WO2008017874A1 - système électronique interactif et procédé pour une pluralité d'utilisateurs - Google Patents

système électronique interactif et procédé pour une pluralité d'utilisateurs Download PDF

Info

Publication number
WO2008017874A1
WO2008017874A1 PCT/GB2007/003071 GB2007003071W WO2008017874A1 WO 2008017874 A1 WO2008017874 A1 WO 2008017874A1 GB 2007003071 W GB2007003071 W GB 2007003071W WO 2008017874 A1 WO2008017874 A1 WO 2008017874A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
local controller
controller
local
transmitted
Prior art date
Application number
PCT/GB2007/003071
Other languages
English (en)
Inventor
Paul Krisman
Original Assignee
Answerback Limited
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Answerback Limited filed Critical Answerback Limited
Publication of WO2008017874A1 publication Critical patent/WO2008017874A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04H—BROADCAST COMMUNICATION
    • H04H40/00—Arrangements specially adapted for receiving broadcast information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
    • H04N21/442—Monitoring of processes or resources, e.g. detecting the failure of a recording device, monitoring the downstream bandwidth, the number of times a movie has been viewed, the storage space available from the internal hard disk
    • H04N21/44213—Monitoring of end-user related data
    • H04N21/44222—Analytics of user selections, e.g. selection of programs or purchase activity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
    • H04N21/24—Monitoring of processes or resources, e.g. monitoring of server load, available bandwidth, upstream requests
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
    • H04N21/242—Synchronization processes, e.g. processing of PCR [Program Clock References]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
    • H04N21/442—Monitoring of processes or resources, e.g. detecting the failure of a recording device, monitoring the downstream bandwidth, the number of times a movie has been viewed, the storage space available from the internal hard disk
    • H04N21/44236—Monitoring of piracy processes or activities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/65—Transmission of management data between client and server
    • H04N21/658—Transmission by the client directed to the server
    • H04N21/6582—Data stored in the client, e.g. viewing habits, hardware capabilities, credit card number
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/16—Analogue secrecy systems; Analogue subscription systems
    • H04N7/173—Analogue secrecy systems; Analogue subscription systems with two-way working, e.g. subscriber sending a programme selection signal
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/24—Systems for the transmission of television signals using pulse code modulation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/24—Systems for the transmission of television signals using pulse code modulation
    • H04N7/52—Systems for transmission of a pulse code modulated video signal with one or more other pulse code modulated signals, e.g. an audio signal or a synchronizing signal

Definitions

  • the present invention relates to an interactive electronic system and method of operating ' an interactive electronic system. More particularly, but not exclusively, the invention relates to an interactive broadcast system, such as an interactive television broadcast system, for a plurality of users, and method of operating such a system.
  • the present invention is particularly, although not exclusively applicable to providing an interactive system which includes security provisions to combat against and/or detect misuse of the system.
  • Interactive electronic systems for multiple users are known in the art, especially in the fields of live events and interactive broadcasting, allowing users to participate, for example, in votes or quizzes.
  • Such systems are used to enable audience members to participate and interact with a broadcast by allowing users of the system to indicate their preference or response to a question.
  • data is broadcast to a plurality of local controllers from a central control server.
  • a stimulus such as a question
  • the time at which a stimulus such as a question
  • the users are invited to respond
  • This may allow the response time of different users to be determined, to decide who has reacted fastest, or provided the first correct response etc.
  • To deliver timed applications it is necessary to provide a local clock signal generator with each local controller.
  • the local controller is then able to deliver the interactive application with reference to the local clock signal of that local controller. It is known to synchronise the local clock signal generator of a local controller with a reference clock signal, such as a master clock signal generated at the central control server. In this way, interactive applications may be performed simultaneously at all local controllers .
  • the local clock signal generator must be adjustable, there is a possibility that a user of the system may misuse this clock signal adjustment functionality in order to gain an unfair advantage over other users of the interactive system.
  • a user can adjust the local clock generator of a first local controller such that an interactive application is delivered by the first local controller after it: is delivered by a second local controller. The user can then have more time to respond to the application, or can even view the answers on the second controller and input the correct answers to the first local controller when the application is delivered at the later time.
  • This type of misuse is referred to as an "Inserted Delay Attack" .
  • a second type of misuse is referred to as a "Spoof Answer Attack" .
  • a spoof answer attack is undertaken when a user tampers with the input/response data to gain an unfair advantage.
  • the users may alter the local clock signal generator such that local timing information provided along with the user input/response indicates that the input/response was provided at an earlier time than it actually was . It is therefore desirable to implement an interactive electronic system for a plurality of users which includes security provisions to combat against and/or detect misuse of the system.
  • an interactive system for a plurality of users comprising: a local controller operable to receive data from at least one user interface device; broadcasting means for broadcasting data to the local controller; and a central controller for processing data, the local controller being in communication with the central controller such that it can transmit data to the central controller; wherein the local controller comprises means for storing information relating to data to be transmitted from the local controller to the central controller.
  • a method of operating an interactive system for a plurality of users comprising: broadcasting data to a local controller operable to receive data from at
  • ⁇ least one user interface device transmitting data from the local controller to the central controller; processing data at the central controller; and storing information relating to the data to be transmitted at the local controller.
  • the local timing information at the local controller is changed, e.g. by modifying the local clock signal generator, the data actually transmitted to and received by the central controller will differ from that which it is (intended) to transmit, and information relating to the data to be transmitted will not match the corresponding information relating to the data actually transmitted and received.
  • information such as the time at which the data was provided, derived from the data actually received by the central controller may not match the stored information which relates to the information which was e.g. intended to be transmitted.
  • the system comprises at least one user interface device.
  • the user interface device is operable to receive a user input and generate data in response to the user- input.
  • the data may be data indicative of the content of the input, and/or information relating the circumstances of the input, e.g. the timing of the input.
  • the user interface device may then transmit the data, e.g. to a local controller and/or central controller.
  • the user interface device may be arranged to receive data from the central controller, and/or local controller. However, in some embodiments the user interface device is a "transmit" only device. In a preferred embodiment, the user interface devices comprise keypads, preferably of a shape and size such that they may be easily held in a user's hand (although this is not essential). Each user interface device may, e.g., comprise one or a plurality of buttons and/or may comprise any suitable interface means such as, purely by way of example, a jog-dial, a touch-screen or a microphone (or a plurality thereof) .
  • Each user interface device preferably has the capability to generate, store and forward data to a (its respective) local controller in response to user inputs provided to the device (e.g. according to which one of its button is activated by a user) .
  • each user interface device also comprises a timer for obtaining information relating to the timing of user inputs.
  • the user interface may be arranged to allow one or more users to use the user interface at a given time. For example, there may be one user interface provided per user, or in other cases, a group of users, e.g. a team, may all be able to use the same user interface device. In some embodiments, four users may use the same user interface device at the same time.
  • the local controller is operable to receive data from at least one user interface device.
  • the local controller may also be arranged to be able to transmit data to the user interface device.
  • the local controller may be arranged to communicate with one or more user interface devices. These user interface devices may be said to be "associated" with the local controller.
  • the local controller may be associated with a group of user interface devices. In some embodiments, this will be a selected group of the plurality of user interface devices, i.e. not all user interface devices. In some embodiments, communications between the user interface devices and the central controller may then be directed via the local controller associated with that user interface device.
  • one local controller per venue to coordinate the inputs received by all user interface devices at the venue.
  • some signals may be transmitted directly from the central controller to the user interface devices " and others via the local controller.
  • the local controller may carry out some processing of signals received from the user interface device, reducing the level of processing required of the user interface devices if desired.
  • the local controller is in communication with a central controller such that it may transmit data to the central controller.
  • the local controller may also be able to receive data from the central controller .
  • the local - controller may be arranged to be in communication with the central controller in any suitable manner or manners, e.g. via wired or wireless links, or via a network connection, such as an internet connection.
  • the local controller may be connected to the central controller by more than one different link e.g. by a network based, link and a different, separate link, such as a broadcast communications link.
  • the local controller may be located at a first venue.
  • the central controller is preferably remote from the first venue. Data transmitted by the local controller is received by the central controller.
  • the data may be received and, if desired, processed, by a computer system of the central controller. Such processing may include any or all of the steps of accumulating, . counting, deleting, displaying and storing the received data, in its received form, or a form to which it has been converted by the local controller.
  • the central controller may be a central or control server.
  • the system further comprises broadcasting means for broadcasting data to the local controller.
  • the broadcasting means may, for example, be an antenna. However, any suitable broadcasting means may be used to broadcast data. For example, a cable-based or IP-based broadcast distribution network may be used. 'The broadcast means may broadcast stimuli to which the users are invited to respond, such as questions, or other prompts.
  • the broadcasting means may be located in the same location as the central controller, e.g. a television studio, or remote therefrom.
  • the central controller may comprise the broadcasting means, and the central controller may be arranged to broadcast data to the local controller via a broadcast communication link.
  • the broadcast data is preferably in the form of a television broadcast, and/or preferably comprises or has the nature of, a television program. It preferably comprises an interactive event, preferably a live interactive event, and preferably includes periodic stimuli, such as questions, to invite responses from users . In a particularly preferred embodiment it comprises an interactive entertainment event or show, such as, and preferably, a quiz or -game.
  • the broadcast data may also comprise other data e.g. relating to user inputs. For example, the data may include information about the winner of the last round of a quiz. Preferably, therefore, the broadcast data is based, at least in part, on user input data received from the local controller (s) .
  • the broadcasting means may broadcast the data at a first venue.
  • the first venue is a location at which more than one user can participate in and/or interact with the broadcast i.e. where a plurality of user interface devices are located.
  • the venue may, for example, be private homes and/or public buildings.
  • the venue is a public house, bar or casino.
  • the data transmitted by the broadcasting means may be received at a number of different venues, and is supplied in the same form to those different venues.
  • the broadcasting means broadcasts data to a local controller or local controllers for communication to the users.
  • the broadcast data is displayed to one or more users of the system.
  • the system may comprise a display arranged to display the data broadcast by the broadcasting means to the local controller, and the method may comprise displaying the data provided to the local controller using the display.
  • the system may further comprise a display located at a first venue where the local controller is located.
  • the local controller receives data broadcast by the broadcasting means and feeds the broadcast data to the display means.
  • the broadcast data is displayed in real-time.
  • the broadcast data may include elements which, trigger the display of data separately transmitted from the central controller to the local controller, e.g. to cause the already transmitted data, or parts thereof, to be displayed. In this way, the broadcast data may control the display e.g. timing of other data received from the central controller.
  • the broadcast data may also comprise data for controlling the local controller or controllers . Such data may not necessarily be transmitted to the user interfaces.
  • the broadcast data comprises a time signal which may be used by the local controller to set a local timing reference signal.
  • the time signal may be a regular signal synchronised with a picture broadcast by the broadcasting means.
  • the time signal may help to reduce to possibility of the local controller clock being tampered with fraudulently, and may reduce the risk of slippage of the clock over time from natural causes, e.g. deficiency in the components of the local controller.
  • the broadcast data may also comprise data instructing the local controller when to be receptive to signals transmitted by the user interfaces'.
  • the local controller may not permanently be activated to receive signals from the user interfaces, and may be shutdown for periods when no user inputs are expected in order to save energy, or as an additional security feature, to allow unusual user interface activity outside an expected timeframe to be identified.
  • the data may instruct the local controller when to be alert to transmissions from user interfaces.
  • the method may further comprise the local controller being responsive to transmissions of the or each user interface device only within selected timeframes, preferably set in accordance with broadcast data. This may be a "listening window".
  • the local controller is preferably not receptive to transmissions in a period before or after the timeframe.
  • the period may be a period between rounds of the quiz, and covers at least the period immediately before and after the period when the local controller is receptive to transmissions.
  • the local controller may be unable to receive transmissions from the user interface devices outside this timeframe, or may be arranged to receive such transmissions, but to take no action, or discard them, as discussed in more detail below.
  • the broadcasted data is broadcasted via a broadcast communication link and data is communicated from the central controller to the local controller via a second different communication link.
  • the second communication link may be a network-based communication link.
  • the system may comprise a display for displaying data from the local controller, and the display may be arranged to display both data broadcasted by the broadcasting means and data communicated to the local controller by the central controller.
  • the users of the system may then view the broadcast data, and provide inputs via the user interface devices in response to the broadcast data.
  • the user interface devices generate data in response to the inputs provided.
  • the data is transmitted to the local controller.
  • the local controller is arranged to receive data from at least one user interface device relating to an input made by the user in response to the broadcast data.
  • the local controller may then process data received from the user interface devices. Such processing may include any or all of the steps of accumulating, counting, deleting, displaying and storing the received data, in its received form, or a form to which it has been converted by the local controller. However, it is not necessary for the local controller to carry out processing, and all processing may be carried out by the central controller. Processing may be carried out by any combination of the user interface devices, the local controllers or the central controller.
  • system of the present invention may include a single local controller only, in a particularly preferred embodiment there are plural local controllers, each having access to an appropriate display for displaying the data broadcast and transmitted by the central controller and/or broadcasting means and each being coupled to one or more, and preferably plural, user interface devices .
  • the local controllers are preferably remote from the central controller and/or are preferably each arranged at locations where users will wish to participate in and interact with the broadcast, such as private homes and/or public buildings.
  • the local controllers are located in public houses, bars and/or casinos.
  • Each local controller will, in effect, serve a given "venue" .
  • the local controller is arranged to transmit data to the central controller, and information relating to the data to be transmitted is stored by the local controller.
  • the local controller comprises a database, and the information is stored in the database.
  • the local controller compiles a log of data transmissions.
  • the information may also be transmitted by the local controller for remote storage.
  • the information may be stored in the local controller memory and also in an archive database.
  • the information stored will relate to the data in the form to be transmitted at least at the time of storing.
  • the 5 time at which the storing of the data takes place may be chosen as desired to try to ensure that it is likely to be useful in identifying fraud in the context of a particular system. Thus, if in one system it is felt that fraud is most likely to involve changing the clock of a local system.
  • the information may be stored at a relatively early stage prior to transmission to maximise the chances that the stored information will relate to the "true" data intended to be transmitted, rather than any data which has already been manipulated. For example, information relating
  • 15 to data received from a user interface device may be stored as soon as the data is received.
  • the information relating to the data to be transmitted may be stored at a later stage, even at the point of transmission.
  • the information may relate to the data actually transmitted.
  • the local controller may comprise means for
  • the method may comprise the step of storing such information.
  • the stored information will relate to the data at the time of storage, and thus this is taken to be the data "to
  • the stored information provides evidence of the state of the data at a particular time, or stage in its passage through the local controller, and may be used to provide a security measure against any further fraud occurring at a subsequent time.
  • more than one set of information may be stored relating to the data at different times prior to transmission to provide greater security against fraud at different points in the transmission operation.
  • the information relating to the data to be transmitted may be any suitable information relating to the content of the data to.be transmitted, or, for example, relating to the circumstances surrounding the data, or its acquisition or transmittal to the local controller.
  • the data to be transmitted may include information relating to the circumstances of its acquisition, or transmittal to the local controller, and thus information relating to the circumstances of the data may also be considered to relate to the content of the data and vice versa.
  • the information is, or includes, timing information, preferably relating to the time at which an input was made at a user interface device, or received by the local controller.
  • the information ' may be a copy of the data transmitted from the local controller to the central controller. However, it is not necessary that a complete copy of the data to be transmitted be used.
  • the information may be a part of the data transmitted ⁇
  • the information need not directly include the data or a part of it, but may be indirectly or directly based on the data.
  • the information may be derived from, or using the data, e.g. may be some function of the data.
  • the information is a checksum derived from the data.
  • the method may therefore comprise performing a checksum on the data to be transmitted, and storing the checksum. Such information is indicative of the content of the data, as the data is used to provide the information.
  • the data to be transmitted to the central controller in relation to which information is stored is preferably data relating to a user input or inputs made at the at least one user interface device from which the local controller receives data e.g. being associated with the local controller.
  • the data may be data received from the user interface device, which may or may not be processed by the local controller, or may be data generated by the local controller in response to data received from the user interface device.
  • the data received from a user interface device may include information relating to an input made by the .user, e.g. the content of the input and the time at which the input was made, and the local controller may be arranged to transmit this information, or information relating thereto to the central controller.
  • the data transmitted from the user interface devices may comprise details of keypresses made by users via the user interfaces, preferably in conjunction with timing information determined by the user interface device or devices as to when the input was made, e.g. in the form of a timestamp.
  • the data is data received by the local controller from the user interface device or devices within a timeframe set by the central controller.
  • the timeframe may be a "listening period", in which the local controller has been instructed to be receptive to transmissions from the user interface devices .
  • the local controller is preferably not receptive to transmissions in a period before or after the timeframe.
  • the stored information is a log of keypresses and associated timing information received by the local controller from one or more user interface devices.
  • the stored information relates to data to be transmitted by more than one user interface device associated with the local controller.
  • the stored information may include any or all of the above types of information.
  • the information is information which may be used to compare the stored data to data actually transmitted and/or received by the central controller. This may be useful in establishing whether any fraud has occurred subsequent to storage of the information.
  • the method preferably comprises comparing the stored information with the data actually transmitted to and/or received by the central controller, and the system comprises means for so doing.
  • the step of comparing the stored information may comprise directly or indirectly comparing the stored information to the data actually received by or transmitted to the central controller.
  • This may involve comparing at least a part of the stored information, or information derived therefrom, with corresponding information relating to at least a part of the data transmitted to or received by the central controller, or derived therefrom, or may comprise comparing the stored information with the data itself, or a part thereof.
  • the stored information may be compared to all or a part of the transmitted or received data. For example, the information may be compared to time information contained in the transmitted or received data. In embodiments where the stored information is a copy of the data to be transmitted by the local controller, the stored information may be compared to the whole of the received or transmitted data or a part thereof.
  • the step of comparing the stored information with the received or transmitted data may comprise determining whether the stored information matches the received or transmitted data, or a part thereof, and/or trying to identify differences between the stored information and the received or transmitted data, or a part thereof.
  • functions, such as checksums, derived from each of the stored information and transmitted and/or received data may be compared.
  • the comparison step may be carried out by the system, or may be carried out remotely.
  • the comparison step may be carried out by the central controller, or another part of the system, such as the local controller, or a third party. It may be necessary for the stored information and/or the data received by the central controller or transmitted thereto to be transmitted such that it may be used in this way.
  • the stored information may be transmitted to the central controller, or provided thereto in response to a request or interrogation by the central controller, or may be transmitted to a third party.
  • a comparison step may not be carried out in relation to every data transmission.
  • a comparison step may be carried out only when a prize of particularly high value is to be awarded in respect of the data transmitted in relation to the winning entry submitted by a user via their user interface device.
  • the results of the comparison may be used as desired depending upon the level of security it is desired to provide. In some cases, no action may be taken. For example, action may be taken only in certain cases, or at certain intervals, perhaps to implement a form of random testing.
  • the results of the comparison may be stored for future reference, or use. The results may be stored to provide a log which may be consulted only if necessary, e.g. in the event of a dispute.
  • the results may be transmitted e.g. to another part of the system or another system. For example, the results may be transmitted to another party whose responsibility it is to investigate potential fraud.
  • the comparing of the information may be used to identify fraudulent users of the system, and in some embodiments, the method may comprise identifying fraudulent users of the system by comparing the stored information to the data transmitted to and/or received by the central controller. In some embodiments, the present invention provides a method of detecting fraudulent users in an interactive system for a plurality of users . It will be appreciated that the references herein to "identifying" fraudulent users do not necessarily require the successful identification of such users, but instead that there is an attempt to try to identify fraudulent users.
  • one or more additional security measures may be taken to further increase the security of the system.
  • anyone of these additional security measures may be carried out in addition to the storing of information relating to the data to be transmitted, and the additional security measures may be carried out in any combination.
  • the local controller may be arranged to be responsive to data from the user interface devices only within certain selected timeframes .
  • the method may further comprise the local controller discarding any data received from a user interface device outside a selected timeframe.
  • the timeframe is preferably set by the central controller.
  • the broadcast data may comprise data instructing the local controller when to be responsive to data from the user interface devices. This may provide a further check to ensure that any time information contained in the data received from the user interface devices is valid.
  • the local controller may check whether timing information of the data received from the user interface devices corresponds to the timeframe within which the local controller is arranged to receive data from the user interface devices. This may be done with reference to the timestamps of the data received.
  • the timing information of the data transmitted by the user interface devices will be defined by the timing means of the user interface devices, which may be set by a timing component of the user interface devices, or in response to a signal from another source. The timing information should confirm that the inputs were submitted within the timeframe in which the local controller is arranged to receive data from the user interface devices.
  • the method may further comprise identifying any data received from the user interface device or devices associated with a timing which does not lie within the timeframe in which the local controller is responsive to data transmitted by the user interface devices. The method may comprise discarding such data, or carrying out further investigation if any such data is identified.
  • the local controller may comprise encryption means for encrypting data transmitted from the local controller to the central controller.
  • the encryption may use any known encryption technique or algorithm suitable for use in the context of the system of the present invention.
  • the transmitted data is encrypted using at least one secret encryption key that is unique to the local controller.
  • each local controller may be set up with at least one unique encryption key, for example during manufacture or installation.
  • the encryption key may be stored by the local controller, or, for greater security may be stored remotely from the local controller, such as in a secure "offline" location.
  • more than one encryption key is associated with each local controller.
  • the keys may t ⁇ ten have a defined hierarchy for their use.
  • the encryption means thus uses a plurality of encryption keys and each of the encryption keys has a defined hierarchical level relating to its use by the encryption means .
  • the keys are associated with different levels of security.
  • the frequency with which a , key is used is inversely proportional to the level of security associated with the key. Thus, keys associated with higher security levels may be used progressively less frequently . than those keys associated with lower security levels.
  • three encryption keys may be used wherein a first key at the lowest hierarchical level is for general encryption use, a second key at a middle hierarchical level is used for encryption during a prize verification process, and a third key at a highest hierarchical level is used for encryption if the system is compromised by a fraudulent user.
  • the keys of a higher hierarchical level are used less frequently, and therefore 'exposed' to hacking attempts less often than a key of a lower hierarchical level.
  • the handling of and storing of such encryption keys may depend upon the hierarchical level of the key. For example an encryption key of the highest hierarchical level may be stored 'off-line' in a secure location which is separate from the interactive system.
  • the information relating to the data to be transmitted by the local controller which is stored by the local controller is encrypted.
  • the method therefore preferably further comprises the step of encrypting the stored information relating to the data to be transmitted by the local controller, and the system comprises means for encrypting the data.
  • the encryption may be carried out using any of the methods described above in relation to encrypting the data transmitted by the local controller, e.g. using one or more encryption keys.
  • the local controller comprises security means to control access, preferably physical access, to the local controller, e.g. to secure the local controller against the possibility of a user gaining access to the local controller to modify information stored by or transmitted by the local controller .
  • security means is means for identifying whether the local controller has been physically tampered with, and may be a physical seal.
  • the method may comprise the step of inspecting a security means to determine whether the local controller has been physically tampered with.
  • a verification step may be performed comprising comparing information stored in the database of the local controller relating to data to be transmitted with data that is actually transmitted to and received by the central controller, and preferably inspecting a physical seal of the local controller. This should be carried out with respect to the local controller associated with the user interface device at which the relevant user input was made.
  • the method may comprise removing the local controller from the system to be inspected.
  • the local controller and its performance may then be analysed "offline" to try to detect any fraud, e.g. in an off-site location.
  • the local controller transmits data to the central controller.
  • the data may be transmitted in response to a command included in the broadcast data.
  • the central controller may process the • ⁇ received data. The processing may involve any of the 'steps described above in relation to the processing of data by the user interface device or local controller.
  • the method may further comprise the central controller using data received from the local controller to derive information relating to a user input or inputs made at one or more of the user interface devices. For example, the central controller may .determine which user answered a question correctly, or provided an input, correct or otherwise in the fastest time at the user interface device.
  • the central controller may store data received from the local controller, or derived from data transmitted thereto.
  • the receiving, storing and processing of the data may be carried out by a computer system of the central controller.
  • the central controller may be arranged to transmit an acknowledgement message to the local controller in response to data transmitted from the local controller to the central controller, and the method may comprise the central controller transmitting such an acknowledgement message.
  • the acknowledgement message may include information relating to the data received by the central controller.
  • the information may include the received data or data derived therefrom, or a part of the data or derived data.
  • the information may be a copy of the received data.
  • the information relating to the data may be of any of the forms described above in relation to the stored information relating to the data to be transmitted by the local controller.
  • the information may also comprise information relating to the receipt of the data by the central controller, such as the time at which it was received, or information identifying an address from which it was received.
  • the central controller may be arranged to encrypt the acknowledgement message using one or more (secret) encryption keys . Encryption may be carried out in any of the manners described above in relation to the data transmitted by the local controller, or the information stored thereby.
  • the local controller may then use the acknowledgement message to compare the information relating to the data received by the central controller with the data actually transmitted thereto, or the stored information relating to the data to be transmitted.
  • the method may comprise using the acknowledgement message to compare the information relating to the data received by the central controller contained in the acknowledgement message to the data transmitted by the local controller to the central controller, or the stored information relating to the data to be transmitted.
  • the acknowledgement message is compared to the stored information relating to data transmitted from the local controller to the central controller.
  • the comparison may be carried out in any suitable manner, and may involve comparing all, or a part, of the stored information, or data derived therefrom, to the data transmitted, or information relating thereto, or any part thereof, or data derived therefrom, in any of the manners described above in relation to using the stored information relating to the data to be transmitted by the local controller with data actually transmitted or received to or by the central controller.
  • checksums may be calculated.
  • a checksum stored relating to the data to be transmitted by the local controller may be compared with a checksum performed on data received by the central controller e.g. in an acknowledgment message.
  • the acknowledgement message comprises information relating to the data received by the central controller for determining whether the data received by the central controller matches the data transmitted from the local controller to the central controller, and the method comprises determining whether the data received by the central controller matches the data transmitted from the local controller to the central controller using the information provided in the acknowledgement message. The method may further comprise determining whether fraudulent use has occurred using the acknowledgement message.
  • the local controller may transmit a confirmation message to confirm receipt of the data from the central controller, e.g. the acknowledgement message.
  • the further confirmation message may be transmitted to the central- controller.
  • the confirmation message may comprise information relating to the data received from the central controller.
  • the information may be of the same form as of the information relating to the data received by the central controller which may be transmitted in the acknowledgement message e.g. a copy, part of the data, data derived from the data or part thereof etc.
  • the information may include a time at which the data transmitted by the central controller was received, and/or information relating to whether or not fraudulent use has been detected.
  • the confirmation message may be encrypted in the same manner described above in relation to the data transmitted by the local controller or the acknowledgement message.
  • the central controller may request that a local controller associated with a selected user interface device transmit the data received from the selected user interface device, or information relating thereto, to the central controller.
  • the user interface device is a user interface device at which an input of interest was made by a user, for example the winning input for a given round.
  • the central controller may then compare the data received from the local controller in response to the request with the corresponding data, or information relating thereto, received previously from the local controller e.g. the initial data transmitted from the local controller to the central controller for the purposes of determining a winner. Again, this further data transmission may be encrypted, and authentication carried out between the central controller and local controller.
  • the central controller may compare the data received in response to the request with the data transmitted earlier. For example, checksums may be performed.
  • this further comparing step may be used in addition to the comparing of information stored by a local controller relating to data to be transmitted to the local controller with data transmitted to or received by the local controller.
  • the first information stored by the local controller in accordance with the invention may comprise information relating to data received from more than one user interface device
  • the further comparison step compares data received by the local controller from a selected user interface or user interface devices, preferably a single user interface device, with the corresponding data received by the central controller.
  • the user interface device may be arranged to receive data from the central controller and/or the local controller. Preferably the user interface device may receive data transmitted over the network link. In this way, a user may review data relating to previous and/or current interactive broadcasts. This may include data relating to the results of data comparisons made during the security checks. As mentioned above, the information relating to the data to be transmitted may comprise timing information. However, in addition to storing timing information relating to data to be transmitted by the local controller, timing information may be used in other ways to provide a further level of security. The system may compare store timing information relating to the transmission of data at any point e.g.
  • Timing information may be compared with corresponding timing information derived in another way, or from another source to try to establish whether any differences exist which might be indicative of fraud. For example, the broadcast time delay or timing of a transmission from a central controller may be used in this way. Timing information may be derived for the same event in more than one different way, and may then be stored, and/or compared.
  • a time of the broadcast delay may be determined with and without using timing information from the local controller.
  • corresponding timing information is derived both with and without using timing information provided by the local controller. The corresponding timing information may then be compared, and any difference may indicate a potential problem with respect to the local controller, which may be subject to alteration of its timing means.
  • each local controller maintains a local timing reference signal.
  • the local timing reference signal of each of the local controllers of the system may be synchronized with one another. This may be achieved in any suitable manner. By synchronized it is meant that the time variables are substantially synchronized, or synchronized to the extent required for a given application. They may not in practice always be exactly synchronized. The use of a network timing protector may allow the time variable at each local controller to be synchronized in this way.
  • the time reference signal may be provided to the local controller using the network timing protocol.
  • the local controller uses the broadcast data to obtain timing information for the local controller.
  • the broadcast data includes data for identifying the time at which the data was broadcast and the local controller uses the data for identifying the time at -which the data was broadcast that is included in the broadcast data to determine time information of the local cotnroller.
  • the time information determined by the local controller may be e.g. the timing of user inputs made at the user interface devices and/or the timeframe in which the local controller is arranged to be responsive to data transmitted by the user interface devices.
  • the local controller uses the time • data included in the broadcast to synchronise its own
  • the local controller may use the data to set a local timing signal of the local controller.
  • the time data is preferably included in the broadcast in the vertical blanking interval (VBI) . part of the broadcast stream.
  • the time data is preferably encoded as a teletext signal in the TV broadcast.
  • the time data is preferably embedded in the standard teletext frame structure.
  • time data in the form of text may be added to the broadcast data (from which the time information could then be extracted by a local controller using a suitable Optical Character Recognition (OCR) method) .
  • OCR Optical Character Recognition
  • the time data may be in the form of a video watermark or bar code.
  • the local controller can extract the time data from the broadcast data in any desired and suitable manner. For example, in the case where that data is embedded in the VBI component of the broadcast data, it can use filter software to extract the VBI component from the broadcast stream and then interpret the data contained therein to derive the time data.
  • the time data in the broadcast data can be used by a local controller in any desired and suitable manner for the purposes of deriving or determining time information for the local controller.
  • the central controller comprises a synchronization server for generating a time .reference • signal.
  • the synchronization server may transmit a time reference signal to the or each local controller of the system, preferably via a network -based communications link.
  • there are a plurality of local controllers and each receives the time reference signal . ⁇ •
  • the time reference signal may be used by the or each local controller to set a local timing reference signal. In this way the local time variable at each of the local controllers may be synchronized.
  • other synchronization methods may be used, and it is not necessary that the system comprises a synchronization server.
  • the or each local controller may then store information relating to the local timing reference signal of the local controller.
  • the method comprises storing information relating to a local timing reference signal, which may be a received signal, at the or each local controller, and the or each local controller is arranged to store such information, for example in a database.
  • the storing of such information may provide an audit trail which can be inspected to determine whether modified or corrupted data has been transmitted to or from a local controller. This may be achieved by comparing the stored information relating to the local time reference signals with information relating to the local time reference signals provided to the local controllers, e.g. by a synchronization server or in the broadcast data. Such information may be stored by the synchronization server.
  • the or each local controller may be arranged to receive a local timing reference signal from the synchronization server or to receive broadcast data including time data.
  • the system further comprises a synchronization server for generating a time reference signal, the local controller being in communication with the synchronization server to receive the time reference signal from the synchronization server, and the local controller is arranged to store information relating to the received time reference signal.
  • the broadcasted data comprises information relating to the time at which the data was broadcasted; and the local controller is arranged to selectively transfer data to the central server in response to processing the broadcasted data and the data received from at least one user interface.
  • the local controller may transmit timing information derived using the local timing reference signal to the central controller.
  • the central controller may use the timing information relating to the user input received from the local controller with other information to check the integrity of the data sent by the local controller, and to try to detect whether any fraud has occurred, such as tampering with the local clock signal of the local controller.
  • the method comprises comparing timing information received from the local controller and based on the local timing reference signal with other timing information not based on the local timing reference signal.
  • the timing information may be compared with an expected or past value for the timing, or timing information obtained from another source, e.g. from the central controller, broadcasting means and/or user interface device.
  • Timing information received from the local controller which may be used in this way may include a broadcast time delay, or a timing relating to the providing of a user input at a user interface device.
  • a broadcast delay may be compensated for, avoiding the need to calculate a broadcast delay.
  • the timing information transmitted by the local controller is preferably encrypted. This may be achieved in any of the ways described above in relation to encryption in other parts of the system, and timing information obtained from another source e.g. external to the local controller.
  • the local controller receives broadcasted, data, and data from at least one user interface device connected thereto.
  • the local controller is arranged to determine timing information relating to when the data was input to the user interface device, or generated by the user interface device, using the broadcast data and data from the user interface device. For example, in some embodiments, the local controllers increase the value of the local timing reference signal.
  • a program broadcast by the broadcasting means may then be received.
  • the broadcast is made by the broadcasting means at a known time.
  • the broadcast may comprise data providing information relating to the time at which the broadcast was made allowing this timing to be established by the local controller.
  • the local controller may determine a broadcast delay using the known time of broadcast and the local timing reference signal .
  • This may involve determining a difference between the local timing reference signal and the time at which the broadcast was known to have been made.
  • a user may input a response to a stimulus contained in the broadcast to their user interface device, which input may be transmitted to the local controller.
  • the local controller may then determine a time at which the input was made using the broadcast delay, the local timing reference signal and the time at which the broadcast was known to have been made. This time may be transmitted to the central controller and compared to a corresponding time at which the user input was made derived without using the local timing reference signal.
  • a value for a broadcast delay determined by the local controller- using the local timing reference signal may be compared to a known value for the delay, e.g. by the central controller.
  • the determining of a broadcast delay may not be necessary in preferred embodiments where the local timing signal is set using data e.g. a time stamp in the broadcast data.
  • Other security measures may be carried out. For example, authentication may be carried out in relation to the parties involved in the transmission of data between the local controller and the central controller.
  • the local controller may be provided with a local controller identity which may be associated with the identities of one of more user interface devices which transmit data to the local controller.
  • the identity of the user interface device may be authenticated when data is received by the local controller from the user interface device to verify that the user interface device is one associated with that local controller.
  • the authentication may be carried out by the local controller.
  • the identity of the local controller may be authenticated by the central controller when data is received from the local controller.
  • the local controller may be required to perform an authentication process in order to transmit data, or may transmit data comprising identity information.
  • the central controller may verify the identity of the user interface device which provided the data to the local controller, and may compare this with the identity of user interface devices known to be associated with the local controller.
  • the local controller may be arranged to check the identity of a user interface device with which it is in i communication, or arranged to be in communication. This may be carried out on a periodic basis, or at certain times, such as when data is received from a user interface device, or randomly. The local controller may then compare the identity of the user interface device detected with that of the user interface devices with which it is associated, or with the previous identity information obtained from the user interface device.
  • Information may be stored associating the identity of a local controller with one or more user interface devices with which it is to communicate for this purpose.
  • identity verification may, alternatively, or additionally, be carried out by the central controller.
  • the local controller may also check the operation of one or more user interface devices with which it is arranged to communicate. This may be carried out at any time, in the same manner as verification of the identity of the user interface devices .
  • the local controller may run a program checking the performance of the user interface device, or its response to certain operations which may reveal whether it may have been tampered with. The results of any such verification processes may be stored. They may then be consulted in the event of an investigation, or routinely, by e.g. the central controller, or a third party.
  • an interactive system for a plurality of users comprising: a local controller operable to receive data from at least one user interface; broadcasting means for broadcasting data to the local controller; and a central server for processing data, the local controller being in communication with the central server such that it can transmit data to the central server; wherein the local controller comprises a database for storing information relating to data transmitted from the local controller to the central server, arranged to identify fraudulent users of the system by comparing information stored in the database with data transmitted to the central server.
  • a method of detecting fraudulent users in an interactive system for a plurality of users comprising: broadcasting data to a local controller operable to receive data from at least one user interface; transmitting data from the local controller to the central server; processing data at the central server; storing information relating to the transmitted data at the local controller,- and identifying fraudulent users of the system by comparing the stored information with the data transmitted to the central server.
  • data transmissions made in accordance with the invention in any of its aspects or embodiments in general may be made wirelessly, or via wired connections, or a combination of wired and wireless connections, using any suitable arrangements for doing so, and may involve any number of intermediate components between the central controller and the local controller (s ).
  • the present invention in its various aspects extends to a system comprising means for carrying out any of the steps of the method of any of the aspects or embodiments of the invention described, and the method comprises steps for carrying out any of the steps that the system is configured to perform.
  • References to "means for" 1 carrying out a step may be interchanged with references to a "sub-system” for performing those steps .
  • various components and elements of the system of the present invention such as the central controller, local controllers, etc., can be arranged and constructed in any desired and suitable form.
  • the central controller need not comprise a single device, but could comprise a number of devices that are associated with each other, such as one server for controlling the broadcast data to the local controllers, and another, separate server for coordinating the separate data transmission to the local controller. It would also, e.g., be possible for there to be more than one central controller in the system.
  • references herein to a "central controller” and a “local controller”, etc. are not intended to require a single device that performs all the described functions (although in one embodiment that is the preferred arrangement) , but are also intended to encompass arrangements in which plural separate or different devices or components act together to perform the functions of the necessary "controller”, etc.
  • the present ⁇ invention may be used to provide any desired form of interactive broadcast, although as will be appreciated from the above, it is particularly applicable to the provision of interactive entertainment broadcasts, such as quizzes and games.
  • the methods in accordance with the present invention may be implemented at least partially using software e.g. computer programs .
  • the present invention provides computer software specifically adapted to carry out a method or the methods herein described when installed on data processing means, a computer program element comprising computer software code portions for performing a method or the methods herein described when the program element is run on data processing means, and a computer program comprising code means adapted to perform all the steps of a method or of ,the methods herein described when the program is run on a data-processing system.
  • the invention also extends to a computer software carrier comprising such software which when used to operate a radio system comprising data processing means causes in conjunction with said data processing means said system to carry out the steps of a method or of the methods of the present invention.
  • a computer software carrier could be a physical storage medium such as a ROM chip, CD ROM or disk, or could be a signal such as an electronic signal over wires, an optical signal or a radio signal such as to a satellite or the like.
  • Such computer readable instructions can be written in a number of programming languages for use with many computer architectures or operating systems. Further, such instructions may be stored using any memory technology, present or future, including but not limited to, semiconductor, magnetic, or optical, or transmitted using any communications technology, present or future, including but not limited to optical, infrared, or microwave. It is contemplated that such a computer program product may be distributed as a removable medium with accompanying printed or electronic documentation, for example, shrink-wrapped software, pre-loaded with a computer system, for example, on a system ROM or fixed disk, or distributed from a server or electronic bulletin board over a network, for example, the Internet or World Wide Web.
  • the method and system of the invention may use any one or ones of the additional security measures described, alone or in any combination. These include the use of encryption, physical seals, acknowledgement messages or timing information.
  • Figure 1 shows an electronic system according to a first embodiment of the invention
  • Figure 2 shows an electronic system according to another embodiment of the invention.
  • Like reference numerals refer to like elements throughout .
  • the term 'user interface' refers to apparatus for receiving a user input comprising at least one input interface, such as a button.
  • a user interface is preferably of a shape and size such that it may be easily held in a user's hand, a user interface according to the invention may be of any suitable shape and size.
  • a user interface need not comprise a plurality of buttons but, instead, may comprise any suitable interface means such as, purely by way of example, a jog-dial, a touch-screen or a microphone (or a plurality thereof) .
  • the electronic system comprises a local controller 10 and a display 12 at a first venue 14, and a central server 16 at a location which may be remote from the first venue 14.
  • the local controller 10 is operable to receive data from first 18, second 20 and third 22 user interfaces, the user interfaces generating data in response to user inputs. Also, the central server 16 is arranged to broadcast data to the local controller 10 via a broadcast communication link 24.
  • the local controller 10 is arranged to be in communication with the central server 16 via a network 26 (i.e. the internet) so that it can transmit data to the central server 16.
  • a network 26 i.e. the internet
  • data may be specific and local to one or more venues or it may be generic .
  • the local controller comprises security means for identifying whether the local controller has been physically tampered with, such as a physical seal. Verification that the security means do not show any signs that the local controller has been tampered with provides assurance that the information logged in the database is authentic (i.e. has not been modified in a fraudulent way) .
  • a verification process can be performed to ensure a user has not misused the system in a fraudulently way.
  • This verification process includes the steps of comparing information stored in the database of the local controllers with data that is actually transmitted to and received by the central server, and inspecting the physical seals of the local controller. In other words, the integrity of the data sent to the central server 16 by the local controller 10 can be assessed. It will therefore be understood that the system uses a combination of data logging and physical security at the local controller 10 to provide protection against fraudulent use of the system.
  • the central server 16 operates in conjunction with a television program
  • the central server 16 is located at a television studio and comprises broadcast means 28 and a computer system 30.
  • the computer system 30 is connected to broadcast means 28 so that it can provide data to the broadcast means 28 for controlling and/or modifying the television program.
  • the computer system may supply questions, or other user stimuli, which are to be superimposed on top of the television program.
  • the broadcast means 28 consolidates and/or mixes the data with the television program and broadcasts the program via the broadcast communication link 24 to the first venue 14.
  • the venue 14 is a location at which ' more than one user can participate in and/or interact with the broadcast television program, for example a public house.
  • the local controller 10 receives the broadcast television program and feeds the received broadcast to the display 12 for display.
  • the program is communicated to the users of the system at the venue 14, the program including a stimulus such as a question or game.
  • the users provide inputs by operating the user interfaces, which in turn generate data in response to user inputs provided.
  • This generated data is transmitted to the local controller 10 and is processed by the local controller 10.
  • processing may include any or all of the steps of converting, accumulating, counting, deleting, displaying and storing the received data in either its received form or any other form into which the data may be converted by the local controller 10.
  • the local controller 10 is also in communication with the central server 16 via the network 26 so that it can transmit and receive data to and from the central server 16. Using this network-based communication link 26, the local controller 10 then transmits some or all of the data relating to the user inputs to the central server 16. This data is received and processed by the computer system 30 of the central controller 16. As above, it is to be appreciated that such processing may include any or all of the steps of converting, accumulating, counting, deleting, displaying and storing the received data in either its received form or any other form into which the data may be converted by the local controller 10.
  • the local controller 10 stores information relating to transmitted data within a database (not shown) .
  • the local controller 10 compiles a log of the data transmissions. This log can then be used to identify if corrupted or modified data has been transmitted to the central server due to a spoof answer attack, for example. Identification of such an attack is achieved by comparing information stored in the database with data that is actually transmitted to and received by the central server 16.
  • the computer system 30 processes the data relating to the user inputs in order to determine which users answered the questions correctly.
  • the computer system 30 may also determine further information relating to the user inputs, such as which user answered provided a correct input in the fastest time. Some or all of the processed data may then be stored in the computer system for subsequent use.
  • Data processed by the computer system 30 is then used in conjunction with the television program.
  • the computer system 30 provides some or all of the processed data to the broadcast means 28 for controlling and/or modifying the television program.
  • processed data relating to the previous question may also be supplied to the broadcasting means 28 for inclusion within the television program.
  • inclusion may be, for example, achieved by modifying the actual television program (i.e. information displayed in the background of studio may be modified) or by superimposing information on top of the television program.
  • the updated television program is then broadcasted via the broadcast communication link 24 to the first venue 14.
  • Data processed by the computer system 30 may also be transmitted to the local controller 10 at the venue 14 via the network 26.
  • the computer system 30 may transmit data to the local controller 10 via the network 26 in response to the data transmitted to it from the local controller 10.
  • this processed data may relate to the specific user inputs provided at the venue 14 and therefore provide information customized to the venue 14.
  • the data transmitted to the local controller 10 may also be related to the state of the current studio activity (i.e. the stage of the game) and may have nothing at all to do with the previous responses from the user interfaces .
  • data transmitted by the computer system 30 to the local controller 10 may comprise an acknowledgement message for acknowledging the receipt of data from the local controller 10.
  • the acknowledgement message may include information relating to the data received by the computer system such as a copy of the received data. It may also include additional information relating to the received data including the time at which it was received and information identifying an address from which it was received.
  • the local controller 10 can check whether the data received by the computer system 30 matches that which was sent to the computer system 30. If the information contained within the acknowledgement message agrees with the related information stored in the database, it is determined that the data transmitted by the local controller to the computer system 30 was not tampered with during transmission .
  • a further message may be transmitted from the local controller 10 to the computer system 30 for the purpose of confirming data has been received from the computer system 30.
  • this confirmation message may contain information relating to the received data, including the time at which it was received and information identifying whether or not a fraudulent user has been detected.
  • the local controller 10 may be arranged to receive both the television program broadcasted by the broadcasting means 28 and the data transmitted by the computer system 30. In such an arrangement, the local controller 10 then processes the received data and broadcast such that the local controller 10 consolidates and/or mixes the received program and data and feeds the consolidated and/or mixed data to the display 12 for display.
  • the display 12 may display both data broadcasted by the central server 16 via the broadcast link 24 and data transmitted to the local controller 10 from the central server 16 via the network 26.
  • the processing may not be undertaken immediately upon receipt of the information.
  • the received data and broadcast may be stored for future interpretation and use.
  • the local controller 10 may produce an interactive program which is customized to the specific venue 14 at which it is located.
  • the broadcast program is a global broadcast which is supplied in the same form to any number of venues, whereas the data transmitted to the local controller 10 via the network 26 is specific to the controller 10 to which it is transmitted.
  • the local controller 10 is able to produce a data signal for display which may contain data of a global nature (i.e. data relating to the inputs of all of the users of the interactive system) and data of a local or regional nature (i.e. data relating only to the inputs of users local to the specific local controller) .
  • each of the venues may display an interactive broadcast which combines a broadcast signal (containing information relating to all of the venues of the system) and a custom transmitted signal (containing information relating to a specific venue and/or venues local to the same) .
  • a broadcast signal containing information relating to all of the venues of the system
  • a custom transmitted signal containing information relating to a specific venue and/or venues local to the same.
  • economically-linked venues i.e. pubs in a chain
  • all other venues receive a custom transmitted signal unique to the venue.
  • a user terminal 32 is also connected to the central server via the network 26. The user terminal 32 can access the processed and stored data of the computer system 30 and/or the local controller so that it can be retrieved to the user terminal 32 for observation.
  • a user of the user terminal 32 may therefore review data relating to previous and/or current interactive broadcasts.
  • data may, for example, relate to the results of the data comparisons made as a part of the security checks.
  • FIG 2 an electronic system according to another embodiment of the invention is shown.
  • the electronic system comprises a broadcast antenna 34, first 1OA and second 1OB local controllers at first 14A and second venues 14B, respectively, and a central server 36 at a location which may remote from the first 14A and second 14B venues.
  • the broadcast antenna 34 may be connected to the central server 36 so that it can be operated in conjunction with data provided to it from the central server 36.
  • the first 1OA controller is operable to receive data from first 18A, second 2OA and third 22A user interfaces, the user interfaces generating data in response to user inputs.
  • the second 1OB controller is operable to receive data from fourth 18B, fifth 2OA and sixth 22A user interfaces .
  • First 12A and second 12B displays for displaying data are also connected to the first 1OA and second 1OB local controllers, respectively.
  • Both the first 1OA and second 1OB local controllers are in communication with the central server 38 via the network 26 so that they can transmit and receive data to and from the central server 38.
  • data may be specific and- local to one or more venues or it may be generic .
  • the first 1OA and second 1OB local controllers of the system shown in Figure 2 also comprise encryption means 44 for encrypting data before it is transmitted to the central server 38.
  • Such encryption may use any known encryption technique or algorithm that is suitable for the requirements of this system.
  • it is preferable that the transmitted data is encrypted using a secret encryption key that is unique to the local controller which encrypts the data.
  • each local controller is initialized with at least one secret encryption key (which is unique to the local controller) during the manufacturing or provisioning process.
  • the secret encryption key(s) may be stored within the encryption means 44 of the local controller using suitable storage means such as Non-Volatile Random Access Memory (NVRAM) or Flash Memory.
  • NVRAM Non-Volatile Random Access Memory
  • Flash Memory Flash Memory
  • more than one encryption key is used for each local controller and these keys will have a defined hierarchy for their use.
  • three encryption keys may be used wherein a first key at the lowest hierarchical level is for general encryption use, a second key at a middle hierarchical level is used for encryption during a prize verification process, and a third key at a highest hierarchical level is used for encryption if the system is compromised by a fraudulent user.
  • the keys of a higher hierarchical level are used less frequently, and therefore 'exposed' to hacking attempts less often than a key of a lower hierarchical level.
  • the provision of storing such encryption keys will, therefore, be modified according to the hierarchical level of the key, for example an encryption key of the highest hierarchical level may be stored 'offline' in a secure location which is separate from the interactive system.
  • the local controllers each comprise at least one physical seal.
  • This physical seal is arranged such that it indicates if the local controller has been physically tampered with. Verification that the physical seal does not show any signs the local controller has been tampered with provides assurance that the information logged in the database is authentic (i.e. has not been modified in a fraudulent way) and that encryptions means have not been compromised. Thus, a verification process can be performed to ensure a user has not misused the system in a fraudulently way.
  • This verification process includes the steps of comparing ⁇ information stored in the database of the local controllers with data that is actually transmitted to and received by the central server, and inspecting the physical seals of the local controller. In other words, the integrity of encrypted data sent to the central server 38 by a local controller can be assessed.
  • the central server 38 comprises a synchronization server 40 for generating a time reference signal and a computer system 42 for processing data.
  • Each local controller is therefore in communication with the synchronization server 40 to receive a time reference signal from the synchronization server 40 via the network 26.
  • the broadcast antenna 34 is arranged to broadcast data to the venues 14A and 14B.
  • the data broadcasted by the antenna 10 comprises information for identifying the time at which data was broadcasted.
  • the local controllers 1OA and 1OB are arranged to receive both the broadcasted data and the time reference signal provided by the synchronization server 40. Upon receipt of these, the local controllers 10A and 1OB process the information from the broadcast and data generated by a connected user interface. This processing enables each local controller to calculate timing information relating to when the data was generated by the user interface and to selectively transfer data to either a connected display or the central server 38.
  • the central server 38 and the broadcast antenna 34 are both located at a television studio. Of course, this is not essential to the invention, and the central serve r 38 and the broadcast antenna 34 may be located at separate locations as may be necessary.
  • An exemplary operation of the electronic system shown in Figure 2 will now be detailed, wherein the electronic system provides an interactive television program to a plurality of users.
  • the interactive television program contains questions which the users answer in order to interact with the program.
  • the synchronization server 40 transmits a time reference signal to- first 1OA and second 1OB local controllers.
  • This time reference signal is used by the local controllers to set a local time variable, wherein the local time variable at each of the local controllers is substantially synchronized.
  • the local time at the first controller 1OA is denoted with a subscript 1 (i.e. T L1 ) and the local time at the second controller 1OB is denoted with a subscript 2 (i.e. T L2 ) .
  • any suitable time synchronization method can be used to synchronise the local time variable at each of the local controllers.
  • the time reference signal is provided using the known Network Time Protocol (NTP) and, according to a paper entitled “Using NTP to control and Synchronise System Clocks" from Sun Mircosystem, accuracies of 10-50 mS are readily achievable in a Wide Area Network (WAN) environment.
  • NTP Network Time Protocol
  • WAN Wide Area Network
  • the maximum synchronisation error is 4OmS which corresponds to the period of a single TV frame (in Europe) .
  • NTP is an appropriate method for synchronizing the local time of the local controllers. It will, however, be appreciated that any other suitable synchronization method may be used to synchronise the local time variable of the local controllers.
  • the local controllers store information relating to received time reference signal in their database, although it is not essential to the invention.
  • an audit trail which can be inspected, either remotely or locally, in order to identify if corrupted or modified data has been transmitted to or from a local controller, identification of such an spoof answer attack can be achieved by comparing information stored in the database with information relating to the time reference signals provided by the synchronization server 40.
  • the broadcast antenna 34 broadcasts the program via a broadcast communication link to the first 14A and second 14B venues.
  • the time at which the program was broadcasted is denoted with a subscript B (i.e. T B ) and information relating to the value of T B is included within the broadcasted data.
  • a preferred a method of embedding information is to include machine-readable code in a visible portion of the broadcasted program.
  • machine-readable code may be in the form of cue dots , a video watermark, or a barcode.
  • the first local controller 1OA calculates the value of the broadcast delay D 1 using the following equation (equation 2):
  • the received program is then fed to the display 12A by the local controller 1OA for display to the users of the system as the first venue 14A.
  • the broadcasted program is communicated to the users of the system at the first venue 14A, the program including a stimulus such as a question.
  • the users of the system at the first venue 14A are contemplating their response to the stimulus/question provided in the displayed program, time passes and the value of a local time variable at both the first 1OA and second 1OB local controllers further increases.
  • a first user then activates a first user interface 18A to provide a response to the stimulus.
  • the time at which the first user activates the first user interface 18A is denoted by T ⁇ _ ⁇ l .
  • the user When the user activates the first user interface 18A, it generates a data signal in response to the user input and transmits the generated data signal to the first local controller 1OA in which it is processed.
  • processing may include any or all of the steps of converting, accumulating, counting, deleting, displaying and storing the received data in either its received form or any other form into which the data may be converted by the local controller 1OA.
  • the above detailed method of calculating the time at which a user activates a first user interface uses timing information embedded in the broadcasted data to compensate for the broadcasting delay D 1 .
  • the local controller obtains a value of the time taken for a first user interface to be activated (»T L1 ) which is relative to the actual time at which the broadcasted program was communicated to the users of the system at the first venue 14A.
  • the first local controller 1OA is in communication with the central server 38 via the network 26 so that it can transmit and receive data to and from the central server 38. Using this network- based communication link 26, the first local controller 1OA then transmits some or all of the data relating to the first user input to the central server 38 (after encrypting the data using the encryption means 44 of the local controller) . For example, the first local controller 1OA of the present example transmits the calculated value of »T L1 and the calculated value of D 1 to the central server, along with information identifying the user interface by which the response was provided. In addition to transmitting encrypted data to the central server 38, the local controller 1OA stores information relating to transmitted data within a database (not shown) .
  • this stored information is also encrypted using by the encryption means 44.
  • the local controller 10 compiles a log of the data transmissions . This log can then be used to identify if corrupted or modified data has been transmitted to the central server due to a spoof answer attack, for example. Identification of such an attack is achieved by comparing information stored in the database with data that is actually transmitted to and received by the central server 38.
  • This data is received and processed by the computer system 42 of the central server 38.
  • processing may include any or all of the steps of converting, accumulating, counting, deleting, displaying and storing the received -data in either its received form or any other form into which, the data may be converted by the computer system 42.
  • the computer system 42 of Figure 2 can undertake a diagnostic process which checks the integrity of the data sent by the local controller.
  • One such check comprises the step of comparing the calculated value of D 1 with expected or past values . Any unusual or unexpected value of D 1 provided by the local controller to the computer system 42 may indicate that the local clock signal of the local controller or the transmitted data has been tampered with. This can be indicated by the computer system and further investigation of the local controller may then be undertaken.
  • the first local controller 1OA also feeds a signal to the display 12A which causes the display 12A to indicate that a first response has been provided by a user at the venue 14A.
  • the display 12A may also display further information relating to the first response, such as the identity of the user interface and the calculated time response time »T L1
  • a local controller does not transmit data to the central server is when the calculated response time (i.e. »T L1 ) is negative.
  • a negative value time taken for a user to respond to the displayed stimulus indicates that the user activated a user interface before the program was received by the relevant local controller and displayed to the users at the respective venue, in such a situation, the local controller discards the data signal received from the activated user interface.
  • the local controllers are also arranged to discard data signals received from user interfaces wherein the calculated response time is larger than a predetermined value, •T MAX .
  • a time window can be defined, wherein the local controller only transmits data relating to a user response to the central server 38 if the calculated time taken for the response is within the time window (i.e. a predetermined range of values, 0 - 'T 101x ).
  • the value of 'T 101x is defined by information include in the broadcasted data. Therefore, the value of 'T 101x can be modified during the broadcast program, and the local controllers can then obtain the value 'T 101x from the broadcasted data and use it in subsequent calculations as necessary.
  • the value of 'T 11J1x may be set for use by the local controllers in other ways, and may not even be variable.
  • the definition of a maximum response time, "T 101x , is optional. For example it is not required where a fastest user response ends an interactive game and subsequent responses from the same venue are to be ignored.
  • Data received by the central server 38 from the first 1OA and second 1OB local controllers may be used to identify the fastest correct response to the stimulus/question provided ' by the broadcasted program.
  • Dl is less than D2 , resulting in the interactive program being communicated the users at the first venue 14A before it is communicated to the users the second venue 14B.
  • the users at the first venue 14A would have an unfair advantage when compared to the users at the second venue. This timing advantage allows the users at the first venue 14A to either take more time to contemplate their answers or be deemed the winner even if they took longer to provide response than users at the second venue 14B.
  • a system according to an embodiment of the invention caters for time delays associated with broadcasting data to different venues. Furthermore, by using information relating to the timing of the users responses and the broadcast delay, the system can verify aspects of data transmitted from a local controller to the central server 38.
  • data processed by the computer system 42 is transmitted to the local controllers via the network 26.
  • the computer system 42 may be arranged to transmit data to the local controllers 10 via the network 26 in response to the encrypted data transmitted to it from the local controllers .
  • data transmitted by the computer system 42 to the first local controller 10A may comprise an acknowledgement message for acknowledging the receipt of encrypted data from the local controller 1OA.
  • This acknowledgement message may include information relating to the data received by the computer system such as a copy of the received data. It may also include additional information relating to the received data including the time at which it was received and information identifying an address from which it was received.
  • the local controller 1OA can check whether the data received by the computer system 42 matches that which it sent to the computer system 42.
  • the data transmitted by the local controller 1OA to the computer system 42 was not tampered with during transmission or the unit has not been impersonated.
  • the timing information used to set the clock of the local controller is set by data included in the broadcast data, e.g. a time stamp.
  • setting of the timing signal using the broadcast data may compensate for the broadcast delay, and it may not then be necessary to calculate a broadcast delay as described above.
  • machine readable code containing information relating to the time at which a program is broadcasted is embedded in the broadcasted program.
  • the time signal is sent as part of the broadcast in the teletext (VBI) part of the broadcast stream.
  • VBI teletext
  • the time signal is stored in bespoke format, embedded in the standard teletext frame structure.
  • standard filter software may be used to extract the VBI component from the stream, and a program used to interpret the timed signal data contained therein.
  • Standard calls in Windows are then used to set the clock on the local controller to synchronise with the time in the studio extracted from the broadcast data stream. In this way, any delay between the signal being broadcast and the reception at the venue is effectively eradicated.
  • the time embedded in the broadcast stream is used to set the clock on each local controller, such that the time on each local controller is set to match the picture being seen on the local displays.
  • the local controller receives instructions through the VBI portion of the television broadcast data received from the broadcasting means . Included in these instructions is a regular time signal, synchronised with the picture of the broadcast. The local controller uses the time signal to set its local clock.
  • This signal may be regular, and broadcast, for example, about every 5 seconds.
  • the use of this time signal allows the risk of the clock being altered ⁇ fraudulently to be reduced, and also may guard against slippage of the clock for other reasons, e.g. due to inaccuracies or defects in the components of the local controller .
  • Another signal in the broadcast data instructs the local controller when to start and stop listening for data from the keypads. Any user inputs made at the user interface devices e.g. keypads during this period are transmitted to the local controller by the user interface devices . The user inputs are transmitted as data signals indicating the key presses involved, together with timestamps assigned by the user interface devices to them.
  • the local controller discards data received outside the listening "window", although in practice there may be a small allowance at the end to accommodate the buffering of the data by the user interface device.
  • the local controller may check the data received from the user interface device to ensure that the embedded timestamps are valid.
  • the local controller may discard the associated data, or may flag up that there is a discrepancy for further investigation. A discrepancy in the timing information would suggest that the local controller time signal had been altered and/or the user interface device timer was incorrect, potentially indicative of fraud.
  • the keypresses, together with their associated timestamp, are stored in the local controller memory and also sent to an archive database for storage.
  • the stored data relates to data received from all of the user interface devices e.g. keypads associated with the local controller.
  • the database may be a file-based database.
  • the broadcast data also includes a further signal instructing the local controller to transmit its data to the control server, for example at the end of a round of questions .
  • the local controller sends the stored information to the control server.
  • the data transmission is encrypted and the identity of the two parties authenticated.
  • the keypad at which the winning input was made is identified according to the information currently received by the control server. There is then a supplementary process which will seek to confirm the consistency of the data received.
  • the control server sends a request to the local controller identified as being associated with the "winning" user interface device e.g. keypad to send the stored data received from the winning user interface device to the control server.
  • This extract from the data stored by the local controller relating to data received from the selected winning user interface device is then returned to the control server using the same protected communication method, i.e. using authentication and encryption processes, so that the control server can perform a comparison. For example, by extracting and formatting this data in a controlled, consistent way, a "checksum" relating to the data can be established.
  • a technician may remote connect to the local controller to manually confirm the checksum or other verifying function whilst logged into the device at a later stage.
  • a further security measure may involve a visit to the venue where the local controller is located e.g. a pub by a verification representative. This will include an examination of the physical seal provided on the local controller to confirm that the local controller has not been tampered with in-situ. The verifier can then run a software process on the local controller that will confirm that the data for the winning user interface device matches that sent to the control server both during the game and the subsequent requests for specific data relating to a winning user interface device. This may be carried out by performing checksums on the data, and comparing the results.
  • any one or ones of the additional security measures described above may be implemented.
  • Other security measures may alternatively or additionally be taken.
  • the recording and transmission of checksums may be performed at any time to try to ensure that data has not been modified since transmission.
  • Processes on the local controller may be performed to confirm the identity and/or correct operation of the user interfaces during the game .
  • Any data transmitted between the local controller and the central server may be encrypted. Authentication of parties involved in transmission between the local controller and the central server, or of the user interfaces and the local controller or central controller may be performed. If desired, a local controller may be removed

Landscapes

  • Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Multimedia (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Social Psychology (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Virology (AREA)
  • Storage Device Security (AREA)

Abstract

La présente invention concerne un système interactif et un procédé de fonctionnement d'un tel système pour une pluralité d'utilisateurs. Le système comprend un contrôleur local (10) opérationnel pour recevoir des données d'entrée d'utilisateur et des estampilles temporelles associées provenant au moins d'un clavier (18), des moyens de diffusion pour diffuser des données vers le contrôleur local (10), et un contrôleur central (16) pour traiter des données. Le contrôleur local (10) est en communication avec le contrôleur central (16) de telle sorte qu'il peut transmettre des données au contrôleur central. Le contrôleur local (10) est agencé pour stocker des informations concernant des données, par exemple des entrées et des estampilles temporelles reçues du clavier ou des claviers (18), et qui doivent être transmises au contrôleur central (16). Les informations stockées sont transmises au contrôleur central (16) et comparées à des données réellement transmises au contrôleur central et/ou reçues par celui-ci pour essayer d'identifier si une utilisation frauduleuse du système s'est produite. Le système peut être une diffusion de télévision interactive. Un certain nombre de mesures de sécurité additionnelles peuvent être prises.
PCT/GB2007/003071 2006-08-11 2007-08-10 système électronique interactif et procédé pour une pluralité d'utilisateurs WO2008017874A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
GBGB0616027.9A GB0616027D0 (en) 2006-08-11 2006-08-11 Interactive electronic system and method for a plurality of users
GB0616027.9 2006-08-11

Publications (1)

Publication Number Publication Date
WO2008017874A1 true WO2008017874A1 (fr) 2008-02-14

Family

ID=37056238

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/GB2007/003071 WO2008017874A1 (fr) 2006-08-11 2007-08-10 système électronique interactif et procédé pour une pluralité d'utilisateurs

Country Status (2)

Country Link
GB (2) GB0616027D0 (fr)
WO (1) WO2008017874A1 (fr)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2474074A (en) * 2009-10-05 2011-04-06 Your View Ltd Electronic voting
WO2011015878A3 (fr) * 2009-08-06 2011-05-05 Tel-Tales Limited Evaluation de réaction

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4592546A (en) * 1984-04-26 1986-06-03 David B. Lockton Game of skill playable by remote participants in conjunction with a live event
US20030056210A1 (en) * 2001-09-17 2003-03-20 Joshi Ajit P. Method for providing database security
WO2005003994A1 (fr) * 2003-07-02 2005-01-13 Ho-Cheol Yoo Procede pour permettre la participation en temps reel a des programmes de diffusion et systeme correspondant
US7073190B1 (en) * 1999-05-04 2006-07-04 Two Way Media Limited Interactive applications

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5519433A (en) * 1991-11-20 1996-05-21 Zing Systems, L.P. Interactive television security through transaction time stamping
US6571344B1 (en) * 1999-12-21 2003-05-27 Koninklijke Philips Electronics N. V. Method and apparatus for authenticating time-sensitive interactive communications
GB2376420A (en) * 2001-05-05 2002-12-18 David Anthony Gillooley Interactive game system

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US4592546A (en) * 1984-04-26 1986-06-03 David B. Lockton Game of skill playable by remote participants in conjunction with a live event
US7073190B1 (en) * 1999-05-04 2006-07-04 Two Way Media Limited Interactive applications
US20030056210A1 (en) * 2001-09-17 2003-03-20 Joshi Ajit P. Method for providing database security
WO2005003994A1 (fr) * 2003-07-02 2005-01-13 Ho-Cheol Yoo Procede pour permettre la participation en temps reel a des programmes de diffusion et systeme correspondant

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2011015878A3 (fr) * 2009-08-06 2011-05-05 Tel-Tales Limited Evaluation de réaction
GB2474074A (en) * 2009-10-05 2011-04-06 Your View Ltd Electronic voting

Also Published As

Publication number Publication date
GB0715642D0 (en) 2007-09-19
GB0616027D0 (en) 2006-09-20
GB2445440A (en) 2008-07-09

Similar Documents

Publication Publication Date Title
EP1700261B1 (fr) Procede et systeme de pari en temps reel avec terminal autonome
KR100919907B1 (ko) 디지털 방송 환경에서의 타임스탬핑 및 타임 스탬프 유효성 검증 시스템, 방법 및 장치
US5850447A (en) Secured system of remote participation in interactive games with verification of the chronology of events
US6595855B2 (en) Electronic lottery system and its operating method and computer-readable recording medium in which the electronic lottery program code is stored
US7124442B2 (en) System and method for insertion and retrieval of microthreads in transmitted data
EP3055810B1 (fr) Procédé et système conçus pour horodater un document ayant un état changeant au fil du temps
CN102687459B (zh) 长期署名用服务器、长期署名用终端及长期署名验证用服务器
NO325531B1 (no) Fremgangsmate og tilpasninger for a realisere veddemal
MXPA02002794A (es) Votacion electronica interactiva mediante difusion remota.
US20150296246A1 (en) Audio visual interfaces
DE60022320T2 (de) Verfahren zur überprüfung einer unterschrift von einer nachricht
CN105225328B (zh) 基于人脸特征识别的移动终端电子投票方法及系统
CN110381334A (zh) 防盗链方法、装置及系统
AU2021200868A1 (en) Authentication of digital broadcast data
US11451543B2 (en) Securing digital data transmission in a communication network
Benaloh et al. Verifiable postal voting
WO2008017874A1 (fr) système électronique interactif et procédé pour une pluralité d'utilisateurs
CN106792227A (zh) 一种直播中互动的方法及装置
CN112135165B (zh) 一种iptv模板文件防篡改方法及系统
JP3781117B2 (ja) 時刻監査システム、時刻監査方法およびプログラム
CN111031356B (zh) 一种多媒体信息的处理方法、装置及服务器、存储介质
Caldelli et al. Electronic voting by means of digital terrestrial television: The infrastructure, security issues and a real test-Bed
CN116485400A (zh) 离线支付的处理方法及其装置、电子设备及存储介质
CN115119070A (zh) 基于联盟链的视频签约方法、装置和系统
Caldelli et al. Electronic Voting by Means of Digital Terrestrial Television The Infrastructure, Security Issues and a Real Test-bed

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 07789197

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

NENP Non-entry into the national phase

Ref country code: RU

122 Ep: pct application non-entry in european phase

Ref document number: 07789197

Country of ref document: EP

Kind code of ref document: A1