0
`4,712,239
`[11] Patent Number:
`[19]
`United States Patent
`
`Frezza et al.
`[45] Dates of Patent:
`Dec. 8, 1987
`
`[54] SECURITY ARRANGEMENT FOR
`DOWNLOADABLE CABLE TELEVISION
`
`...................... .. 380/20
`9/1985 Cooper et a1.
`4,542,407
`4,558,464 12/1985 O’Brien ................................. 380/20
`
`[75]
`
`CONVERTERS
`Inventors: William Frezn, Warminster; Robert
`Siinons, Lansdale; Richard Westerfer,
`Norristown, all of Pa.
`_
`_
`[73] A3“‘3“‘°‘ G°"°"l I"‘“'“"‘°“‘ C°"l’°"‘u°“v
`Ncw York’ N'Y'
`[21] App], No_; 874,845
`.
`_
`Jun‘ 16’ 1986
`[22] Filed’
`[51]
`Int. Cl.‘ ...................... .. H04N 7/167; H04-L 9/00
`[52] U.S. Cl. ...................................... 380/20; 358/349;
`.
`380/13; 380/49; 455/4
`FlCld Of
`........................... .. 20, 13,
`353/349; 455/4
`
`[56]
`
`Referem Cited
`us. PATENT DOCUMENTS
`
`Primary Examiner-—Stephen C. Buczinski
`A”0"'9.V: 1489"‘: 07‘ Fi"m—'Bal‘1'Y R- Lipsitzs Esq-
`[57]
`ABS-I-RACI
`d
`h
`d
`bod
`A
`met
`apparatus prevent unaut orize
`an
`ro-
`gramming viewing via a downloadable cable televilsaion
`converter. A booter checksum is computed from data
`contained in a downloaded booter image. A valid
`checksum is extracted from tag data associated with a
`scrambled program signal transmitted on the cable sys-
`tem. The booter checksum is compared to the extracted
`valid checksum. If the booter checksum and valid
`checksums match, a descrambler is enabled to descram-=
`ble the scrambled Pfogfajn signal_
`the checksums do
`not match, the descrambler is not enabled. In this man-
`ner, a pirate is preventedlfromoownloading a false
`booter image to defeat the integrity of the converter.
`
`4,054,911 10/1977 Fletcher et al.
`
`...................... 358/86
`
`11
`
`1 Drawing Figure
`
` V|DEO SIGNAL /
`RF ours: rr TO
`TAG DATA
` DESCRAMBLER
`TELEVIS. 3N
`W//4
`
`
`
`
`ADDRESSABLE
`DATA STREAM
`
`PMC Exhibit 213
`
`Apple v. PM
`
`|PR2016b-0075
`Page 1
`
`TAG /SYNCH
`DATA
`
`
`
`BOOTER
`IMAGE
`
`PMC Exhibit 2134
`Apple v. PMC
`IPR2016-00753
`Page 1
`
`

`
`U.S. Patent
`
`Dec. 8,1987
`
`Sheet 1 ofl
`
`4,712,239
`
`zo_m_>m._EE53.8“E
`
`E._ms_<mommo
`
`<2003.\._<zo_m89>
`
`n._._m<mmmmoa<
`
`zqmmbm3.40
`
`mommuoomn.
`
`..Q5..2
`
`~vN
`
`:oz>m\03.
`
`<._.<o
`
`M4_9...Ex...
`
`mm>_momm
`
`PMC Exhibit 213
`
`Apple v. PM
`|PR2016-0075
`
`Page
`
`PMC Exhibit 2134
`Apple v. PMC
`IPR2016-00753
`Page 2
`
`
`
`
`
`
`

`
`4,712,239
`
`1
`
`SECURITY ARRANGEMENT FOR
`DOWNLOADABLE CABLE TELEVISION
`CONVERTERS
`
`FIELD OF THE INVENTION:
`
`This invention relates to cable television systems
`using downloadable converters, and more particularly,
`to a method and apparatus for preventing unauthorized
`parties from illegitimate access to cable television pro-
`grams.
`
`BACKGROUND OF THE INVENTION:
`
`Cable television (CATV) systems which provide
`access to regular television programming and “pre-
`mium” or “pay-per-view” programming are well
`known. It has long been desirable to introduce fully
`downloadable CATV converters which can accept all
`of their operating software from a booter channel upon
`power up. Downloadable converters are easier to main-
`tain than known read only memory (ROM) based prod-
`ucts, and provide the additional advantage of allowing
`field upgradeability and customization as new features
`are introduced in a cable television system. Further,
`downloadable converters can serve as an essential
`bridge, via emulation software, for systems which wish
`to retire older products in a phased manner.
`One important obstacle that has prevented the devel-
`opment of one-way CATV systems with downloadable
`converters is the issue of software security. For exam-
`ple, a “pirate” booter image could be loaded into a
`converter (e.g., by a subscriber who wants to receive
`premium channels without paying), which could defeat
`the integrity of the converter by permitting all video
`programs to be unscrambled without permission. This
`problem has been solved in a two-way CATV system
`using a technique described in co-pending, commonly
`assigned U.S. patent application Ser. No. 726,676, filed
`Apr. 24, 1985, entitled “Bootstrap Channel Security
`Arrangement for Communication Network”, and incor-
`porated herein by reference. In the apparatus and
`method disclosed in the co-pending application, soft-
`ware is downloaded on a booter channel via a commu-
`nication network. A subscriber terminal coupled to the
`network initiates a communication with the network to
`receive downloaded booter data. The downloaded data
`is stored, and a checksum is computed from at least a
`portion of the downloaded data. The checksum is tested
`for validity, and control of the subscriber terminal is
`released to the downloaded software only if the check-
`sumis valid.
`It would be advantageous to provide a method and
`apparatus for securing the booter image in one-way
`CATV systems. In one-way systems, there is no ability
`to transfer a computed checksum back to the headend
`for verification. Thus, a system must be provided
`wherein verification of the booter image occurs at the
`subscriber converter, and wherein an illegitimate booter
`image prevents the converter from enabling the view-
`ing of an unauthorized program. The present invention
`relates to such an apparatus and method.
`SUMMARY OF THE INVENTION
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`45
`
`50
`
`55
`
`In accordance with the present invention, the booter
`image on a one-way CATV system using downloadable
`converters is secured to prevent unauthorized receipt of
`programming. In one embodiment, the video descram-
`bling process is disabled unless a valid checksum is
`
`65
`
`2
`computed from the downloaded booter image. Such
`apparatus includes means for computing a booter
`checksum from data contained in a downloaded booter
`image. Means, coupled to receive a program signal,
`extract a valid checksum from tag data associated with
`the signal. The booter checksum is compared to the
`extracted valid checksum, and if a match is found, a
`descrambler is enabled to unscramble the program sig-
`nal.
`Means can be provided for storing the booter check-
`sum after it is computed at the converter. The storing
`means can then be inhibited from storing another check-
`sum until a new booter image is downloaded.
`In accordance with the method of the present inven-
`tion, unauthorized parties are precluded from obtaining
`illegitimate access to cable television programs in a
`cable system in which a booter image is downloaded to
`subscriber converters. A booter checksum is computed
`from booter image data downloaded to a subscriber
`converter. The booter checksum is compared to a valid
`checksum extracted from data associated with a televi-
`sion signal received via the cable system. A subscriber is
`prevented from viewing a scrambled program unless
`the checksum computed from the booter image matches
`the valid checksum. The booter image and valid check-
`sum data can be changed on a periodic basis to further
`frustrate the efforts of a pirate who attempts to over-
`come the checksum security feature.
`BRIEF DESCRIPTION OF THE DRAWING
`
`The FIGURE is a block diagram illustrating the
`pertinent parts of a CATV converter/descrambler in
`accordance with the present invention.
`DETAILED DESCRIPTION OF THE
`INVENTION
`—
`
`The present invention provides security for a booter
`image downloaded to a cable television converter from
`a cable television system headend.
`As diagrammatically shown in the FIGURE, 21 cable
`television converter 11 is coupled to a cable television
`system via an input terminal 10. The cable system
`carries various signals, including a video signal which
`can have tag data associated therewith as illustrated by
`line 12, and an addressable data stream as illustrated by
`line 14. The provision of the video signal/tag data and
`addressable data stream are conventional, and have
`been used in conjunction with known cable television
`converters such as that manufactured by the Jerrold
`Division of General Instrument Corporation and desig-
`nated as Model No. DRZN-3A.
`In accordance with the present invention, an addi-
`tional signal is transmitted via the cable system in the
`form of a booter image, designated by line 16 in the
`FIGURE. Like the addressable data stream, which is
`typically delivered via a 14 kilobit per second (kb/s)
`FM data stream, the booter image is transmitted via a
`second FM data stream that is added to the cable system
`and dedicated to the booter image. This “booter chan-
`nel” cyclically transmits operating software to the con-
`verter. A frequency agile FM receiver 18 is provided in
`converter 11 to receive either the addressable data
`stream or the booter image from the cable system.
`When converter 11 is powered up, an initialization pro-
`gram stored in the “BOOT ROM” 30 force tunes re-
`ceiver 18 (via microprocessor 24) to the booter channel
`on which the incoming booter image appears. The
`
`PMC Exhibit 213
`
`Apple v. PM
`|PR2016-0075
`
`Page
`
`PMC Exhibit 2134
`Apple v. PMC
`IPR2016-00753
`Page 3
`
`

`
`3
`booter image is received by receiver 18 and the data
`(including the converter operating software) contained
`therein is loaded into the converter’s random access
`memory (RAM) 32.
`After downloading of the booter image is complete,
`receiver 18 is retuned to the channel which contains the
`addressable data stream. Data from the addressable data
`stream is stored, during the operation of converter 11
`and in accordance with the operating software, in RAM
`32 or RAM 34 via the converter’s microprocessor 24. A
`battery 36 provides backup for RAM 34 in the event of
`a power failure, thereby maintaining the data stored in
`RAM 34.
`
`Signals contained in the addressable data stream re-
`ceived by frequency agile receiver 18 are placed on the
`cable by the cable system operator to define, for exam-
`ple, which programs the subscriber using the converter
`is authorized to receive. The data detected by receiver
`18 is transmitted to microprocessor 24 in a conventional
`manner.
`
`Converter 11 includes a timer 20 which is coupled to
`the incoming cable at input terminal 10. Tuner 20 is a
`dual conversion tuner which produces modulated video
`and audio carriers at its output for one of a plurality of
`channels transmitted over the cable. A subscriber se-
`lects a channel using a keyboard (not shown) coupled to
`microprocessor 24 or alternately, with a hand-held re-
`mote control unit (not shown) which interfaces with
`microprocessor 24 using, e.g., well-known infrared sig-
`nal transmission means. Microprocessor 24 decodes the
`chaimel information and sends a signal to tuner 20 to
`tune in the selected channel.
`The modulated carrier for the selected channel is
`passed from the output of tuner 20 to a descrambler 26,
`which may be of the gated RF synch suppression type,
`and to an AM receiver 22. The modulated carrier con-
`tains audio and video signals. In the case of a premium
`channel, the video signals are scrambled. AM receiver
`~ 22 detects the synchronization data for use by descram-
`bler 26, and couples this data to microprocessor 24.
`vMicroprocessor 24 decodes the synchronization data
`from AM receiver 22 and forwards it to descrambler 26.
`Descrambler 26 can comprise a descrambling univer-
`sal logic array (ULA) which is programmed to perform
`the descrambling function. A special register 28 is pro-
`vided in the descrambling ULA into which a booter
`checksum is loaded. The booter checksum is computed
`by microprocessor 24, in accordance with the boot
`ROM 30 software, from the booter image received
`during initialization by frequency agile receiver 18.
`Only one such load of a checksum into special register
`28 is accepted per initialization. Thus, a downloaded
`booter image cannot write to special register 28 without
`initiating a re-boot. After special register 28 is loaded
`with the checksum computed from the booter image,
`control is turned over to the booter operating software
`downloaded into RAM 32.
`
`~
`
`Each program transmitted by the cable system opera-
`tor includes tag data which is detected by AM receiver
`22 and forwarded to microprocessor 24. In accordance
`with the present invention, the tag data (which may be
`transmitted either on the audio carrier or with the video
`signal of the transmitted program) will include a valid
`security checksum for all scrambled channels. The de-
`scrambling ULA of descrambler 26 extracts this valid
`checksum via microprocessor 24 and compares it to the
`one loaded into special register 28. If the checksum
`computed from the booter image (“booter checksum”)
`
`5
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`50
`
`55
`
`65
`
`4,712,239
`
`4
`matches the valid checksum extracted from the tag
`data, descrambler 26 is enabled and scrambled pro-
`grams which the subscriber is authorized to receive are
`descrambled for viewing. If the booter checksum and
`valid checksum do not match, the descrambler will not
`descramble the video, thereby protecting the converter
`from pirates seeking to enable the descrambler using an
`illegitimate booter image.
`It will now be understood that the present invention
`secures downloadable CATV converters against pirates
`who attempt to enable descrambling of a scrambled
`program by downloading an illegitimate booter image
`to the converter. The CATV converter includes RAM
`memory for receiving downloaded software on a sepa-
`rate booter channel. The advantage of such a converter
`is that it is reprogrammable from the headend. A fre-
`quency agile FM receiver l8 is provided to capture the
`booter image upon initialization of the converter when
`it is powered up. An initialization program stored in
`boot ROM 30, operating in conjunction with micro-
`processor 24, computes a checksum from the down-
`loaded booter image. This checksum is stored in a spe-
`cial checksum register 28 prior to turning control of the
`converter over to the downloaded booter image soft-
`ware.
`
`In operation, the descrambler 26 compares the con-
`tents of the special checksum register to a transmitted
`program checksum carried in program tag data. De-
`scrambling is enabled only if the checksums match.
`Hardwired logic in the descrambler ULA prevents the
`downloaded program from changing the contents of the
`checksum register. In this manner, a pirate is prevented
`from downloading a false booter image to defeat the
`integrity of the converter.
`We claim:
`
`1. Apparatus for preventing unauthorized receipt of
`programming in a downloadablecable television con-
`verter comprising:
`receiver means for receiving data downloaded via a
`cable televison network;
`means for automatically tuning said receiver means to
`a dedicated booter charmel for receipt of data com-
`prising a booter image when said converter is pow-
`ered up;
`means for subsequently tuning said receiver means to
`a separate channel for receipt of additional data
`after receipt of said booter image;
`means for computing a booter checksum from data
`contained in said booter image;
`means, coupled to receive a program signal, for ex-
`tracting a valid checksum from tag data associated
`with said signal;
`means for comparing the booter checksum to said
`extracted valid checksum;
`a descramber coupled to receive at least a portion of
`said program signal to be descrambled; and
`means operatively associated with said descrambler
`for enabling the descrambler to operate only if said
`comparing means determines that
`the booter
`checksum matches the extracted valid checksum.
`2. The apparatus of claim 1 further comprising:
`means for storing the booter checksum;
`means for coupling said storing means to said com-
`paring means; and
`means operatively associated with said comparing
`means for retrieving the booter checksum from the
`storing means for comparing with the extracted
`valid checksum.
`
`PMC Exhibit 213
`
`Apple v. PM
`|PR2016-0075
`
`Page
`
`PMC Exhibit 2134
`Apple v. PMC
`IPR2016-00753
`Page 4
`
`

`
`4,712,239
`
`5
`
`10
`
`15
`
`_
`5
`means for subsequently tuning said first receiver
`IP93“ t0 3 5¢P31’3t€_Cha1m€1_
`fol‘ 1'4‘-0€l_Pf Of addi-
`tmnal data after “Capt °f Smd b°°t°’ “"33”?
`means for computing a booter checksum from data
`contained in a downloaded booter image;
`means coupled to said second receiver means for
`extracting a valid checksum from data associated
`with a rcccivcd television signal;
`means for comparing the booter checksum to the
`extracted valid checksum; and
`means for preventing a user from viewing a program
`I0
`1'°Pl'°d“‘_3ed f1'0m 3 1'€C¢1VFd t€1¢V1510fl
`5181131
`‘f sad °°mP‘“'m9 means determmes that the boot“
`checksum does not match the extracted valid
`checksum.
`.
`.
`.
`8. The cable television converter of claim 7 further
`comprising:
`a descrambler coupled to receive and descramble
`television signals from said second receiver;
`said preventing means operatively associated with
`said descrambler to inhibit the operation of the
`descrambler if the booter checksum and Valid
`checksum do not match.
`9. The communication system of claim 7 wherein said
`25 first receiver means is an FM receiver.
`10. A method for preventing unauthorized parties
`ill
`'tim
`bl
`1
`'
`‘
`’
`
`5
`3, The apparatus of claim 2 wherein said booter
`checksum is computered and stored upon downloading
`of the booter image, said apparatus further comprising:
`means for inhibiting said storing means from storing
`another checksum until a booter image is again
`d°wn1°‘_“?°d'
`_
`l
`_
`_
`4. A television oommumcation system comprising:
`3 t1'8n3mi53i°n Path fol’ Carrying t°1°Visi°“ Signals
`from a headend to subscriber converters;
`means for downloading a booter image to a sub.
`scriber converter via said transmission path, said
`converter comprising receiver means for receiving
`downloaded data, means for automatically tuning
`.
`.
`.
`said receiver means to a dedicated booter channel
`.
`.
`.
`for receipt of said booter image when the converter
`i5 P°“’°’°d “P, and means f°r Subsequemly tuning
`Said 1'°C¢‘-iV¢1' 316335 *0 3 Sfipafate Chalmfil f°1' 1'3‘
`ceipt of additional data after receipt of said booter 20
`image;
`means for computing a booter checksum from said
`booter image;
`mcms for extracting a valid checksum from tag
`data contained in a televison signal received at
`said converter;
`means
`extracted Valid °h°°k5“m5
`3 dewramblef °P°T3tiVC1Y associawd with Said 30
`converter for descrambling television signals;
`and
`means operatively associated with said descram-
`bler for
`the dcscramblcr to opgl-ate only
`if said comparing means determines that
`the 35
`booter checksum matches the extracted valid
`checksum.
`C05‘ The °°mmm_‘icafi°n system ofclaim 4 wherein said
`“V° er °°mP“5°S‘
`second receiver means for receiving television sig-
`na1S-
`6. The communication system of claim 4 wherein said
`receiver means is an FM receiver.
`7. A cable television converter comprising:
`first receiver means for receiving a booter image to be
`downloaded to the converter from a dedicated
`.
`.
`.
`.
`.
`.
`booter channel;
`seamd receiver means for recewmg televlslon 513' 50
`"3153
`_
`_
`_
`means for _t11mfl8 Said first
`fe°e1V¢f means “P011
`power up to said booter channel to effect a booter
`image download;
`
`.
`
`to
`
`f
`
`to subscriber converters, comprising the steps of:
`tuning a data receiver in a subscriber terminal to a
`booter channel
`to receive downloaded booter
`image data;
`re-tuning said data receive to a separate channel for
`I'eCCipt ‘ Of 3dditiOIlal data after l'CCCipt Of
`b°°t"_’ “M33 data?
`_
`_
`computmgabooter checksum from Said mote” Image
`data;
`comparing the booter checksum to a valid checksum
`extracted from data associated with a television
`signal received by the subscriber converter via the
`cablc system; and
`preventing a subscriber from viewing a program to be
`reproduced from a received television signal unless
`the checksum computed from the booter image
`matches the Valid ¢hF°k5“m-
`_
`.
`11' The m°th°d °f Clam‘ 10 °°mP“5mg the further
`Stags ofil
`d.
`b
`t
`.
`t
`.d
`b
`.b
`,
`oxmglal ing a 00 er image 0 sai
`su scri er con-
`transmitting a television signal with associated valid
`checksum data to said subscriber converter; and
`changing the booter image and validchecksum data
`on a periodic basis.
`"
`*
`
`*
`
`*
`
`*
`
`40
`
`45
`
`55
`
`60
`
`65
`
`PMC Exhibit 213
`
`Apple v. PM
`|PR2016-0075
`
`Page
`
`PMC Exhibit 2134
`Apple v. PMC
`IPR2016-00753
`Page 5