Information terminal having reconfigurable memory

INFORMATION TERMINAL HAVING RECONFIGURABLE MEMORY

BACKGROUND OF THE INVENTION

00031. Technical Field

0004The present invention generally relates to an information termini having a reconfigurable memory and, more particularly, to a subscription information system including such a subscriber

0005terminal unit with a secure authorization memory that is reconfigurable under control of multiple

0006information service providers via a central location.

00072. Description of the Related Art

0008The volume of information and number of features being made available to subscribers in information systems such as subscription television systems are continuously increasing. For example, the advent of optical fiber networks and links to telecommunication networks enables

0009an almost limitless supply of information and features to be provided to subscribers. Already

0010subscription television systems are being used for addressed message transmissions, pay-per-view

0011programming, impulse pay-per-view programming, favorite channel features, and parental control. Cable television system operators may also provide text services such as news articles,

0012sports scores, stock market quotations, and weather reports. Relatively new features such as video game delivery, digital audio services, wide area network access, home shopping, travel

0013reservations service, home banking, -energy management, video conferencing, burglar and fire

0014alarm services and other such services are also being provided.

0015Each of the various services may be provided by a different service provider, for example, energy management services from a public utility (gas/electric/oil), a digital audio service from

0016a digital audio service provider, game service from a game service provider, stock ticker services

0017from a ticker service provider, home shopping services from a catalog vendor, movie services from a video-on-demand .service vendor, and so on. Each of these services may offer subscription

0018services at a charge and so require the ability to authorize or deny service to an individual

0019subscriber. Moreover, certain of these service providers may require the ability for a subscriber to authorize their services impulsively; for example, a subscriber should be able to view a movie

0020of their choice without having to preorder the movie in advance from the service provider.

0021Such impulse pay-per-view services typically require a return path to the service provider

0022to report on information services purchased. In direct- to-home, direct broadcast satellite, cable television or other known systems, a telephone return line is typi-cally used. Telephone return

0023paths are described by U.S. Patent Nos. 4,792,848; 5,053,883 (terminal polling method); and

00245,270,809 among others. In coaxial cable and optical fiber systems and combinations thereof, the

0025cable may provide a return path, for example, at radio frequency. In one such system described by U.S. Patent Nos. 5,109,286; 5, 142,690; 5, 155,590; 5,225,902; 5,235,619; 5,251,324; and

00265,255,086, one or more bands of upstream channels from a subscriber to a head end are utilized. Data channels are selected to avoid noisy channels or bands. Uniquely encrypting data at a

0027plurality of transmission sites for transmission to a reception site are described by U.S. Patent No. 5,341,425.

0028All such services are preferably protected from would-be service pirates. In the past,

0029scrambling and encryption techniques have been generally employed to protect the offered services from piracy. In order to provide such service protection, manufacturers of, for example, cable

0030television terminal equipment have included microprocessors and non-volatile memories in which

0031an authorization memory may be maintained and updated with new accepted services and the like.

0032While the transmission of services and addressed commands may be protected from pirates, pirates have generally found ways to compromise services, for example, by obtaining access to the non¬

0033volatile memories. Such systems of the prior art, however, failed to provide access to multiple service providers who wished to market their services differently. It was always assumed that there was a single vendor for all the services offered such as cable television services.

0034Alternatively, each service provider separately accessed separate terminal units over separate data communications channels from the service providing channel or channels.

0035One solution to providing secure terminal authorization is to transmit authorization data in

0036encrypted format requiring decryption for the data to be in intelligible form. Presently, it is

0037known to utilize so-called public key/private key encryption systems and algorithms, two of which are known as RSA, the last initials of the inventors named on the patents, and digital signature

0038algorithm (DSA) as described by U.S. Patent No. 's 4,405,829 and 5,231,668 respectively.

0039Moreover, as encryption and scrambling became essential for preserving services from

0040pirates, it has become desirable to assure that related authorization messages and the like are certified as to source. For example, in copending U.S. application Serial No. 08/306,447 of

0041Houser et al. entitled "Electronic Document Verification System and Method" there is described a process whereby a document is certified or verified by embedding a security object in a signed

0042electronic document. A verification processor certifies or verifies the "signature" in the electronic

0043document. The document itself and/or the security information may be encrypted to protect the

0044security information or they may not. Moreover, the security information may include a document digest and/or a signature digest, the former including a hash value, the latter, a secret serial number unique to each security object.

0045Cable television equipment manufacturers have solved the problem of limited memory

0046capacity by providing expansion memories, for example, in the form of so-called smart cards

0047including such memories. Generally, as memory requirements increased, so did the size of the memories made available. For example, U.S. Patent No. 5,367,571 to Bowen et al. issued November, 1994, describes a subscription terminal with an expansion slot adapted to received such a smart card including programmable memory. The memory, for example may be utilized for special graphics features, control software or other features. Related copending application Serial No. 07/983,909 filed December 1, 1992, entitled "Reprogrammable Subscriber Terminal" describes a reprogrammable subscriber terminal in which sixteen pages of 64 bytes capacity each

0048of EEPROM memory can be programmed from a headend.

0049One example of a prior art reconfigurable terminal is described by U.S. Patent No.

00505,003,591 to Kauffman et al. This patent describes a cable television converter with remotely modifiable functionality. Firmware may be downloaded over a cable television network.

0051Nonvolatile memory is coupled to a processor for storing a default operating program in the event no firmware is downloaded to the terminal. It is suggested that a procedure for ordering pay-per-

0052view programs can be modified through downloadable firmware or utility meter reading may be

0053provided by adding an asynchronous data port and controlling the retrieval of utility data via downloaded firmware.

0054In information decoder equipment, it is also known to provide decryption via a so-call-ed smart card which is plug-in insertable into the decoder. Smart cards for service decryption

0055purposes are described by U.S. Patent Nos. 5,029,207 and 5,237,610.

0056None of the above-described references describe any concern for conserving valuable non¬ volatile memory or do they propose specific implementation solutions for responding to varying

0057needs and requirements of multiple service providers in an efficient manner. It would be clearly

0058desirable if multiple service providers were able to individually access and utilize the same memory resource in a subscription information terminal. Moreover, such a memory resource

0059would preferably be secure from service pirates who would want to control their opportunity to

0060obtain free services.

00614 SϋBSimi E SHEET (RULE 26) SUMMARY OF THE INVENTION

0062The present invention involves the inclusion in an information terminal of a memory which may be addressably reconfigured under control of a headend. Preferably the memory is secure and non-volatile and its access is controlled by a secure processor. Moreover, the secure terminal

0063memory may be separately accessed by multiple service providers so that each may need to utilize

0064only that amount of memory necessary for its purposes. Once a service provider is certified to a subscriber terminal by a trusted entity, as will be explained herein, the service provider

0065communicates messages directly with the subscriber terminal without headend or trusted entity

0066intervention. Moreover, as service providers and subscribers to their respective offerings change

0067their requirements, memory may be differently allocated and reconfigured via a process known as linked listing. In such a process, memory blocks are returned from an allocated to an empty

0068list status as requirements change.

0069Thus, according to the present invention, an information terminal comprises a data receiver for receiving commands and data from an entity and from information providers, a processor for

0070interpreting the commands and data, and reconfigurable memory, responsive to the processor, adapted to store a plurality of blocks of data in memory blocks depending on the requirements of

0071information providers, each said information provider being allocated at least one memory block, all unallocated memory blocks being linked in an empty list. Preferably, the memory blocks have

0072predetermined length, for example, on the order of forty bytes including four bytes of status and

0073pointers. One type of memory block points to the next memory block for a service provider, to

0074the first memory block for the next service provider or to an empty list of memory blocks. The memory blocks may comprise service provider descriptive information, including signature data

0075and encryption/decryption keys, large tier maps, large program maps, small program maps,

0076individual program authorizations and subscriber initiated transaction data such as impulse pay- per-view event authorizations among others. In this manner, a scarce resource, namely non¬ volatile memory of a secure microprocessor, may be reallocated dynamically to meet changing service provider requirements.

0077These and other features and advantages of the present invention will be better understood from a reading of the following detailed description in conjunction with the accompanying

0078drawings. BRIEF DESCRIPTION OF THE DRAWINGS

0079Figure 1 is a generalized block diagram of an information system in accordance with the

0080instant invention.

0081Figures 2A, 2B, 2C and 2D are block diagrams of a subscription television system in which

0082the instant invention may be implemented, Figure 2B defining a combination analog/digital environment into which the present invention may be retrofitted and Figure 2C defining a digital

0083service providing environment.

0084Figure 3 is a detailed block diagram of subscriber terminal unit 160 shown in Figure 2C.

0085Figure 4 A shows the content of an exemplary basic memory block or non- volatile storage memory cell (NVSC) including a type/status byte; Figure 4B provides an example for data

0086comprising the type and status byte; Figure 4C provides an example of type values of the type

0087data; and Figure 4D provides representative values for the status data.

0088Figure 5 is a chart showing definitions of each of a plurality of memory block types provided by way of example.

0089Figure 6 is a block diagram of an exemplary linked list for multiple service provider access

0090to terminal memory of the subscriber terminal unit of Figure 3.

0091Figure 7 is a chart showing the specific memory configuration example of Figure 6 and

0092alternative examples. DETAILED DESCRIPTION

0093Figure 1 is a generalized block diagram of an information system 10 in accordance with the

0094instant invention. Information system 10 may be analog, digital or represent a combination of analog and digital technologies. Information system 10 includes an information distribution center

009512 which receives information from one or more remotely located information service providers (SP) 14-1, ..., 14-n and supplies or broadcasts this information to a terminal unit 16.

0096"Information" as used herein includes, but is not limited to, analog video, analog audio, digital

0097video, digital audio, text services such as news articles, sports scores, stock market quotations,

0098and weather reports, electronic messages, electronic program guides, database information,

0099software including game programs, home shopping catalogs, energy management services, alarm services and wide area network data. Alternatively or in addition, information distribution center

010012 may locally generate information and supply this locally generated information to terminal unit 16.

0101According to the present invention, information distribution center 12 may be the premises of a so-called trusted entity for registering information specific to a service provider. In

0102particular, it is assumed that the service providers will each entrust the trusted entity with a key

0103certificate and a public key. The key certificate certifies to the validity of the key. The trusted entity should preserve the information in confidence from other service providers and service

0104pirates. In an initial transaction or two between the trusted entity and the subscription information terminal of a particular subscriber, the trusted entity validates the identity of the service provider to the terminal, their key and communicates a transport data stream identifier over which to expect

0105communications. Messages from the trusted entity to the home communications terminals

0106preferably are signed by the trusted entity and their signatures certified by the process described by U.S. application serial no. 08/306,447 or other known process. All this information or

01077 SUBSTITUTE SHEET (WΛf 26) selected portions thereof may be communicated encrypted and is decrypted by the secure microprocessor of the present invention. Other information about the service provider may be transmitted in the clear (their address, logo and graphics data and the like), but this data is not required for providing or authorizing service to begin. In this manner, authorizations issuing from

0108each service provider to a particular service subscriber may be received, their signatures certified,

0109portions decrypted and data stored in accordance with the service provider's validated public key and the subscriber's personal private key as appropriate.

0110The information transmitted by information distribution center 12 to terminal unit 16

0111includes addressed messages including commands and data to be received and interpreted by

0112terminal unit 16. Such commands and data may comprise, for example, commands to store a key

0113certificate for a new service provider from the trusted entity. Preferably said key certificate is retained in non-volatile, secure memory.

0114The information distribution center follows the first command and data with a command authorizing the terminal to receive messages directly from the service provider. A maximum number of memory blocks of terminal memory to be allocated to that service provider may be

0115specified with the command.

0116Thereafter, the service provider may communicate with the subscriber terminal directly via addressed communications. Such communications may be provided via the trusted entity as shown in Figure 2B or via a public or private, switched or non-switched data network or combination of

0117networks as shown in Figure 2C. The service provider transmits a key, sometimes referred to

0118herein as a multi-session key (MSK), via the information distribution center 12 to the terminal for

0119storage in terminal memory, preferably secure non-volatile memory.

0120Preferably, subsequent commands from the service provider are commands to provide

0121certain service authorizations, signed with a signature, and optionally encrypted with the

01228 SUBSTITUTE SHEET («A£ 26) subscriber's public key. These commands then are received, decrypted using also the subscriber's private key and authorization data is stored in secure terminal memory.

0123Figures 2A, 2B, 2C and 2D are block diagrams of a subscription television system 100 in

0124which the instant invention is incorporated, analog, digital or a combination or analog and digital technologies. It will of course be apparent that the instant invention may be applied to

0125information systems other than a subscription television system and the invention is not limited

0126in this respect. A subscription television system 100 provides information to a plurality of

0127subscriber locations, e.g., 120-1, ..., 120-n (see Figure 2C). The information may include, but is not limited to analog video, analog audio, digital video, digital audio, text services such as news

0128articles, sports scores, stock market quotations, and weather reports, electronic messages,

0129electronic program guides, database information, software including game programs, and wide

0130area network data. Referring to Figure 2 A, subscription television system 100 includes a plurality of information providers 114-1, ..., 114-n, each of which may supply one or more of the

0131information types identified above. For example, information provider 114-2 includes an

0132information source 115 for providing an analog television signal to a transmitter 118. Transmitter

0133118 is coupled to a satellite uplink 121 which transmits an analog television signal 122-2. Information providers 114-1 and 114-3 each provide digital information from an information source 115 to a respective encoder 116 that generates an encoded data stream for transmission.

0134Information source 115 of information providers 114-1 and 114-3 may be a memory such as an optical memory for storing information. If either of information providers 114-1 and 114-3

0135provides a variety of information, e.g., a plurality of different game programs or different types

0136of text servi-ces or a plurality of digital television or audio programs, encoder 116 may multiplex

0137the information to generate a multiplexed data stream for transmission. The data stream from encoder 116 is supplied to a transmitter 118 and then to a satellite uplink 121. By way of example in Figure 2A, the encoder 116 operated by information provider 114-1 generates a digital data

0138signal 122-1 and the encoder 116 operated by information provider 114-3 generates a digital data signal 122-3. Each signal 122-1, 122-2, and 122-3 is transmitted via a satellite 123 to a head-end installation 125 (see Figure 2B). It is understood that there may be many information service

0139providers in the system of the instant invention, and therefore a plurality of signals may be

0140transmitted via satellite 123 to locations such as head-end installation 125. Although not shown, signals may be received at locations other than a head-end installation, such as, for example, at

0141the locale of a direct broadcast satellite (DBS) subscriber. In addition, while the link between the

0142information providers and the head-end installation is shown as a satellite link, the invention is

0143not limited in this respect. Accordingly, this link may, for example, be a coaxial cable, a

0144telephone network, a satellite system, a radio frequency (RF) link, or an optical fiber or any combination thereof. Further, while the information providers of Figure 2A are remotely located from head-end installation 125, one or more information providers may be physically located at the same site as head-end installation 125.

0145Each information service provider preferably has its own unique service provider identifier

0146and, further, its own public key, which is, as described above, entrusted to the trusted entity which may operate head-end installation 125. Moreover, the service provider retains its own private key. Similarly each subscriber has a public key and a private key. Moreover, messages

0147transmitted by either to the other may be signed, or certified as to accuracy. Data that is to be

0148individually addressed to a subscriber is preferably encrypted with a key rendering it unaccessible to a service pirate. The data may include service authorization data, encrypted with a key, that is received eventually at a secure microprocessor, decrypted and stored in secure non-volatile

0149memory, according to the present invention, in non-volatile storage cells (NVSC's) of

0150predetermined length. To summarize, a service provider or a subscriber may be concerned about two issues: privacy of communications (for example, from pirates or others) and 2) certification, that is, that

0151a document or message or data is received without tampering and is certified (or verified) as to its source. According to the present invention, the same secure microprocessor or controller of

0152a home communications terminal may be equally used to achieve both certification and privacy objectives with economies in program memory utilization.

0153Referring to Figure 2B, a satellite down-link 124 at head-end installation 125 provides

0154received signals 122-1, 122-2, and 122-3. Head-end installation 125 serves as a communications

0155hub, interfacing to the various information providers, and connecting them on a conditional basis to subscriber locations 120-1, ..., 120-n. Moreover, head-end installation 125 may be the location

0156of the trusted entity referred to above. For example, received digital data signal 122-1 is supplied

0157to a receiver 126-1 and then to a modulator 128-1, where it is modulated onto a distinct cable

0158channel. Modulator 128-1 may employ any suitable modulation technique such as quadrature

0159partial response (QPR) modulation. Received analog television signal 122-2 is supplied to a receiver 126-2, then to a scrambler 130 for scrambling, and then to a modulator 128-2, where it

0160is modulated into a distinct cable channel. As will be discussed in detail below, scrambler 130 also inserts in-band data into analog television signal 122-2. It will be apparent that additional receivers, modulators, and, optionally, scramblers may be similarly provided for digital and

0161analog information signals received from other information providers, either local or remote (not

0162shown). Moreover, while the present invention is described in the context of a cable television terminal, the present invention may be suitably utilized in a direct-to-home satellite terminal, a

0163direct broadcast satellite terminal, a digital audio service terminal or other subscriber information terminal. Received digital data signal 122-3 is provided to an information signal processor (ISP) 142 so that it may be transmitted using so-called in-band or out-of-band transmissions. Other data

0164streams (not shown) from other information providers may also be provided to ISP 142. ISP 142 is responsible for receiving the one or more data signals and then transmitting data to the

0165subscriber terminal locations as will now be described. ISP 142 provides data to scrambler 130. ISP 142 may provide data to additional scramblers depending on factors such as the amount of

0166data to be transmitted and the speed at which the data must be supplied and updated. Data is repetitively sent out by scrambler 130. If there is only one scrambler and a large amount of data,

0167the repetition rate will be slow. Use of more than one scrambler allows the data repetition rate

0168to increase.

0169Specifically, scrambler 130 places data in-band for transmission to subscribers, along with scrambling the associated analog television signal 122-2. In one arrangement, data is placed in

0170the vertical blanking interval of the television signal, but data may be placed elsewhere in the

0171signal and the invention is not limited in this respect. For example, data could be amplitude modulated on a sound carrier as is well known. As herein described, in-band transmission means

0172the transmission of data within the video television channel comprising both audio and video

0173carriers. Thus, the data from ISP 142 may be transmitted by amplitude modulation on the sound carrier, hereinafter in-band audio data, or in the vertical or horizontal blanking periods of an analog television signal, hereinafter in-band video data. ISP 142 may also be arranged to supply

0174the data for transmission during unused portions a digital data stream such as an MPEG

0175compressed video data stream.

0176ISP 142 can also receive and/or generate information locally. For example, ISP 142 may generate messages for transmission to subscribers concerning upcoming events or service

0177interruptions or changes. Such messages need not be encrypted. If received from an information

017812 SUBSTITUTE SHffr<RULE 26) service provider, the information may either be transmitted as received or be reformatted by ISP 142, then supplied to scrambler 130 for transmission to subscribers. Moreover, according to the

0179present invention, especially sensitive information, such as service authorization information, is preferably encrypted at the premises of the service provider prior to transmission to the subscriber.

0180ISP 142 also passes information to a head-end controller ("HEC") 132, which is connected to scrambler 130 and an out-of-band transmitter 134. Although HEC 132 is illustrated as being connected to the same scrambler as ISP 142, HEC 132 may in fact be connected to a different

0181scrambler or scramblers. HEC 132 may conveniently be a Scientific-Atlanta Model 8658 for

0182controlling transmission of data to scrambler 130 and out-of-band transmitter 134. As noted above, scrambler 130 places data in-band for transmission to subscribers, along with scrambling

0183an associated television signal. Out-of-band transmitter 134 transmits information on a separate

0184carrier, i.e., not within a channel. In one implementation, the out-of-band carrier is at 108.2 MHz, but other out-of-band carriers may also be used. The information transmitted under the control of HEC 132 may, for example, be descrambling data. In one arrangement, information

0185is inserted in each vertical blanking interval to indicate the type of scrambling employed in the

0186next video field. Scrambling systems are well known in the art. For example, sync suppression scrambling, video inversion scrambling, and the like, or some combination of scrambling techniques may be used.

0187In accordance with the present invention, authorization information can be signed with an

0188electronic signature and portions of the message transmitted encrypted for receipt by a secure terminal processor. Authorization information authorizes subscribers to receive certain channels,

0189events, programs or tiers of services. As used herein, programs is intended to generically refer to subscription information services having predetermined channel and time slots although, the

0190concept may be expanded to include other information service marketing schemes as well. Tiers are used to define a level of service, for example, encompassing multiple data channels and time slots. One example of a tier may be arcade mode game playing, whereby a subscriber may have

0191access to any video game (a plurality of game channels) over a long period of time, such as a Saturday. Events may be defined in the form of channels and time slots as well while channels

0192may be low speed data channels (for ticker services) or high speed data channels for high^'

0193definition television and surround-sound audio.

0194Information from ISP 142 and/or HEC 132 may also be transmitted over non-scrambled channels via data repeaters (not shown) such as a Scientific-Atlanta Model 8556-100 data repeater

0195as either in-band audio or video data.

0196Some of the transmitted information is global, i.e., it is transmitted to every subscriber. For

0197example, the descrambling data may be a global transmission. It is noted that just because each subscriber receives the descrambling data does not mean that each subscriber terminal unit can descramble a received signal. Rather, only authorized subscriber terminal units are capable of descrambling the received signal. On the other hand, some information transmissions may be addressed transmissions. For example, authorization information would normally be addressed

0198to individual subscribers. That is, when transmitted, the data will have an address (for example,

0199a subscriber terminal unit serial number) associated with it. The addressed subscriber terminal

0200unit receives the information and, if there is a match between its address and the address contained in the message, responds accordingly. Other subscriber terminal units will ignore the data. Further, there can be group addressed data, which will affect groups of subscriber terminal units.

0201The outputs of modulators 128-1, 128-2, any additional modulators, and out-of-band

0202transmitter 134 are supplied to a combiner 136 that combines the individual channels into a single wide-band signal that is then transmitted via distribution network 138 to a plurality of subscriber

020314 SUBSTTTUTf SHEET (RULE 26) locations 120-1, ..., 120-n (see Figure 2C). Distribution network 138 may include, for example, one or more optical transmitters 140, one or more optical receivers 142, and a coaxial cable 1-44.

0204As indicated in Figure 2B, subscription television system 100 may include a plurality of head-end installations which each provide information to locations in a particular city or

0205geographic region. A central control 146 may be provided to coordinate the operation of various

0206head-end installations in subscription television system 100. Central control 146 is often associated with the central office of a multi-service operator and may communicate with and

0207control head-end installations in many cities. Central control 146 includes a system control

0208computer 148 that directs the other components of central control 146. In accordance with the

0209present invention, control computer 148 typically maintains secure any information service

0210provider specific information such as key certificates, keys and identifiers and may, likewise with headend 125 comprise a trusted entity according to the present invention. One example of a

0211system control computer 148 is a Scientific-Atlanta System Manager 10 network controller.

0212Central control 146 may, for example, provide billing services for the service provider, including billing for pay-per-view events. A billing computer 150 stores billing data and may also format

0213and print bills. Communication between system control computer 148 and HEC 132 may be via

0214modem, although the invention is not limited in this respect. Authorization data may be transmitted from system control computer 148 to HEC 132. HEC then 132 appropriately formats the authorization data and transmits the formatted authorization data to subscriber terminal units

0215either in-band through scrambler 130 or out-of-band through out-of-band data transmitter 134 as

0216discussed above.

0217Head-end installation 125 also includes an RF processor 152 for receiving reverse path data communications from subscriber locations 120-1, ... , 120-n. Alternatively, reverse path

0218communications may be received via telecommunications facilities and be served by a telephone

021915 SUBSTITUTE SHffT (RULE 26) processor (not shown). These data communications may include billing information for impulse- pay-per-view purchases which may be forwarded to system control computer 148 and may also include subscriber requests for database information maintained at head-end installation 125. For

0220example, a database server 154 such as an Oracle • database server may provide access to

0221reference materials such as encyclopedias, atlases, dictionaries, and the like. The subscriber request is forwarded from RF processor 152 to an information request processor 156 which accesses database 154 for the requested information and forwards the requested information to the

0222requesting subscriber, for example, via an addressed in-band or out-of-band transaction as

0223described above. In addition, information request processor 156 may also access a

0224communications network 158 in order to provide subscriber access to services such as the Internet.

0225As the amount of the data transmitted between the head-end installation and the subscriber locations increases, increased use will likely be made of out-of-band and digital transmission. For example, 50 MHz of bandwidth may be dedicated to digital data (non-video) transmission, both

0226forward channel (to the subscriber terminal unit) and reverse channel (from the subscriber terminal

0227unit). Two hundred MHz or more may also allocated to digital video and 300 MHz to 500 MHz may be allocated for analog video. Accordingly, although various illustrative transmission techniques are discussed above, the present invention is not limited in any respect by the manner

0228in which information is communicated between the head-end installation and the subscriber

0229locations.

0230The previous explanation of a system according to Figure 2B implies that the present invention may be adapted for application in a combination analog/digital system as described.

0231Likewise, the present invention may be retrofitted into earlier known systems which may be

0232considered analog systems. Referring now to Figure 2C, there is shown a digital system in which communications between service providers and the trusted entity, between the service providers

023316 SUBSTm^jIE SHEET (RULE 26) and the subscribers (the home communications terminals), and other combinations of possible

0234communications occur via a public or private, switched or non-switched interactive data network

0235or combination of such networks. According to Figure 2C, a plurality of service providers SP1 . . . SPn communicate with a Trusted Entity and a plurality of home communications terminals HCT1 . . . HCTm over a switched or un-switched interactive network shown as a cloud.

0236Typically, in such networks, for example, those operating under asynchronous transfer mode (ATM) criteria, packets of data, including headers, are transmitted addressed from, for example,

0237SP1 to HCT2, without particular regard as to the direction or path the data packet follows to its

0238destination. At a receiver, for example, a home communications terminal, the packet is received,

0239certified as to signature, decrypted as necessary and acted upon as appropriate according to embedded control data or predetermined algorithms stored in program memory. Furthermore,

0240plural packets may be collected, reformatted into the order in which they may be interpreted

0241together as a message and then acted upon. In other words, it may not be of any concern to a

0242receiver whether packet 1 transmitted first is in fact received last in relation to related packet 2. The receiver is programmed to collect the data of all related packets and acknowledge their non- receipt if packets are missing or not certifiably accurate according to such ATM or other

0243protocols. Of course, other data communications protocols may be adaptively used to advantage in the context of the present invention besides ATM. Moreover, it is to be understood that any

0244of the trusted entity, a service provider location or a location of a home communications terminal may be a transmitter or a receiver; moreover, messages which may comprise a plurality of data

0245packets may be individually, group, or globally addressed.

0246Referring to Figure 2D, each subscriber location 120-1, ..., 120-n includes a subscriber

0247terminal unit 160 connected to distribution network 138. "Subscriber location" as used herein

0248refers to any location which is remotely located with respect to head-end installation 125. In accordance with the instant invention, a subscriber terminal may, for example, be located in a

0249home, a classroom, a hotel room, a hospital room, or an office. Each subscriber terminal unit 160 may be coupled to one or more devices 162-1, ... , 162-n. Devices 162-1, ..., 162-n may include devices which are capable of being operated in response to user-supplied commands and

0250the instant invention is not limited in this respect. Thus, the devices may include televisions,

0251stereo receivers, video cassette recorders (VCRs), audio cassette recorders, compact disc (CD)

0252players, video disc players, video game players, personal computers, energy controllers and the like. Certain ones of the devices may be operatively connected together. Thus, as shown in Figure 2D, device 162-1 is connected to device 162-2. For example, device 162-2 may be a

0253television and device 162-1 may be a video cassette recorder. For purposes of discussion, it will

0254be assumed that device 162-1 is a video cassette recorder and that device 162-2 is a television. One or more of devices 162-1, ..., 162-n may be connected to switched power outlets of subscriber terminal unit 160, whereby subscriber terminal unit 160 may internally effect the on

0255and off switching of these devices. A remote control unit 166 communicates information to

0256subscriber terminal unit 160 over a communication link 168. Communication link 168 may, for example, be an infrared link.

0257Figure 3 is a detailed block diagram of subscriber terminal unit 160 showing a combination

0258of analog and digital technologies. The terminal of Figure 3 is merely representative of one terminal in which the present invention may be utilized to advantage. A representative all-digital terminal would be one in which all analog channel tuning is eliminated and digital service data and

0259related is received via ATM, time division multiplexed (TDM), pulse coded modulation (PCM),

0260combination frequency-division multiplex/TDM systems, and other related data transmission

0261means or combinations thereof. The wide-band signal from communications network 138 is supplied to an analog tuner 170,

0262a data receiver 198, and a digital tuner 202. Analog tuner 170 and digital tuner 202 are tunable

0263according to a channel selected by a subscriber. Analog tuner 170 is tunable, for example, over a frequency range of 54 MHz to 550 MHz and can be tuned to a predetermined "off-channel" for

0264receiving in-band data when television 160-2 is switched off. This so-called off-channel may be

0265predetermined by system control computer 148 (see Figure 2B) and data identifying the

0266predetermined channel may be forwarded to subscriber terminal unit 160 using any one of the data transmission techniques described above. The off-channel identification data may be stored in

0267memory of subscriber terminal unit 160. Preferably, only one of the analog and digital tuners is active at a given time.

0268Analog tuner 170 uses a phase-locked loop under the control of analog control circuit 172 to convert the selected or predetermined off channel signal to a 45.75 MHz intermediate frequency

0269(IF) signal. Analog control circuit 172 may, for example, be an application specific integrated circuit (ASIC) which combines a plurality of subscriber terminal unit control and data handling

0270functions into a single unit. Of course, the analog ASIC may include any combination of individual control circuits. Alternatively, or in addition, other control circuitry may be used, such

0271as a microprocessor. Analog control circuit 172 has an associated RAM 196 and ROM 197.

0272A filter 174, for example, a SAW filter, filters the IF signal from analog tuner 170 to split the signal into separate video and audio portions for processing. The video portion is demodulated and descrambled by video demodulator and descrambler 176 under the control of analog control

0273circuit 172. For example, if sync suppression scrambling has been used, video demodulator and

0274descrambler 176 may perform sync restoration. The video signal then passes through a bandpass filter 178 to an on-screen display control 180 where inverse video inversion (descrambling) takes

0275place, if necessary. The descrambling of the video portion, whether sync suppression, sync inversion, video line inversion, and the like, is under the control of analog control circuit 172. Thus, analog control circuit 172 supplies to on-screen display control 180 any necessary timing

0276signals, inversion axis levels, and information about whether the video is inverted and supplies to video demodulator and descrambler 176 any necessary timing, restoration levels, and

0277identification of sync pulses to be restored. Analog control circuit 172 receives the descrambling data for implementing such control, for example, from pulses as in-band audio data or from data

0278modulated on the video during the vertical blanking interval.

0279In the other path, the audio signal is converted to the intermodulation frequency of 4.5 MHz

0280by a synchronous detector 182. Feedback for automatic gain control of synchronous detector 182 is supplied from the output of a bandpass filter 184. An amplitude modulation detector 186

0281performs pulse detection to recover in-band audio data which is amplitude modulated onto the audio carrier. The detected in-band audio data is supplied to analog control circuit 172. The in- band audio data, except for descrambling data, is stored in RAM 196 for buffering. The descrambling data is directly accessed by analog control circuit 172 for the above-described

0282descrambling operations. The audio signal from bandpass filter 184 is demodulated by an FM

0283demodulator 188. Volume control of the audio signal is performed under control of a volume control circuit 190 and a main processor 200 as described, for example, in commonly assigned U.S. Patent No. 5,054,071, which is in-corporated herein by reference. After volume control, the

0284audio signal is supplied to a mute switch 192 which is under the control of main processor 200.

0285The output of mute switch 192 is supplied to a modulator 194.

0286The output of on-screen display control 180 is supplied to analog control circuit 172 for

0287detecting in-band video data from the blanking intervals of the signal. Analog control circuit 172

0288stores the detected data in RAM 196 prior to processing by main processor 200. As noted above,

0289any descrambling data is directly accessed by analog control circuit 172 for the above-described descrambling operations. Additional details of the detecting of this in-band video data can be

0290found in commonly assigned copending application Serial No. 08/229,805, filed April 19, 1994, entitled "Subscription Television System and Terminal for Enabling Simultaneous Display of

0291Multiple Services", which is incorporated herein by reference. Further, time-of-day data is transmitted from head-end installation 125 and stored in RAM 196, for example. For example,

0292global time-of-day transmissions may periodically occur, based on satellite time standards as described in commonly assigned U.S. Patent No. 4,994,908, which is incorporated herein by

0293reference. Thus, main processor 200 has access to current time-of-day information.

0294On-screen display control 180 selectively generates on-screen character and graphi s displays in place of or overlaid on the video signal. For example, information stored in RAM 196 or

0295ROM 197 may be read out to on-screen display control 180 and used to generate on-screen

0296characters and or graphics. Modulator 194 combines the output of on-screen display control 180

0297and the audio signal from the output of mute switch 192 and converts the combined signal to the channel frequency selected by main processor 200, such as channel 3 or 4. The combined and

0298remodulated signal is supplied as an RF output to VCR 162-1 and/or to television 162-2 in a well known manner.

0299The input wide-band signal is also supplied to out-of-band data receiver 198 for receiving commands and data. Out-of-band data receiver 198 provides received out-of-band data to analog

0300control circuit 172. This data may be stored in RAM 196 where it is accessible by main processor

0301200.

0302The input wide-band signal is also supplied to a digital tuner/demodulator 202 which is tunable in a range, for example, from 400 MHz to 750 MHz and is tuned in accordance with a

0303subscriber selection. Digital tuner/demodulator 202 is used to tune to digital data channels. A

0304digital control circuit 204 which may include a digital ASIC recovers and processes the digital data on the tuned digital data channel and supplies corresponding analog and/or digital output signals to one of devices 162-1, ..., 162-n. Alternatively, the recovered digital data may be accessed by

0305one of devices 162-1, ..., 162-n. For example, if the digital data includes digital audio data, corresponding analog output signals may be supplied to speakers. If the digital data is video game

0306data, a video game player may access the recovered digital data which is stored in RAM 206, for example, through a video game player port (not shown). If the digital data includes digital

0307television data, corresponding analog output signals may be supplied to VCR 162-1 and/or to television 162-2. If the digital data includes software programs, a personal computer may access

0308the recovered software programs through a serial port. Details of digital control circuits which may be used to recover and process digital data may be found, for example, in commonly assigned

0309U.S. Patent No. 5,239,540 to Rovira; commonly assigned U.S. Application Serial No. 08/352,162, entitled "Secure Authorization and Control Method and Apparatus for a Game

0310Delivery Service"; and commonly assigned U.S. Application Serial No. 07/970,918, entitled "System and Method for Multiplexing a Plurality of Digital Program Services for Transmission to Remote Locations. " Each of these patents or applications is incorporated herein by reference thereto. Digital control circuit 204 also has an associated RAM 206 and ROM 208.

0311Coupled also to digital control circuit 204 is secure processor 205 including secure non¬

0312volatile memory. Typically, a secure microprocessor with public key support has approximately four bytes of on-board non-volatile memory. This capacity figure is used by way of example for the purposes of demonstrating the feature of the present invention whereby precious non-volatile

0313memory is reconfigurable and efficiently utilized. The present invention may be equally utilized

0314to advantage to conserve larger or smaller memories. Of the present exemplary four kilobytes of memory, some is reserved for storage of a private key, control algorithms and the like. This

0315leaves room for approximately 80 non-volatile storage cells (NVSC's) of predetermined length, for example, forty bytes. Again, this allocation is by way of example only, there may be greater

0316or fewer than 80 cells and greater or fewer than -40 bytes per cell (100 cells, 32 bytes per cell; 60, 50; or other arrangement depending on the application of the present invention). Moreover, it is

0317a principle of the present invention, that remaining memory for, for example, program memory

0318may be efficiently allocated for, for example, both electronic signature on message certification and decryption privacy.

0319Processor 205 is preferably inside the same housing as the rest of the terminal of Figure 3,

0320but, in alternative embodiments, may comprise a smart card or other secure processor/memory

0321as described by U.S. Patent 5,029,207 and 5,237,610 incorporated herein by reference. Such a smart card is plug-in insertable to a slot adapted to receive it and may be magnetically, optically

0322or otherwise read and/or written to.

0323Although digital tuner 202, digital control circuit 204, secure processor 205, RAM 206, and

0324ROM 208 are shown as being integral with the remaining circuitry, these elements individually, in combination or in sub-combinations thereof may alternatively be provided as an add-on or sidecar unit which is connectable to main processor 200 via an expansion slot connected to

0325processor bus 224. In any of the smart card, side car or internal to terminal embodiments,

0326encryption and decryption of commands and data are performed within processor 205 and data is stored therein in the clear. One of the characteristics of a secure processor is that once a pirate would attempt to break into the processor to seek to obtain the data stored therein, the memory

0327may be lost and, of course, the processor functionally rendered inactive.

0328Subscriber terminal unit 160 further includes an LED display 210 for displaying information

0329such as channel numbers, a keypad 212 for inputting subscriber commands, an infrared receiver 214 for receiving commands from remote control 166, and a VCR control 216 for transmitting

0330commands to VCR 162-1 by, for example, LR signals. An RF transmitter is controllable by main processor 200 for transmitting reverse path transmissions over distribution network 138. These transmissions may be generated in response to subscriber-supplied inputs for requesting information from database 154 at head-end installation 125 or for the purpose of transmitting billing information regarding impulse pay-per-view purchases to system control computer 148,

0331the latter being preferably encrypted in accordance with the present invention and stored in processor 205. A switched power outlet 226 may be provided to selectively power one or more of devices 162-1, ..., 162-n plugged therein.

0332Main processor 200 is preferably a PowerPC • microprocessor and controls the overall

0333operation of subscriber terminal unit 160 in accordance with program code stored in memory

0334(e.g., ROM 218 and RAM 220) and with data downloaded from head-end installation 125.

0335Referring now to Figure 4A-4D, secure non-volatile storage cells (NVSC's) of s-ecure processor 205 of Figure 3 will be explained in further detail. Referring first to Figure 4A, there

0336is shown a typical NVSC or memory block of predetermined length, for example, forty bytes of non- volatile memory such as EEPROM of secure microprocessor 205. This is a software construct than can be predetermined to any suitable length, forty bytes being one example.

0337Preferably the NVSC is a group of contiguous bytes for ease of memory access. One byte may comprise a shared byte for type and status data as will be further described in connection with

0338Figure 4B. Another byte may be spare or reserved. Thirty-six bytes of data then follow. Lastly there is a pointer to the next NVSC in a list of allocated or empty memory blocks.

0339All valid NVSC's are linked. There always exists a pointer maintained external to the

0340preferably contiguous NVSC array which points to the first valid NVSC and each valid NVSC

0341points to the next valid NVSC in the list. The pointer in the last NVSC of a list contains the value OxFFFF. Similarly, all empty NVSC's are linked, with an external pointer to the first empty

0342memory block on the empty list. The first empty cell on the list is found by using the external address pointer. The Status data field is changed to "writing" except if there is already data stored in the memory block, then the status is "changing". Once the NVSC is written the status data field is changed to "valid". A cell (NVSC) is removed from a linked list by replacing the pointer of the previous cell with the address of the following cell.

0343Referring now to Figure 4B, there is shown a representative type/status byte comprising eight bits. Four bits comprise type information as further described by Figure 4C and four bits

0344comprise status information as further described by Figure 4D.

0345Referring to Figure 4C, the type field indicates what type of NVSC data the block is. The memory block (NVSC) may comprise a service provider SP descriptor block, a multisession key

0346(MSK) block, a large tier map, (a small tier map), a large program map, a small program map,

0347an individual programs authorizations list (for example, eight programs maximum) or an impulse

0348pay-per-view events list (also, for example, eight events). Four bits of data provide a maximum of sixteen choices. Other possible service authorization and purchase NVSC's may come to mind

0349for different services, such as digital game services or digital audio services. Some of these secure data comprise authorization or service acceptance data that should be preserved from

0350service pirates and must be returned to the service provider for billing. An advantage then of the present invention is that an electronic signature of a subscriber and encryption of such service

0351acceptance related data with a subscriber's key may be accomplished within the secure processor

0352and any data accessible to a service pirate would be unintelligible to the pirate since it is encrypted. One exemplary arrangement is shown in Figure 4C, whereby type value 0001 represents a large tier map of up to 256 levels of service that may be provided by a particular

0353service provider. Allowing 32 bytes for the large tier map, 2 bytes for a SP identifier and 2 bytes

0354for a transport stream identifier, the large tier map utilizes 1 NVSC. Other NVSC type values identified by way of example only are likewise defined. Type value 0000 is an error indicator.

035525 SUBSTITUTE SHKT (RULE 26) Type value 0011 represents a small portion of a 4096 channel authorization map, equivalent to

03561/16 of a such a map. Other arrangements may come to mind for different applications of the present invention. A modified NVSC type list is shown in Figure 5.

0357Referring to Figure 4D, the status field indicates what the status of the memory block is at

0358a given point in time. The status may be changing, may be valid (i.e., in use), writing or a

0359member of the empty list. In an alternative embodiment, the type status byte may be appropriately shared to permit, for example, five bits of type data and three bits of status data.

0360Again, the byte sharing example is merely that, an example of what may be adapted for use in

0361accordance with the principles of the present invention. As shown by the present example, most

0362bit positions for status value are not valid and may be wasted.

0363Now an example of the present invention will be described in the context of Figures 5, 6 and 7. Firstly, Figure 5 shows exemplary NVSC types. For example, the Service Provider (SP) Descriptor block comprises a complete description of the service provider by identifier (two

0364bytes), a public key hash of 16 bytes, up to two channel authorizations (two channels identified by 8 bytes, four bytes each), other SP characteristics (8 bytes) and an NVSC pointer of two bytes to the next NVSC. Alternatively, the channel authorizations may be bit mappable to

0365predetermined data channels for the service provider and comprise a bit authorization map for up

0366to sixty-four channels.

0367Another memory block may be for storage of the multi-session key (MSK) for a particular

0368service provider. Even and odd MSK's may be provided to further thwart pirates as is well known in the art, each 16 bytes long. In this same memory block may be stored a Service Provider ID and a Transport data Stream Identification (TS ID) of two bytes to identify the

0369transport data stream the data is received on. Other memory blocks are defined as shown in Figure 5 (or Figure 4C in a modified embodiment), for example, for defining 256 levels of service (large tier map), 4096 channels

0370(large) or 256 (small), advance purchased events and impulse pay-per-view events. The purchased impulse pay-per-view events are representative of subscription information service acceptance data and preferably are encrypted and transmitted in a secure manner via reverse path means, RF or

0371telephone, for example. A user or subscriber registers service acceptance data (which may be home shopping data) via the terminal of Figure 3, for example, by remote control including a

0372personal signature or personal voice recognition. Such data is not erased from secure memory of

0373processor 205, preferably, until acknowledgement has been received via billing computer 150

0374(Figure 2B) that the service acceptance data has been successfully registered at the billing computer.

0375Referring now to Figure 6, there is shown a linked list example showing how scarce non¬

0376volatile memory can be allocated and reallocated. We have assumed thus far that 80 NVSC's are

0377available at a predetermined length of 40 bytes each. A single command or set of commands from a trusted entity is received to set up a service provider descriptor block and await further

0378commands from the service provider. These first transactions from the trusted entity serve to

0379certify to the subscription information terminal that the service provider is a valid service provider, once the message integrity and the trusted entity's signature is certified and that the

0380terminal is authorized to receive communications directly from the identified service provider.

0381Typically, at least one memory block from the empty list is allocated to that service provider

0382in the introductory transaction. The initial or series of service provider certifying transactions will communicate the service provider identifier, the service provider's key certificate, the service

0383provider's key, the transport data stream or streams the service provider communicates over, and

0384the maximum number of NVSC's that service provider will utilize of non-volatile memory. Similarly, when a service provider no longer wishes to provide service through the trusted entity,

0385one or more commands are received and acted upon by secure processor 205 to erase the memory

0386blocks for that service provider and return the memory blocks to the empty list. As already

0387described, the end of a list may be predefined by the pointer OxFFFF in hexadecimal.

0388Entering a service provider list at the top of Figure 6, the service provider pointer may match a service provider identifier number in a first Service Provider Descriptor block. If there

0389is no match, the chart follows to Service Provider #2 and to #3 in turn. It is assumed that there

0390are only three valid service providers in this example.

0391Service provider #1 is a service provider which utilizes a multi-session key block, a large

0392tier map block and a channel (program) authorization map (4 NVSC's).

0393Figure 6 assumes that Service Provider #2 is a service provider which utilizes a multi-session key, and a very large channel map, comprising in this example, seventeen memory blocks.

0394Figure 6 also assumes that Service Provider #3 is a so-called broadcast service provider which has no tier structure, no pre-purchase or impulse purchase capabilities and the like. Service

0395Provider #3 only requires two memory blocks. Altogether, then, non-volatile memory of

0396processor 205 comprising 80 memory blocks or NVSC's is only utilized to the extent of some 25

0397memory blocks leaving 55 memory blocks in an empty list.

0398Figure 7 shows this result in the first column. The second column shows the application of the principles of the present invention to a recently announced field trial of cable television services known in the industry as the USWest Omaha Trial. There are a total of twenty-three

0399service providers (each with a key block, these require 46 NVSC's) in this recently announced

0400example. Fourteen of these require large tier maps. We also assume nine different eight channel

0401authorization maps to authorize 72 channels. These then leave 11 NVSC's in an empty list. Further examples are shown for a direct-to-home service provider (Ex #3) and other exemplary models. In this manner and by way of example, it has been shown that only 4

0402kilobytes of secure non-volatile memory may be utilized by multiple service providers in a secure, efficient manner and reutilized and reconfigured at the will and control of the service providers

0403and the service subscribers without the intervention of the trusted entity (once the trusted entity has validated the relationship). All data for loading into the map is received, any electronic

0404signatures certified, any data portion of a message that are encrypted, are decrypted in the secure

0405micro and stored therein, unreachable to any service pirates. Any data leaving the secure

0406microprocessor 205 may be likewise signed by the subscriber with a unique security objiϊct stored

0407in secure memory and portions or all of the message encrypted with a subscriber key so the

0408service provider will be able to readily certify the message and recover its included data and

0409determine the existence of a service pirate attempting to interfere with reverse path communications. The present invention may prove useful in practically any subscription information service terminal, direct-to-home, direct broadcast satellite, as well as cable television,

0410used by way of example only.

0411Also, while the present invention has been described in the context of a so-called analog/digital or wholly digital subscription information services terminal as per Figure 3, the present invention may be adaptably retrofitted into certain existent cable television terminals such as the Scientific-Atlanta Models 8600 and 8600X and other similar terminals of other

0412manufacturers with or without manufacturer intervention.

0413While the invention has been described in detail with reference to the appended drawings,

0414the invention is limited in scope only by the claims. Moreover, any application cited herein

0415should be construed to be incorporated by reference as to any subject matter deemed essential to

0416the present disclosure.