Wireless video communication

CROSS REFERENCE TO RELATED DOCUMENTS

p-0002This application is related to and claims priority benefit of U.S. Provisional Application No. 60/999,596 filed Oct. 18, 2007, which is hereby incorporated herein by reference.

COPYRIGHT AND TRADEMARK NOTICE

p-0003A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise reserves all copyright rights whatsoever. Trademarks are the property of their respective owners.

BACKGROUND

p-0004High Definition Multimedia Interface (HDMI) connections have become the standard in interconnection of high definition audio visual equipment. The interface has been well received, relatively problem free and accepted by consumers. However, as with all wired interconnections, the wiring itself often makes for troublesome or unsightly interconnection regardless of the interface.

p-0005In HDMI interfaces, High-Bandwidth Digital Copy Protection (HDCP) is used to assure the protection of secure content from copying by unauthorized equipment. In the analog world, each generation of copying introduces a small amount of content degradation, leading to a somewhat self limiting problem with multi-generational copying. However, in the digital environment, each copy is essentially a perfect copy of the original, leading to increased dependence upon copy protection and copy management for secure content to avoid compromise of the content and subsequent unauthorized use. HDCP provides such protection of the content between authorized devices using HDMI.

p-0006Several manufacturers are now attempting to address the inconvenience of hard wiring in the HDMI environment by use of wireless transmission of the content received from an HDMI/HDCP source or host device to a recipient “sink” device such as a television that might be more conveniently located in place that is not conducive to hard wiring. However, conversion of the content to wireless introduces security vulnerabilities that heretofore have not been adequately addressed or in many instances even recognized. These vulnerabilities can create a security breech. There are at least 4 scenarios to analyze: 1) standalone wireless repeater transmitter and standalone wireless repeater receiver, 2) standalone wireless repeater transmitter and embedded wireless repeater receiver, 3) embedded wireless repeater transmitter and standalone wireless repeater receiver, and 4) embedded wireless repeater transmitter and embedded wireless repeater receiver.

p-0007Initially, manufacturers are planning to target scenario #1 above which will work with existing HDMI/HDCP devices. Later as the wireless schemes become adopted they will be built-in to the devices and therefore Scenarios #2 and #3 will become important. Later, they will be built-in to all devices, and Scenario #4 will be important. Even though both content sources and display devices may have wireless capability built-in, they may need to accommodate devices that won't have it built-in as well.

BRIEF DESCRIPTION OF THE DRAWINGS

Certain illustrative embodiments illustrating organization and method of operation, together with objects and advantages may be best understood by reference detailed description that follows taken in conjunction with the accompanying drawings in which:

<figref idrefs="DRAWINGS">FIG. 1</figref> is an illustrative HDMI repeater.

<figref idrefs="DRAWINGS">FIG. 2</figref> is an illustrative wireless repeater device.

<figref idrefs="DRAWINGS">FIG. 3</figref> is another representation of the wireless repeater.

<figref idrefs="DRAWINGS">FIG. 4</figref> is a flow chart broadly depicting a hacking process that could be used to spoof the wireless repeater of <figref idrefs="DRAWINGS">FIG. 2</figref>.

<figref idrefs="DRAWINGS">FIG. 5</figref> is an exemplary wireless repeater transmitter and receiver consistent with certain embodiments of the present invention.

<figref idrefs="DRAWINGS">FIG. 6</figref> is an exemplary wireless repeater transmitter with the receiver integrated in the display consistent with certain embodiments of the present invention.

<figref idrefs="DRAWINGS">FIG. 7</figref> is an exemplary integrated wireless repeater transmitter and a standalone receiver consistent with certain embodiments of the present invention.

<figref idrefs="DRAWINGS">FIG. 8</figref> is an exemplary integrated wireless repeater transmitter and integrated receiver integrated in the display consistent with certain embodiments of the present invention.

<figref idrefs="DRAWINGS">FIG. 9</figref> is a flow chart of an exemplary communication process consistent with certain embodiments of the present invention.

DETAILED DESCRIPTION

p-0018While this invention is susceptible of embodiment in many different forms, there is shown in the drawings and will herein be described in detail specific embodiments, with the understanding that the present disclosure of such embodiments is to be considered as an example of the principles and not intended to limit the invention to the specific embodiments shown and described. In the description below, like reference numerals are used to describe the same, similar or corresponding parts in the several views of the drawings.

p-0019The terms “a” or “an”, as used herein, are defined as one or more than one. The term “plurality”, as used herein, is defined as two or more than two. The term “another”, as used herein, is defined as at least a second or more. The terms “including” and/or “having”, as used herein, are defined as comprising (i.e., open language). The term “coupled”, as used herein, is defined as connected, although not necessarily directly, and not necessarily mechanically. The term “program” or “computer program” or similar terms, as used herein, is defined as a sequence of instructions designed for execution on a computer system. A “program”, or “computer program”, may include a subroutine, a function, a procedure, an object method, an object implementation, in an executable application, an applet, a servlet, a source code, an object code, a shared library/dynamic load library and/or other sequence of instructions designed for execution on a computer system.

p-0020Reference throughout this document to “one embodiment”, “certain embodiments”, “an embodiment” or similar terms means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, the appearances of such phrases or in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments without limitation.

p-0021The term “or” as used herein is to be interpreted as an inclusive or meaning any one or any combination. Therefore, “A, B or C” means “any of the following: A; B; C; A and B; A and C; B and C; A, B and C”. An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.

p-0022The term “processor”, “controller”, “CPU”, “Computer” and the like as used herein encompasses both hard programmed, special purpose, general purpose and programmable devices and may encompass a plurality of such devices or a single device in either a distributed or centralized configuration without limitation.

p-0023In the discussion below, HDMI is used as the proposed digital interface. However, the Digital Video Interface (DVI) could be used equally as well. DVI is a legacy interface that did not cover audio. New audio visual products use HDMI. Both HDMI and DVI use HDCP to protect content across the link from the source to the sync device. While the illustrative examples below utilize HDMI, HDCP and AES, other embodiments may equally well use other technologies.

p-0024Turning now to <figref idrefs="DRAWINGS">FIG. 1</figref>, it is useful to review how a wire-based HDCP repeater operates, since wireless repeaters are likely to be based upon this technology and must work with legacy devices having HDMI interfaces. In this example, the HDMI host <b>10</b> (e.g., a television set top box (STB) or other source of content) has a transmitter <b>14</b> that transmits content encrypted using HDCP keys <b>18</b> to a receiver device. In our scenario, the receiver device is a repeater. The HDMI host <b>10</b> transmits using HDCP protocol to the HDMI repeater <b>22</b> where the content is received by HDMI receiver <b>26</b> that decrypts the content using keys <b>30</b>. Note that HDMI requires two way communications using <b>12</b>C, so the terms transmitter and receiver as used herein are used loosely to define the direction of flow of the content and not in the strictest sense. Thus a receiver also includes an <b>12</b>C transmitter and vice versa.

p-0025HDMI receiver <b>26</b> passes the content along to one or more HDMI transmitters <b>34</b> and <b>38</b> for retransmission using encryption under KSV (Key Source Vector) keys <b>42</b> and <b>46</b> respectively. The transmissions are directed in this example to displays <b>50</b> and <b>54</b> via HDCP protected HDMI connections and are received by HDMI receivers <b>58</b> and <b>62</b> respectively that decrypt the content for display using KSV keys <b>70</b> and <b>74</b> respectively. A major assumption with “standard” HDCP is that the repeater HDMI transmitters <b>34</b> and <b>38</b> are “known” to the repeater HDMI receiver <b>26</b> since they are part of the same device. As described in more detail below, if the HDMI receiver is not revoked, and check value sent by the HDMI transmitter <b>14</b> verifies, then HDMI receiver <b>26</b> checks out and it will not lie about the identities of the HDMI transmitters. The HDMI transmitters must be secure too. The repeater transmitters <b>34</b> and <b>38</b> will verify the identity of the corresponding HDMIV receivers <b>58</b> and <b>62</b> and report those through the HDMI receiver back to the host <b>10</b>. All the HDMI transmitters and receivers are therefore considered secure by the source device, host <b>10</b>, and copy protected content can be played out from the host. However, in the case of a wireless repeater, this assumption may be incorrect leading to a potential for a security breech.

p-0026Now delving into a more details, in a correctly functioning environment, the source HDMI transmitter <b>14</b> verifies the repeater HDMI receiver <b>26</b> by sending an encrypted random number to the receiver <b>26</b>. Receiver <b>26</b> then decrypts the random number and sends it back to the transmitter <b>14</b> in order to verify that the receiver is valid. Once verified, the transmitter <b>14</b> knows that a valid repeater receiver, having the HDCP private keys associated with a particular KSV, is connected. The repeater HDMI transmitters <b>34</b> and <b>38</b> use a similar technique to verify the display HDMI receivers <b>58</b> and <b>62</b>. Once the HDMI transmitters verify that valid display receivers <b>58</b> and <b>62</b> are connected, the identities of the display receivers are reported to the host <b>10</b> through the <b>12</b>C connection of HDMI receiver <b>26</b>. The repeater <b>22</b> knows the KSVs (Key Source Vector—essentially an identifier) <b>42</b> and <b>46</b> of both of the repeater HDMI transmitters as these are built into the same device <b>22</b>. These KSVs <b>42</b> and <b>46</b> are also reported to host <b>10</b>. The content source, host <b>10</b>, is then able to check the repeater receiver <b>26</b>, repeater transmitters <b>34</b> and <b>38</b> and the display receivers <b>58</b> and <b>62</b> against a revocation list. Assuming none of the devices have been revoked, normal communication can be carried out—protected content can be played out. The coexistence of HDMI receiver <b>26</b> in the same device as HDMI transmitters <b>34</b> and <b>38</b> provides a measure of implicit trust between those devices in order to assure security of the system against compromise of the secured content. Because of its inherent split nature, the wireless repeater lacks this implicit trust, and this leads to the potential security breech.

p-0027Let's consider the wireless repeater devices <b>80</b> and <b>82</b> of <figref idrefs="DRAWINGS">FIG. 2</figref>. In this scenario, the repeater is essentially the same as a wired repeater except that there is no direct internal connection between HDMI receiver <b>26</b> and HDMI transmitters <b>34</b> and <b>38</b>. A wireless transmitter and wireless receiver pair <b>86</b> and <b>90</b> are juxtaposed between the HDMI receiver <b>26</b> and HDMI transmitters <b>34</b> and <b>38</b> and have their own separate identities <b>24</b> and <b>25</b> respectively, defined, for example, by a serial number ID and cryptography keys. The wireless repeater transmitter (WRT) <b>80</b> and wireless repeater receiver (WRR) <b>82</b> each have at least two identities—one from the wireless transmitter or wireless receiver, and one from the HDMI transmitter or HDMI receiver. Both the WRT <b>80</b> and the WRR <b>82</b> must work with legacy HDMI-enabled devices which know nothing about the separate wireless identities <b>24</b> and <b>25</b>. Ideally, any WRT <b>80</b> should work with any WRR <b>82</b> to facilitate its versatility and reparability. Hence, in the scenario shown in <figref idrefs="DRAWINGS">FIG. 2</figref>, there is no implicit trust between the repeater HDMI receiver <b>26</b> and the repeater HDMI transmitters <b>34</b> and <b>38</b> since they no longer form a part of the same device.

p-0028Since the HDMI receiver <b>26</b> and HDMI transmitters <b>34</b> and <b>38</b> are no longer a part of the same enclosed system, there is potential for vulnerability of the system by spoofing or faking a wireless repeater receiver (WRR) <b>82</b>. Because the WRT <b>80</b> and the WRR <b>82</b> must work with the existing HDCP protocol, their wireless identities <b>24</b> and <b>25</b> cannot be revoked using those protocols. WRT <b>80</b> and WRR <b>82</b> are intended to add wireless capability to existing wired devices. But the main security issue is with wireless identity <b>25</b> since wireless identity <b>24</b> in the wireless repeater transmitter can be indirectly revoked using the HDCP identity <b>30</b>. Indirect revocation is possible since wireless identity <b>24</b> is built into the same device as HDCP identity <b>30</b>. Since HDCP identity <b>30</b> can be checked, wireless identity <b>24</b> is not a security issue. As will be shown below describing various embodiments consistent with the invention, the existing HDCP mechanism used for revoking HDCP devices can be used to revoke compromised a wireless identity <b>25</b> used with WRR.

p-0029A method is provided for linking the wireless receiver identity <b>25</b> with that of HDCP identities <b>42</b> (and/or <b>46</b> if there is a dual HDMI output). This method causes the KSVs from <b>42</b> and/or <b>46</b> to be correctly reported back to the content source, host <b>10</b>, so that they may be checked against a revocation list. It should be noted that while <figref idrefs="DRAWINGS">FIG. 2</figref> shows two HDMI transmitters <b>34</b> and <b>38</b> for easy comparison with <figref idrefs="DRAWINGS">FIG. 1</figref>, the discussion below is equally valid if only one HDMI transmitter were used or if greater than two are used. In certain embodiments, only one of the HDCP identities can be used to validate the repeater, but in others, both or all can be used as part of the certificate described later.

p-0030In proposed wireless repeater devices, the wireless link is encrypted using the Advanced Encryption Standard (AES). A session key is delivered involving keys <b>24</b> and <b>25</b> of WRT <b>80</b> and WRR <b>82</b> respectively. The keys <b>24</b> and <b>25</b> may entail symmetric or public/private keys. In some implementations, keys <b>24</b> may not exist and keys <b>25</b> are the primary keys. A hacker may be able to create a fake WRR by reverse engineering a real WRR <b>82</b> and then mass producing clones. In some of the proposed implementations, identity and keys <b>25</b> are not authenticated, e.g. using a certificate signed by trusted certificate authority. In which case, wireless WRR keys and identity <b>25</b> might be synthesized outright by a hacker. Alternatively, again depending on the proposed security implementation, it may be possible to observe the communication between the WRT <b>80</b> and the WRR <b>82</b> so that a hacker may be able to cryptographically attack and thereby gain knowledge of the keys <b>25</b>. In any of the above scenarios, once a WRR identity and keys <b>25</b> are known or created (synthesized), a spoof receiver may be created that can then be used to improperly output content without copy protection, e.g. to an HDMI interface with HDCP permanently turned-off. A good security system should anticipate this possibility, and provide a means to shut-off the spoof receiver. HDCP employs a revocation list. The spoof receiver, described above, will report KSVs, <b>42</b> and <b>46</b>, associated with the HDMI transmitters <b>34</b> and <b>38</b>. But these are not implicitly trusted as in the simple HDCP repeater case, and they are unverified in that the associate keys are not used with a random check value to show that they are real. Consequently, any KSV values, <b>42</b> and <b>46</b>, can be reported back to the wireless repeater transmitter (WRT). In turn, the WRT will report those fake KSVs to the host <b>10</b>. Revocation by the host <b>10</b> therefore will be impossible.

p-0031Now consider <figref idrefs="DRAWINGS">FIG. 3</figref>, which depicts one link to TV <b>50</b>, using the signal chain described in connection with <figref idrefs="DRAWINGS">FIG. 2</figref>. In this example, device <b>10</b> is the content source, device <b>80</b> is considered a wireless repeater transmitter (WRT), device <b>82</b> is considered a wireless repeater receiver (WRR) and device <b>50</b> is considered the display. This chain of devices can be hacked using the following scenario as is broadly outlined in <figref idrefs="DRAWINGS">FIG. 4</figref> starting at <b>100</b>.

p-0032As described above, by any number of different means, a hacker might be able to fake a wireless repeater receiver (WRR) device <b>82</b> so that clear content can be copied at the HDMI interface. The hacker may use a real, or depending on the proposed security implementation, a completely made-up or fake identity <b>25</b> for the WWR <b>82</b> at <b>104</b>. At <b>108</b>, the real or fake wireless identity <b>25</b> and fake HDCP identity <b>42</b> of WWR <b>82</b> is sent to the WRT <b>80</b> and ultimately to the content host <b>10</b> at <b>108</b>. Since, at present, the WWT <b>80</b> has no way to assure the integrity of WRR <b>82</b>'s HDCP identity <b>42</b>, the KSV. It carries out normal communication thereby rendering the content compromised at <b>116</b>. The HDCP identity <b>42</b>, the KSV, of the WRR should be revoked by the content source host <b>10</b>, but the hacked WRR <b>82</b> can send a fake HDCP identity <b>42</b> to WRT <b>80</b> instead. That faked HDCP identity will then be reported to the content source, host <b>10</b>. No revocation will be possible and thus the security of the content is compromised.

p-0033One proposal to avoid this problem is to mate a WRT <b>80</b> and a WRR <b>82</b> forming a wireless repeater pair at the factory. For example, a WRT <b>80</b> could be programmed to only listen to a specific WRR <b>82</b> wireless identity <b>25</b> with certain unique keys. In such a scenario, a factory database is created which ties WRT <b>80</b> and WRR <b>82</b> together as well as the associated HDCP KSV and keys <b>42</b> and <b>46</b>. To perform a hack, a pair of devices would need to be compromised. The WRT <b>80</b> must report a valid and verified KSV to the host <b>10</b> if content is to be sent to it by host <b>10</b>. If a wireless repeater pair was hacked, the HDCP KSV <b>24</b> and <b>42</b> (and <b>46</b> if there is a dual HDMI output) would appear on the revocation list. While mating does solve the security problem, it presents problems of its own. Such a factory pairing has a number of drawbacks including the inability to replace only one part of a defective repeater and the ability to receive the wireless transmission from a different source device <b>10</b> connected to a different WRT <b>80</b>. Mating would also inhibit or prevent a consumer from later upgrading the transmitter to one with a greater range. Also, in the case of the wireless receiver WRR <b>82</b> embedded in the display <b>50</b> (see <figref idrefs="DRAWINGS">FIGS. 6 and 8</figref>), mating would create operational problems as the factory lines are often in different physical locations, and replacement of multiple components which are paired could create a high service cost and limit versatility. Factory mating also precludes a “many-to-one” scenario, where a consumer operating a WR may pick from various WT devices spread across the home.

p-0034Referring now to <figref idrefs="DRAWINGS">FIGS. 6-8</figref>, several variants of the repeater circuit shown in <figref idrefs="DRAWINGS">FIG. 5</figref> are depicted. In <figref idrefs="DRAWINGS">FIGS. 6 and 8</figref>, rather than a repeater, the wireless receiver (WR) is embedded within a display device directly. In <figref idrefs="DRAWINGS">FIGS. 7 and 8</figref>, the wireless transmitter (WT) is embedded in the host or content source device directly. In either case, without the use of certificates <b>150</b>, the same vulnerability would exist as in the repeater of <figref idrefs="DRAWINGS">FIG. 2</figref>. And, while mating the WT with the WR could solve the security problem, it may have the aforementioned operational and usability issues.

p-0035Additionally, with the devices of <figref idrefs="DRAWINGS">FIGS. 6 and 8</figref>, the wireless communication is directly with a display device, which has internal wireless receiver capability. Thus, although not strictly a repeater device, the term wireless receiver (WR) can be used instead, with the understanding that it behaves in the same manner as though it were a repeater receiver. Hence the terms WR and WRR can be used somewhat interchangeably with WR being somewhat more properly generic. Similarly, the term wireless transmitter (WT) can be considered generic for and interchangeable with a WRT, where wireless transmitter <b>86</b> incorporated within the host device can be considered a WT. But, references throughout to a WT or WR, WRT or WRR should be considered broadly incorporating both true repeater devices as well as source and sink devices or any other devices operating in the manner described.

p-0036The various embedded scenarios depicted in <figref idrefs="DRAWINGS">FIGS. 6</figref>, <b>7</b> and <b>8</b> have the same security problems as the standalone scenario of <figref idrefs="DRAWINGS">FIG. 2</figref>, which can be remedied using the same digital certificate <b>150</b> and associated revocation technique as discussed. In the absence of certificate <b>150</b> and the associated technique, each would suffer from same lack of ability to properly verify the reported HDCP KSV value <b>42</b> (and/or <b>46</b> if there is another HDMI output). With embedded WT approaches of <figref idrefs="DRAWINGS">FIGS. 7 and 8</figref>, the WT <b>80</b> is built into the host <b>10</b>. And so, the KSV will be checked against the revocation list directly instead of being forward to a separate host <b>10</b>. In <figref idrefs="DRAWINGS">FIGS. 6 and 8</figref>, the WR <b>82</b> is embedded in the display <b>50</b>. Therefore, in the absence of a certificate, there may not be any HDCP KSV to report at all and no way to revoke a compromised combination WR and display. As will be discussed later, a KSV key can be provided even in the absence of HDCP as a KSV key that can be used for revocation purposes.

p-0037Any system such as those mentioned above remains vulnerable to attack as long as a spoof device acting as a WR <b>82</b> can be produced that can entice a WT to transmit content over the wireless connection. <figref idrefs="DRAWINGS">FIG. 5</figref> depicts an enhanced security wireless repeater arrangement that remedies the flaw found with proposed wireless repeaters. In this embodiment, a WT <b>180</b> utilizes a wireless link to WR <b>182</b> (which may form a part of a wireless display device in which content is consumed wirelessly rather than being repeated—shown in <figref idrefs="DRAWINGS">FIGS. 6 and 8</figref>).

p-0038In this arrangement, a digital certificate is utilized to tie the wireless receiver identity and keys <b>25</b> to a specific HDCP KSV and keys <b>42</b> and <b>46</b>, to assure the security integrity of the signal path. In accord with this arrangement a digital certificate <b>150</b> (or multiple digital certificates) is created by using a combination of the HDCP device identity (the KSV for either or both or as many transmitters as are present) and an identity for the device itself (e.g., an identification number (ID) for the entire device, or any subsystem thereof) so that the HDCP <b>42</b> and <b>46</b> identity is tightly coupled to the WRR <b>82</b> device. The certificate can also include a public key, if used, for the WRR wireless receiver identity and keys <b>25</b>, and a certificate signature. The public key can be used to establish a session key between the WT <b>86</b> and WR <b>90</b> that can be used to secure the wireless link. The associated private key is safeguarded and will ensure that a hacker cannot simply observe the transfer of the digital certificate from the WRR <b>182</b> to the WRT <b>180</b>, and copy the certificate to create credentials for a spoof device <b>182</b>. However, the public key could be transferred in a different certificate than from that linking the HDCP identities to the wireless identities. The certificates could be linked, e.g. using a common wireless identity <b>25</b> or serial number used with WRR <b>182</b>.

p-0039In one embodiment, this can be accomplished by hashing or otherwise combing or binding one or more of the HDCP identities (KSV) <b>42</b> and <b>46</b> with a wireless repeater receiver identifier and placing this information in a digital certificate with a digital signature that can be transferred via the wireless link from WR <b>182</b> to WT <b>180</b>. The WRT <b>80</b> then passes the correct KSV <b>42</b> and <b>46</b> to the host <b>10</b> for verification against a revocation list. Or, if the WT is embedded in the host, then it would check the KSV in the revocation list directly. In the future, an enhanced HDCP protocol might allow the passing of the WR wireless receiver identity to the source. If either or both of the identities (KSV or receiver identifier) are found to be compromised, e.g. manufactured into mass marketed hacking devices, they can be placed on the revocation list. If a spoof or fake WR <b>80</b> is detected and is on the revocation list, the spoof will fail and the content will remain secure.

p-0040By hashing these identities, or otherwise combining or binding them, an HDCP identity can be tightly coupled to the device itself, and is thereby readily managed using digital certificates. The KSV value reported will be real and tied to a real WR <b>82</b>. In other embodiments, the certificate can contain information for other copy protection systems besides HDCP. For example, a DTCP identity (used on the 1394, USB, USB2 or IP interface) could be listed or other information that can be used to uniquely identify the WR for security purposes. If any of these other identities are found to be compromised and on any revocation list processed by the host <b>10</b>, then copy protected content is not output HDMI.

p-0041Under this scenario, a certificate that makes sure the identity of the WR wireless receiver <b>90</b> is real and tightly linked a HDCP KSV identity. This provides for verification of the authenticity of the WR <b>82</b> and guards against a spoof device. The certificate is checked by the WT. The WT reports the correct HDCP KSV identity to the source. The source has the power to revoke a compromised HDCP KSV and not output content. Any suitable digital certificate management authority <b>190</b> can be used to manage the certificate since this security application is tied to HDCP. It is possible for a manufacture to obtain a manufacturer certificate from a root authority. The manufacturer may then be able to sign the WR certificates as a manufacturer certificate authority. Or the manufacturer could simply sign the WR certificates as a root certificate authority.

p-0042In the connections of <figref idrefs="DRAWINGS">FIGS. 6 and 8</figref>, the WR receiver identity is built into a television display device or television (TV). There is no corresponding HDMI transmitter <b>34</b> or <b>38</b>, and KSVs associated with the content sent over the wireless path. In this scenario, there may be a HDCP KSV <b>75</b> associated with a different HDMI receiver <b>58</b> on the display <b>55</b>. That KSV associated with the HDMI input can be associated with the certificate. Another possible solution is the association of a pseudo HDCP KSV with the display <b>55</b>. The pseudo HDCP KSV does not have any associated HDMI receiver. The pseudo KSV will allow revocation by a host <b>10</b> but will not be used to transfer data in the display device by the embedded WRR function. Consequently, use of a pseudo KSV will not require any real HDCP keys. The pseudo KSV does need to be tracked by Digital Copy Protection LLC so that it could be placed in revocation list if need be. The pseudo KSV has the benefit of not being tied to a real HDMI circuit. So it might be possible, for example, to repair an HDMI circuit by replacing a board. The KSV would be different but since the pseudo KSV is not tied to a real circuit, no change would be required to the certificate. Another possible solution would create an internal HDMI connection inside the display <b>50</b>, but such an approach would have the additional expense of extra hardware and possibly an internal HDMI cable.

p-0043Under both scenarios above, revocation of an embedded WR is closely tied to HDCP. In a preferred embodiment, the certificate would be constructed to contain a device address (e.g., 40 bits), an HDCP Key Selection Vector (KSV) (e.g., 40 bits), a wireless receiver public key (e.g., 1024-bit RSA which is approximately equal to an 80 bit symmetric key) and a Certificate Authority Signature (e.g., 2048-bit RSA which is approximately equal to 112-bit symmetric key). But, of course, other sizes could be used with longer bit strings providing better security. Alternatively, instead of RSA, Elliptic Curve public key cryptography may be used which might allow for shorter key lengths. For example, Elliptic Curve cryptography with a length of 160 bits is equal to 1024-bit RSA, and 224 bits to 2048-bit RSA. By tying the WR wireless identity to an HDCP KSV, the proper KSV can be reported to the source device, host <b>10</b> for checking against the revocation list. A breech of the wireless identity will cause a revocation through the HDCP KSV identity.

p-0044For purposes of this document, the tern KSV key or HDCP key or HDCP KSV or the like is also intended to embrace and reference the above concept of a pseudo key, without regard for presence or absence of associated HDCP to the key. Such a pseudo key will be used, as disclosed above, for the same purposes—that is, to support use of a digital certificate that ties a KSV key to a specified element of hardware including repeater parts or displays, etc.

p-0045Additionally, with the devices of <figref idrefs="DRAWINGS">FIGS. 6 and 8</figref>, as noted above, the wireless communication is directly with a display device, which has internal wireless receiver capability. Thus, although not strictly a repeater device, the term wireless receiver (WR) can be used instead, with the understanding that it behaves in the same manner as though it were a repeater receiver. Hence the terms WR and WRR can be used somewhat interchangeably with WR being somewhat more properly generic. Similarly, the term wireless transmitter (WT) can be considered generic for and interchangeable with a WRT, where wireless transmitter <b>86</b> incorporated within the host device can be considered a WT. But, references throughout to a WT or WR, WRT or WRR should be considered broadly incorporating both true repeater devices as well as source and sink devices or any other devices operating in the manner described.

p-0046A session authorization process is depicted at <figref idrefs="DRAWINGS">FIG. 9</figref> starting at <b>200</b> wherein at <b>202</b> a wireless session is initiated. The digital certificate is read at <b>206</b> by the WT. For standalone WRT, the KSV is extracted passed along the signal path using HDCP protocols to the source device <b>10</b> at <b>206</b>. Once the KSV is received at the host <b>10</b>, the source checks the KSV against a revocation list provided by the digital certificate authority at <b>210</b>. If the KSV has not been revoked at <b>214</b>, normal communication can proceed at <b>218</b>. If the KSV has been revoked at <b>214</b>, the receiver device <b>182</b> (or spoof device) is locked out at <b>222</b>. For embedded WRTs built into the host device such as is shown in <figref idrefs="DRAWINGS">FIGS. 7 and 8</figref>, the KSV can be extracted from the certificate and checked directly.

p-0047Therefore, in a mating process, the WR delivers its certificate to the WT. In some embodiments, the WT may have a certificate as well. The WT certificate may contain a public key used to create the session key. Certificate signatures are checked using the public key of the certificate authority. For example, the root CA could be the Digital Content Protection (DCP). Manufacturer certificates may be allowed. In which case, the WRT traverses a chain of trust to first verify the device certificate issued by the manufacturer and then to verify the root authority certificate of the manufacturer. The KSV value is checked against an HDCP revocation list by the content source, host <b>10</b> which can also check to see if the device identification has been revoked (if a revocation list exists) for example when WT is embedded in the host <b>10</b>. A revocation of a KSV also revokes the wireless receiver identity. Thus, the validity of the wireless high definition interface (WHDI) depends on HDCP revocation.

p-0048In all embodiments, one copy protection system is linked to another which has the potential for revocation. A breach of the system without revocation will cause the identity of the scheme with revocation to be revoked because the identities for the different copy protection system are linked in a database held either by the manufacture or by the licensing authority. Thus, a certificate is used to link one copy protection system with another which has a revocation scheme. A number of different copy protection systems could be managed this way and not just two, wireless and HDCP, as depicted.

p-0049The certificate may be created real-time once it is known just which copy protection identity is being linked with another copy protection identify at the factory. As mentioned above, the manufacturer may be able to use a “manufacturer certificate” tied to the root certificate authority, e.g. in the case of HDCP this would DCP LLC. The manufacture would then be able to sign certificates for newly create devices with wireless receiver capability. The factory typically draws from a lot of identities when creating a new unit, e.g. MAC address, device serial number, copy protection device IDs, etc. In certain embodiments, it may be desirable to also create a more powerful “copy protection linkage” certificate signed by a neutral third party serving as a digital certificate authority.

p-0050Hence, in accord with certain embodiments, the manufacturer creates a digital certificate which will tie the wireless, e.g. WHDI, security to HDCP KSV values. The manufacturer is aware of the HDCP identity used in their wireless transmitter (WT) and wireless receiver (WR) products. A set-top box or other source might have many different links and there might be many different identities to check. In certain embodiments, the consumer entertainment (CE) manufacturer could communicate with a neutral certificate authority portal to get them to sign the certificate. This might provide a more neutral way to allow parties to validate devices. Other embodiments will occur to those skilled in the art upon consideration of the present teachings.

p-0051While the above techniques are described in terms of inserting a wireless repeater or other wireless link into a normally secure HDMI/HDCP wired connection, embodiments consistent with the present invention are generally applicable to other systems wherein an alternate transmission method is inserted into an original transmission system. Security is assured by using an existing certificate revocation system in which the digital certificate is created by binding a device identity to a security key, so that a device can be revoked in the event of an attempted spoof attack. In the above examples, the HDMI/HDCP wired connections are considered an original transmission method (OT), while the wireless arrangement is considered an alternate transmission (AT) method.

p-0052Thus, a method of managing revocation when an alternate transmission method, using an alternate transmitter identity and an alternate receiver identity, is juxtaposed into an original transmission system, the original transmission system having its own original transmitter and receiver identities which communicate using an original transmission method, involves: at the alternate transmission receiver (ATR), providing a digital certificate, the digital certificate binding the ATR identity to an original transmission (OT) re-transmitter identity; at the ATR, responsive to an initiation of a communication session from an alternate transmission transmitter (ATT), sending the digital certificate to the ATT using alternate the transmission method; at the ATT, extracting the original transmission identity from the certificate and sending it to the original transmission transmitter (OTT) using original transmission method for checking in a revocation list; then, if the OT identity is found to be in the revocation list, preventing copy protected content from being sent from the OTT.

p-0053In certain embodiments, the original transmission is one of: HDMI with High-Bandwidth Digital Copy Protection (HDCP), Digital Visual Interface (DVI) with HDCP, Internet Protocol (IP) with Digital Transmission with Copy Protection (DTCP), Universal Serial Bus (USB) with DTCP, IEEE1394 with DTCP. In certain embodiments, the alternate transmission is one of wireless, carried over coaxial cable, and carried over powerline cable. In certain embodiments, f the OT identity is not found on the revocation list, then permitting content to be sent from the OTT. In certain embodiments, the digital certificate includes the ATR identity hashed or otherwise combined with an original transmission (OT) re-transmitter identity.

p-0054In certain embodiments, an alternate transmission, with alternate transmitter and receiver identities, is partly juxtaposed on an original transmission system, with either an original transmitter and receiver identity involves at the alternate transmission receiver (ATR), providing a digital certificate, the digital certificate binding the ATR identity to an original transmission (OT) identity which can be used for revocation purposes; at the ATR, responsive to an initiation of a communication session from an alternate transmission transmitter (ATT), sending the digital certificate to the ATT using alternate transmission means; at the ATT, performing one of the following: directly checking to see if the OT identity or ATR identity is in a revocation list, extracting the original transmission identity from the certificate and sending it to an original transmission transmitter (OTT) using original transmission method for checking in a revocation list, sending the entire certificate to a controlling authority to check identities in a revocation list; then, if the OT identity or ATR identity is found to be in the revocation list, preventing content from being sent either from the ATT or OTT.

p-0055Thus, in accord with certain embodiments, a method of managing revocation when an alternate transmission method, using an alternate transmitter identity and an alternate receiver identity, is juxtaposed into an original transmission system, the original transmission system having its own original transmitter and receiver identities that communicate via an original transmission method involves at an alternate transmission receiver (ATR), providing a digital certificate, the digital certificate cryptographically binding the ATR identity to an original transmission (OT) re-transmitter identity; at the ATR, responsive to an initiation of a communication session from an alternate transmission transmitter (ATT), sending the digital certificate to the ATT using the alternate transmission method; at the ATT, extracting the original transmission identity from the certificate and sending it to the original transmission transmitter (OTT) using the original transmission method for checking in a revocation list; and if the OT identity is found to be in the revocation list, preventing copy protected content from being sent from the OTT.

p-0056In certain embodiments, the digital certificate also includes a public key or is linked to a public key that is provided in a different certificate and one of the following is performed: the ATT checks that the ATR has a corresponding private key to public key in the certificate before either sending the OT identity to the OTT for checking against the revocation list or passing copy protected content to the ATR, and uses the public key in the delivery or generation of the session key used to encrypt copy protected content from the ATT to ATR thereby ensuring that only an ATR with the corresponding private key will correctly receive the content.

p-0057In certain embodiments the original transmission method comprises at least one of: high definition multimedia interface (HDMI) with High-Bandwidth Digital Copy Protection (HDCP), Digital Visual Interface (DVI) with HDCP, Internet Protocol (IP) with Digital Transmission with Copy Protection (DTCP), Universal Serial Bus (USB) with DTCP, IEEE1394 with DTCP. In certain embodiments, the alternate transmission method comprises one of wireless communication, data carried over coaxial cable, and data carried over powerline cable. In certain embodiments, other original transmission identities besides the original re-transmitter identity connected downstream are also sent using alternate transmission means to the ATT and then through original transmission means to the OTT for checking in a revocation list.

p-0058In another method of managing revocation when an alternate transmission, with alternate transmitter and receiver identities that use an alternate transmission method, is partly juxtaposed on an original transmission system, with either one of an original transmitter and receiver identity that use an original transmission method, the method involves at an alternate transmission receiver (ATR), providing a digital certificate, the digital certificate cryptographically binding the ATR identity to an original transmission (OT) identity which can be used for revocation purposes; at the ATR, responsive to an initiation of a communication session from the alternate transmission transmitter (ATT), sending the digital certificate to the ATT using the alternate transmission method; at the ATT, performing one of the following: directly checking to see if the OT identity or ATR identity is in a revocation list, extracting the original transmission identity from the certificate and sending it to an original transmission transmitter (OTT) using the original transmission method for checking in a revocation list, sending the entire certificate to a controlling authority to check identities in a revocation list; and if the OT identity or ATR identity is found to be in the revocation list, preventing content from being sent either from the ATT or OTT.

p-0059In certain embodiments, the digital certificate also includes a public key or is linked to a public key that is provided in a different certificate, and one of the following is performed: the ATT checks that the ATR has a corresponding private key to public key in the certificate before either sending the OT identity to the OTT for checking against the revocation list or passing copy protected content to the ATR, and uses the public key in the delivery or generation of the session key used to encrypt copy protected content from the ATT to ATR thereby ensuring that only an ATR with the corresponding private key will correctly receive the content.

p-0060In certain embodiments, the original transmission method comprises at least one of: high definition multimedia interface (HDMI) with High-Bandwidth Digital Copy Protection (HDCP), Digital Visual Interface (DVI) with HDCP, Internet Protocol (IP) with Digital Transmission with Copy Protection (DTCP), Universal Serial Bus (USB) with DTCP, IEEE1394 with DTCP. In certain embodiments, the alternate transmission method comprises one of wireless communication, data carried over coaxial cable, and data carried over powerline cable. In certain embodiments, other original transmission identities besides the original re-transmitter identity connected downstream are also sent using alternate transmission means to the ATT and then through original transmission means to the OTT for checking in a revocation list.

p-0061In another method of carrying out an alternate transmission, the method involves an alternate transmission transmitter (ATT) device, receiving an alternate transmission of a digital certificate from an alternate transmission receiver (ATR), the digital certificate containing an original transmission identity suitable for revocation combined with a device identifier for the ATR, a device public key and a digital signature; the ATT receiving the digital certificate, extracting the original transmission identity suitable for revocation, and sending this to a source device using original transmission means for checking in a revocation list; if the original identity is found to be revoked, the source device preventing transmission of copy protected content using the original transmission.

p-0062In certain embodiments, the digital certificate also includes a public key or is linked to a public key that is provided in a different certificate, and one of the following is performed: the ATT checks that the ATR has a corresponding private key to public key in the certificate before either sending the OT identity to the OTT for checking against the revocation list or passing copy protected content to the ATR, and uses the public key in the delivery or generation of the session key used to encrypt copy protected content from the ATT to ATR thereby ensuring that only an ATR with the corresponding private key will correctly receive the content. In certain embodiments, the original transmission method comprises at least one of: high definition multimedia interface (HDMI) with High-Bandwidth Digital Copy Protection (HDCP), Digital Visual Interface (DVI) with HDCP, Internet Protocol (IP) with Digital Transmission with Copy Protection (DTCP), Universal Serial Bus (USB) with DTCP, IEEE1394 with DTCP. In certain embodiments, the alternate transmission method is one of wireless communication, data carried over coaxial cable, and data carried over powerline cable. In certain embodiments, other original transmission identities besides the original re-transmitter identity connected downstream are also sent using alternate transmission means to the ATT and then through original transmission means to the OTT for checking in a revocation list.

p-0063An alternate transmission receiver (ATR) according to certain embodiments for receiving copy protected content from an associated alternate transmission transmitter (ATT) using an alternate transmission system and then adapting it to an original transmission system has a storage device. A digital certificate is stored on the storage device and contains an identity for an alternate transmission system, an identity for an original transmission system, a digital signature cryptographically binding the identity for the alternate transmission system and the identity for the original transmission system; and a circuit for transmitting the digital certificate to the ATT using alternate transmission means for the purpose of authenticating the ATR and providing for revocation.

p-0064In certain embodiments, the digital certificate further comprises a public key used to explicitly or implicitly authenticate the alternate transmission identity at the ATT. In certain embodiments, the alternate transmission method comprises one of wireless communication, data carried over coaxial cable, and data carried over powerline cable. In certain embodiments, the digital certificate comprises the ATR identity hashed with an original transmission (OT) system component identity. In certain embodiments, the circuit for transmitting further comprises a wireless transmitter portion of a wireless repeater.

p-0065Another method of carrying out wireless video communication consistent with certain embodiments involves at a wireless receiver (WR) device, providing a digital certificate, the digital certificate containing a High-Bandwidth Digital Copy Protection (HDCP) Key Source Vector (KSV),a device identifier for the WR device, and a digital signature cryptographically binding the identifiers; at the WR, responsive to an initiation of a wireless communication session from a wireless transmitter (WT) device, sending the digital certificate to the WT device; the WT receiving the digital certificate and having the identities in the digital certificate checked against a revocation list; and if one of the WR device's identities has been revoked, halting the wireless communication session.

p-0066Another method of carrying out wireless video communication involves at a wireless receiver (WR) device, providing a digital certificate, the digital certificate containing a High-Bandwidth Digital Copy Protection (HDCP) Key Source Vector (KSV),a device identifier for the WR device, and a digital signature cryptographically binding the identifiers; at the WR, responsive to an initiation of a wireless communication session from a wireless transmitter (WT) device, sending the digital certificate to the WT device; the WT receiving the digital certificate and having the identities in the digital certificate checked against a revocation list; and if one of the WR device's identities has been revoked, halting the wireless communication session.

p-0067In certain embodiments, the WR comprises a part of a wireless repeater and wherein the WT also comprises a part of the wireless repeater. In certain embodiments, the KSV is hashed with the device identifier in the digital certificate.

p-0068Another method of carrying out wireless video communication involves at a wireless receiver (WR) device, providing a digital certificate, the digital certificate containing a High-Bandwidth Digital Copy Protection (HDCP) Key Source Vector (KSV), a device identifier for the WR device, and a digital signature cryptographically binding the identifiers; at the WR, responsive to an initiation of a wireless communication session from a wireless transmitter (WT) device, sending the digital certificate to the WT device; the WT receiving the digital certificate and having the identities in the digital certificate checked against a revocation list; and if one of the WR device's identities has been revoked, halting the wireless communication session.

p-0069In certain embodiments, the WR comprises a part of a wireless repeater and wherein the WT also comprises a part of the wireless repeater. In certain embodiments, the KSV is hashed with the device identifier in the digital certificate.

p-0070Another method of carrying out wireless video communication involves at a wireless transmitter (WT) device, receiving a wireless communication of a digital certificate from a wireless receiver (WR) device, the digital certificate containing a High-Bandwidth Digital Copy Protection (HDCP) Key Source Vector (KSV), a device identifier for the WR device, and a digital signature; the WT wirelessly receiving the digital certificate and having the digital certificate checked against a revocation list; and if the WR device's digital certificate has been revoked, halting the wireless communication session.

p-0071In certain embodiments, the WR comprises a part of a wireless repeater and wherein the WT also comprises a part of the wireless repeater. In certain embodiments, the KSV is hashed with the device identifier to create the signature in the digital certificate.

p-0072In certain embodiments, an electronic storage medium stores a digital certificate that binds a copy protection system without revocation to one with revocation to permit revocation when authenticated, having: a High-Bandwidth Digital Copy Protection (HDCP) Key Source Vector (KSV); a device identifier for the WR device; and a digital signature that cryptographically binds the KSV and the device identifier; whereby, the digital certificate can be read and the KSV extracted and sent to a host device to be verified by comparison to a revocation list to verify the validity of the WR device.

p-0073In certain embodiments, a public key is also bound to the KSV and the device identifier. In certain embodiments, the KSV is hashed with the device identifier to create the signature in the digital certificate. In certain embodiments, the electronic storage medium is situated in a wireless receiver (WR). In certain embodiments, the WR comprises a part of a wireless repeater.

p-0074While certain embodiments herein were described in conjunction with specific circuitry that carries out the functions described, other embodiments are contemplated in which the circuit functions are carried out using an equivalent programmed processor to carry out the functions described or portions thereof. General purpose computers, microprocessor based computers, micro-controllers, optical computers, analog computers, dedicated processors, application specific circuits and/or dedicated hard wired logic, analog circuitry, pluralities of such devices and combinations of such devices in centralized or distributed configurations may be used to construct alternative equivalent embodiments. Other embodiments could be implemented using hardware component equivalents such as special purpose hardware and/or dedicated processors.

p-0075While certain illustrative embodiments have been described, it is evident that many alternatives, modifications, permutations and variations will become apparent to those skilled in the art in light of the foregoing description.