USOO806861 OB2

(12) United States Patent (10) Patent No.: US 8,068,610 B2

Moroney et al. (45) Date of Patent: Nov. 29, 2011

(54) METHOD AND SYSTEM FOR PROVIDING ? E. f : 22999 E.

ObertS et al.al.................. 39.
SECURITY WITHIN MULTIPLE SET TOP 6,588,017 B1 * 7/2003 Calderone ..................... 725/120
BOXES ASSIGNED FOR A SINGLE 6,678,004 B1* 1/2004 Schultheiss et al. .......... 348,552
CUSTOMER 6,738,905 B1* 5/2004 Kravitz et al. ......... ... 713,194
6,751.402 B1* 6/2004 Elliott et al. .................... 386.83
(75) Inventors: Paul Moroney, Encinitas, CA (US); 6,757,829 B1* 6/2004 Laczko et al. ................ 713,187
Scott Contini, San Diego, CA (US); (Continued)
Eric Sprunk, Carlsbad, CA (US); Allen
James Anderson, Katy, TX (US) FOREIGN PATENT DOCUMENTS
DE 444.0174 5, 1996
(73) Assignee: General Instrument Corporation, (Continued)
Horsham, PA (US)
(*) Notice: Subject to any disclaimer, the term of this OTHER PUBLICATIONS
past lSEOs lusted under 35 Ramanathan S. et al. "Home Network Controller: A Cost-Effective
M YW- y yS. Method for Providing Broadband Access to Residential Subscrib
(21) Appl. No.: 10/301,092 ers'. International Conference on Consumer Electronics—Digest of
9 Technical Papers. Rosemont, Jun. 7-9, 1995, New York, IEEE, vol.
(22) Filed: Nov. 20, 2002 Conf. 14, pp. 378-379, XP000547862. ISBN: 0-7803-2141-3.
(65) Prior Publication Data (Continued)
US 2003/OO97563 A1 May 22, 2003
Primary Examiner — Techane Gergiso
Related U.S. Application Data (74) Attorney, Agent, or Firm — Stewart M. Wiener
(60) Provisional application No. 60/332,386, filed on Nov.
21, 2001. (57) ABSTRACT
(51) E./00 (2006.01) Two or more set-top boxes are installed in a household. A
HO)4N 7/173 (201 i. 01) communications link, preferably a physical link, is provided
H04N 7/16 (2011015 between or among the set-top boxes. One of the boxes is
(52) U.S. Cl 380/2.77: 725/100. 725/1 25; 72.5/151 designated as a “master box while the other box or boxes are
(58) Field Of Classification search s 380/277: “slaves.” The slave box will use the communications link to
- - - - -73.5/151 131 100 communicate in a secured and encrypted manner with the
See application file for complete search history s master box. If that communication is severed, e.g., if an
attempt is made to move the slave box to anotherhousehold to
(56) References Cited provid horized Service
roV1de unauthor1Zed ice 1n
in that household, the Slave
slave bbox
will stop working when it can no longer communicate with
U.S. PATENT DOCUMENTS the master box.
4,633,309 A * 12/1986 Li et al. ......................... 380,242
5,541,670 A 7, 1996 Hanai
5,878,141 A * 3/1999 Daly et al. ...................... 705/78 11 Claims, 2 Drawing Sheets

GEN PING
FUNCTION
(122)
CONF RESPONSE GEN RESPONSE
FUNCTION FUNCTION

PING
RESPONSE
2^ (121) 4
 US 8,068,610 B2
Page 2

U.S. PATENT DOCUMENTS FOREIGN PATENT DOCUMENTS

6,904,522 B1 6, 2005 Benardeau et al. T13,156 EP 1079626 2, 2001
6,957,344 B1 * 10/2005 Goldshlag et al. . 713,194 EP 1079626 A2 2, 2001
7,058, 179 B1 6, 2006 Maruo et al. ... 380,211 EP 1126708 8, 2001
7,336,785 B1 2/2008 Lu et al. ...... 380,201 KR 2003O33572 A * 5, 2003
7,484.234 B1 1/2009 Heaton et al. .. T25/80 WO 8505524 12/1985
2001/0038422 A1* 11/2001 Yamada et all 348,478 WO OO?O4707 1, 2000
2002.0003884 A1* 1/2002 Sprunk ....... 380,239
2002, 0083438 A1 6, 2002 So et al. ... T25/31
2002/0101991 A1* 8, 2002 Bacon et al. 380,212 OTHER PUBLICATIONS
2002/0104098 A1* 8, 2002 Zustalk et al. .. 725,131
2002/0112175 A1* 8, 2002 Makofka et al. 713,200 Office Action, Canadian App. No. 2,467,907, Apr. 20, 2010.
2002fO194596 A1: 12/2002 Srivastava... 725/37 PCT Search Report, Re: Application #PCT/US02/37592; Feb. 18,
2003/0028886 A1* 2/2003 Wang et al. ............ ... 725,78 2003.
2003.0035540 A1 2/2003 Freeman et al. 380,210
2003/0059047 A1 3/2003 Iwamura ................ 380,201 * cited by examiner
U.S. Patent Nov. 29, 2011 Sheet 1 of 2 US 8,068,610 B2

AAG. Z

AZG 2
GEN PING
FUNCTION
(122)
CONF RESPONSE PING GEN RESPONSE
FUNCTION (120) FUNCTION

-
PING
los- 4 || “E || 4 || 103
U.S. Patent Nov. 29, 2011 Sheet 2 of 2 US 8,068,610 B2

WHITENER WHITENER WHITENER

(141) (141) (141)
PSEUDO PSEUDO PSEUDO
RANDOM BYTES RANDOM BYTES RANDOM BYTES
(140a) (140b) (140c)
 US 8,068,610 B2
1. 2
METHOD AND SYSTEM FOR PROVIDING However, there are dangers to the system operator if sec
SECURITY WITHIN MULTIPLE SET TOP ondary set-top boxes are offered at a reduced subscription
BOXES ASSIGNED FORASINGLE rate. This danger arises from the potential dishonesty of cus
CUSTOMER tomers who obtain services that are not properly paid for. For
example, Suppose the first set-top box within a household has
RELATED APPLICATIONS a S40 per month fee and the second has a S10 per month fee.
In Such a case, a dishonest customer could purchase a second
The present application claims priority under 35 U.S.C. set-top box and give it to his or her neighbor who previously
S119(e) from the following previously-filed Provisional did not have the service. The result is that the provider is
Patent Application, U.S. Application No. 60/332.386, filed 10 collecting S50 per month for service to the two households,
Nov. 21, 2001 by Paul Moroney et al., entitled “Method and when the provider should be collecting S80 per month for
System for Providing Security within Multiple Set-Top service to two separate households.
Boxes Assigned for a Single Customer, and which is incor Moreover, in the past, there have been problems with the
porated herein by reference in its entirety. dishonesty of the installer: the person who sets up a set-top
15 box whena subscriber first subscribes to the service. Methods
TECHNICAL FIELD exist to prevent an installer from dishonestly giving away
cable/satellite service without registering the users of the
The present invention relates to the fields of cable and service in the single set-top box scenario. However, if the
satellite television. More particularly, the present invention installer is allowed to sell and set-up multiple set-top boxes in
relates to the field of operating a network that includes set-top a single household, it becomes substantially more difficult to
boxes to provide customers with cable or satellite television ensure that the installer is not dishonestly providing service to
and other services. The present invention provides a means those who may be paying off the installer directly for such
and method for securely providing multiple set-top boxes for service.
use by a single customer while preventing the unauthorized Consequently, there is a need in the art for a secure means
use of a secondary set-top box by another party. 25 and method of providing multiple set-top boxes to a single
subscriber without having to charge a full subscription fee for
BACKGROUND each Such set-top box and while preventing secondary set-top
boxes from being used to provide services to those who are
The cable and satellite television industry provides cus not paying the appropriate fees.
tomers with the ability to view a wide variety of television 30
programming for a fee, usually paid monthly. Providing cable SUMMARY
or satellite television programming is typically accomplished
through a “set-top box.” A set-top box is a box of electronics A secure means and method of providing multiple set-top
that is connected between the cable or satellite television boxes to a single Subscriber without having to charge a full
system and the user's television set. The electronics in the 35 subscription fee for each such set-top box is disclosed herein.
set-top box allow the user to receive the television program In the disclosed method and system, the use of a secondary
ming from the cable or satellite system on the connected set-top box to provide services to those who are not paying the
television set. Subscribers are provided with a set-top box appropriate fees is prevented. Cryptographic mechanisms are
when registering or subscribing with the cable or satellite used to ensure that the second set-top box is not used in an
television provider. 40 unauthorized way.
Set-top boxes are also conditional access devices which In one of many possible embodiments, a method of
may allow the display of certain cable/satellite television securely providing cable or satellite television services to
programs only under certain conditions. For example, a set multiple set-top boxes includes (1) providing a master set-top
top box can be programmed to provide access to specific box; (2) providing a slave set-top box in electronic commu
premium channels if the Subscriber pays an additional fee. 45 nication with the master set-top box; (3) sending data from the
Access to Such premium channels can be restricted through slave set-top box to the master set-top box; (4) generating a
the set-top box if the subscriber has not paid the additional response with the master set-top box based on an authentica
fees. tion key shared by the slave and master set-top boxes; (5)
However, a single set-top box will typically only allow one sending the response from the master set-top box to the slave
program to be viewed at a time. Consequently, if a household 50 set-top box; and (6) checking the response from the master
would like to be able to view two different programs on two set-top box with the slave set-top box. If the response is
different television sets, they have generally been required to correct, the slave set-top box continues providing the cable or
purchase a second set-top box and pay twice the monthly satellite television services. If the response is incorrect, the
subscription fee. slave set-top box discontinues providing the cable or satellite
If faced with paying a second full Subscription fee, most 55 television services. This approach provides the benefit of
subscribers will decide instead to get by with a single set-top allowing continued operation of the master even if the slave
box and pay only a single Subscription fee. This is true even fails, is unplugged, or otherwise goes offline.
through the subscribers would prefer to have the ability to
watch multiple programs simultaneously. Thus, Subscribers BRIEF DESCRIPTION OF THE DRAWINGS
are actually purchasing fewer services than they really desire 60
because the incremental cost of an additional Subscription for The accompanying drawings illustrate embodiments of the
a second set-top box is too high. Consequently, from a busi present invention and are a part of the specification. The
ness model standpoint, many cable and satellite television illustrated embodiment are merely examples of the present
system operators would like the ability to provide a household invention and do not limit the scope of the invention.
with a second set-top box so that multiple programming can 65 FIG. 1 illustrates the creation of a master/slave set-top box
be accessed simultaneously without having to charge two full system according to one embodiment of the present inven
Subscription fees. tion.
 US 8,068,610 B2
3 4
FIG. 2 illustrates the secure communication between the unit (102) may be used by the installer (100) to program and
master and slave set-top boxes to prevent separation of the configure the first and master box (104).
boxes for unauthorized purposes according to one embodi The installer (100) next installs a second set-top box (107)
ment of the present invention. for use with a second television set (106). Again, the installer
FIG. 3 illustrates the encryption of data items used to (100) receives reconfiguration data for the second box (107)
secure communications between the master and slave set-top from the authorized agent (109). The installer can then con
boxes according to one embodiment of the present invention. figure the second box (107) as a slave box. Again, the remote
FIG. 4 illustrates a Pseudo Random Number Generator control (102) may be used by the installer to program the
according to one embodiment of the present invention. second box (107).
Throughout the drawings, identical reference numbers 10 The installer (100) provides the authorized agent (109)
designate similar, but not necessarily identical, elements. with confirmation numbers for the set-top boxes (104, 107)
deployed. The authorized agent (109) can then see that the
DETAILED DESCRIPTION subscribing household is properly billed for the first set-top
box (104) at a full subscription rate and the second set-top box
15 (107) at a lower subscription rate. Subsequent reconfiguration
The methods and systems disclosed herein assume a model of set-tops could be required, e.g. due to the failure of a master
of operation in which two or more set-top boxes are installed necessitating the associated slave's reconfiguration as the
in a household. A communications link, preferably a physical new master. If this occurs, the present system has the benefit
link, is provided between or among the set-top boxes. The of easily facilitating such reconfiguration in a manner analo
communications link between the set-top boxes is used in gous to the above. An installer might be sent to the home to
Such away that one of the boxes cannot easily be moved to an reconfigure the slave to be the new master, or the consumer
unauthorized location, such as to provide service to a second may be allowed to do so himself while on the phone with the
household. authorized agent. Such ease of reconfiguration is a benefit of
One of the boxes is designated as a “master box while the this system.
other box or boxes are “slaves.” The slave box will use the 25 In the present example, a physical connection (105) is
communications link to communicate regularly in a secured made between the first (104) and second (107) set-top boxes.
and encrypted manner with the master box. If that communi However, the communication link between boxes (104,107)
cation is severed, e.g., if an attempt is made to move the slave may be wireless, powerline, phone line, or other local com
box to another household to provide unauthorized service in munication means. This connection (105) allows the boxes
that household, the slave box is programmed to stop working 30 (104,107) to communicate. If that communication is inter
when it can no longer communicate with the master box. rupted, for example, if the slave box (107) is disconnected
In our model, set-top boxes can be in one of three different from the master box (104) and taken to another household to
states: (i) standalone—for households that have only a single provide unauthorized service at that location, the second set
set-top, (ii) master—the main or primary of multiple set-top top box (107) will cease to function. The behavior of disable
boxes within a household, and (iii) slave-a secondary set 35 ment upon disconnection is fundamental to the security pro
top within a household in communication with a master box. tection characteristics of this invention. Likewise, the
Set-tops can be reconfigured from one state to another state, connection means between master and slave should be local
but preferably only by an authorized installer who obtains in nature, Such that it is extremely inconvenient, costly, diffi
reconfiguration data from a customer service representative cult or impossible to locate either device any substantial dis
or authorized agent of the system operator. The authorized 40 tance from the other. This connection means should limit
agent may support new subscriptions and the installation of where they can be located in keeping with the assumption that
new set-top boxes, run billing software for the system and the slave is intended for use in the same household.
provide “reconfiguration data” to an installer who sets up the In this embodiment, the connection (105) between the
set-top boxes within the subscriber's household. set-top boxes (104, 107) is an RS232 cable. RS232 cables
Upon reconfiguring a set-top, the set-top box will display a 45 must be kept within a particular length or cannot reliably be
confirmation number that the installer must report to the used for electronic communication between equipment Such
authorized agent. The authorized agent enters the confirma as the set-top boxes (104,107). Consequently, if an attempt is
tion number into the billing software, and assuming the con made to substitute a much longer RS232 cable, such that the
firmation number is correct, the billing software updates the slave box (107) could be taken to a neighboring household to
records of the Subscriber's account and, from then on, charges 50 provide unauthorized service for that household, the boxes
the appropriate monthly fee. An example of this system is (104, 107) will no longer be able to communicate reliably
illustrated in FIG. 1. over the lengthened cable (105) and thus the slave box (107)
As shown in FIG. 1, an authorized installer (100) is used to will cease functioning. Benefit is seen both from the elec
set up service for a new subscriber or to expand a subscriber's tronic reliability aspects of excessive cable length, as well as
service to include multiple set-top boxes. The installer (100) 55 the sheer inconvenience of the connecting cable.
installs a first set-top box (104) for use with a first television A basic objective of the system is to detect the disconnec
set (103). In this example, this first box (104) will be the tion or blockage of communication between the master and
master box. Consequently, the installer (100) contacts an slave, and to disable slave operation should this occur. The
authorized agent (109) working for the cable or satellite tele basic means of achieving this is to design the slave so that it
vision company. The installer (100) may contact the autho 60 will disable itself if it does not communicate with the master
rized agent (109) using a telephone (101) and local telephone regularly. In addition to crude manipulations such as discon
network (108). However, the installer (100) may use any other nection, there are three main other ways by which one may
method of communicating with the authorized agent (109), attempt to defeat the system described above:
for example, a wireless phone. 1. The dishonest customer may attempt to simulate with a
The authorized agent (109) will provide reconfiguration 65 personal computer (PC) the communication between the two
data that must be entered into the set-top box (104) in order to set-top boxes so that the set-top boxes can operate separately
configure that set top (104) as a masterbox. A remote control and independently of each other.
 US 8,068,610 B2
5 6
2. The installer or the customer may attempt to reconfigure and the only strict security requirement is that they must not
the set-tops without having the billing Software updated, i.e. be easily reproducible outside of the billing software and
reconfiguring a slave box as an independently-operable mas set-top. This can be done in many ways. For example, gener
terbox. ating the values pseudo-randomly or using a hash that is a
3. The installer or the customer may attempt to have the function of the unit keys of the master-slave pair (or the unit
billing software updated without reconfiguring the set-tops. key of the standalone).
All Such methods of cheating may be minimized or elimi Since a master-slave pair share the same authentication key
nated through the use of cryptography. Each set-top is which is unknown outside of the two set-tops and the billing
equipped with two cryptographic keys: a unit key and an Software, it has the necessary cryptographic values to verify
authentication key. The unit key is used for reconfiguration, 10 that the two set-tops are linked together. This is accomplished
and the authentication key is shared between a master-slave through a “ping protocol. After the elapse of some fixed time
pair to verify that they have not been separated. Both keys are interval, e.g. 15 minutes, the slave sends a pseudo-randomly
delivered to the set-tops in encrypted form, so that neither the generated value to the master. The master does a crypto
installer, customer, nor authorized agent is aware of the true graphic signature of the received value via a message authen
key values. The initial (“provisioning) keys are provided 15 tication code (MAC) using the shared authentication key, and
during the manufacturing process of the set-tops. sends the result back to the slave. The slave verifies that the
In order to prevent unauthorized reconfiguration, a set-top correct signature was obtained, including the use of the cor
box cannot be reconfigured, e.g., from a slave state to a master rect pseudo-randomly generated value sent, and if so, contin
state, unless a unit key is entered. The input key is processed ues operation as normal. If the slave did not receive the correct
through a cryptographic hash function by the set-top box response or did not receive any response within Some fixed
which results in a value equal to a previous unit key stored in time interval, the slave repeats its request up to some fixed
the set-top box. If the input unit key passed through the hash number of times. If it still fails to receive the correct reply, it
function does not result in the previous unit key, reconfigu then discontinues displaying cable/satellite television until
ration will not be allowed. Since hash functions are intention the master gives the correct reply.
ally designed to not be invertible (i.e. to be “one way func 25 Each set-top box is provided with an initial provisioning
tions'), this makes it infeasible for anyone to reconfigure a token (input data). The provisioning token will at least
box without knowing the inverse hash of the current unit key. include a unit key (the bottom of the hash chain) and an
Consequently, the method disclosed includes generating a authentication key. For new set-top boxes, this can be done
“hash chain' of unit keys for each set-top. The last unit key within the factory. For legacy set-top boxes, the data will have
value in this chain is indexed using a “token counter value of 30 to be entered by an installer who obtains the information from
Zero, where the unit key for token counter value Zero is an authorized agent of the system operator who is operating,
calculated by passing the unit key for token counter value 1 for example, a personal computer running a Windows.(R) bill
through the hash function. Each key n in the chain leads to the ing program. Checks will be in place to prevent the installer
previous key n+1 when processed through the hash function. from placing incorrect data.
This hash chain of unit keys for each set-top box may be 35 The set-top boxes can operate in one of four different
stored within the billing software or are otherwise provided to states: STANDALONE, MASTER, SLAVE ONLINE, and
the authorized agent. In this way, an installer cannot recon SLAVE OFFLINE. The STANDALONE State is intended for
figure a set-top box without contacting the authorized agent viewers who do not use the multiple viewing capabilities that
and obtaining the next unit key in the hash chain for input to the present system can securely provide. The other states are
the set-top box being reconfigured. Only the authorized agent 40 for boxes that are part of a multiple-box system used by a
who runs the billing software or otherwise has access to future particular subscriber. For these, the MASTER state is
unit keys will be able to allow reconfiguration of a set-top intended for the main set-top box within a household. Any
box. The bottom of the hash chain is supplied to each set-top others will be slaves. Typically, there will be only one slave
box during manufacture or upon provisioning. (107) per master (104), but the present invention is not so
Without a loss of generality, other information such as the 45 restricted.
set-top serial number or the number of times a box has been A slave (107) will be in state SLAVE ONLINE if it is in
reconfigured can be required as part of the hash chain, both of communication with a master box (104), or SLAVE
which improve security. As a further precaution, in order to OFFLINE if it is not. It is imagined that the latter state will
prevent the unit keys from being revealed to anybody (includ only happen if the connection (105) between the slave (107)
ing the authorized agent and installer), new unit keys are 50 and the master (104) is disconnected or interrupted, or if the
encrypted under the previous unit keys. Thus, the actual value master (104) experiences a power outage. When the slave
of the unit keys is known only within the billing software and (107) is in the SLAVE OFFLINE state, then it will no longer
the set-top box. provide service, e.g., display cable/satellite television pro
This is useful in controlling the confirmation number. The gramming and provide related services.
confirmation number is computed from the cryptographic 55 The slave (107) will need to check to see that it is still in
hash of the new unit key. In general, the confirmation number communication with the master (104) by sending a "ping
does not need to be too large to ensure security. If the hash command. The master (104) is responsible for responding to
function outputs many bytes, the confirmation number can be the command in such away that the slave (107) is assured that
restricted to some Small, designated portion of it (for the response came from the master (104). As described above,
example, the first 2 or 4 bytes). 60 this ping operation can occur overan RS232 cable connecting
Whenever a set-top box is reconfigured, it is also delivered the master and slave. However, any other connection (105)
an authentication key along with the new unit key. The can be used. For example, an L band cable connecting both
authentication key is also encrypted under the previous unit boxes to a satellite antenna can be used, or an AC powerline
key, thus being known only to the set-top and the billing communications technology Such as Homeplug, HPNA, or a
software. When two set-tops are reconfigured to be a master 65 wireless home network technology such as 802.11, or Blue
slave pair, they must be delivered the same authentication key. tooth technology. For slaves that are online, the ping will
Authentication keys are generated by the billing software, preferably happen every 15 minutes, and for slaves that are
 US 8,068,610 B2
7 8
offline, the ping will happen continuously until an appropriate while the master (104) runs GEN RESPONSE (123). It is
reply from the master is received. assumed that the master (104) and slave (107) share the same
At times, reconfiguration may be necessary. For instance, a authentication key.
slave box may need to be changed to a master box if the GEN PING: The function GEN PING (Generate Ping)
existing master set-top box is broken and needs to be repaired. (122) will preferably be executed by the slave (107) to send a
Alternatively, a standalone box may need to be changed to a ping (120) to the master (104) every 15 minutes when the
master box if a Subscriber desires to add multiple-program slave (107) is online, or more frequently when the slave (107)
viewing ability. Reconfiguration will need to be done by an is offline. The GEN PING function (122) may work as fol
lows:
installer (100) who obtains a reconfiguration token (e.g., 21
bytes of data) from an authorized agent (109). Set-top boxes 10 1. y=MAX NUM ATTEMPTS (assumed to be 3).
can only be reconfigured if the correct token is obtained. Note 2. Use the PRNG to get an 8-byte nonce.
that it is also possible for a duly-authorized consumer to 3. While (yd-0) do
a. Send nonce to master.
perform reconfiguration instead of an installer, to avoid the b. Wait up to X Seconds for a response. If no response,
inconvenience and cost of an installer visit. 15 then y-y-1; continue;
Upon a valid reconfiguration, the set-top box (e.g. 104. c. If CONF RESPONSE (nonce, response) succeeds
107) will preferably display a 2-byte (4 hexadecimal charac then state=SLAVE ONLINE; return;
ters) confirmation number to the installer (100) which he or d. /*CONF RESPONSE failed */y y-1;
she must communicate to the authorized agent (109) in order e. Wait for 1 to 2 seconds.
for the authorized agent to update the billing records. Each 4. /* failed after y attempts */state=SLAVE OFFLINE;
reconfiguration requires a new reconfiguration token, and return;
reconfiguration may be limited to a maximum of times, e.g., GEN RESPONSE: The function GEN RESPONSE
100 times. The reconfiguration token is similar to the provi (Generate Response to Ping) (123) will be executed by the
Sioning token: it contains a unit key (e.g., 9 bytes) (UK) and master (104) whenever it receives a ping (120). It takes as
an authentication key (e.g., 9 bytes) (AK). The authentica 25 input the 8-byte pseudo-random value (or “nonce') received
tion key will be shared between the master (104) and the slave from the slave (107), the authentication key AK (stored on
(107) as described above. master), and Cinfo (to be specified later). The result is a ping
For new set-top boxes, provisioning will be performed response (121) sent to the slave (107), where said response
within the factory by, for example, a personal computer on the does not retransmit the received nonce back to the slave that
manufacturing line. The PC will query the set-top box for its 30 originally generated it. The GEN RESPONSE function
identification number (e.g., 4 bytes) ("CA ID') and use this (123) may work as follows:
to look up its initial provisioning token. Then the set-top box 1. If received nonce is not 8 bytes, then return:
will be loaded with a 9-byte UK, a 9-byte AK which will be /* data transmission error: do nothing */
used to seed a Pseudo Random Number Generator
2. Compute signature=SIGNOAK, nonce, Cinfo).
35 3. Send signature--Cinfo back to the slave.
(“PRNG”), and a 2 byte value of 00 for the token counter. By CONF RESPONSE: The function CONF RESPONSE
default, the set-top box will preferably be in the STANDAL (Confirm Response to Ping) (124) is executed when a ping
ONE State. response (121) is received by the slave (107). The slave (107)
For legacy set-top boxes, the provisioning is necessarily must confirm the reply given by the master (104) is a correct
done by the reconfiguration procedure. The legacy boxes 40 one in order to confirm that the slave (107) is connected to the
need to initially have a token counter value of -1 (represented master (104) and not to something else. The function (124)
with 2 bytes) to indicate they have not been provisioned, and takes as input the original, slave-generated 8-byte nonce that
will be in the STANDALONE state. If the owner of the set-top it generated in GEN PING (122), the 8-byte signature sent by
box later decides to add a second box, the installer (100) will the master (104), the Cinfo sent by the master, and the authen
contact an authorized agent (109) to get a reconfiguration 45 tication key (AK) (stored on slave). The return value is either
token. This reconfiguration token will actually be a provision SUCCESS Or FAILURE.
ing token, but this fact is invisible to both installer and con 1. If Cinfo is not a valid Cinfo or if signature is not 8 bytes,
Sumer. The initial provisioning token along with cycle infor then return FAILURE;
mation will be used to seed the PRNG for these boxes. 2. Compute expected signature-SIGNOAK, nonce,
As shown in FIG. 2, the ping protocol is for the slave (107) 50 Cinfo);
to verify that it is still connected to the master (104). The slave 3. if expected signature is not the same as signature, then
(107) will preferably perform a ping (120) every 15 minutes return FAILURE;
when in SLAVE ONLINE state, or continuously when in 4. return SUCCESS;
SLAVE OFFLINE state. If the ping (120) fails, the slave box econfiguration will be necessary in at least the following
(107) automatically resets its state to SLAVE OFFLINE and 55 circumstances: (1) whenever a master needs to change to a
discontinues service, e.g., displaying cable/satellite televi slave or a standalone; (2) whenever a standalone needs to
sion. If the ping (120) succeeds, the slave box (107) maintains change to anything else; (3) whenever a slave needs to change
or re-sets its state to SLAVE ONLINE and continues to dis to a master or a standalone; and (4) in the extremely unlikely
play satellite television. Note that no reconfiguration is nec event of communication failure due to the master and slave
essary for a slave (107) to change from OFFLINE to ONLINE 60 not having the same AK.
or vice versa. This allows the slave box (107) to address The last event is extremely unlikely since checks will be in
common conditions such as the loss of power to the master place to notice and correct nearly all input errors, including
(104), which might appear like an insecure (i.e. relocated) mischievous attempts at providing false data. Any time a
condition to the slave (107). set-top box is reconfigured to be a slave, its master will also be
The protocol has 3 functions: GEN PING (122), GEN 65 reconfigured. Likewise, any time a set-top box is reconfigured
RESPONSE (123), CONF RESPONSE (124). The slave to be a master, its slave will also be reconfigured. This is
(107) runs GEN PING (122) and CONF RESPONSE (124), because each master/slave pair is a matched set and shares the
 US 8,068,610 B2
10
same AK, and each reconfiguration involves a new AK. If figure a set-top box because he made an error writing down
only one member of this matched set pair is reconfigured, this the data required for entry through the remote control, it will
will result in a different AK for each device, and subsequently be possible for him to contact an authorized agent and obtain
a failure of the Ping protocol. The failure of the Ping protocol the data again. It will also be useful for the installer to be able
will disable display of television, thereby serving as a con to access the token counter that may be needed by the autho
spicuous indicator that an error has occurred. rized agent in order to facilitate debugging of unexpected
As explained above, the reconfiguration data will be problems.
obtained from a customer service representative (109; FIG. 1) A function for getting reconfiguration data (GET RE
and entered into a set-top box by a representative from the CONF DATA) is the core function needed for the master
satellite or cable television company, the installer (100; FIG. 10
slave admin application. It takes a 9-byte array UK TO
1). The reconfiguration data consists of 2 blocks of 22 and 29 P OF CHAIN which all unit keys for that box are derived
decimal digits respectively, which shall be converted to a from, the CA ID of the box that requires reconfiguration, an
9-byte and 12-byte block. The conversion is done by treating integer representing a token counter for the box, a variable
the values as little endian decimal integers and converting to
base 256 little endian integers. 15 state which represents the new state for the box, an array of 9
The word “endian refers to the order in which bytes are bytes representing a new AK, an array block1 which holds 22
stored in memory or transmitted across the wire. Consider the characters, an array block2 which holds 29 characters, and an
decimal number “593, the digit “5” (five-hundred) is the array conf which holds a 2-byte confirmation number. It is
most significant or “big” digit. The numbers 593 and 693 are important to the security of this design that the UK TO
significantly different, whereas the numbers 593 and 594 are P OF CHAIN values are kept in the utmost confidentiality.
not significantly different. When ordering bytes in memory, Integer j represents the number of times the box has been
the term “big-endian refers to putting the most significant reconfigured.
byte first, whereas “little-endian refers to putting the least The GET RECONF DATA function returns SUCCESS
significant byte first. or error value INVALID INDEX. Upon a SUCCESS, the
The function RECONFIGURE will take as input the 25 reconfiguration data will be stored in block1 and block2.
address of the current UK, the address of a token counter, the Under normal operation, the value j that is input will be
address of the current AK, and the address of the state variable obtained from a database stored on the local PC that keeps
(i.e. MASTER, SLAVE ONLINE or OFFLINE, STANDAL track of the token counter of each box. However, in case of
ONE). It will get the 21 bytes of user input data and send all problems, GET RECONF DATA can be used to retrieve
information into the security function LDCHK (to be 30 data for smaller values of j. If both a master and a slave are
described later). LDCHK will perform all error checking, being reconfigured to work together, the new AK that is input
state changes, AK changes, and UK changes. The value must be the same for both calls to GET RECONF DATA.
returned by RECONFIGURE is the same as that returned by This value shall be generated randomly on the personal com
LDCHK, which is either UK ENTRY ERROR (The first puter. GET RECONF DATA works as follows:
block of the token was entered incorrectly), AK ENTRY 35 1. ifi>99 then return INVALID INDEX.
ERROR (the second block of the token was entered incor 2. Look up the token counter for box CA ID from data
rectly), or TOKEN ENTRY ERROR (the entire token needs base.
to be reentered). If an error is returned, the installer must 3. Ifj>token counter then return INVALID INDEX.
reenter the erroneous values only in order to reattempt recon 4. UK=UK TOP OF CHAIN.
figuration. Otherwise, a 2-byte confirmation number (4 hexa 40 5. Fork=100 to j+1 by -1 do
decimal characters) shall be computed with the function a. UK=HASHOUKCA ID(unsigned char)k(unsigned
COMPUTE CONF NUMBER (described later) and dis char)(k>8), 15).
played on the screen so that the installer can communicate the 6. If (=-1) then
confirmation number to the authorized agent. a. encrypted UK=CTS ENCRYPT9(UK, key k") where
An application, for example a billing application, will be 45 k'={k1,k2) is formed by taking k1 as CA IDIOOO
needed for a network operator or authorized agent to provide (seven bytes total) and k2 is seven Zero bytes.
reconfiguration data when it is required. This will preferably 7. Else
be a windows application used by an authorized agent. When a. prev UK=HASH(UKCA ID (unsigned char) (un
ever an installer needs to reconfigure a set-top box with id signed char)(>8), 15).
CA ID, the installer contacts an authorized agent. The autho 50 b. encrypted UK=CTS ENCRYPT9(UK, key k") where
rized agent will use the Master Slave Admin application k'={k1,k2) is formed by taking k1'as the first 7 bytes
(“Msapp') to look up reconfiguration data for set-top box of prev UK and k2 as the last 7 bytes of prev UK
CA ID and give the information to the installer. The recon (remark: it is intentional that the keys k1' and k2
figuration data will consist of two blocks of data, the first overlap).
being 22 digits and the second being 29 digits. For readability, 55 8. Encode encrypted UK as a 22-byte decimal integer and
the digits of the data will be grouped into blocks of 4. Thus, a store in block1. Encoding is done by treating encrypt
sample data will be similar to the following ed UK as a little endian integer base 256 and converting
Block 1: XXXXXX XXXX XXXX XXXX XXXX to a little endian integer base 10.
Block 2: XXXXX XXXX XXXX XXXX XXXX XXXX 9.Compute a key k={k1,k2) by k1=first 7 bytes of UK and
XXXX 60 k2=last 7 bytes of UK (remark: it is intentional that the
where the X's represent digits. keys k1 and k2 overlap).
The admin application will be responsible for keeping 10. Compute encrypted AK=CTS ENCRYPT12
track of the number of times each set-top box has been recon (state|OOAK, key k).
figured (i.e. each box’s token counter) so that it can readily 11. Encode encrypted AK as a 29-byte decimal integer
look up the necessary data for the current reconfiguration. It 65 and store in block2. Encoding is done the same as in Step
will also be able to provide earlier reconfiguration data in case 8.
of problems. For instance, if the installer is notable to recon 12. Compute conf to be the first 2 bytes of HASH(UK, 9).
 US 8,068,610 B2
11 12
13. Update the database for box CA ID by replacing the The steps for CTS DECRYPT9 are:
token counter with token counter--1. 1. Let P2=DES3' (last 8 bytes of ciphertext).
14. Return SUCCESS 2. Compute P1 =DES3 (first byte of ciphertext|first 7
The symbol “I” means concatenation. In the database, all bytes of P2).
token counters must initially have the value of -1 if they have 3. The plaintext is P1 concatenated with the last byte of P2.
not been provisioned, or 0 if they have been provisioned. The function LDCHK will take as input the input token
Getting initial provisioning data from this function is equiva (after conversion to a 21 character value), the address of the
lent to inputting the value j=-1. current UK, the address of a token counter, the address of the
Upon SUCCESS, the MSapp shall display the two tokens, current AK, the address of the state variable (i.e. MASTER,
and then prompt for the installer's confirmation number (2 10
SLAVE ONLINE or OFFLINE, STANDALONE), and the
bytes represented as 4 hexadecimal characters). When this CA ID. The value returned by LDCHK is either SUCCESS,
information is entered, the MSapp will verify the data UK ENTRY ERROR (The first block of the token was
matches the configuration array computed above. If the data
does match, the reconfiguration for this box shall be com entered incorrectly), AK ENTRY ERROR (the last block of
plete, and the MSapp may communicate this fact to the billing 15 the token was entered incorrectly), or TOKEN ENTRY ER
software. If the data does not match, the MSapp will prefer ROR (the entire token needs to be reentered). The function
ably allow unlimited attempts to match the confirmation operates as follows:
number. It may also have an “abort” option, which will allow 1. If token counter is -1 then
the MSapp to process new data without updating the billing a. Let new UK=CTS DECRYPT9(first nine bytes of
software for the current data. token, key k") where k={k1', k2} is formed by taking
Several security functions will now be discussed. The first k1" as CA IDIOOIO and k2 is all Zero bytes.
security function, CTS ENCRYPT12, performs “ciphertext 2. else
stealing encryption of 12-byte plaintext data using a 14-byte a. Let new UK=CTS DECRYPT9(first nine bytes of
key with two key triple DES EDE as a subprocedure. It token, key k") where k={k1', k2} is formed by taking
returns a 12-byte ciphertext. Likewise, the function CTS DE 25 k1'as the first 7 bytes of current UK and k2 as the last
CRYPT12 performs the corresponding decryption. The func 7 bytes of current UK (remark: it is intentional that
tions CTS ENCRYPT9 and CTS DECRYPT9 are the same the keys k1' and k2 overlap).
as CTS ENCRYPT12 and CTS DECRYPT12 except for b. If RATCHETT(CAID, new UK, current UK,
with 9-byte plaintexts and ciphertexts. All functions addition token counter)=FAILURE then return UK EN
ally require a 14-byte key. 30 TRY ERROR.
As shown in FIG.3, for CTS ENCRYPT12, the plaintext 3. Compute a key k={k1, k2 by k1=first 7 bytes of
is divided into 3 words P1, P2, P3, where a word represents a new UK and k2=last 7 bytes of new UK (remark: it is
4-byte value. Then, the following steps are performed: intentional that the keys k1 and k2 overlap).
1. Compute 2 ciphertext words C1A, C1 B=DES3(P1|P2). 4. Compute new AK=CTS DECRYPT12(last 12 bytes of
2. Compute 2 ciphertext words C2A, C2B-DES3 35 token, key k).
(C1B|P3). 5. If the first byte of new AK does not represent a legal
3. The output ciphertext is C1A|C2A|C2B. state or if the next 2 bytes are not zero then
It must be emphasized that the prepended bytes represent a. If token counter is -1 then return TOKEN ENTRY
ing the state and the 2 Zero bytes (when the AK is encrypted) ERROR.
must be in word P1. 40 b. Else return AK ENTRY ERROR.
To decrypt the 12-byte ciphertext, divide it into three 6. If token counter is -1 then
words: C1, C2, C3. Then, the following steps are performed: a. PRNG INIT CONTEXT(last nine bytes of
1. Compute two words P1B, P3=DES3' (C2C3). new AK);
2. Compute two words P1, P2=DES3' (C1|P1B). 7. Change current UK to be the same as new UK.
3. The plaintext is P1|P2P3. 45 8. Change state to the value of the first byte of new AK.
The key k for the DES3 function will consists of two 9. Change the current AK to the last nine bytes of new AK.
7-byte values: k1,k2. DES3k applied to an 8-byte (2 word) 10. Increase token counter by 1.
plaintext block X works as follows: 11. Return SUCCESS
1. Compute x1=DES(x). The function RATCHETT is called by LDCHK to verify
2. Compute x2=DES'(x1). 50 the validity of the reconfiguration data. It takes as input a
3. Compute ciphertext x3-DES (x2). 4-byte CA ID, a 9-byte newly entered UK, the 9-byte current
The decryption with function for DES3 is easily derived UK, and the 2-byte token counter, and returns SUCCESS if
from the encryption function. the data is valid or FAILURE if the data is invalid.
In addition to CTS ENCRYPT12 and CTS DECRYPT12, 1. If token counterd99 then return FAILURE.
another ciphertext stealing encryption and decryption proce 55 2. Compute a tag of the form HASH
dure will be required for encrypting/decrypting 9-byte plain (new UKICA IDtoken counter 15).
texts/ciphertexts corresponding to unit keys. These functions 3. If the tag is the same as the current UK, return SUC
will naturally be referred to as CTS ENCRYPT9 and CTS CESS.
DECRYPT9. Unfortunately, the description of CTS EN 4. Otherwise, return FAILURE.
CRYPT9 is not as elegantas CTS ENCRYPT12 since blocks 60 The function COMPUTE CONF NUMBER computes a
do not fall on natural word boundaries. The steps are as confirmation number which the installer will need to give to
follows: the authorized agent to prove a reconfiguration has been
1. Let C1 =DES3 (first 8 bytes of plaintext). completed. It takes the 9-byte UK as input and outputs a
2. Compute C2=DES3(last 7 bytes of C1||last byte of 2-byte confirmation number, conf.
plaintext). 65 1. conf=the first 2 bytes of HASH(UK, 9);
3. The output ciphertext is the first byte of C1 concatenated The SIGN function takes a 9-byte AK, an 8-byte nonce, and
with C2. a 4-byte value Cinfo. It performs a cryptographic sign opera
 US 8,068,610 B2
13 14
tion on the nonce and Cinfo using key AK. The cryptographic providing communication between a master set-top box
sign algorithm is simply HASHCAKnonce|Cinfo). and a slave set-top box, wherein said providing commu
The function HASH takes a string and the length of that nication comprises:
string in bytes, and returns a 9-byte hash value. The hash sending data from said slave set-top box to said master
function shall be the first 9-bytes of the SHA1 hash of the set-top box;
String. generating a response with said master set-top box based
FIG. 4 illustrates the master/slave set top box PRNG. The on an authentication key shared by said slave and
PRNG takes a fixed key (FK) that is stored in program master set-top boxes;
memory, a 9-byte “whitener string (141), and a 9-byte state sending said response from said master set-top box to
which will be fed into the CTS ENCRYPT9 function. Each 10
said slave set-top box;
iteration will output 9 bytes of pseudo random data (140a, checking said response from said master set-top box
140b, 140c) that is formed by “exclusive or of the PRNG with said slave set-top box; and,
state (which is stored in a context variable) with the encrypted if said response is incorrect, rendering said slave set-top
PRNG state and the whitener. The new PRNG state becomes
the encrypted previous state. The initial PRNG state will be 15 box non-functional; and
provided during provisioning. The whitener string is intended rendering said slave set-top box non-functional if said
to be an input string that has a random appearance and communication is interrupted.
changes over time. Such as encrypted content data. 2. The method of claim 1, wherein said sending data is
The context containing the PRNG state shall be stored in performed periodically.
RAM and copied to memory, preferably non-volatile random 3. The method of claim 1, wherein said providing commu
access memory (NVRAM), every 10 iterations. If the pro nication, comprises physically connecting said master and
cessor should ever be reset, the copy of the context in slave set-top boxes.
NVRAM shall be written back to random access memory 4. The method of claim 3, further comprising connecting
(“RAM) in order to resume operation. said master and slave set-top boxes with RS232 cable.
The PRNG INIT CONTEXT function initializes in RAM 25 5. A method of securely providing cable or satellite televi
the context of the PRNG. This operation is only intended for sion services to multiple set-top boxes, said method compris
use during provisioning and upon a processor reset. In the ing:
latter case, the copy of the most recent context that is stored in configuring a first set-top box as a master set-top box;
NVRAM is sent into PRNG INIT CONTEXT. configuring a second set-top box as a slave set-top box,
The PRNG GET BYTES function takes the RAM con 30 wherein configuring said first and second set-top boxes
text variable which holds the PRNG state, a 9-byte whitener further comprises providing an initial provisioning
string, and the number of PRNG bytes that the user requests, token including at least a unit key and an authentication
byte len. It returns a string of byte len pseudorandomly gen key to both said first and second set-top boxes, and
erated bytes. wherein the authentication key is encrypted under a
After every 10 iterations that this function is called, the 35 previous unit key; and
PRNG context shall be copied into NVRAM. providing communication between said master set-top box
There will be certain variables within our system which and said slave set-top box, wherein said slave set-top box
must be stored in non-volatile memory (NVRAM). These will become non-functional if said communication is
include (1) the AK (9 bytes), (2) the UK (9 bytes), (3) the interrupted; and
token counter (2 byte), a copy of the PRNG context (9 bytes); 40 wherein said authentication key is encrypted when input to
and the state (1 byte). said set-top boxes.
Although this protocol has been described using entirely 6. The method of claim 5, further comprising obtaining
symmetric key cryptography, it can easily be enhanced to said unit key from an authorized agent of a television system
include public key cryptography without changing the basic operator.
underlying ideas. For instance, the shared authentication key 45 7. The method of claim 5, further comprising outputting a
can be replaced with public key signatures and Verified using confirmation number based on the unit key upon configura
standard PKI techniques including certificates. tion of the set-top box.
Similar protocols are possible with different assumptions, 8. The method of claim 7, further comprising reporting said
including where the master sends “ping data to the slave, and confirmation number to an authorized agent of a television
disables itself if no slave response is received. Such an alter 50 system operator.
native would cause both master and slave to disable them 9. The method of claim 8, further comprising confirming
selves should either go offline, since both devices would have that said confirmation number is based on said unit key and, if
to be designed to self-disable if no secure data transmission said confirmation number is confirmed, updating a billing
took place. Though it is typically undesirable for both devices system based on receipt of said confirmation number.
to disable in event of one experiencing a normal failure or 55 10. A system for securely providing cable or satellite tele
power disconnect, this still may be useful in some networks. vision services to multiple set-top boxes, said system com
The preceding description has been presented only to illus prising:
trate and describe the invention. It is not intended to be means for providing communication between a master set
exhaustive or to limit the invention to any precise form dis top box and a slave set-top box, wherein said means for
closed. Many modifications and variations are possible in 60 providing communication comprise:
light of the above teaching. It is intended that the scope of the means for sending data from said slave set-top box to
invention be defined by the following claims. said master set-top box:
means for generating a response with said master set-top
What is claimed is: box based on an authentication key shared by said
1. A method of securely providing cable or satellite televi 65 slave and master set-top boxes;
sion services to multiple set-top boxes, said method compris means for sending said response from said master set
ing: top box to said slave set-top box:
 US 8,068,610 B2
15 16
means for checking said response from said master set set-top boxes comprises means for providing an initial
top box with said slave set-top box; and, provisioning token including at least a unit key and an
if said response is incorrect, means for rendering said authentication key to both said first and second set-top
slave set-top box non-functional; and boxes and wherein the authentication key is encrypted
means for rendering said slave set-top box non-func under a previous unit key; and
tional if said communication is interrupted. means for providing communication between said master
11. A system for securely providing cable or satellite tele set-top box and said slave set-top box, wherein said slave
vision services to multiple set-top boxes, said system com set-top box will become non-functional if said commu
prising: nication is interrupted; and
means for configuring a first set-top box as a master set-top 10 means for encrypting said authentication key when input to
box; said set-top boxes.
means for configuring a second set-top box as a slave
set-top box, wherein configuring said first and second k k k k k