United States Patent [19J
`Frezza et al.
`
`[11] Patent Number:
`[45] Date of Patent:
`
`4,712,239
`Dec. 8, 1987
`
`[75]
`
`[54] SECURITY ARRANGEMENT FOR
`DOWNLOADABLE CABLE TELEVISION
`CONVERTERS
`Inventors: William Frezza, Warminster; Robert
`Simons, Lansdale; Richard Westerfer,
`Norristown, all of Pa.
`[73] Assignee: General Instrument Corporation,
`New York, N.Y.
`[21] Appl. No.: 874,845
`Jun. 16, 1986
`[22] Filed:
`Int. Cl.4 ........................ H04N 7/167; H04L 9/00
`[51]
`[52] u.s. Cl. ······································ 380/20; 358/349;
`380/13; 380/49; 455/4
`[58] Field of Search ............................. 380/20, 13, 49;
`358/349; 455/4
`
`[56]
`
`References Cited
`U.S. PATENT DOCUMENTS
`4,054,911 10/1977 Fletcher et al ....................... 358/86
`
`4,542,407 9/1985 Cooper et al ......................... 380/20
`4,558,464 12/1985 O'Brien ................................. 380/20
`Primary Examiner-Stephen C. Buczinski
`Attorney, Agent, or Firm-Barry R. Lipsitz, Esq.
`[57]
`ABSI'RACf
`A method and apparatus prevent unauthorized pro(cid:173)
`gramming viewing via a downloadable cable television
`converter. A hooter checksum is computed from data
`contained in a downloaded hooter image. A valid
`checksum is extracted from tag data associated with a
`scrambled program signal transmitted on the cable sys(cid:173)
`tem. The hooter checksum is compared to the extracted
`valid checksum. If the hooter checksum and valid
`checksums match, a descrambler is enabled to descram(cid:173)
`ble the scrambled program signal. If the checksums do
`not match, the descrambler is not enabled. In this man(cid:173)
`ner, a pirate is prevented from downloading a false
`hooter image to defeat the integrity of the converter.
`
`11 Claims, 1 Drawing Figure
`
`VIDEO SIGNAL I
`TAG DATA
`
`RF OUTP IT TO
`TELEVISo !!:!...
`
`16
`
`APPLE EX. 1006
`Page 1
`
`

`
`II
`
`VIDEO SIGNAL I
`TAG DATA
`
`RF OUTPUT TO
`TELEVISION
`
`16
`
`APPLE EX. 1006
`Page 2
`
`

`
`4,712,239
`
`1
`
`SECURITY ARRANGEMENT FOR
`DOWNLOADABLE CABLE TELEVISION
`CONVERTERS
`
`2
`computed from the downloaded booter image. Such
`apparatus includes means for computing a booter
`checksum from data contained in a downloaded booter
`image. Means, coupled to receive a program signal,
`5 extract a valid checksum from tag data associated with
`the signal. The booter checksum is compared to the
`extracted valid checksum, and if a match is found, a
`descrambler is enabled to unscramble the program sig-
`nal.
`Means can be provided for storing the booter check-
`sum after it is computed at the converter. The storing
`means can then be inhibited from storing another check(cid:173)
`sum until a new booter image is downloaded.
`In accordance with the method of the present inven(cid:173)
`tion, unauthorized parties are precluded from obtaining
`illegitimate access to cable television programs in a
`cable system in which a booter image is downloaded to
`subscriber converters. A booter checksum is computed
`from booter image data downloaded to a subscriber
`converter. The booter checksum is compared to a valid
`checksum extracted from data associated with a televi-
`sion signal received via the cable system. A subscriber is
`prevented from viewing a scrambled program unless
`the checksum computed from the booter image matches
`the valid checksum. The booter image and valid check(cid:173)
`sum data can be changed on a periodic basis to further
`frustrate the efforts of a pirate who attempts to over(cid:173)
`come the checksum security feature.
`
`FIELD OF THE INVENTION:
`This invention relates to cable television systems
`using downloadable converters, and more particularly,
`to a method and apparatus for preventing unauthorized
`parties from illegitimate access to cable television pro- 10
`grams.
`
`BACKGROUND OF THE INVENTION:
`Cable television (CATV) systems which provide
`access to regular television programming and "pre- 15
`mium" or "pay-per-view" programming are well
`known. It has long been desirable to introduce fully
`downloadable CATV converters which can accept all
`of their operating software from a booter channel upon
`power up. Downloadable converters are easier to main- 20
`tain than known read only memory (ROM) based prod(cid:173)
`ucts, and provide the additional advantage of allowing
`field upgradeability and customization as new features
`are introduced in a cable television system. Further,
`downloadable converters can serve as an essential 25
`bridge, via emulation software, for systems which wish
`to retire older products in a phased manner.
`One important obstacle that has prevented the devel(cid:173)
`opment of one-way CATV systems with downloadable
`converters is the issue of software security. For exam- 30
`pie, a "pirate" booter image could be loaded into a
`converter (e.g., by a subscriber who wants to receive
`premium channels without paying), which could defeat
`the integrity of the converter by permitting all video
`programs to be unscrambled without permission. This 35
`problem has been solved in a two-way CATV system
`using a technique described in co-pending, commonly
`assigned U.S. patent application Ser. No. 726,676, filed
`Apr. 24, 1985, entitled "Bootstrap Channel Security
`Arrangement for Communication Network", and incor- 40
`porated herein by reference. In the apparatus and
`method disclosed in the co-pending application, soft(cid:173)
`ware is downloaded on a booter channel via a commu(cid:173)
`nication network. A subscriber terminal coupled to the
`network initiates a communication with the network to 45
`receive downloaded booter data. The downloaded data
`is stored, and a checksum is computed from at least a
`portion of the downloaded data. The checksum is tested
`for validity, and control of the subscriber terminal is
`released to the downloaded software only if the check- 50
`sum· is valid.
`It would be advantageous to provide a method and
`apparatus for securing the booter image in one-way
`CATV systems. In one-way systems, there is no ability
`to transfer a computed checksum back to the headend 55
`for verification. Thus, a system must be provided
`wherein verification of the booter image occurs at the
`subscriber converter, and wherein an illegitimate booter
`image prevents the converter from enabling the view(cid:173)
`ing of an unauthorized program. The present invention 60
`relates to such an apparatus and method.
`
`SUMMARY OF THE INVENTION
`In accordance with the present invention, the booter
`image on a one-way CATV &ystem using downloadable 65
`converters is secured to prevent unauthorized receipt of
`programming. In one embodiment, the video descram(cid:173)
`bling process is disabled unless a valid checksum is
`
`BRIEF DESCRIPTION OF THE ORA WING
`The FIGURE is a block diagram illustrating the
`pertinent parts of a CATV converter/descrambler in
`accordance with the present invention.
`
`DETAILED DESCRIPTION OF THE
`INVENTION
`The present invention provides security for a booter
`image downloaded to a cable television converter from
`a cable television system headend.
`As diagrammatically shown in the FIGURE, a cable
`television converter 11 is coupled to a cable television
`system via an input terminal 10. The cable system
`carries various signals, including a video signal which
`can have tag data associated therewith as illustrated by
`line 12, and an addressable data stream as illustrated by
`line 14. The provision of the video signal/tag data and
`addressable data stream are conventional, and have
`been used in conjunction with known cable television
`converters such as that manufactured by the Jerrold
`Division of General Instrument Corporation and desig(cid:173)
`nated as Model No. DRZN-3A.
`In accordance with the present invention, an addi(cid:173)
`tional signal is transmitted via the cable system in the
`form of a booter image, designated by line 16 in the
`FIGURE. Like the addressable data stream, which is
`typically delivered via a 14 kilobit per second (kb/s)
`FM data stream, the booter image is transmitted via a
`second FM data stream that is added to the cable system
`and dedicated to the booter image. This "booter chan(cid:173)
`nel" cyclically transmits operating softwar~ to the con(cid:173)
`verter. A frequency agile FM receiver 18 is provided in
`converter 11 to receive either the addressable data
`stream or the booter image from the cable system.
`When converter 11 is powered up, an initialization pro(cid:173)
`gram stored in the "BOOT ROM" 30 force tunes re(cid:173)
`ceiver 18 (via microprocessor 24) to the booter channel
`on which the incoming hooter image appears. The
`
`APPLE EX. 1006
`Page 3
`
`

`
`20
`
`3
`hooter image is received by receiver 18 and the data
`(including the converter operating software) contained
`therein is loaded into the converter's random access
`memory (RAM) 32.
`After downloading of the hooter image is complete, 5
`receiver 18 is retuned to the channel which contains the
`addressable data stream. Data from the addressable data
`stream is stored, during the operation of converter 11
`and in accordance with the operating software, in RAM
`32 or RAM 34 via the converter's microprocessor 24. A 10
`battery 36 provides backup for RAM 34 in the event of
`a power failure, thereby maintaining the data stored in
`RAM34.
`Signals contained in the addressable data stream re(cid:173)
`ceived by frequency agile receiver 18 are placed on the 15
`cable by the cable system operator to defme, for exam(cid:173)
`ple, which programs the subscriber using the converter
`is authorized to receive. The data detected by receiver
`18 is transmitted to microprocessor 24 in a conventional
`manner.
`Converter 11 includes a tuner 20 which is coupled to
`the incoming cable at input terminal 10. Tuner 20 is a
`dual conversion tuner which produces modulated video
`and audio carriers at its output for one of a plurality of
`channels transmitted over the cable. A subscriber se- 25
`lects a channel using a keyboard (not shown) coupled to
`microprocessor 24 or alternately, with a hand-held re(cid:173)
`mote control unit (not shown) which interfaces with
`microprocessor 24 using, e.g., well-known infrared sig(cid:173)
`nal transmission means. Microprocessor 24 decodes the 30
`channel information and sends a signal to tuner 20 to
`tune in the selected channel.
`The modulated carrier for the selected channel is
`passed from the output of tuner 20 to a descrambler 26,
`which may be of the gated RF synch suppression type, 35
`and to an AM receiver 22. The modulated carrier con(cid:173)
`tains audio and video signals. In the case of a premium
`channel, the video signals are scrambled. AM receiver
`22 detects the synchronization data for use by descram(cid:173)
`bler 26, and couples this data to microprocessor 24. 40
`Microprocessor 24 decodes the synchronization data
`from AM receiver 22 and forwards it to descrambler 26.
`Descrambler 26 can comprise a descrambling univer-
`sal logic array (ULA) which is programmed to perform
`the descrambling function. A special register 28 is pro- 45
`vided in the descrambling ULA into which a booter
`checksum is loaded. The hooter checksum is computed
`by microprocessor 24, in accordance with the boot
`ROM 30 software, from the hooter image received
`during initialization by frequency agile receiver 18. 50
`Only one such load of a checksum into special register
`28 is accepted per initialization. Thus, a downloaded
`hooter image cannot write to special register 28 without
`initiating a re-boot. After special register 28 is loaded
`with the checksum computed from the hooter image, 55
`control is turned over to the booter operating software
`downloaded into RAM 32.
`Each program transmitted by the cable system opera(cid:173)
`tor includes tag data which is detected by AM receiver
`22 and forwarded to microprocessor 24. In accordance 60
`with the present invention, the tag data (which may be
`transmitted either on the audio carrier or with the video
`signal of the transmitted program) will include a valid
`security checksum for all scrambled channels. The de(cid:173)
`scrambling ULA of descrambler 26 extracts this valid 65
`checksum via microprocessor 24 and compares it to the
`one loaded into special register 28. If the checksum
`computed from the booter image ("hooter checksum")
`
`4,712,239
`
`4
`matches the valid checksum extracted from the tag
`data, descrambler 26 is enabled and scrambled pro(cid:173)
`grams which the subscriber is authorized to receive are
`descrambled for viewing. If the booter checksum and
`valid checksum do not match, the descrambler will not
`descramble the video, thereby protecting the converter
`from pirates seeking to enable the descrambler using an
`illegitimate booter image.
`It will now be understood that the present invention
`secures downloadable CATV converters against pirates
`who attempt to enable descrambling of a scrambled
`program by downloading an illegitimate hooter image
`to the converter. The CATV converter includes RAM
`memory for receiving downloaded software on a sepa(cid:173)
`rate hooter channel. The advantage of such a converter
`is that it is reprogrammable from the headend. A fre(cid:173)
`quency agile FM receiver 18 is provided to capture the
`booter image upon initialization of the converter when
`it is powered up. An initialization program stored in
`boot ROM 30, operating in conjunction with micro(cid:173)
`processor 24, computes a checksum from the down(cid:173)
`loaded hooter image. This checksum is stored in a spe(cid:173)
`cial checksum register 28 prior to turning control of the
`converter over to the downloaded hooter image soft(cid:173)
`ware.
`In operation, the descrambler 26 compares the con(cid:173)
`tents of the special checksum register to a transmitted
`program checksum carried in program tag data. De(cid:173)
`scrambling is enabled only if the checksums match.
`Hardwired logic in the descrambler ULA prevents the
`downloaded program from changing the contents of the
`checksum register. In this manner, a pirate is prevented
`from downloading a false hooter image to defeat the
`integrity of the converter.
`We claim:
`1. Apparatus for preventing unauthorized receipt of
`programming in a downloadable .cable television con(cid:173)
`verter comprising:
`receiver means for receiving data downloaded via a
`cable televison network;
`means for automatically tuning said receiver means to
`a dedicated hooter channel for receipt of data com(cid:173)
`prising a booter image when said converter is pow(cid:173)
`ered up;
`means for subsequently tuning said receiver means to
`a separate channel for receipt of additional data
`after receipt of said hooter image;
`means for computing a hooter checksum from data
`contained in said booter image;
`means, coupled to receive a program signal, for ex(cid:173)
`tracting a valid checksum from tag data associated
`with said signal;
`means for comparing the hooter checksum to said
`extracted valid checksum;
`a descramber coupled to receive at least a portion of
`said program signal to be descrambled; and
`means operatively associated with said descrambler
`for enabling the descrambler to operate only if said
`comparing means determines that the booter
`checksum matches the extracted valid checksum.
`2. The apparatus of claim 1 further comprising:
`means for storing the hooter checksum;
`means for coupling said storing means to said com(cid:173)
`paring means; and
`means operatively associated with said comparing
`means for retrieving the hooter checksum from the
`storing means for comparing with the extracted
`valid checksum.
`
`APPLE EX. 1006
`Page 4
`
`

`
`4,712,239
`
`10
`
`5
`3. The apparatus of claim Z wherein said hooter
`checksum is computered and stored upon downloading
`of the hooter image, said apparatus further comprising:
`means for inhibiting said storing means from storing
`another checksum until a hooter image is again
`downloaded.
`4. A television oommunication system comprising:
`a transmission path for carrying television signals
`from a headend to subscriber converters;
`means for downloading a hooter image to a sub(cid:173)
`scriber converter via said transmission path, said
`converter comprising receiver means for receiving
`downloaded data, means for automatically tuning
`said receiver means to a dedicated hooter channel 15
`for receipt of said hooter image when the converter
`is powered up, and means for subsequently tuning
`said receiver means to a separate channel for re(cid:173)
`ceipt of additional data after receipt of said hooter 20
`image;
`means for computing a hooter checksum from said
`hooter image;
`means for extracting a valid checksum from tag
`data contained in a televison signal received at 25
`said converter;
`means for comparing the hooter checksum to the
`extracted valid checksum;
`a descrambler operatively associated with said 30
`converter for descrambling television signals;
`and
`means operatively associated with said descram(cid:173)
`bler for enabling the descrambler to operate only
`if said comparing means determines that the 35
`hooter checksum matches the extracted valid
`checksum.
`5. The communication system of claim 4 wherein said
`converter comprises:
`second receiver means for receiving television sig(cid:173)
`nals.
`6. The communication system of claim 4 wherein said
`receiver means is an FM receiver.
`7. A cable television converter comprising:
`first receiver means for receiving a hooter image to be
`downloaded to the converter from a dedicated
`hooter channel;
`second receiver means for receiving television sig- 50
`nals;
`means for tuning said first receiver means upon
`power up to said hooter channel to effect a hooter
`image download;
`
`40
`
`6
`means for subsequently tuniD.g said first receiver
`means to a separate channel for receipt of addi(cid:173)
`tional data after receipt of said hooter image;
`means for computing a hooter checksum from data
`contained in a downloaded hooter image;
`means coupled to said second receiver means for
`extracting a valid checksum from data associated
`with a received television signal;
`means for comparing the hooter checksum to the
`extracted valid checksum; and
`means for preventing a user from viewing a program
`to be reproduced from a received television signal
`if said comparing means determines that the hooter
`checksum does not match the extracted valid
`checksum.
`8. The cable television converter of claim 7 further
`comprising:
`a descrambler coupled to receive and descramble
`television signals from said second receiver;
`said preventing means operatively associated with
`said descrambler to inhibit the operation of the
`descrambler if the hooter checksum and valid
`checksum do not match.
`9. The communication system of claim 7 wherein said
`first receiver means is an FM receiver.
`10. A method for preventing unauthorized parties
`from illegitimate access to cable television programs in
`a cable system in which a hooter image is downloaded
`to subscriber converters, comprising the steps of:
`tuning a data receiver in a subscriber terminal to a
`hooter channel to receive downloaded hooter
`image data;
`re-tuning said data receive to a separate channel for
`receipt of additional data after receipt of said
`hooter image data;
`computing a hooter checksum from said hooter image
`data;
`comparing the hooter checksum to a valid checksum
`extracted from data associated with a television
`signal received by the subscriber converter via the
`cable system; and
`preventing a subscriber from viewing a program to be
`reproduced from a received television signal unless
`the checksum computed from the hooter image
`matches the valid checksum.
`11. The method of claim 10 comprising the further
`steps of:
`downloading a hooter image to said subscriber con(cid:173)
`verter;
`transmitting a television signal with associated valid
`checksum data to said subscriber converter; and
`changing the hooter image and valid checksum data
`on a periodic basis.
`• * • • •
`
`45
`
`55
`
`60
`
`65
`
`APPLE EX. 1006
`Page 5