WO2005117443A2 - Authentication of applications - Google Patents
Authentication of applications Download PDFInfo
- Publication number
- WO2005117443A2 WO2005117443A2 PCT/IB2005/051710 IB2005051710W WO2005117443A2 WO 2005117443 A2 WO2005117443 A2 WO 2005117443A2 IB 2005051710 W IB2005051710 W IB 2005051710W WO 2005117443 A2 WO2005117443 A2 WO 2005117443A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- certificates
- certificate
- application
- distributor
- identifiers
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
- H04N21/443—OS processes, e.g. booting an STB, implementing a Java virtual machine in an STB or power management in an STB
- H04N21/4433—Implementing client middleware, e.g. Multimedia Home Platform [MHP]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F15/00—Digital computers in general; Data processing equipment in general
-
- C—CHEMISTRY; METALLURGY
- C07—ORGANIC CHEMISTRY
- C07C—ACYCLIC OR CARBOCYCLIC COMPOUNDS
- C07C211/00—Compounds containing amino groups bound to a carbon skeleton
- C07C211/43—Compounds containing amino groups bound to a carbon skeleton having amino groups bound to carbon atoms of six-membered aromatic rings of the carbon skeleton
- C07C211/57—Compounds containing amino groups bound to a carbon skeleton having amino groups bound to carbon atoms of six-membered aromatic rings of the carbon skeleton having amino groups bound to carbon atoms of six-membered aromatic rings being part of condensed ring systems of the carbon skeleton
- C07C211/60—Compounds containing amino groups bound to a carbon skeleton having amino groups bound to carbon atoms of six-membered aromatic rings of the carbon skeleton having amino groups bound to carbon atoms of six-membered aromatic rings being part of condensed ring systems of the carbon skeleton containing a ring other than a six-membered aromatic ring forming part of at least one of the condensed ring systems
-
- C—CHEMISTRY; METALLURGY
- C07—ORGANIC CHEMISTRY
- C07C—ACYCLIC OR CARBOCYCLIC COMPOUNDS
- C07C217/00—Compounds containing amino and etherified hydroxy groups bound to the same carbon skeleton
- C07C217/78—Compounds containing amino and etherified hydroxy groups bound to the same carbon skeleton having amino groups and etherified hydroxy groups bound to carbon atoms of six-membered aromatic rings of the same carbon skeleton
- C07C217/80—Compounds containing amino and etherified hydroxy groups bound to the same carbon skeleton having amino groups and etherified hydroxy groups bound to carbon atoms of six-membered aromatic rings of the same carbon skeleton having amino groups and etherified hydroxy groups bound to carbon atoms of non-condensed six-membered aromatic rings
- C07C217/82—Compounds containing amino and etherified hydroxy groups bound to the same carbon skeleton having amino groups and etherified hydroxy groups bound to carbon atoms of six-membered aromatic rings of the same carbon skeleton having amino groups and etherified hydroxy groups bound to carbon atoms of non-condensed six-membered aromatic rings of the same non-condensed six-membered aromatic ring
- C07C217/84—Compounds containing amino and etherified hydroxy groups bound to the same carbon skeleton having amino groups and etherified hydroxy groups bound to carbon atoms of six-membered aromatic rings of the same carbon skeleton having amino groups and etherified hydroxy groups bound to carbon atoms of non-condensed six-membered aromatic rings of the same non-condensed six-membered aromatic ring the oxygen atom of at least one of the etherified hydroxy groups being further bound to an acyclic carbon atom
-
- G—PHYSICS
- G03—PHOTOGRAPHY; CINEMATOGRAPHY; ANALOGOUS TECHNIQUES USING WAVES OTHER THAN OPTICAL WAVES; ELECTROGRAPHY; HOLOGRAPHY
- G03G—ELECTROGRAPHY; ELECTROPHOTOGRAPHY; MAGNETOGRAPHY
- G03G5/00—Recording members for original recording by exposure, e.g. to light, to heat, to electrons; Manufacture thereof; Selection of materials therefor
- G03G5/02—Charge-receiving layers
- G03G5/04—Photoconductive layers; Charge-generation layers or charge-transporting layers; Additives therefor; Binders therefor
- G03G5/06—Photoconductive layers; Charge-generation layers or charge-transporting layers; Additives therefor; Binders therefor characterised by the photoconductive material being organic
- G03G5/0601—Acyclic or carbocyclic compounds
- G03G5/0605—Carbocyclic compounds
-
- G—PHYSICS
- G03—PHOTOGRAPHY; CINEMATOGRAPHY; ANALOGOUS TECHNIQUES USING WAVES OTHER THAN OPTICAL WAVES; ELECTROGRAPHY; HOLOGRAPHY
- G03G—ELECTROGRAPHY; ELECTROPHOTOGRAPHY; MAGNETOGRAPHY
- G03G5/00—Recording members for original recording by exposure, e.g. to light, to heat, to electrons; Manufacture thereof; Selection of materials therefor
- G03G5/02—Charge-receiving layers
- G03G5/04—Photoconductive layers; Charge-generation layers or charge-transporting layers; Additives therefor; Binders therefor
- G03G5/06—Photoconductive layers; Charge-generation layers or charge-transporting layers; Additives therefor; Binders therefor characterised by the photoconductive material being organic
- G03G5/0601—Acyclic or carbocyclic compounds
- G03G5/0605—Carbocyclic compounds
- G03G5/0607—Carbocyclic compounds containing at least one non-six-membered ring
-
- G—PHYSICS
- G03—PHOTOGRAPHY; CINEMATOGRAPHY; ANALOGOUS TECHNIQUES USING WAVES OTHER THAN OPTICAL WAVES; ELECTROGRAPHY; HOLOGRAPHY
- G03G—ELECTROGRAPHY; ELECTROPHOTOGRAPHY; MAGNETOGRAPHY
- G03G5/00—Recording members for original recording by exposure, e.g. to light, to heat, to electrons; Manufacture thereof; Selection of materials therefor
- G03G5/02—Charge-receiving layers
- G03G5/04—Photoconductive layers; Charge-generation layers or charge-transporting layers; Additives therefor; Binders therefor
- G03G5/06—Photoconductive layers; Charge-generation layers or charge-transporting layers; Additives therefor; Binders therefor characterised by the photoconductive material being organic
- G03G5/0601—Acyclic or carbocyclic compounds
- G03G5/0612—Acyclic or carbocyclic compounds containing nitrogen
- G03G5/0614—Amines
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
- H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
- H04N21/254—Management at additional data server, e.g. shopping server, rights management server
- H04N21/2541—Rights Management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
- H04N21/434—Disassembling of a multiplex stream, e.g. demultiplexing audio and video streams, extraction of additional data from a video stream; Remultiplexing of multiplex streams; Extraction or processing of SI; Disassembling of packetised elementary stream
- H04N21/4345—Extraction or processing of SI, e.g. extracting service information from an MPEG stream
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
- H04N21/434—Disassembling of a multiplex stream, e.g. demultiplexing audio and video streams, extraction of additional data from a video stream; Remultiplexing of multiplex streams; Extraction or processing of SI; Disassembling of packetised elementary stream
- H04N21/4348—Demultiplexing of additional data and video streams
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
- H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
- H04N21/4622—Retrieving content or additional data from different sources, e.g. from a broadcast channel and the Internet
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/47—End-user applications
- H04N21/478—Supplemental services, e.g. displaying phone caller identification, shopping application
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
- H04N21/81—Monomedia components thereof
- H04N21/8166—Monomedia components thereof involving executable data, e.g. software
- H04N21/8173—End-user applications, e.g. Web browser, game
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
- H04N21/83—Generation or processing of protective or descriptive data associated with content; Content structuring
- H04N21/835—Generation of protective data, e.g. certificates
- H04N21/8352—Generation of protective data, e.g. certificates involving content or source identification data, e.g. Unique Material Identifier [UMID]
-
- C—CHEMISTRY; METALLURGY
- C07—ORGANIC CHEMISTRY
- C07C—ACYCLIC OR CARBOCYCLIC COMPOUNDS
- C07C2602/00—Systems containing two condensed rings
- C07C2602/02—Systems containing two condensed rings the rings having only two atoms in common
- C07C2602/04—One of the condensed rings being a six-membered aromatic ring
- C07C2602/08—One of the condensed rings being a six-membered aromatic ring the other ring being five-membered, e.g. indane
Definitions
- the present invention relates to authentication of applications, and in particular to authentication of applications associated with a particular distributor.
- the Digital Video Broadcasting (DVB ® ) Project (www.dvb.org) is developing standards such as Multimedia Home Platform (MHP ® ) which allow interactive applications to be developed and distributed independently of mainstream digital content whilst being accessible to end users by being run on standardised consumer devices such as set top boxes, integrated digital TVs and the like.
- MHP ® Multimedia Home Platform
- this code is the manufacturer's software in the TV or set-top box.
- MHP and the US OpenCable Applications Platform (OCAP) this code is externally developed Java applications.
- a key part of code authentication schemes is the use of Public Key Infrastructure (PKI) to identify the source of the code being authenticated.
- PKI Public Key Infrastructure
- an issued certificate is restricted to those Website domains operated by the approved organisation.
- certificates are intended to be used for specified purposes, for example to authenticate a specified interactive TV application.
- the MHP specification is silent regarding to whom certificates will be issued.
- Appropriate organisations could for example be TV broadcasters, since these are more able to pay for certificates and hence to contribute to the cost of operating the PKI system.
- usage of an issued certificate is not restricted to the market or markets in which the operator is active.
- a certificate issued to sign MHP applications in one market could in addition, or alternatively, be used to sign MHP applications in another market. This may not correspond to the intention of the issuer of the certificate.
- the Wireless LAN (WLAN) System Service identifiers (SSIDs) public key certificate extension contains a list of SSIDs. When more than one certificate indicates that the certified public key is appropriate for use in the LAN environment, then the list of SSIDs may be used to select the correct certificate for authentication in a particular WLAN. However, the document acknowledges that since SSID values are unmanaged, the same SSID can appear in different certificates that are intended to be used with different WLANs (for example each run by a different operator or provider). When this occurs, automatic selection of the certificate will fail. It is an object of the present invention to provide an improved method of selecting a certificate for an application.
- a method for selecting a certificate for the authentication of an application associated with a distributor comprising : - accessing application metadata, which metadata comprises an identifier of the distributor; - extracting the identifier from the application metadata; - receiving certificates, each certificate comprising one or more identifiers of respective distributors; - extracting the identifiers from the certificates; and - selecting a certificate based on a comparison of the identifiers extracted from the application metadata and the certificates; wherein, the association of an identifier with a distributor is managed.
- the managed association of identifiers with distributors ensures that certificates can only be used to authenticate applications distributed by identified distributors.
- the term 'application' is used herein to refer to software-based informational, productivity or entertainment services provided in the form of modules or programs intended to run standalone or in conjunction with another service or services.
- the term 'distributor' includes entities such as broadcasters, network operators and service providers. Such entities distribute applications to various types of markets, such as national or regional populations, a group of subscribers and the like.
- the term 'managed' in relation to the identifiers means that the determination and utilisation of the identifiers is not ad-hoc; rather, control is by an authority to ensure that identifiers, and therefore distributors and their applications, are distinguishable one from another.
- the application itself can be intended for (distributed to) more than one market by containing the corresponding identifiers.
- a single certificate can serve a plurality of markets (distributors) by containing the corresponding identifiers for those markets. More than one certificate may be available to sign an application; in this case the method is free to select any one of those which correspond.
- This enables a certificate authority to provide specific services for specific distributors or for those organisations distributing applications via a specific distributor.
- the method can employ existing identifiers which are already managed, thereby saving cost.
- the identifiers are preferably managed by the
- DVD Digital Video Broadcasting Project
- Network ID issued to a respective distributor.
- the term 'Network ID' is used herein to refer to the DVB entity 'networkJD' and/or entity OriginaLnetworkJD' as defined in ETSI ETR 101 162: "Digital Video
- DVB Allocation of Service Information (SI) codes for DVB systems” and ETSI EN 300 468 "Digital Video Broadcasting (DVB);
- SI Service Information
- DVB Network ID an identifier of the distributor couples authentication of applications to the operational functioning of the DVB network itself, which makes such an authentication mechanism very difficult to circumvent.
- Applications authorised by certificates selected according to the present invention may be any suitable informational, productivity or entertainment application.
- An example of the latter includes a Digital Video Broadcasting compliant application in which the Service Information of the associated DVB service comprises the application metadata (comprising identifiers for at least one distributor).
- a system for selecting a certificate for the authentication of an application associated with a distributor comprising : - a first server and at least one receiver, the first server operable to send certificates to the at least one receiver; wherein the at least one receiver is operable to : o access application metadata, which metadata comprises an identifier of the distributor; o extract the identifier from the application metadata; o receive certificates, each certificate comprising one or more identifiers of respective distributors; o extract the identifiers from the certificates; and o select a certificate based on a comparison of the identifiers extracted from the application metadata and the certificates.
- the distribution of certificates can be independent of the distribution of applications and associated application metadata.
- an application (and its metadata) may be already resident at or in a receiver (for example on a portable record carrier such as an optical disc, or in non-volatile storage within the receiver); authentication of the application being then dependent on the receipt of a suitable certificate.
- the certificate may be forwarded to the receiver using any suitable wired or wireless distribution method, including for example, broadcast TV/radio (via terrestrial, cable and/or satellite) or computerised network (Internet via dial-up PSTN/ xDSL, Ethernet, WiFi, GSM/GPRS).
- the application metadata may also be sent to the receiver, using any suitable method from those listed above.
- the application metadata and certificate(s) may be distributed using the same distribution mechanism (for example where both are carried in the same DVB multiplex); such a scenario is particularly suited to the case where a server is configured to provide both application metadata and certificate(s).
- application metadata and certificate(s) may be distributed using different methods (e.g. application metadata via broadcast transmission; certificates via the Internet). In this case, different servers may be used to respectively send application metadata and certificate(s).
- a receiver for use in the system comprising: - a store operable to store application metadata; - a first input device operable to receive certificates; - a processor comprising a CPU interconnected to a program store and a data store, the processor configured to : o access application metadata, which metadata comprises an identifier of the distributor; o extract the identifier from the application metadata; o receive certificates, each certificate comprising one or more identifiers of respective distributors; o extract the identifiers from the certificates; and o select a certificate based on a comparison of the identifiers extracted from the application metadata and the certificates.
- the receiver can be independent of or combined with the entity which executes the application authenticated by the selected certificate, an example of the latter being a set top box.
- the receiver may already have access to the application metadata, for example from local storage, and therefore receives certificates via an input device.
- suitable input devices include a tuner in the case where certificates are distributed using broadcast media, or a network interface (for example a modem, Ethernet card, WiFi interface, IrDA port, etc.) where certificates are distributed via a computer network (for example the Internet) or a media reader where certificates are distributed using physical media.
- the receiver may also receive the application metadata (and optionally also the corresponding application) via the same input device used for receiving certificates.
- a separate input device is used to receive the application metadata.
- Figure 1 shows a method for selecting a certificate for authentication of an application associated with a distributor
- Figure 2 shows a system for selecting a certificate for authentication of an application associated with a distributor
- Figure 3 shows a receiver for selecting a certificate for authentication of an application associated with a distributor
- Figure 4 shows the functional components of a set top box for selecting a certificate for authentication of an application associated with a distributor.
- Figure 1 shows a method, shown generally at 100, for selecting a certificate for authentication of an application associated with a distributor.
- the method starts at 102 and proceeds to access 104 metadata of an application.
- Metadata of an application typically comprises technical data related to the application such as the location of components of the application within the transmission multiplex.
- the metadata also includes an identifier indicating the distributor of the application. Any suitable distributor identifier may be used, including in respect of the application any of: an author/creator, a licensor, a network operator or a medium used to distribute the application. A pre-requisite of a suitable distributor identifier is that it is managed (as discussed earlier).
- the metadata of the application comprises one or more Network IDs in the Service Information (SI) data which, for the purpose of the present invention, also serve as distributor identifiers.
- SI Service Information
- Other parameters defined within DVB may be eligible to serve as distributor identifiers either exclusively or in combination with Network IDs, for example data identifying the delivery system (terrestrial, cable, satellite, and the like).
- Other distributor identifier schemes are also supported by the present invention.
- the corresponding metadata on the DVD, or sent via other means
- the corresponding metadata might comprise data identifying the physical distributor (e.g. a film distributor, a retailer).
- the identification scheme is managed then the present invention supports this and other types of physical distribution; one example is to use an existing managed coding scheme, such as the manufacturer identification number utilised in UPC/EAN bar-coding.
- Metadata of an application, distributed independently or in conjunction with the application itself, may be read from removable media such as magnetic/optical disk, solid state storage, or from non-volatile storage internal to the device or product hosting the application, such as hard disk or solid state storage.
- the metadata and/or its application may be factory programmed; typically, it is downloaded to the device or product hosting the application, for example via local wired or wireless LAN, Internet or broadcast.
- the method extracts 106 one or more identifiers 108 from the metadata, for example by parsing, and then receives 110 certificates for authenticating the application.
- Any suitable certificate type may be used, providing it has the ability to also convey identifiers for at least one distributor.
- an adapted existing certification scheme is employed, for example using certificates specified according to the Internet X.509 Public Key Infrastructure Certificate and CRL profile and including extension data comprising identifiers for at least one distributor. This particular scheme is described in document RFC 2459 - "Internet X.509 Public Key Infrastructure.
- Each certificate comprises one or more identifiers each identifying a respective distributor.
- the method then extracts 112 the identifiers 114 from the certificates.
- the one or more identifiers 108 from the application metadata are then compared 116 with the identifiers 114 from the received certificates.
- the result 118 of the comparison determines whether a certificate is selected 120, such determination being application dependent. In the example of a DVB compliant application, selection of a certificate occurs if, and only if, an identifier from the application metadata matches an identifier from the certificate. Where the result of comparison indicates that a certificate does not comprise a matching identifier, then such a certificate is rejected.
- a certificate may be selected on the basis that it comprises one, some, or all, matching identifiers, according to pre- determined conditions for example as specified by the distributor.
- the method ends at 122.
- Figure 2 shows a system, shown generally at 200, for selecting a certificate for authentication of an application associated with a distributor.
- the system comprises a server 210 which sends certificates 218 to a receiver 206 of a population (or market) of receivers, as denoted by 202.
- the server 210 may reside in a network (including the Internet), and communicate with the receiver via a local (wired or wireless) area network (LAN) connected using for example Ethernet, WiFi, Infrared, or the like; and/or a wide area network connected using for example PSTN/xDSL modem, GSM, PCS, GPRS, or the like.
- LAN local (wired or wireless) area network
- the server may communicate using a data service provided within a broadcast distribution, such as DVB-T, DVB-S or DVB-C.
- a broadcast distribution such as DVB-T, DVB-S or DVB-C.
- certificates are delivered to the receiver using physical media rather than from a server, for example CD-ROM, DVD, floppy disk or the like; however, distribution of certificates in this way is not preferred.
- the receiver 206 can receive certificates from more than one server, as shown by servers 210, 214.
- the receiver 206 accesses application metadata which may be available within the receiver itself; typically, new or updated applications can be also be provided by application server 212, 216 which in the example depicted also provide the respective metadata 220, 226.
- the receiver compares the distributor identifiers obtained from the application metadata with those obtained from the received certificates to determine a suitable certificate to select to authenticate the application.
- a certificates server 214 or application server 216 can serve different receiver populations 202, 204 (markets) comprising receivers 206, 208 with respective certificates 222, 228 and respective metadata 226, 224.
- server 210 could provide receiver 206 with certificates 218 relevant to application metadata 226 provided by server 216, the application itself residing in receiver 206 or provided by either server 212 or server 216.
- a server described above could be capable of providing to a receiver any combination of certificates, application metadata and applications.
- one arrangement would be for a DVB registered operator to distribute certificates, application metadata and applications using the existing broadcast TV distribution network.
- FIG 3 shows a receiver, shown generally at 300, for selecting a certificate for authentication of an application associated with a distributor.
- the receiver comprises an input device 302 which receives data comprising certificates 320 from a source such as server on a network, as described above in relation to Figure 2.
- input devices include a tuner (for example DVB tuner, DAB tuner, broadcast analogue TV tuner for VBI data, broadcast analogue FM radio for RDS data), modem (for example PSTN- Hayes, xDSL, cable), network interface unit (for example Ethernet, WiFi, HiperLAN, IrDA, GSM, GPRS, PCS).
- input device 302 is a media reader such as a floppy disk drive, optical disk drive or the like.
- the input device may be part of another host system such as a PC, cable TV box, set top box or the like.
- a processor comprising CPU 304 interconnected 324 in known fashion with non-volatile storage (for example program ROM 306) and data memory (for example RAM 308), receives certificates 322 from the input device 302.
- non-volatile storage for example program ROM 306
- data memory for example RAM 308
- Alternative arrangements for the processor are readily identifiable to the skilled person.
- certificates may be already resident in the non-volatile storage, but in general, certificates will be received from a source external to the receiver.
- applications and associated metadata may be already resident within the receiver in non-volatile storage 306, 308; alternatively, one or both may also be received via the input device 302 from a network or physical media.
- application metadata may be received using a further input device, as discussed in more detail below in relation to Figure 4.
- the processor obtains identifiers from the metadata and certificates and selects a certificate based on a comparison of the identifiers.
- Figure 4 shows the functional components of a set top box, shown generally at 400, for selecting a certificate for authentication of an application associated with a distributor.
- the set top box comprises a DVB tuner 402 which receives broadcast transmissions 430, from a DVB compliant satellite, terrestrial or cable network, as is known in the art.
- a processor comprising CPU 406 interconnected 442 with non-volatile storage (for example program ROM 408) and data memory (for example RAM 410) controls 432 the tuner 402 according to user commands 440 from user interface 412 to select services and applications obtainable from the DVB network.
- Data 434 received by the tuner is demultiplexed 404 into its corresponding primary service (for example TV programme) AV content 436 and secondary service content 438.
- a secondary service can comprise an interactive application designed to complement the primary service content such as an interactive advertisement.
- secondary service content 438 may comprise only certificates to authenticate an interactive application already resident within or available to the set top box.
- the certificates may be received using a separate input device such as modem 418 which is able to receive the certificates 448 from a computer network such as the Internet 420.
- interactive applications are downloadable, for example from the DVB network and secondary service content 438 then comprises applications and associated metadata and typically also the certificates.
- the processor then obtains the distributor identifiers from the metadata and certificates, selects a suitable certificate and then authenticates and runs the relevant interactive application.
- AV content output 444 from the interactive application is then applied to AV processing block 414 to be combined with primary service AV content 436 according to the requirements of the interactive application.
- the AV processing block 414 then passes processed AV signals 446 to output device 416 which then forwards 448 them for rendering using suitable display and audio devices.
- service content 438 is independent of any primary service content, for example service content 438 comprising games, productivity software programs, and the like.
- service content 438 comprising games, productivity software programs, and the like.
- a method for selecting a certificate for the authentication of an application associated with a distributor comprising accessing 104 application metadata comprising an identifier 108 of the distributor and extracting 106 the identifier, receiving 110 certificates comprising one or more identifiers 114 of respective distributors and extracting 112 these identifiers, and then selecting 120 a certificate based on a comparison 116 of the identifiers extracted from the application metadata and the certificates.
- the association of an identifier with a distributor is managed so that certificates can only be used to authenticate applications distributed by identified distributors.
- the Digital Video Broadcasting (DVB ® ) Project performs this management task through the use of DVB Network IDs to identify distributors which are included in the extension data of the certificates as well as within the application metadata.
Landscapes
- Engineering & Computer Science (AREA)
- Signal Processing (AREA)
- Multimedia (AREA)
- Organic Chemistry (AREA)
- Chemical & Material Sciences (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Data Mining & Analysis (AREA)
- Mathematical Physics (AREA)
- Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
Abstract
Description
Claims
Priority Applications (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP05742714A EP1754124A2 (en) | 2004-05-27 | 2005-05-25 | Authentication of applications |
KR1020067024690A KR101150784B1 (en) | 2004-05-27 | 2005-05-25 | Method and system for selecting a certificate for of an authentication of an application associated with a distributor, receiver for use in the system, set top box, and record carrier |
US11/569,613 US20070234422A1 (en) | 2004-05-27 | 2005-05-25 | Authentication of Applications |
BRPI0511490-0A BRPI0511490A (en) | 2004-05-27 | 2005-05-25 | Method and system for selecting a certificate for authentication of an application associated with a distributor, receiver, device top converter, recording carrier, and software utility |
JP2007514283A JP2008500628A (en) | 2004-05-27 | 2005-05-25 | Application authentication |
MXPA06013701A MXPA06013701A (en) | 2004-05-27 | 2005-05-25 | Authentication of applications. |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GBGB0411861.8A GB0411861D0 (en) | 2004-05-27 | 2004-05-27 | Authentication of applications |
GB0411861.8 | 2004-05-27 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2005117443A2 true WO2005117443A2 (en) | 2005-12-08 |
WO2005117443A3 WO2005117443A3 (en) | 2006-03-30 |
Family
ID=32671169
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/IB2005/051710 WO2005117443A2 (en) | 2004-05-27 | 2005-05-25 | Authentication of applications |
Country Status (11)
Country | Link |
---|---|
US (1) | US20070234422A1 (en) |
EP (1) | EP1754124A2 (en) |
JP (1) | JP2008500628A (en) |
KR (1) | KR101150784B1 (en) |
CN (1) | CN100478830C (en) |
BR (1) | BRPI0511490A (en) |
GB (1) | GB0411861D0 (en) |
MX (1) | MXPA06013701A (en) |
RU (1) | RU2351079C2 (en) |
TW (1) | TW200612277A (en) |
WO (1) | WO2005117443A2 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101047832B (en) * | 2007-04-30 | 2010-06-23 | 中兴通讯股份有限公司 | Implementing method for service capability authentication and its trigger of internet network TV |
EP2713295A1 (en) * | 2011-05-19 | 2014-04-02 | Nippon Hoso Kyokai | Cooperative broadcast communication receiver device, resource access control program and cooperative broadcast communication system |
GB2535146A (en) * | 2015-02-03 | 2016-08-17 | Samsung Electronics Co Ltd | Broadcast application security |
US10412589B2 (en) | 2015-02-03 | 2019-09-10 | Samsung Electronics Co., Ltd. | Broadcast apparatus and method of authenticating broadcast data |
Families Citing this family (19)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101789065B (en) | 2005-02-14 | 2012-05-09 | 松下电器产业株式会社 | Application executing device, managing method, and program |
JP2007235306A (en) * | 2006-02-28 | 2007-09-13 | Matsushita Electric Ind Co Ltd | Broadcast receiver mounted with use authentication system |
US8341401B1 (en) * | 2008-05-13 | 2012-12-25 | Adobe Systems Incorporated | Interoperable cryptographic peer and server identities |
US8312147B2 (en) | 2008-05-13 | 2012-11-13 | Adobe Systems Incorporated | Many-to-one mapping of host identities |
SE532587C2 (en) * | 2008-10-16 | 2010-03-02 | Alfa Laval Corp Ab | Hard brazed heat exchanger and method of manufacturing brazed heat exchanger |
JP5912615B2 (en) * | 2012-02-08 | 2016-04-27 | 日本放送協会 | Broadcast communication cooperative receiver and broadcast communication cooperative system |
US20130254906A1 (en) * | 2012-03-22 | 2013-09-26 | Cavium, Inc. | Hardware and Software Association and Authentication |
JP6066586B2 (en) * | 2012-05-22 | 2017-01-25 | キヤノン株式会社 | Information processing system, control method thereof, and program thereof |
JP6261933B2 (en) * | 2012-10-16 | 2018-01-17 | 日本放送協会 | Broadcast communication cooperative receiver and broadcast communication cooperative system |
US10440132B2 (en) * | 2013-03-11 | 2019-10-08 | Amazon Technologies, Inc. | Tracking application usage in a computing environment |
US9154488B2 (en) * | 2013-05-03 | 2015-10-06 | Citrix Systems, Inc. | Secured access to resources using a proxy |
EP3021517B1 (en) * | 2013-07-10 | 2021-04-28 | Saturn Licensing LLC | Reception device, reception method, and transmission method |
JP6301624B2 (en) * | 2013-10-03 | 2018-03-28 | 株式会社東芝 | Broadcast receiving apparatus, information processing system, and information processing apparatus |
KR101535378B1 (en) * | 2014-03-27 | 2015-07-09 | 정성택 | Method for providing family contents, device using the same and system thereof |
KR102285888B1 (en) * | 2014-08-14 | 2021-08-05 | 주식회사 한국무역정보통신 | Method and server for issuing certificate and mandating digital signature |
WO2016054149A1 (en) | 2014-09-30 | 2016-04-07 | Citrix Systems, Inc. | Fast smart card logon and federated full domain logon |
US10841316B2 (en) | 2014-09-30 | 2020-11-17 | Citrix Systems, Inc. | Dynamic access control to network resources using federated full domain logon |
US10320572B2 (en) * | 2016-08-04 | 2019-06-11 | Microsoft Technology Licensing, Llc | Scope-based certificate deployment |
US10958640B2 (en) | 2018-02-08 | 2021-03-23 | Citrix Systems, Inc. | Fast smart card login |
Family Cites Families (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6038319A (en) * | 1998-05-29 | 2000-03-14 | Opentv, Inc. | Security model for sharing in interactive television applications |
US6223291B1 (en) * | 1999-03-26 | 2001-04-24 | Motorola, Inc. | Secure wireless electronic-commerce system with digital product certificates and digital license certificates |
US6519571B1 (en) * | 1999-05-27 | 2003-02-11 | Accenture Llp | Dynamic customer profile management |
WO2001028093A1 (en) | 1999-10-14 | 2001-04-19 | Koninklijke Philips Electronics N.V. | Method for assigning program locations in a receiver |
US20020009842A1 (en) * | 2000-01-03 | 2002-01-24 | Ming-Tsung Tung | High-voltage device and method for manufacturing high-voltage device |
US20020154777A1 (en) * | 2001-04-23 | 2002-10-24 | Candelore Brant Lindsey | System and method for authenticating the location of content players |
US20030078962A1 (en) | 2001-10-19 | 2003-04-24 | Robert Fabbricatore | Integrated communications system |
CA2365691A1 (en) | 2001-12-19 | 2003-06-19 | Ibm Canada Limited-Ibm Canada Limitee | Identifying network servers capable of hosting a database |
US7742992B2 (en) * | 2002-02-05 | 2010-06-22 | Pace Anti-Piracy | Delivery of a secure software license for a software product and a toolset for creating the software product |
US7680743B2 (en) * | 2002-05-15 | 2010-03-16 | Microsoft Corporation | Software application protection by way of a digital rights management (DRM) system |
CA2486937C (en) * | 2002-05-22 | 2011-09-13 | Thomson Licensing S.A. | Signing and authentication devices and processes and corresponding products, notably for dvb/mpeg mhp digital streams |
WO2004036870A2 (en) * | 2002-10-18 | 2004-04-29 | Koninklijke Philips Electronics N.V. | Method and system for metadata protection in tv-anytime |
JP2004157703A (en) * | 2002-11-06 | 2004-06-03 | Hitachi Ltd | Content protection system |
US20040268120A1 (en) * | 2003-06-26 | 2004-12-30 | Nokia, Inc. | System and method for public key infrastructure based software licensing |
-
2004
- 2004-05-27 GB GBGB0411861.8A patent/GB0411861D0/en not_active Ceased
-
2005
- 2005-05-24 TW TW094116899A patent/TW200612277A/en unknown
- 2005-05-25 EP EP05742714A patent/EP1754124A2/en not_active Withdrawn
- 2005-05-25 WO PCT/IB2005/051710 patent/WO2005117443A2/en active Application Filing
- 2005-05-25 MX MXPA06013701A patent/MXPA06013701A/en active IP Right Grant
- 2005-05-25 BR BRPI0511490-0A patent/BRPI0511490A/en not_active IP Right Cessation
- 2005-05-25 RU RU2006146811/09A patent/RU2351079C2/en not_active IP Right Cessation
- 2005-05-25 JP JP2007514283A patent/JP2008500628A/en active Pending
- 2005-05-25 US US11/569,613 patent/US20070234422A1/en not_active Abandoned
- 2005-05-25 KR KR1020067024690A patent/KR101150784B1/en not_active IP Right Cessation
- 2005-05-25 CN CNB2005800170853A patent/CN100478830C/en not_active Expired - Fee Related
Non-Patent Citations (1)
Title |
---|
None |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101047832B (en) * | 2007-04-30 | 2010-06-23 | 中兴通讯股份有限公司 | Implementing method for service capability authentication and its trigger of internet network TV |
EP2713295A1 (en) * | 2011-05-19 | 2014-04-02 | Nippon Hoso Kyokai | Cooperative broadcast communication receiver device, resource access control program and cooperative broadcast communication system |
EP2713295A4 (en) * | 2011-05-19 | 2015-04-22 | Japan Broadcasting Corp | Cooperative broadcast communication receiver device, resource access control program and cooperative broadcast communication system |
GB2535146A (en) * | 2015-02-03 | 2016-08-17 | Samsung Electronics Co Ltd | Broadcast application security |
GB2535146B (en) * | 2015-02-03 | 2019-07-24 | Samsung Electronics Co Ltd | Broadcast application security |
US10412589B2 (en) | 2015-02-03 | 2019-09-10 | Samsung Electronics Co., Ltd. | Broadcast apparatus and method of authenticating broadcast data |
Also Published As
Publication number | Publication date |
---|---|
BRPI0511490A (en) | 2007-12-26 |
WO2005117443A3 (en) | 2006-03-30 |
KR101150784B1 (en) | 2012-06-08 |
GB0411861D0 (en) | 2004-06-30 |
EP1754124A2 (en) | 2007-02-21 |
CN100478830C (en) | 2009-04-15 |
JP2008500628A (en) | 2008-01-10 |
RU2006146811A (en) | 2008-07-10 |
MXPA06013701A (en) | 2007-03-23 |
RU2351079C2 (en) | 2009-03-27 |
TW200612277A (en) | 2006-04-16 |
KR20070020461A (en) | 2007-02-21 |
US20070234422A1 (en) | 2007-10-04 |
CN1957309A (en) | 2007-05-02 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20070234422A1 (en) | Authentication of Applications | |
US8924731B2 (en) | Secure signing method, secure authentication method and IPTV system | |
US8627487B2 (en) | Method and apparatus for providing DRM service | |
CN102934118B (en) | Subscriber equipment and control method thereof | |
US8434102B2 (en) | Television receiver and digital broadcast system | |
US7774487B2 (en) | Method and apparatus for checking the health of a connection between a supplemental service provider and a user device of a primary service provider | |
US20110239287A1 (en) | Method for sharing content | |
US20060045110A1 (en) | Information distribution system, terminal device, information distribution server, information distribution method, terminal device connection method, information processing program product, and storage medium | |
CN103780962A (en) | Set top box architecture with application based security definition | |
US20120102167A1 (en) | Automatic configuration in a broadcast application apparatus | |
JP3695367B2 (en) | Information providing system, information processing apparatus and method, recording medium, and program | |
CN100440840C (en) | Information appliance and access control method | |
EP1678634A1 (en) | Accessing content at a geographical location | |
US8813191B2 (en) | Method and apparatus for controlling the number of devices installed in an authorized domain | |
JP2003069976A (en) | Information providing system, information processor and method, information providing device and method, recording medium, and program | |
EP3506115B1 (en) | Information processing device | |
US20090158395A1 (en) | Method and apparatus for detecting downloadable conditional access system host with duplicated secure micro | |
WO2011052103A1 (en) | Information distribution system, information distribution management device, information distribution management method, information distribution management program, information receiving device, information receiving method, and information receiving program | |
JP4575518B1 (en) | Information distribution management device, information distribution management method, information distribution management program, and information distribution system | |
JP5471641B2 (en) | Information distribution system, information transmission / reception device | |
CN101626487A (en) | Data transmission method and service platform | |
KR200371216Y1 (en) | The set-top box and the server for security improvement | |
KR100681475B1 (en) | System and method for providing the imbedded database in set-top box | |
KR100947315B1 (en) | Method and system for supporting roaming based on downloadable conditional access system | |
JP2011097385A (en) | Information receiver, information receiving method, information reception program, and information distribution system |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A2 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KM KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NG NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SM SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A2 Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IS IT LT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 2005742714 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2007514283 Country of ref document: JP |
|
WWE | Wipo information: entry into national phase |
Ref document number: PA/a/2006/013701 Country of ref document: MX Ref document number: 1020067024690 Country of ref document: KR |
|
WWE | Wipo information: entry into national phase |
Ref document number: 11569613 Country of ref document: US Ref document number: 2007234422 Country of ref document: US Ref document number: 200580017085.3 Country of ref document: CN |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: DE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 4527/CHENP/2006 Country of ref document: IN |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2006146811 Country of ref document: RU |
|
WWP | Wipo information: published in national office |
Ref document number: 1020067024690 Country of ref document: KR Ref document number: 2005742714 Country of ref document: EP |
|
WWP | Wipo information: published in national office |
Ref document number: 11569613 Country of ref document: US |
|
ENP | Entry into the national phase |
Ref document number: PI0511490 Country of ref document: BR |