regions (which is explained in more detail later) each individual terminal equipment belongs. Geographic regions, which may be specific television broadcast markets, such as a city and its surrounding area, are defined by sets of coordinates, as indicated by reference 416. Each region is assigned a unique or unique Region Index, and the coordinate sets for a given region define the boundaries or boundaries for that region. Coordinate sets can consist of orthogonal linear coordinates, corresponding angles and radius lengths from a given center point, or any other type or set that can be used to define a contour, either with or without interpolation. A given region can be identified as coinciding with the coverage area of ​​a local broadcast terrestrial transmitter. Next, at block 418, the coordinates of each subscriber are used to determine in which region the subscriber is located. Sets of coordinates defined as indicated by reference 416 are interpolated in order to determine a contour for a particular region. (While not shown separately, it will be understood that a looping procedure of region index iteration actions may be performed, such that a customer position is checked or contrasted against each of the various sets of coordinates.) The subscriber's coordinates are then checked to determine if these coordinates are within the region. When the correct region is determined for a subscriber, the Region Index is marked or pointed to that subscriber. The dialed subscribers are entered into List 422. The Conditional Access System can address each subscriber individually and the operation shown by 422 serves to transmit the appropriate Region Index to each subscriber in a secure remixed manner. The Region Index can be transmitted as part of the user authorization data messages of Figure 1.

A region can correspond to a specific country but not to another country. Alternatively, a region can be legally predefined around a certain metropolitan area. Still another example is a region that must be excluded, or obscured.

Figure 8 shows the addition of Conditional Access information to each program to be remixed and broadcast by satellite. Non-geographic conditions are formed, as indicated by reference 424, such that they are included in the composite Conditional Access. These include preferred or top-rated channels and the other channel groups to which this particular program has been assigned from a subscription point of view. Geographic attributes are added as indicated by reference 426 and serve to indicate which regions may be eligible to receive this program. Region codes are used as attributes that can be further matched to a Region Index at the terminal equipment.

Finally, the program source 428 itself has been included, in such a way that all the attributes and the program are assembled for transmission as indicated by reference 430. The combination of the program and the 14

ES 2 367 243 T3 attributes is transmitted by uplink to the satellite and then transmitted by downlink in the manner explained for Figure 1, with the modification that the data messages include the Region Code for a given program.

The second part of this method occurs in customer access control, such as terminal equipment 37 of Figure 2, as modified in accordance with the following explanation. Conditional access that results in the rollback of the remix of the program for use occurs (that is, access is granted) when all of the following conditions are satisfied:

1. The Region Code that accompanies the remixed programming must match the Region Index previously transmitted by the Service Provider and be stored securely on the equipment.

2. The GPS must indicate, with respect to the exposure relating to the original Application and as explained for Figures 1-6 above, that the terminal equipment has not been moved from its authorized position.

3. Other conditional access criteria including customer subscription to specific schedule and satisfactory balance sheet.

There may be programming that is not restricted to a region such as a particular metropolitan area , but can be received and used outside of the region or metropolitan area. In this case, the programming will be transmitted to the terminal equipment in such a way that the special Region Code carries the meaning of all regions. That is, any region can access it. For this case, heading 1 above is automatically satisfied and the system works like the system of the original Patent Application and of Figures 1-6 above, which only involves conditions 2) and 3) above.

Figure 9 shows the individual terminal equipment operation consisting of receiving the intended Region Index for the equipment. The remixed Region Index is received as indicated by reference 432 and passed to reference 434, where it is subsequently re-mixed and stored securely for later use, as compared to the codes of Region set to each program.

Figure 10 shows the procedure of enabling remix rollback of a remixed program 436. As described above with reference to Figure 8, the remixed program has one or more Region Codes associated with it. In Figure 10, these Region Codes are detached from the remixed program 436 to become independent codes 438. A Region Code 438 is compared to Region Index 440 stored as in Figure 9, so that this comparison is carried out by a region comparer 442. The region comparer 442 may, for example, consist of a plurality of AND gates that compare the Region Code (s) and Region Index bitwise. As with the gates and other hardware components illustrated in this and the other figures herein, the region comparator 442 may be implemented as a software stage rather than as a hardware component.

When more than one Region Code is associated with the remixed program 436 of Figure 10, the Region Codes are compared in sequence by the region comparer 442 in order to determine if there is a match between any of the 438 Region Codes and the Region Index 440. If any match occurs, the output of the region comparer 442 serves as the enabling input to AND gate 444. The non-geographic conditional access token 446 (i.e., representative of the customer account reasonably in force at the time, the customer having chosen to get a given prime-time channel or show, etc.) is provided using known systems and provided as a second enabling input to AND gate 444. The third input to AND gate 444 is provided by AND gate 452, which compares the authorized coordinates 448 for terminal equipment 37 of Figure 2 with the coordinates determined by GPS 450. When the three enabling inputs supplied to AND gate 135 are present, the remix program reversal device 454 is enabled, and the remix of the remixed program 436 is reversed.

It will be appreciated that a latch or other storage device, not shown, may be used for the enabled output of gate 444, in the event that multiple Region Code (s) are included in the program. Alternatively, a given Region Code 438 may be interpreted by the Region Comparator 442 as a match for several of the Region Indices 440, in which case hooking or holding of the enablement is not required. In the same way, in the simple case in which a single Region Code accompanies a given program, the hooking or retention of a rating is not required. However, the retention of an enablement can also be used if the regions overlap in such a way that a team could be in the two regions at any given time and therefore have two Region Indices that would be compared sequentially in comparator 442 of regions versus Region Code (s) 438.

It will be appreciated that combinations of regions can be easily structured and used for cases where there are different legal restrictions in place for different program segments. As an example, a program assigned a Region A, whose remixed signal can be received by a subscriber located in a Region A

ES 2 367 243 T3

B, will not be accessible to said subscriber due to a mismatch between the subscriber's Region and the Region for which the program is intended. A different program, as a second example, may be assigned to both Regions A and B and potentially accessible to subscribers located in those two Regions. In fact, one program can be enabled for all Regions. This becomes the situation described in the original patent application.

A second method of achieving geographic conditional access involves a first part that is carried out by the Service Provider and a second part that is carried out by the terminal equipment. This method is similar to the first disclosed method but also contains important additions. In this second, the terminal equipment is provided with a set of region coordinates which, when interpolated, describe the geographic contour around eligible receiving locations. The coordinate sets are made available to the terminal equipment by two different means. In the first medium, the coordinates are communicated in a remixed form to the terminal equipment by satellite transmission. In the second means, the coordinates are previously programmed into the secure authorization card assigned to said terminal equipment, which is often called a Smart Card. Alternatively, in the event that such a card is not used in the terminal equipment, the coordinates can be stored in a secure section of memory, within the equipment. With any of these coordinate access methods, the terminal equipment first calculates the necessary interpolations and then uses GPS to determine whether the terminal equipment is within the contours described by one or more sets of coordinates. A particular set of coordinates is sent to all of the computers that had been predetermined to be within the aforementioned geographic boundaries, by the means described for the first method of this invention. If the position of the terminal is within the boundaries, then geographic conditional access is granted. If other criteria, including payment for the service, are also satisfied, then the client's desired program will be re-mixed by the terminal equipment.

The geographical coordinates to be sent to each terminal equipment are those that describe a certain region. As explained in the first method, a shorthand or abbreviated Region Index is used to denote each particular region. In this second method, one or more Region Indices are supplied to each terminal equipment, consistent with the geographic address of the equipment. Subsequent to this operation, each group of coordinates that limits a certain Region has, associated with it, the appropriate Region Index. The terminal equipment then saves the set of coordinates whose Region Index coincides with the Region Index previously and individually provided to said equipment.

Terminal Equipment with the capacity described above can now carry out two operations using GPS. It can perform the function of determining whether said equipment has been displaced from its initial position, as before, and secondly, it can now determine whether or not it is anywhere within a certain region described by the Region coordinate set. even though it may have been moved from its initial operating location. These two operations are useful in the two different programming conditions:

1. It is desired that, for some programming, the terminal equipment is not moved to a commercial location from its registered residential location, and

2. It is satisfactory for some programming that the terminal equipment is usable anywhere within the permitted Region, regardless of whether it is commercial or residential.

In this way the programs can be additionally marked or indicated with respect to which of the two situations independently is to be implemented for the program material. The terminal equipment can also be operated in a way that none of the geographic requirements are mandatory when a program has been marked or marked appropriately. Finally, the terminal equipment can be operated in such a way as to require the two conditions mentioned simultaneously.

The details of the second method will be described in relation to the first method. All the operations shown in Figures 7 and 8 are carried out for method two as well as for method one. Furthermore, method two makes it possible to use the region coordinates directly at the terminal equipment. In the event that these coordinates are transmitted in remixed form to each terminal equipment, this is done with the appropriate Region Code marked in each group of coordinates. In this way, each group of coordinates can be transmitted only once, instead of individually for each terminal equipment. Each terminal equipment is programmed to accept and store the set of coordinates for the region whose Region Code matches the Region Index that has been individually sent to each terminal equipment. As mentioned above, the issue of transmitting sets of coordinates to equipment can be replaced by the act of providing these sets of coordinates already within the terminal equipment at the time of purchase or rental by the subscriber. The set of coordinates can, as an example, be stored securely on the Smart Card, although other implementations serve the same basic purpose.

The terminal equipment for method two operates according to Figure 9, except that the set of coordinates must be further received and stored by the terminal equipment.

ES 2 367 243 T3

Figure 11 shows the logic operation for the terminal equipment operating according to the second method. An Operational Code, hereinafter referred to as the Op Code, is transmitted from the satellite in addition to the Region Code, for each 460 Remixed Program. This Op Code has four possible values, 0, 1, 2 and 3, the meanings of which are shown in the Figure 11. The terminal equipment recognizes the Op Code and provides its decoding to generate four possible enabling lines or conduits. In Figure 11, these enabling lines are called, respectively, Code Op 0, Code Op 1, Code Op 2 and Code Op

3. Only one of the four will be active, which means that it allows the operation of the gate that receives its signal, for a particular program. An OR gate 462 responds to the four possible geographic Op Codes, such that if any of the inputs is satisfied, its output is an enabling input to the AND gate 464. The second input to the AND gate 464 is the Non-Geographic Conditional Access entry 466. If both inputs to AND gate 464 are active, then remix reversal device 468 reverses the remix from program 460 to provide an output program 470.

Also, in Figure 11, OR gate 464 responds directly to Op Code 0 and provides an output for the event that there are no geographic requirements for the current program. The Op 1 Code control AND gate 472 provides an active output when the no-motion condition (for the Originating Request and arrangement of Figures 1-6 above) is satisfied by the GPS comparator 474. The Op 2 Code enables AND gate 476 in such a way that a match between the Region Code and the Index Code in the region comparer 478 will enable the output of the OR gate 462. Finally, the gate output And 480 is enabled for Op 3 Code when both geographic conditions (equipment located at the right coordinates and in the right region) are satisfied.

Figure 11 is shown in a form intended for ease of understanding, and other forms of implementation may be used. First, the logic can be written and simplified to create fewer gates. Second, the comparison of Authorized Coordinates and GPS determined coordinates is a comparison of vectors rather than two binary inputs, but has been shown as a binary function for ease of illustration. On the other hand, as mentioned above, the software implementation of various components of the invention can alternatively be used.

The Region Index, as input to the region comparer 478, is a modified version of the Region Index as determined in method one, where it is provided directly from the satellite to each terminal equipment separately. The modification is shown in Figure 12. The Region Index provided by the Service Provider for each particular terminal equipment is indicated by reference 482 in Figure 12. Gate 484 is used to pass Region Index 482 on the condition that the equipment is currently located in Region X whose set of coordinates is indicated by reference 486 and whose Index number is 482. calculation or software 488 compares the detected GpS 490 with the coordinate set (s) 486 and outputs a "yes" or enable when the GPS shows that the equipment is in the proper position. It is the procedure that carries out the necessary calculations to determine if the determination of gPs that is carried out as indicated by reference 320 is within Region X.

A third method provides the ability for the terminal equipment itself to learn in which region it currently resides. This allows the flexibility for the subscriber to transport the terminal equipment to a different Region, perhaps a vacation area, and to be able to use such terminal equipment with programming authorized for that Region, rather than the Region in which they had authorized the equipment. In this case, the terminal equipment must not be in an invalid Region to reverse the remix of programming for use. An example of a rogue region can be a foreign country. Another example is a Region that is certainly defined by a set of coordinates but is not authorized for the local scheduling subset that is generated to be used only in a different Region.

In the third method, the coordinate sets for multiple Regions are stored in the terminal equipment. These sets of coordinates can be acquired by said equipment by one or two means. The first means is to securely receive the coordinate sets via satellite transmission of these. The sets are stored within such equipment, in a tamper-proof manner. The second storage medium is the aforementioned Smart Card, which is provided at the time of purchase or rental of said equipment. A variant of this is the secure storage of the coordinate set on the equipment itself at the time of purchase or rental.

The sets of coordinates stored in the terminal equipment are organized in such a hierarchy that it includes both the Geographic Regions that are legally protected, as well as larger geographic areas or zones, such as individual countries. That is, a terminal equipment may be located within a country where rights for programming exist, but the location of such equipment may be outside of any Region that is protected from receiving programming that does not have a local license. Such areas will occur when programming from a terrestrial broadcast transmitter cannot be received because the distance from said transmitter is too great to allow reception. There will be no geographic restriction in this case where the terminal equipment is within a permitted country but outside of any Region with legal restrictions. Another way to represent this is to consider that the programming that is licensed to

ES 2 367 243 T3 a local area can be legally reverted in its remix in that region, corresponding to said same Region or to all areas that have not been defined as Regions but that are within the contours or limits of the allowed country .

In short, a large area or Region is defined first, such as a country, within which the reversion of the remixing of the programming may be allowed, subject to geographical restrictions in localized areas but outside of which it is not allowed. the reversion of the remix. Second, if the criteria for the Large Region are satisfied and the geographic location of the terminal equipment is not within any Local Region within the larger Region, then no geographic restriction will apply to any programming that has restrictions for some regions. However, if such equipment is within one of the defined Localized Regions, then scheduling restrictions may be imposed by the Service Provider for some subset of scheduling.

A flow chart is presented in Figure 13 showing first the large region validation and then the local region (s) determination. The GPS coordinate data is supplied to the processor as indicated by reference 500, where the actual GPS data 501 detected by the customer access control equipment is compared, in box 502, to the set of coordinates for the large area. The region validation indicator is set to 1 in box 504 if the terminal or client access equipment is in the large area, while box 506 sets the validation indicator to 0 if it is not. it is in the large area.

Treatment of the Large Region is completed at this point in Figure 13. In case there were multiple Large Regions instead of a single Large Region, a modified treatment method would have been required, similar to the method that will be described below for the determination of one or more Region Indices.

In box 508, the region test number is initialized and the control refers to reference 510, which calculates the contours for a region. Next, box 512 determines, via box 514, whether the GPS coordinates from reference 501 are in a particular local region. Box 516 puts the region number in a Region Indices list if the test is positive. Box 518 checks if the highest region number is the one being tested. If not, control goes back to box 510 through box 520, which increments the region number. When all regions have been checked, the "yes" output from box 518 is forwarded back to box 500. Although not shown, if no regions have been found, a Region Absence indicator is set to one ( active).

As shown in Figure 13, the third method provides the ability of the terminal equipment itself to learn which Region it is currently in. This allows the flexibility for the subscriber to transport the terminal equipment to a different Region, perhaps a vacation area, and for the subscriber to be able to use such equipment with programming authorized for that Region, rather than the Region in which the terminal has been authorized. team. In this case, the terminal equipment must not be located in an invalid Region, in order to reverse the remix of programming for use. An example of a rogue region can be a foreign country. Another example is a Region that is certainly defined by a set of coordinates but is not authorized for the subset of local programming that is generated for use only in a different Region.

In the third method, the coordinate sets for multiple Regions are stored in the terminal equipment. These sets of coordinates can be captured by said equipment by one or two means. The first means is to securely receive the coordinate sets via satellite transmission of these. Said sets are stored within said equipment in a tamper-proof manner. The second storage means are the aforementioned Smart Card, which is provided at the time of purchase or rental of said equipment. A variant of this is the secure storage of coordinate sets on the equipment itself at the time of purchase or rental.

The sets of coordinates stored in the terminal equipment are organized according to a hierarchy in order to include both Geographical Regions that are legally protected and larger geographical areas or zones, such as individual countries. That is, a terminal equipment may be located within a country where rights to programming exist, but the location of such equipment may be outside of any Region that is protected against receiving programming that is not locally licensed. Such zones will occur when the programming from a terrestrial broadcasting transmitter cannot be received because the distance that separates said transmitter is too great to allow its reception. There will be no geographical restriction in this case where the terminal equipment is located within a permitted country but outside any Region with local restrictions. Another way to represent this is to consider that the programming that is authorized for a local area can be legally reversed in its remix in that Region, in correspondence with said Region itself or in all areas that have not been defined as regions but that are within the limits or contours of the permitted country.

In short, it first defines a large Region, such as a country, within which the reversion of the remixing of the programming can be allowed, subject to geographical restrictions in localized areas but outside of which the reversion of the programming is not allowed. reversion of the remix. Second, if the Large Region criterion is satisfied and

ES 2 367 243 T3 the geographical location of the terminal equipment is not within any Local Region within the Large Region, then no geographical restriction will apply to any programming that has restrictions for some regions. However, if such equipment is within one of the defined Localized Regions, then scheduling restrictions may be imposed by the Service Provider for some subset of scheduling.

In method 3, the terminal equipment has stored in its memory the geographic coordinate sets for the Large Region (s) that determine the contours for one or more countries and the sets for the multiple local regions. A unique or unique Region Index number is included with each coordinate set. Starting with these coordinate sets and the GPS coordinate data determined in the terminal equipment, the functions of Figures 13 and 16 are implemented.

It will be appreciated that this treatment has been provided by way of example for this system and may take modified forms. An example of this is that continuous treatment of all located Regions can be replaced by a confirmatory trial of the same Region, once the Region index has been established. The test of all Regions can be started again only if the established Region fails to pass the confirmation test.

In Figure 16, the determination made in the treatment of Figure 13, together with the initially authorized coordinates for the terminal equipment and the non-geographic conditional access information, are used to allow reversion of the remix if appropriate. . The same Op Codes as in Figure 11 are used with the individual programs. It is assumed here that the incoming encoded Op Code is decoded such that only one of Op Codes zero to 3 is active at any one time. In addition, a large region validation no requirement indicator has been provided, which comes with the program material. If this flag is worth one, then input by that name to OR gate 530 is high, or active.

The operation of Figure 16 proceeds similarly to that of Figure 11. Components that can be operated essentially the same way as the components of Figure 11 will be numbered within the 600 series, with the same two digits, and the explanation that given here will focus on the differences. However, the first difference is that AND gate 664 now has three inputs instead of two. The new input comes from OR gate 530, which is active (at one) if either the GPS large region validation flag is active (at one) or the no large region validation requirement flag is active. (a one). These were determined in the treatment of Figure 13. The AND gate output 664 is active and the program remix reversal device 668 is enabled if all three inputs to 664 are active (all in one).

The other difference in Figure 16 from Figure 11 is the addition of an OR gate 532. The purpose of this gate is to provide an active input (in one) to gates 676 and 680 if one of two conditions is satisfied. The first is that a match is found between the Region Index stored in the Region Indices list and the Region Code that appears with the particular program. The second is that the indicator is active if no local region was found in the search in Figure 13.

Referring to Figure 14, practical aspects of the operation of the present invention will be illustrated by examples. Large area A includes regions R1, R2, R3, and r4, as well as an open area OA within A but outside regions R1 through R4. A client C1 located in the R1 region can receive signals that are region specific for the R1 region. Additionally, the customer or subscriber C1 may receive signals that are large area signals (ie, accessible anywhere in area A) and are not region specific. The client may receive other signals called region exclusion signals, which are turned black in one or more of the R2, R3, and R4 regions, but are accessible in the R1 region. For example, if a particular network has no affiliates in the R1 region, an affiliated signal from the R2, R3, or R4 regions can be made accessible in the R1 region even though it is excluded from other regions that have an affiliate of that network. Other signals, called position specific signals, may be accessible only if the client access control or terminal equipment 37 of Figure 2 remains in a single fixed position, as explained in the preferred embodiment provided for the Figures 1-6. Of course, any or all of these classes of signals may include non-geographic restrictions on them, such as that the subscriber's account is paid in a reasonable time and that the customer has chosen to receive any preferred or prime-time channels.

Customer C2 lives in a region R2, which may be associated with a different city or television broadcast market than in city R1. Client C2 will receive signals in a similar way to client C1, except that C2 receives region-specific signals for region C2 and receives region-exclusive signals as long as they are not region-exclusive C2. An example of a region-exclusion signal would be when a sports prime-time channel or pay-per-view channel broadcasts a sporting event that is contractually excluded or turned off in region R2. The region darkened or turned black may consist of a region code, not shown, which could, by means of the appropriate gates, disable gate 664 of Figure 16 such that access to such programs would be denied.

Client C3 lives in a region R3 and receives signals similarly to the other clients located in position C3 of

ES 2 367 243 T3 the R3 region. Again, this client or subscriber receives region specific signals corresponding to region R3.

The invention allows two possibilities if customer C3 moves with his terminal equipment or customer access control to position C3 'of Region R4. A first technique prevents the use of other regions. For example, a region determining device similar to that of Figure 12 can compare the previously stored region index with the current value at that time and block access upon a change. (The previously stored index can be a region index contained in the customer access control box or equipment, adjusted by a smart card or other tamper resistant programming, when provided to the customer, or simply the value initially determined using a region determination device like the one in Figure 12.) However, A second technique allows the customer to move the customer access equipment or control 37 from region R3 to region R4.

In order to accommodate movement from region to region, the region determination technique of Figure 12 can simply detect that client C3 has drifted from region R3 to region R4, and grant access to region-specific signals for the R4 region (but no longer granting access to region-specific signals for the R3 region). Any specific position signals will no longer be accessible. However, a tamper-resistant technique can also be provided that allows the Service Provider to readjust the coordinates for the customer's new location when addressing the customer's terminal equipment, such that the customer can receive position-specific signals at the location. new location.

Customer C4 is in large area A, but is in an open area outside of the broadcast market or the other regions R1 to R4. Since customer C4 is not located in any of the R1 to R4 regions, that customer may be allowed access to any affiliated network channels from any or all of the R1 to R4 regions, depending on contractual and / or regulatory considerations. copyright or copyright.

Referring to Figure 15, client C5 obtains authorized programming for region R2, while client C6 obtains authorized programming for region R1. However, since the R1 and R2 regions overlap and the C7 client lives in the overlap or junction of the regions, the C7 client can receive signals from both the R2 and R1 regions.

While specific constructions have been presented herein, it should be understood that these are for illustrative purposes only. Various modifications and adaptations will be apparent to those of skill in the art. In view of possible modifications, it will be appreciated that the scope of the present invention should be determined with reference to the claims that accompany it.