CA2413880C - Encryption and content control in a digital broadcast system - Google Patents

Abstract

A selective encryption encoder has a packet identifier that identifies packets of a specified packet type forming a part of a program. A packet duplicator duplicates the identified packets to produce first and second sets of the identified packets. A PMT (program map table) inserter generates temporary identifying information that identifies the first and second sets of identified packets inserts the temporary identifying information as user private data in a program map table (PMT) forming a part of the transport program specific information (PSI). The data are then sent to and received from a primary encryption encoder to encrypt the first set of identified packets under a first encryption method. A secondary encrypter encrypts the second set of identified packets under a second encryption method. The PSI is then modified at a PSI modifier to remove the temporary identifying information and to correctly associate the first and second sets of identified packets and the unencrypted packets with the program.

Description

CROSS REFERENCE TO RELATED DOCUMENTS
.11 This application is a continuation in part of patent applications docket 12 number SNY-R4646.01, entitled "Critical Packet Partial Encryption" to Unger et al., 13 serial number 10/038,217.; patent applications docket number SNY-R4646.02 14 entitled "Time Division Partial Encryption" to Candelore et al., serial number 10/038,032; docket number SNY-R4646.03 entitled "Elementary Stream Partial 16 Encryption" to Candelore , serial number 10/037,914; docket number SNY-17 R4646.04 entitled "Partial Encryption and PID Mapping" to Unger et al., serial 18 number 10/037,499; and docket number SNY-R4646.05 entitled "Decoding and 19 Decrypting of Partially Encrypted Information" to Unger et al. serial number 10/037,498 all of which were filed on January 2, 2002.

22 This application is also related to and claims priority benefit of U.S.
23 Provisional patent application serial number. 60/355,326 filed February 8, 24 docket number 50R4900, entitled "Analysis of Content Selection Methods", to Candelore and to U.S. Provisional patent application serial number 60/370,274 filed 26 April 5, 2002, docket number 50R4903 entitled "Method of Control of Encryption 27 and Content in a Digital Broadcast System" to Pedlow, Jr., et al.

2 A portion of the disclosure of this patent document contains material which 3 is subject to copyright protection. The copyright owner has no objection to the 4 facsimile reproduction of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent file or records, but otherwise 6 reserves all copyright rights whatsoever.

9 This invention relates generally to the field of encryption. More particularly, this invention relates to a method of control of content and encryption in a digital 11 broadcast system.

14 The above-referenced commonly owned patent applications describe inventions relating to various aspects of methods generally referred to herein as 16 partial encryption or selective encryption. More particularly, systems are described 17 therein wherein selected portions of a particular selection of digital content are 18 encrypted using two (or more) encryption techniques while other portions of the 19 content are left unencrypted. By properly selecting the portions to be encrypted, the content can effectively be encrypted for use under multiple decryption systems 21 without the necessity of encryption of the entire selection of content. In some 22 embodiments, only a few percent of data overhead is needed to effectively encrypt 23 the content using multiple encryption systems. This results in a cable or satellite 24 system being able to utilize Set-top boxes or other implementations of conditional access (CA) receivers from multiple manufacturers in a single system - thus freeing 26 the cable or satellite company to competitively shop for providers of Set-top boxes.
27 In order. to provide appropriate tracking of clear packets and packets 28 encrypted under multiple encryption systems, a system of multiple packet 29 identifiers (PIDs) has been devised as described in the above-referenced patent Docket No.: SNY-R4903.01 -2- PATENT

I applications. However, in head-end equipment provided by certain manufacturers, 2 the PIDs can be remapped within the encryption encoder. This can result in the 3 system losing track of the clear and encrypted packets.

BRIEF DESCRIPTION OF THE DRAWINGS
6 The features of the invention believed to be novel are set forth with 7 particularity in the appended claims. The invention itself however, both as to 8 organization and method of operation, together with objects and advantages 9 thereof, may be best understood by reference to the following detailed description of the invention, which describes certain exemplary embodiments of the invention, 11 taken in conjunction with the accompanying drawings in which:
12 FIGURE 1 is a block diagram of an exemplary cable system head end 13 consistent with certain embodiments of the present invention.
14 FIGURE 2 is an illustration of sample transport stream PSI consistent with certain embodiments of the present invention.
16 FIGURE 3 is a further illustration of sample transport stream PSI
consistent 17 with certain embodiments of the present invention.

18 FIGURE 4 is a block diagram of an illustrative control processor 100 19 consistent with certain embodiments of the present invention.
FIGURE 5 is a flow chart generally describing the overall operation of the 21 selective encryption encoder 114.

24 While this invention is susceptible of embodiment in many different forms, there is shown in the drawings and will herein be described in detail specific 26 embodiments, with the understanding that the present disclosure is to be 27 considered as an example of the principles of the invention and not intended to limit 28 the invention to the specific embodiments shown and described. In the description Docket No.: SNY-R4903.01 -3- PATENT

f CA 02413880 2002-12-10 l I below, like reference numerals are used to describe the same, similar or 2 corresponding parts in the several views of the drawings.
3 The terms "scramble" and "encrypt" and variations thereof are used 4 synonymously herein. Also, the term "television program" and similar terms can be interpreted in the normal conversational sense, as well as a meaning wherein 6 the term means any segment of AN content that can be displayed on a television 7 set or similar monitor device. The term "video" is often used herein to embrace not 8 only true visual information, but also in the conversational sense (e.g., "video tape 9 recorder") to embrace not only video signals but associated audio and data.
The term "legacy" as used herein refers to existing technology used for existing cable 11 and satellite systems. The exemplary embodiments disclosed herein are decoded 12 by a television Set-Top Box (STB), but it is contemplated that such technology will 13 soon be incorporated within television receivers of all types whether housed in a 14 separate enclosure alone or in conjunction with recording and/or playback equipment or Conditional Access (CA) decryption module or within a television set 16 itself. The present document generally uses the example of a "dual partial 17 encryption" embodiment, but those skilled in the art will recognize that the present 18 invention can be utilized to realize multiple partial encryption without departing from 19 the invention. Partial encryption and selective encryption are used synonymously herein.

21 Turning now to FIGURE 1, a head end 100 of a cable television system 22 suitable for use in practicing a dual encryption embodiment of the present invention 23 is illustrated. Those skilled in the art will appreciate that the present invention could 24 . also be implemented using more than two encryptions systems without departing from the present invention. The illustrated head end 100 implements the dual 26 partial encryption scenario of the present invention by adapting the operation of a 27 conventional encryption encoder 104 (such as those provided by Motorola, Inc. and 28 Scientific-Atlanta, Inc., and referred to herein as the primary encryption encoder) 29 . with additional equipment.

Docket No.: SNY-R4903.01 -4- PATENT

ff CA 02413880 2002-12-10 1 Head end 100 receives scrambled content from one or more suppliers, for 2 example, using a satellite dish antenna 108 that feeds a satellite receiver 110.
3 Satellite receiver 110 operates to demodulate and descramble the incoming 4 content and supplies the content as a stream of clear (unencrypted) data to a selective encryption encoder 114. The selective encryption encoder 114, according 6 to certain embodiments, uses two passes or two stages of operation, to encode the 7 stream of data. Encoder 114 utilizes a secondary conditional access system (and 8 thus a second encryption method) in conjunction with the primary encryption 9 encoder 104 which operates using a primary conditional access system (and thus a primary encryption method). A user selection provided via a user interface on a 11 control computer 118 configures the selective encryption encoder 114 to operate 12 in conjunction with either a Motorola or Scientific Atlanta cable network (or other 13 cable or satellite network).
14 It is assumed, for purposes of the present embodiment of the invention, that the data from satellite receiver 110 is supplied as MPEG (Moving Pictures Expert 16 Group) compliant packetized data. In the first stage of operation the data is passed 17 through a Special Packet Identifier (PID) 122. Special Packet Identifier 18 identifies specific programming that is to be dual partially encrypted according to 19 the present invention. The Special Packet Identifier 122 signals the Special Packet Duplicator 126 to duplicate special packets. The Packet Identifier (PID) Remapper 21 130, under control of the computer 118, to remap the PIDs of the elementary 22 streams (ES) (i..e., audio, video, etc.) of the programming that shall remain clear 23 and the duplicated packets to new PID values. The payload of the elementary 24 stream packets are not altered in any way by Special Packet Identifier 122, Special Packet Duplicator 126, or PID remapper 1306. This is done so that the primary 26 encryption encoder 104 will not recognize the clear unencrypted content as content 27 that is to be encrypted.
.28 The packets may be selected by the special packet identifier 122 according 29 to one of the selection criteria described in the above-referenced applications or may use another selection criteria such as those which will be described later Docket No.: SNY-R4903.01 -5- PATENT

CA 02413880 2002-12-10 {

1 herein. Once these packets are identified in the packet identifier 122, packet 2 duplicator 126 creates two copies of the packet. The first copy is identified with the 3 original PID so that the primary encryption encoder 104 will recognize that it is to 4 be encrypted. The second copy is identified with a new and unused PID, called a "secondary PID" (orshadow PID) bythe PID Remapper 122. This secondary PID
6 will be used later by the.selective encryption encoder 114 to determine which 7 packets are to be encrypted according to the secondary encryption method.
8 FIGURE 2 illustrates an exemplary set of transport PSI tables 136 after this 9 remapping with a PAT 138 defining two programs (10 and 20) with respective PID
values 0100 and 0200. A first PMT 140 defines a PID=0101 for the video 11 elementary stream and PIDs 0102 and 0103 for two audio streams for program 10.
12 Similarly, a second PMT 142 defines a PID=0201 for the video elementary stream 13 and PIDs 0202 and 0203 for two audio streams for program 20.
14 As previously noted, the two primary commercial providers of cable head end encryption and modulation equipment are (at this writing) Motorola, Inc.
and 16 Scientific-Atlanta, Inc. While similar in operation, there are significant differences 17 that should be discussed before proceeding since the present selective encryption 18 encoder 114 is desirably compatible with either system. In the case of Motorola 19 equipment, the Integrated Receiver Transcoder (IRT), an unmodulated output is available and therefore there is no need to demodulate the output before returning 21 a signal to the selective encryption encoder 114, whereas no such unmodulated 22 output is available in a Scientific-Atlanta device. Also, in the case of current 23 Scientific-Atlanta equipment, the QAM, the primary encryption encoder carries out 24 a PID remapping function on received packets. Thus, provisions are made in the selective encryption encoder 114 to address this remapping.
26 In addition to the above processing, the Program Specific Information (PSI) 27 is also modified to reflect this processing. The original, incoming Program 28 Association Table (PAT) is appended with additional Program Map Table (PMT) 29 entries at a PMT inserter 134. Each added PMT entry contains the new, additional streams (remapped & shadow PIDs) created as part of the selective encryption Docket No.: SNY-84903.01 -6- = PATENT

1 (SE) encoding process for a corresponding stream in a PMT of the incoming 2 transport. These new PMT entries will mirror their corresponding original PMTs.
3 The program numbers will be automatically assigned by the selective encryption 4 encoder 114 based upon open, available program numbers as observed from the program number usage in the incoming stream. The selective encryption System 6 114 system displays the inserted program information (program numbers, etc) on 7 the configuration user interface of control computer 118 so that the Multiple System 8 Operator (MSO, e.g., the cable system operator) can add these extra programs into 9 the System Information'(Sl) control system and instruct the system to carry these programs in the clear.
11 The modified transport PSI is illustrated as 144 in FIGURE 3 with two 12 additional temporary PMTs 146 and 148 appended to the tables of transport PSI
13 136. The appended PMTs 146 and 148 are temporary. They are used for the 14 primary encryption process and are removed in the second pass of processing by the secondary encryption encoder. In accordance with the MPEG standard, all 16 entries in the temporary PMTs are marked with stream type "user private"
with an 17 identifier of OxFO. These PMTs describe the remapping of the PIDs for use in later 18 recovery of the original mapping of the PIDs in the case of a PID remapping in.the 19 Scientific-Atlanta equipment. Of course, other identifiers could be used without departing from the present invention..
21 In order to assure that the Scientific-Atlanta PID remapping issue is 22 addressed, ' if the selective encryption encoder 114 is configured to operate with a 23 Scientific-Atlanta. system, the encoder adds a user private data descriptor to each 24 elementary stream found in the original PMTs in the incoming data transport stream (TS).per the format below (of course, other formats may also be suitable):

Docket No.: SNY-R4903.01 -7- PATENT

CA 02413880 2002-12-10 dd t ~ t Syntax value # of bits private_data_indicator descr iptorO {
descriptor tag OxFO 8 descriptor length 0x04 8 private-data indicatoro {
orig_pid Ox???? 16 stream-type Ox?? 8 reserved OxFF. 8 }
}
1 The selective encryption encoder 114 of the current embodiment also adds 2 a user private data descriptor to each elementary stream placed in the temporary 3 PMTs created as described above per the format below:

Syntax value # of bits private_data_indicator descriptorp {
descriptor tag OxFO 8 descriptor length 0x04 8 private-data indicatoro {
orig_pid Ox???? 16 stream_type Ox?? 8 reserved OxFF 8 }
}
6 The "???" in the tables above is the value of the "orig_pid" which is a variable 7 while the "??" is a "stream_type" value. The data field for "orig_pid" is a variable 8 that contains the original incoming PID or in the case of remap or shadow PIDs, 'the 9 original PID that this stream was associated with. The data field "stream-type' is a variable that describes the purpose of the stream based upon the chart below:

Docket No.: SNY-R4903.01 -8- PATENT

2 Stream Type Value Legacy ES Ox00 3 Remapped ES Ox01 4 Shadow ES 0x02 Reserved 0x03 - OxFF
6.
7 These descriptors will be used later to re-associate the legacy elementary 8 streams, which are encrypted by the Scientific-Atlanta, Inc. primary encryption 9 encoder 104, with the corresponding shadow and remapped clear streams after PID remapping in the Scientific-Atlanta, Inc. modulator prior to the second phase 11 of processing of the Selective Encryption Encoder. Those skilled in the art will 12 appreciate that the above specific values should be considered exemplary and 13 other specific values could be used without departing from the present invention.
14 In the case of a Motorola cable system being selected in the selective encryption encoder configuration GUI, the original PAT and PMTs can remain 16 unmodified, providing the system does not remap PIDs within the primary 17 encryption encoder. The asterisks in FIGURE 1 indicate functional blocks that are 18 not used in a Motorola cable system.
19 The data stream from selective encryption encoder 114 is passed along to the input of the primary encryption encoder 104 which first carries out a PID
filtering 21 process at 150 to identify packets that are to be encrypted. At 152, in the.case of 22 a Scientific-Atlanta device, a PID remapping may be carried out. The data are then 23 passed along to an encrypter 154 that, based upon the PID of the packets encrypts 24 certain packets (in accord with the present invention, these packets are the special packets which are mapped by the packet duplicator 130 to the original PID of the 26 incoming data stream for.the current program). The remaining packets are 27 unencrypted. The data then passes through a PSI modifier 156 that modifies the 28 PSI data to reflect changes made at the PID remapper. The data stream is then 29 modulated by a quadrature amplitude modulation (QAM) modulator 158 (in the case of the Scientific-Atlanta device) and passed to the output thereof. This Docket No.: SNY-R4903.01 -9- PATENT

( f1 modulated signal is then demodulated by a QAM demodulator 160. The output of 2 the demodulator 160 is directed back to the selective encryption encoder 114 to a 3 PS! parser164.
4 The second phase of processing of the transport stream for selective encryption is to recover the stream after the legacy encryption process is carried 6 out in the primary encryption encoder 104. The incoming Program Specific 7 Information (PSI) is parsed at 164 to determine the PIDs of the individual 8 elementary streams and their function for each program, based upon the 9 descriptors attached in the first phase of processing. This allows for the possibility of PID remapping, as.seen in Scientific-Atlanta primary encryption encoders.
The 11 elementary streams described in the original program PMTs are located at PSI
12 parser 164 where these streams have been reduced to just the selected packets 13 of interest and encrypted in the legacy CA system format in accord with the primary 14 encryption method at encoder 104. The elementary streams in the temporary programs appended to the original PSI are also recovered at elementary stream 16 concatenator 168. The packets in the legacy streams are appended to the 17 remapped content, which is again remapped back to the PlD of the legacy streams, 18 completing the partial, selective encryption of the original elementary streams.
19 The temporary PMTs and the associated PAT entries are discarded and 20. removed from the PSI. The user private data descriptors added in the first phase 21 of processing are also. removed from the remaining original program PMTs in the 22 PSI. For a Motorola system, no PMT or PAT reprocessing is required and only the 23 final secondary encryption of the transport stream occurs.
24 During the second phase of processing, the SE encoder 114 creates a shadow PSI structure that parallels the original MPEG PSI, for example, having at 26 PAT origin-at PlD 0x0000. The shadow PAT will be located at a PID specified in 27 the SE encoder configuration as indicated by the MSO from the user interface. The 28 shadow PMT PIDs will be automatically assigned by the SE encoder 114 29 dynamically, based upon open, available PID locations as observed from PID
usage of the incoming stream. The PMTs are duplicates of the'original PMTs, but Docket No.: SNY-R4903.01 -10- PATENT

1 also have CA descriptors added to the entire PMT or to the elementary streams 2 referenced within to indicate the standard CA parameters and optionally, shadow 3 PID and the intended operation upon the associated elementary stream. The CA
4 descriptor can appear in the descriptorl () or.descriptor2() loops of the shadow PMT. If found in descriptorl O, the CA PID called out in the CA descriptor contains 6 the non-legacy ECM PID which would apply to an entire program.
Alternatively, the 7 ECM PID may be sent in descriptor2O. The CA descriptor should not reference the 8, selective encryption elementary PID in the descriptorl () area.

CA PID Definition Secondary CA private data Value ECM PID Ox00 Replacement PID 0x01 Insertion PID 0x02 ECM PID undefined (default) 11 This shadow PSI insertion occurs regardless of whether the selective 12 encryption operation is for a Motorola or Scientific Atlanta cable network.
The 13 elementary streams containing the duplicated packets of interest that were also 14 assigned to the temporary PMTs are encrypted during this second phase of operation at secondary packet encrypter in the secondary CA format based upon 16 the configuration data of the CA system attached using the DVB (Digital Video 17 Broadcasting) SimulcryptTM standard.
18 The data stream including the clear data, primary encrypted data, secondary 19 encrypted data and other information are then passed to a PSI modifier 176 that modifies the transport PSI information by deletion of the temporary PMT tables and 21 incorporation of remapping as described above. The output of the PSI
modifier 176 22 is modulated at a QAM modulator 180 and delivered to the cable plant 184 for 23 distribution to the cable system's customers.
24 The control processor 100 may be a personal computer based device that is used to control the selective encryption encoder as described' herein. An Docket No.: SNY-R4903.01 -11- PATENT

1 exemplary personal computer based controller 100 is depicted in FIGURE 4.
2 Control processor 100 has a central processor unit (CPU) 210 with an associated 3 bus 214 used to connect the central processor unit 210 to Random Access Memory 4 218 and Non-Volatile Memory 222 in a known manner. An output mechanism at 226, such as a display and possibly printer, is provided in order to display and/or 6 print output for the computer user as well as to provide a user interface such as a 7 Graphical User Interface (GUI). Similarly, input devices such as keyboard and 8 mouse 230 may be provided for the input of information by the user at the M.SO.
9 Computer 100 also may have disc storage 234 for storing large amounts of information including, but not limited to, program files and data files.
Computer 11 system 100 also has an inter face 238 for connection to the selective encryption 12 encoder 114. Disc storage 234 can store any number of encryption methods that 13 can be downloaded as.desired by the MSO to vary the encryption on a regular 14 basis to thwart hackers. Moreover, the encryption methods can be varied according to other criteria such as availability of bandwidth and required level of 16 security.

17 The operational process 250 of the selective encryption encoder 114 of.
18 FIGURE 1 is described generally by the flow chart of FIGURE 5 starting at 254.
19 incoming packets from the satellite receiver 110 are first optionally remapped at 122. In accordance with the specified dual encryption process, packets to be 21 encrypted are identified at 258 and these packets are duplicated and mapped to 22 specific PIDs at 262. The original unencrypted packets that are to be encrypted are 23 replaced with these duplicated packets at 262. Temporary identifying information 24 is inserted as PMT tables of the PSI, with the identifying information being coded as user private data at 270. This will permit reassociation of the proper packets 26 with appropriate PIDs after processing (and possible PID remapping) by the primary 27 encryption encoder. The data stream with the PSI, unencrypted and duplicated 28 packets is then sent to the primary encryption encoder at 274 where it is processed 29 by encryption of one set of the duplicated packets. As previously mentioned, for Docket No.: SNY-R4903.01 -12- PATENT

1 Scientific Atlanta encoders (or any other encoder operating in a similar manner), 2 the PIDs may be remapped inside the encoder.
3 The data stream is then returned from the primary encryption encoder at -4 278. The data stream is then processed by parsing the PSI information to recover information describing any PID remapping that has taken place in the primary 6 encryption encoder at 282. PID remapping can be addressed at this point in either 7 of at least two ways. In one embodiment, the PIDs can be remapped back to the 8 mapping as originally sent to the primary encryption encoder. This, of course, 9 requires that each packet be examined and potentially remapped. A simpler technique is to simply accept any remapping that the primary encryption encoder 11 has done.
12 The selective encryption processor encrypts the other of the pair of 13 duplicated packets at 286. The PIDs can then either be remapped as described.
14 above or the PSI can simply be modified to correct for any PID remapping at 290.
Also at 290, the temporary identifying information added to the PSI at 270 can be 16' removed. The resultant data stream can then be modulated and transmitted to the 17 end user at 294 and the process ends at 298.
18 The partial encryption process described above utilizes any suitable 19 conditional access encryption method at encrypters 154 and 174: Any suitable selective encryption process (e.g., such as those described in the above-21 referenced applications or any other suitable selective encryption technique). For 22 example, in one such technique, only slice headers are encrypted at encrypters 154 23 and 174. Other encryption techniques are' also possible. In general, but without 24 the intent to be limiting, the selective encryption process utilizes intelligent selection of information to encrypt so that the entire program does not have to 26 undergo dual encryption. By appropriate selection of appropriate data to encrypt, 27 the program material can be effectively scrambled and hidden from those who 28 desire to hack into the system and illegally recover commercial content without 29 paying. Additionally, multiple combinations of the above techniques are possible to produce encryption that has varying bandwidth requirements, varying levels of Docket No.: SNY-R4903.01 -13- PATENT

i 1 security and varying complexity. Control computer 118 can be used to selectively 2 choose an encryption technique from a plurality of available techniques. .
In 3 accordance with certain embodiments of the present invention, a selection of 4 packets to encrypt can be made by the control computer 118 in order to balance encryption security with bandwidth and in order to shift the encryption technique 6 from time to time to thwart. hackers.
7 Many modifications will occur to those skilled in the art which fall within the 8 scope of the present invention. For example, in certain embodiments, it is not 9 necessary to map the duplicated content to two new PID packets. In this embodiment, only one of the packets is remapped to get the legacy equipment to 11 encrypt it. The other can stay "disguised" with the content that is to remain "clear".
12 The PSI can be correspondingly simpler in such an embodiment.
13 Those skilled in the art will recognize that the present invention has been 14 described in terms of exemplary embodiments based upon use of. a programmed processor (e.g., processor 118, processors implementing any or alI of the elements 16 of 114). However, .the invention should not be so limited, since the present 17 invention could be implemented using hardware component equivalents such as 18 special purpose hardware and/or dedicated processors which are equivalents to 19 the invention as described and claimed. Similarly, general purpose computers, microprocessor based computers, micro-controllers, optical computers, analog 21 computers, dedicated processors and/or dedicated hard wired logic may be used 22 to construct alternative equivalent embodiments of the present invention.
23 Those skilled in the art will appreciate that the program steps and associated 24 data used to implement the embodiments described above can be implemented using disc storage as well as other forms of storage such as for example Read 26 Only Memory (ROM) devices, Random Access Memory (RAM) devices; optical 27 storage elements, magnetic storage elements, magneto-optical storage elements, 28 flash memory, core memory and/or other equivalent storage technologies without 29 departing from the present invention. Such alternative storage devices should be considered equivalents.

Docket No.: SNY-R4903.01 -14- PATENT

I The present invention, as described in embodiments herein, is implemented 2 using a programmed processor executing programming instructions that are 3 broadly described above form that can be stored on any suitable electronic storage 4 medium or transmitted over any suitable electronic communication medium or otherwise be present in any computer readable or propagation medium, However, 6 those skilled in the art will appreciate that the processes described above can be 7 implemented in any number of variations and in many suitable programming 8 languages without departing from the present invention. For example, the order of 9 certain operations carried out can often be varied, additional operations can be added or operations can be deleted without departing from the invention. Error 11 trapping can be added and/or enhanced and variations can be made in user 12 interface and information presentation without departing from the present invention.
13 Such variations are contemplated and considered equivalent.
14 Software code and/or' data embodying certain aspects of the present invention may be present in any computer readable medium, transmission 16 medium, storage medium or propagation medium including, but not limited to, 17 electronic storage devices such as those described above, as well as carrier 18 waves, electronic signals, data structures (e.g., trees, linked lists, tables, packets, 19 frames, etc.) optical signals, propagated signals, broadcast signals, transmission media (e.g., circuit connection, cable, twisted pair, fiber optic cables, waveguides, 21 antennas, etc.) and other media that stores, carries or passes the code and/or data.
22 Such media may either store the software code and/or data or serve to transport 23 the code and/or data from one location to another. In the present exemplary 24 embodiments, MPEG compliant packets, slices, tables and other data structures are used, but this should not be considered limiting since other data structures can 26 similarly be used without departing from.the present invention.
27 While the invention has been described in conjunction with specific 28 embodiments, it is evident that many alternatives, modifications, permutations and 29 variations will become apparent to those skilled in the art in light of the foregoing description. Accordingly, it is intended that the present invention embrace all such Docket No.: SNY-R4903.01 -15- PATENT

t 4 1 alternatives, modifications and variations as fall within the scope of the appended 2 claims.

Docket No.: SNY-R4903.01 -16- PATENT

Claims (27)

1. A selective encryption method, comprising:
examining unencrypted packets of data in a digital video signal to identify a specified packet type;
duplicating the packets of the specified packet type to produce duplicate packets;
identifying the duplicate packets by a first packet identifier (PID);
identifying remaining unencrypted packets by a second packet identifier (PID);

replacing the packets of the specified packet type with the first duplicate packets;
generating identifying information that identifies the first duplicate packets, and the unencrypted packets;
storing the identifying information as transport program specific information (PSI);
creating a data stream comprising the PSI, the first duplicate packets, and the unencrypted packets into the data stream; and sending the data stream to a primary encryption encoder.

2. The method according to claim 1, wherein the identifying information is stored as user private data in a program map table (PMT) in the transport PSI.

3. The method according to claim 1, further comprising:
receiving a data stream back from the primary encryption encoder;
reading a program map table (PMT), a program association table (PAT) and the identifying information from the transport PSI; and mapping the PIDs associated with at least one of the first duplicate packets and the unencrypted packets to values stored in the identifying information.

4. The method according to claim 3, further comprising deleting the identifying information from the PSI.

5. The method according to claim 1, further comprising:

receiving a data stream back from the primary encryption encoder;
reading a program map table (PMT), a program association table (PAT) and the identifying information from the transport PSI; and modifying the PSI to reflect any remapping of the PIDs in the primary encryption encoder.

6. The method according to claim 1, further comprising deleting the identifying information from the PSI.

7. A tangible computer readable storage medium storing instructions which, when executed on a programmed processor, carry out the selective encryption method according to claim 1.

8. The tangible computer readable storage medium of claim 7, wherein the storage medium comprises an electronic storage medium.

9. A selective encryption method, comprising:
examining unencrypted packets of data in a digital video signal to identify a specified packet type;
duplicating the packets of the specified packet type to produce first and second duplicate packets;
identifying the first duplicate packets by a first packet identifier (PID);
identifying the second duplicate packets by a second packet identifier (PID);
identifying unencrypted packets by a third packet identifier (PID);
replacing the packets of the specified packet type with the first duplicate packets and the second duplicate packets;
generating identifying information that identifies the first duplicate packets, the second duplicate packets and the unencrypted packets;
storing the identifying information as transport program specific information (PSI);

creating a data stream comprising the PSI, the first duplicate packets, the second duplicate packets and the unencrypted packets into the data stream; and sending the data stream to a primary encryption encoder.

10. The method according to claim 9, wherein the identifying information is stored as user private data in a program map table (PMT) in the transport PSI.

11. The method according to claim 9, further comprising:
receiving a data stream back from the primary encryption encoder;
reading a program map table (PMT), a program association table (PAT) and the identifying information from the transport PSI; and mapping the PIDs associated with at least one of the first duplicate packets, the second duplicate packets and the unencrypted packets to values stored in the identifying information.

12. The method according to claim 11, further comprising deleting the identifying information from the PSI.

13. The method according to claim 9, further comprising:
receiving a data stream back from the primary encryption encoder;
reading a program map table (PMT), a program association table (PAT) and the identifying information from the transport PSI; and modifying the PSI to reflect any remapping of the PIDs in the primary encryption encoder.

14. The method according to claim 9, further comprising: deleting the identifying information from the PSI.

15. A tangible computer readable storage medium storing instructions which, when executed on a programmed processor, carry out the selective encryption method according to claim 9.

16. The tangible computer readable medium of claim 15, wherein the storage medium comprises an electronic storage medium.

17. A selective encryption encoder, comprising:
a packet identifier that identifies packets of a specified packet type forming a part of a program;
a packet duplicator, receiving an output from the packet identifier, that duplicates the identified packets to produce first and second sets of the identified packets;
means for generating temporary identifying information that identifies the first and second sets of identified packets and for inserting the temporary identifying information as transport program specific information (PSI); and means for sending and receiving packets to and from a primary encryption encoder to encrypt the first set of identified packets under a first encryption method.

18. The selective encryption encoder of claim 17, wherein the temporary identifying information is stored as user private data in a program map table.

19. The selective encryption encoder of claim 17, further comprising:
a secondary encrypter for encrypting the second set of identified packets under a second encryption method; and means for modifying the PSI to remove the temporary identifying information and to correctly associate the first and second sets of identified packets with the program.

20. The selective encryption encoder of claim 19, wherein the means for modifying the PSI further modifies the PSI to correctly associated unencrypted packets with the program.

21. The selective encryption encoder of claim 17, further comprising:
a secondary encrypter for encrypting the second set of identified packets under a second encryption method;

means for modifying the PSI to remove the temporary identifying information;
and a PID remapper that remaps the PIDs associated with the first and second identified packets to correctly associate the first and second sets of identified packets with the program.

22. The selective encryption encoder of claim 21, wherein the PID remapper further remaps PIDs associated with unencrypted packets to correctly associate the unencrypted packets with the program.

23. A selective encryption encoder, comprising:
means for receiving a demodulated clear data stream of unencrypted packets carrying a program;
a PID remapper that remaps packet identifiers (PIDs) associated with the program;
a packet identifier, receiving an output from the PID remapper, that identifies packets of a specified packet type forming a part of the program;
a packet duplicator, receiving an output of the packet identifier, that duplicates the identified packets to produce first and second sets of the identified packets;

means for generating temporary identifying information that identifies the first and second sets of identified packets and for inserting the temporary identifying information as user private data in a program map table (PMT) forming a part of transport program specific information (PSI);
means for sending and receiving packets comprising the PSI, the first and second sets of identified packets and the unencrypted packets to and from a primary encryption encoder to encrypt the first set of identified packets under a first encryption method;
a secondary encrypter for encrypting the second set of identified packets under a second encryption method;
means for modifying the PSI to remove the temporary identifying information and to correctly associate the first and second sets of identified packets and unencrypted packets with the program; and a quadrature amplitude modulation (QAM) modulator that QAM modulates a data stream associated with the program and comprising PSI, first and second identified packets and the unencrypted packets.

24. A tangible computer readable storage medium that carries instructions that when executed on a programmed processor to facilitate operation of a selective encryption encoder wherein the instructions comprise:
a code segment that examines unencrypted packets of data in a digital video signal to identify a specified packet type;
a code segment that duplicates the packets of the specified packet type to produce first and second duplicate packets;
a code segment that identifies the first duplicate packets by a first packet identifier (PID);
a code segment that identifies the second duplicate packets by a second packet identifier (PID);
a code segment that identifies unencrypted packets by a third packet identifier (PID);
a code segment that replaces the packets of the specified packet type with the first duplicate packets and the second duplicate packets;
a code segment that generates identifying information that identifies the first duplicate packets, the second duplicate packets and the unencrypted packets;
a code segment that stores the identifying information as transport program specific information (PSI); and a code segment that creates a data stream comprising the PSI, the first duplicate packets, the second duplicate packets and the unencrypted packets into the data stream.

25. The tangible computer readable storage medium of claim 24, wherein the storage medium comprises an electronic storage medium.

26. A tangible computer readable storage medium carrying instructions that, when executed, carry out a selective encryption method, comprising:
examining unencrypted packets of data in a digital video signal to identify a specified packet type;
duplicating the packets of the specified packet type to produce first and second duplicate packets;
identifying the first duplicate packets by a first packet identifier (PID);
identifying the second duplicate packets by a second packet identifier (PID);
identifying unencrypted packets by a third packet identifier (PID);
replacing the packets of the specified packet type with the first duplicate packets and the second duplicate packets;
generating identifying information that identifies the first duplicate packets, the second duplicate packets and the unencrypted packets;
storing the identifying information as transport program specific information (PSI);
and creating a data stream comprising the PSI, the first duplicate packets, the second duplicate packets and the unencrypted packets into the data stream.

27. The tangible computer readable storage medium of claim 26, wherein the storage medium comprises an electronic storage medium.