Patent application number | Description | Published |
20100215171 | TRANSPORT PACKET DECRYPTION TESTING IN A CLIENT DEVICE - In a method for testing a transport packet decrypting module of a client device, a first decryption operation of the transport packet decrypting module is implemented on a test encrypted control word using a content decryption key ladder to derive a test control word, a second decryption operation of the transport packet decrypting module is implemented on one or more test transport packets using the test control word via a predetermined content decryption algorithm, the KIV is derived from the decrypted transport packets, and the derived KIV is compared with a value stored in the client device to verify whether the transport packet decrypting module of the client device is functioning properly. | 08-26-2010 |
20100313014 | DOWNLOADABLE SECURITY BASED ON CERTIFICATE STATUS - A conditional access system (CAS) computer in a downloadable CAS receives a downloadable management certificate (DMC) and determines, using the DMC, security information including a DMC key size and an expiration time of a DMC subordinate certificate authority (sub-CA) certificate, for the client device. The CAS computer then determines whether the DMC is valid based on the expiration time of the DMC sub-CA certificate. If the DMC is determined to be valid, the CAS server sends a cryptographic identity for the client device and a CAS client to the client device protected using the DMC. At a later time, if the DMC key size is considered to be still sufficiently secure, the validity of the DMC is extended by issuing a new DMC sub-CA certificate with the same public key as the original DMC sub-CA certificate. | 12-09-2010 |
20110161661 | ENHANCED AUTHORIZATION PROCESS USING DIGITAL SIGNATURES - A method is provided for enhancing security of a communication session between first and second endpoints which employs a key management protocol. The method includes sending a first message to a first end point over a communications network requesting a secure communication session therewith. The message includes an identity of a second end point requesting the authenticated communication session. A digital certificate is received from the first endpoint over the communications network. The digital certificate is issued by a certifying source verifying information contained in the digital certificate. The digital certificate includes a plurality of fields, one or more of which are transformed in accordance with a transformation algorithm. A reverse transform is applied to the one or more transformed fields to obtain the one or more fields. The digital certificate is validated and a second message is sent to the first endpoint indicating that validation is complete. | 06-30-2011 |
20110196793 | GENERIC FEATURE LICENSING FRAMEWORK - A system enables customers to provision devices with feature licenses that enable specified features in the devices. The system includes a feature definition module configured to store product feature information associated with different products available from a plurality of different manufacturers. The system also includes a feature license management module configured to generate, update and revoke feature licenses. The feature licenses that are generated all have a common format. The system further includes a feature credit management module configured to monitor and account for feature credits available to customer organization units. A user management module is also provided in the system, which is configured to authenticate users of the system. A user interface is accessible over a communications network through which authenticated users can request and receive feature licenses. | 08-11-2011 |
20110197077 | SOFTWARE FEATURE AUTHORIZATION THROUGH DELEGATED AGENTS - A method enables selected features of a software product residing on an end user electronic device with a license delivered from a licensing provider to a service provider of the end user electronic device. The method includes requesting at least one license to authorize a first service provider. An encrypted installation key uniquely associated with the first service provider is received as well as an authorization agent module for installation on one or more authorization agent devices associated with the first service provider. The encrypted installation key and the authorization agent module are installed on the authorization agent devices. A device-unique identifier (DUID) is generated for each authorization agent device based on hardware characteristics of the respective authorization agent devices. The DUID and the encrypted installation key are sent from the authorization agent device to a licensing provider to obtain the requested license. The requested license is received by the authorization agent devices if the DUID and the encrypted installation key are validated by the licensing provider. The license on authorization agent device authorizes and enables the selected features of the software product on an end user electronic device. | 08-11-2011 |
20110246646 | Locating Network Resources for an Entity based on its Digital Certificate - A method and apparatus are provided for locating network resources over a communication network. The method includes receiving a digital certificate identifying a first entity and extracting information from at least one predetermined field of the digital certificate. The extracted information is used as input to a location generation function to create a resource locator (e.g., a URL). The network resource is contacted over the communication network in accordance with a communication protocol using the resource locator to obtain requested information concerning the first entity. | 10-06-2011 |
20120042160 | SYSTEM AND METHOD FOR COGNIZANT TRANSPORT LAYER SECURITY (CTLS) - A method of authentication and authorization over a communications system is provided. Disclosed herein are systems and methods for creating a cryptographic evidence, called authentication/authorization evidence, AE, when a successful authentication/authorization between a client and an authentication server is complete. There are a variety of methods for generating AE. For instance, the AE can be data that is exchanged during the authentication signaling or data that results from it. A distinctive point being that AE results from the authentication process and is used as prior state for the following TLS exchange. An example for creation of AE, is as follows: EAP authentications typically result in an Extended Master Session Key (EMSK). The EMSK can be used to create an Evidence Master Key (EMK) that can then be used to create AE for a variety of servers. | 02-16-2012 |
20120143766 | Secure Large Volume Feature License Provisioning System - Disclosed is a manufacturing process and feature licensing system for provisioning personalized (device-unique) licenses to devices. The secure system uses a secure key wrapping mechanism to deliver the LSK to LPS. Another feature is that various network communication links are secured using standard security protocol. Application messages, license templates, licenses are digitally signed. The system is flexible, configured to allow multiple manufacturers and to allow various feature configurations via the use of License Template; scalable, as it is possible to use multiple LPS hosts to serve multiple programming stations; and available in that the delegation of license signing capability from CLS to LPS eliminates the dependency on unreliable Internet connections. Redundant LPS hosts provide high level of availability required for high volume license provisioning. The system is traceable: license and device association are replicated back to the CLS to provide full license request and generation traceability. | 06-07-2012 |
20120204269 | SECURE AUTOMATED FEATURE LICENSE UPDATE SYSTEM AND METHODS - A method for providing a secure automated feature license update is disclosed. This method may be performed at a central license server. A license template including features for enablement on a device is generated. The license template is sent to an authorized user. A license update request is received from an entity. An updated license is generated by the central license server. A response is sent to the entity. | 08-09-2012 |
20120303951 | METHOD AND SYSTEM FOR REGISTERING A DRM CLIENT - A client, method and system for registering a DRM client is disclosed. The method ( | 11-29-2012 |
20130185173 | FEATURE LICENSING FRAMEWORK FOR THIRD PARTY FEATURE CREDIT MANAGEMENT - A method and apparatus for provisioning devices. One method includes authenticating a first customer as an authenticated user and receiving from a first customer a first request to establish a credit record for a specified number of upgraded feature licenses. The upgraded feature licenses are obtainable from a third party supplier and are associated with components available from the third party supplier. The credit record includes feature credits to be made available to the first customer to obtain the upgraded feature licenses from the third party supplier. A second request is received from the first customer to release the feature credits to a credit pool associated with the first customer so that the feature credits are available to the first customer. The upgraded feature licenses are generated and the credit pool associated with the first customer is debited for the number of credits needed to obtain the upgraded feature licenses. | 07-18-2013 |
20130185551 | REVOCATION LIST UPDATE FOR DEVICES - In one embodiment, a method includes receiving a revocation request for revoking a model type of a device. A first computing device determines a list of device unit identifiers (UIDs) that are associated with the model type from a database. The device UIDs are for devices of the model type manufactured by a first entity. The method adds the list of device UIDs to a device revocation list and outputs the device revocation list to revoke a validity of secure information associated with devices associated with the list of device UIDs. | 07-18-2013 |
20130297940 | AUTHENTICATION IN COMMUNICATIONS NETWORKS - The invention relates to a method of authenticating a user equipment in a communications network. The method involves sending a message from a network entity to the user equipment. This message includes a set of options for an authentication procedure for authenticating an internet protocol communication over a first interface between the user equipment and the network entity; said options including a “shared key”-based authentication procedure. The method also involves selecting an option from the set. In the event that the “shared-key”-based authentication procedure is selected, a shared secret from a security key established in a generic bootstrapping architecture (GBA) is generated over a second interface between the user equipment and a bootstrapping service function. The shared secret is then used to compute and verify authentication payloads in the key-based authentication procedure for the communication over the first interface. | 11-07-2013 |
20140029747 | SYSTEM AND METHOD FOR TRANSCODING CONTENT - A system is provided for use with secure content in a first format. The system includes a conditional access device, a transcoding device and a media processor. The conditional access device is operable to receive the secure content and can generate a second secure content based on the secure content. The conditional access device can further provide the second secure content to the transcoding device. The transcoding device can transcode the second secure content into transcoded content of a second format, can secure the transcoded content as secure transcoded content and can provide the secure transcoded content to the media processor | 01-30-2014 |
20140082358 | EFFICIENT KEY GENERATOR FOR DISTRIBUTION OF SENSITIVE MATERIAL FROM MULITPLE APPLICATION SERVICE PROVIDERS TO A SECURE ELEMENT SUCH AS A UNIVERSAL INTEGRATED CIRCUIT CARD (UICC) - A method provides end-to-end security for transport of a profile to a target device (e.g., a mobile computing device) over at least one communications network that includes a plurality of nodes. In accordance with the method, the profile is encrypted for transport between the target device and an initial node of the network through which the profile is transported. The encryption is an end-to-end inner layer encryption performed prior to hop-to-hop encryption. The encrypting uses a public key of a public, private key pair. The private key is derivable from a seed securely provisioned in the target device using a public key algorithm. The encrypted profile is transmitted over the communications network to the target device. | 03-20-2014 |
20140082359 | EFFICIENT KEY GENERATOR FOR DISTRIBUTION OF SENSITIVE MATERIAL FROM MULTIPLE APPLICATION SERVICE PROVIDERS TO A SECURE ELEMENT SUCH AS A UNIVERSAL INTEGRATED CIRCUIT CARD (UICC) - A method provides end-to-end security for transport of a profile to a target device (e.g., a mobile computing device) over at least one communications network that includes a plurality of nodes. In accordance with the method, the profile is encrypted for transport between the target device and an initial node of the network through which the profile is transported. The encryption is an end-to-end inner layer encryption performed prior to hop-to-hop encryption. The encrypting uses a public key of a public, private key pair. The private key is derivable from a seed securely provisioned in the target device using a public key algorithm. The encrypted profile is transmitted over the communications network to the target device. | 03-20-2014 |
20140280828 | FEATURE LICENSE-RELATED REPAIR/REPLACEMENT PROCESSES AND CREDIT HANDLING - A system and method for issuing a license for a device through a license server is provided. A server receives identification information for a device that communicates to the server if a first license binding identity and/or a first display identity has changed. A previous license for the device is revoked and a previous license credit is returned to a user's credit pool if the first license binding identity and/or the first display identity has changed. A license request is received, which includes a second license binding identity identifying the device. If the second license binding identity is the same as the first license binding identity, the previous license for the device is issued. If the second license binding identity is not the same as the first license binding identity, a new license for the device is issued and a new license credit is deducted from the user's credit pool. | 09-18-2014 |
20140281502 | METHOD AND APPARATUS FOR EMBEDDING SECRET INFORMATION IN DIGITAL CERTIFICATES - A method and system is provided for embedding cryptographically modified versions of secret in digital certificates for use in authenticating devices and in providing services subject to conditional access conditions. | 09-18-2014 |