Method and apparatus for use in a downloadable conditional access system
In a downloadable conditional access system (DCAS), preferably all DCAS-specific code is implemented in a configurable secure (CS) processor that is in communication with the host processor. Preferably, no DCAS-specific code is executed in the host processor. The host processor delivers commands to the CS processor, which the CS processor performs to configure itself in accordance with the particular DCAS encryption scheme used by the DCAS. Once configured, the CS processor executes a DCAS software module that has been downloaded to the CS processor, which looks for the corresponding EMMs and ECMs, processes them to obtain the CW, and then uses the CW to decrypt the content stream.
1. An apparatus for providing conditional access (CA) in a downloadable CA system (DCAS), the apparatus comprising:
a host processor circuit; and
a configurable secure (CS) processor circuit in communication with the host processor, the CS processor being configured to:
receive DCAS commands and content stream processing commands from the host processor and to configure itself in accordance with the received commands to parse and decrypt an encrypted content stream received by the CS processor from a source external to the CS processor and the host processor, the CS processor decrypting the encrypted content stream by executing a DCAS software module that has been downloaded to the CS processor to identify an encrypted-content decryption key included in the encrypted content stream received by the CS processor; and
receive instructions from the host processor to be configured or reconfigured by the host processor to parse and decrypt encrypted content streams that have been encrypted in accordance with different downloadable CA systems (DCASs) encrypting algorithms, wherein the host processor configures or reconfigures the CS processor depending on the DCAS encryption algorithm that has been used to encrypt a content stream that a user is attempting to access.
2. The apparatus of claim 1 , wherein the host processor and the CS processor are implemented on a single integrated circuit (IC).
3. The apparatus of claim 1 , wherein the CS processor is a processor separate from the host processor.
4. The apparatus of claim 1 , wherein the CS processor comprises:
an input/output (I/O) interface configured to enable the CS processor to communicate with the host processor;
at least one memory element, the DCAS software module being stored in said at least one memory element;
a stream parsing component configured to parse the content stream and obtain an Entitlement Control Message (ECM) and an Entitlement Management Message (EMM) from the encrypted content stream, the ECM including the encrypted-content decryption key, the EMM including information as to whether decryption of the encrypted content stream is authorized; and
a decrypting component configured to decrypt the encrypted content stream if the information included in the obtained EMM indicates that decryption of the encrypted content stream is authorized, the decrypting component using the encrypted-content decryption key to decrypt the encrypted content stream.
5. The apparatus of claim 4 , wherein said at least one memory element stores multiple DCAS software modules, each DCAS software module being associated with a respective downloadable CA system (DCAS) encrypting algorithm.
6. The apparatus of claim 1 , wherein the CS processor receives instructions from the host processor to be reconfigured by the host processor to parse and decrypt a second encrypted content stream that has been encrypted in accordance with a different downloadable CA system (DCAS) encrypting algorithm, wherein if the CS processor is reconfigured, a different DCAS software module that has been downloaded to the CS processor is executed by the processor to parse and decrypt the second encrypted content stream.
7. The apparatus of claim 1 , wherein the CS processor receives instructions from the host processor to be configured by the host processor to simultaneously parse and decrypt content streams that have been encrypted in accordance with different DCAS encrypting algorithms.
8. The apparatus of claim 1 , wherein the host processor and the CS processor are integrated into a single IC, the host processor comprising host processing logic and the CS processor comprising CS processing logic.
9. A method performed by a downloadable conditional access system (DCAS), the method comprising:
receiving a first DCAS software module in a configurable secure (CS) processor, the CS processor in communication with a host processor;
receiving a first set of DCAS commands and stream processing commands, the CS processor configuring itself in accordance with the CAS commands and stream processing commands;
receiving an encrypted content stream in the CS processor from a source external to the CS processor and the host processor;
executing the received first DCAS software module in the CS processor to decrypt the encrypted content stream by the CS processor using the received first DCAS, the CS processor identifying an encrypted-content decryption key included in the encrypted content stream to decrypt the encrypted content stream; and
receiving instructions from the host processor to be configured or reconfigured by the host processor to parse and decrypt encrypted content streams that have been encrypted in accordance with different downloadable CA systems (DCASs) encrypting algorithms,
wherein the host processor configures or reconfigures the CS processor depending on the DCAS encryption algorithm that has been used to encrypt a content stream that a user is attempting to access.
10. The method of claim 9 , further comprising:
receiving a second DCAS software module in the CS processor;
receiving a second set of DCAS commands and stream processing commands, the CS processor reconfiguring itself in accordance with the second set of DCAS commands and stream processing commands; and
executing the second DCAS software module in the CS processor, wherein when the CS processor to decrypt the encrypted content stream by the CS processor using the received first DCAS, the CS processor identifying a second encrypted-content decryption key included in the encrypted content stream to decrypt the encrypted content stream.
11. The method of claim 9 , wherein the host processor and the CS processor are implemented on a single integrated circuit (IC).
12. The method of claim 9 , wherein the CS processor is a processor separate from the host processor.
13. The method of claim 9 , wherein the first and second downloaded CAS software modules are executed concurrently by the CS processor such that multiple content streams that have been encrypted with different DCAS encrypting algorithms are simultaneously parsed and decrypted and are available to be simultaneously accessed by a user.
14. The method of claim 9 , wherein the CS processor comprises a stream parsing component that parses the encrypted content stream and a decrypting component that decrypts the encrypted content stream, wherein the stream parsing component parses the encrypted content stream to obtain an Entitlement Control Message (ECM) and an Entitlement Management Message (EMM) from the encrypted content stream, the ECM including the encrypted-content decryption key, the EMM including information as to whether decryption of the encrypted content stream is authorized, and wherein the decrypting component uses the decryption key to decrypt the encrypted content stream if the obtained EMM indicates that decryption of the encrypted content stream is authorized.
15. The method of claim 9 , further comprising:
prior to executing the DCAS software module, storing the DCAS software module in a memory element of the CS processor.
16. The method of claim 9 , further comprising:
prior to executing the first DCAS software module, storing the first DCAS software module in a memory element of the CS processor; and
prior to executing the second DCAS software module, storing the second DCAS software module in the memory element.
17. A non-transitory computer-readable medium having instructions encoded thereon that, when executed in a single integrated circuit included in a downloadable conditional access system (DCAS), cause the DCAS to:
receive a first DCAS software module in a configurable secure (CS) processor, the CS processor and the host processor both implemented on the single integrated circuit;
receive a first set of DCAS commands and stream processing commands in the CS processor from the host processor, the CS processor configuring itself in accordance with the DCAS commands and stream processing commands;
receive an encrypted content stream in the CS processor from a source external to the integrated circuit;
execute the DCAS software module in the CS processor to decrypt the encrypted content stream by the CS processor using the received first DCAS, the CS processor identifying an encrypted-content decryption key included in the encrypted content stream to decrypt the encrypted content stream, wherein when the CS processor executes the DCAS software module, the CS processor parses and decrypts the encrypted content stream; and
receive instructions from the host processor to be configured or reconfigured by the host processor to parse and decrypt encrypted content streams that have been encrypted in accordance with different downloadable CA systems (DCASs) encrypting algorithms,
wherein the host processor configures or reconfigures the CS processor depending on the DCAS encryption algorithm that has been used to encrypt a content stream that a user is attempting to access.
18. The computer readable medium of claim 17 , further comprising instructions, that when executed by the processor cause the DCAS to:
receive a second DCAS software module in the CS processor;
receive a second set of DCAS commands and stream processing commands in the CS processor, the second set of commands being sent to the CS processor by the host processor, the CS processor reconfiguring itself in accordance with the second set of CAS commands and stream processing commands; and
execute the second DCAS software module in the CS processor, wherein when the CS processor executes the second DCAS software module, the encrypted content stream is parsed and decrypted.
19. The non-transitory computer-readable medium of claim 17 , wherein the host processor and the CS processor are implemented on a single integrated circuit (IC).
20. The non-transitory computer-readable medium of claim 17 , wherein the CS processor is a processor separate from the host processor.
21. The non-transitory computer readable medium of claim 17 , wherein when the content stream is parsed, an Entitlement Control Message (ECM) and an Entitlement Management Message (EMM) are obtained from the encrypted content stream, the ECM including an encrypted-content decryption key, the EMM including information as to whether decryption of the encrypted content stream is authorized, and wherein if the obtained EMM indicates that decryption of the encrypted content stream is authorized, the decryption key is used to decrypt the encrypted content stream.
22. The non-transitory computer readable medium of claim 17 , further comprising instructions, that when executed by the processor cause the DCAS to:
storing the DCAS software module in a memory element of the CS processor prior to the DCAS software module being executed in the CS processor.
23. The non-transitory computer readable medium of claim 17 , further comprising instructions, that when executed by the processor cause the DCAS to:
store the first DCAS software module in a memory element of the CS processor prior to the first DCAS software module being executed in the CS processor; and
store the second DCAS software module in the memory element prior to executing the second DCAS software module.