1. Method for broadcasting a scrambled multimedia program by way of a broadband network, wherein:
information can be routed to a multicast address so that only one group of several terminals corresponding to this multicast address receives the information while other terminals connected to the same network do not receive this information, and
information can be routed to a unicast address so that only the terminal corresponding to this unicast address receives the information while the other terminals connected to the same network do not receive it,
and wherein a network head:
scrambles the multimedia program with a control word,
encrypts the control word in order to obtain a first cryptogram,
encrypts the first cryptogram in order to obtain a second cryptogram, the first and second encryptions being effected by means of different encryption keys selected from the group composed of a processing key (KProc) and a license key (KTerm),
multiplexes the second cryptogram with the scrambled multimedia program to obtain multiplexed contents,
broadcasts the multiplexed contents to a multicast broadcast address in order to establish a point-to-multipoint connection between the network head and several receivers of the multiplexed contents, and
on a point-to-point link established with a terminal using the unicast address of this terminal, transmits the license key individually to this terminal by way of this point-to-point link,
characterized in that, before the transmission of the license key:
the network head carries out a step of authenticating the terminal, and
if the terminal has been successfully authenticated, the network head sends to the terminal a license transmission message containing the license key or a cryptogram of the license key, by way of the point-to-point link established, and
if the terminal is not successfully authenticated, the network head acts in such a manner as to prevent the complete unscrambling by this terminal of the scrambled multimedia program broadcast.
2. Method according to claim 1, wherein the network head carries out a phase of establishing a secure tunnel on the point-to-point link established, during which, if the terminal has been successfully authenticated:
the network head establishes, by random selection, a session key common to the terminal and to the network head, then
sends to the terminal the license transmission message encrypted with this session key.
3. Method according to claim 1, wherein, during the authentication step, the network head:
determines a unique key (KECMU) suitable for identifying the terminal from among all of the terminals connected to the network, on the basis of:
pre-recorded data which are known to the network head and which have not been transmitted to it by the terminal, and
data transmitted (UA) by the terminal to the network head, the pre-recorded data and the transmitted data each being insufficient by themselves to permit the determination of the unique key (KECMU) used by this terminal,
checks that the terminal is capable of correctly encrypting or decrypting data with the unique key which it has determined without the network head having had to transmit to this terminal beforehand the pre-recorded data or the unique key (KECMU) determined, and, in the affirmative, establishes that the terminal is authenticated.
4. Method according to claim 3, wherein, in order to check that the terminal is capable of correctly decrypting encrypted data with the unique key (KECMU) determined, the network head sends an ECM message (Entitlement Control Message) to the terminal in which the field which is to contain a cryptogram of a control word contains a cryptogram obtained by encrypting a datum (AleaAuth) unknown to the terminal by means of the unique key (KECMU) determined, then checks that the datum unknown to the terminal has been correctly decrypted by this terminal.
5. Method according to claim 1 for a terminal equipped with a security processor containing a security processor key (KProcU), wherein the network head encrypts the license key (KTerm) at least by means of the key (KProcU) of the security processor of the terminal in order to obtain a cryptogram of the license key (KTerm), and incorporates this cryptogram of the license key (KTerm) in the license transmission message.
6. Method according to claim 1 for a terminal equipped with a receiver containing a key (Klicense) for encrypting the license key and with a removable security processor containing a security processor key (KProcU), the processor key initially being known solely to the security processor and the key for encrypting the license key initially being known to the receiver, wherein the network head:
carries out consecutively over time a first and second encryption of the license key (KTerm) in order to obtain a cryptogram of the license key (KTerm), the first and second encryptions being carried out by means of different encryption keys selected from the group composed of the processor key (KProcU) and the key (Klicense) for encrypting the license key, and
incorporates this second cryptogram of the license key in the license transmission message.
7. Method for receiving a scrambled multimedia program broadcast by means of a broadcasting method according to claim 1, wherein the terminal:
monitors the multicast broadcast address and receives the multiplexed contents,
demultiplexes the multiplexed contents received in order to obtain the second cryptogram and the scrambled multimedia program,
decrypts the second cryptogram in order to obtain the first cryptogram,
decrypts the first cryptogram in order to obtain the control word, the first and second decryptions being effected by means of different encryption keys selected from the group composed of the processing key (KProc) and the license key (KTerm), and
unscrambles the scrambled multimedia program with the control word,
characterized in that, during the authentication step, the terminal cooperates with the network head in order to be authenticated.
8. Method according to claim 7, for receiving a multimedia program broadcast in accordance with a method for broadcasting a scrambled multimedia program by way of a broadband network, wherein:
information can be routed to a multicast address so that only one group of several terminals corresponding to this multicast address receives the information while other terminals connected to the same network do not receive this information, and
information can be routed to a unicast address so that only the terminal corresponding to this unicast address receives the information while the other terminals connected to the same network do not receive it,
and wherein a network head:
scrambles the multimedia program with a control word,
encrypts the control word in order to obtain a first cryptogram,
encrypts the first cryptogram in order to obtain a second cryptogram, the first and second encryptions being effected by means of different encryption keys selected from the group composed of a processing key (KProc) and a license key (KTerm),
multiplexes the second cryptogram with the scrambled multimedia program to obtain multiplexed contents,
broadcasts the multiplexed contents to a multicast broadcast address in order to establish a point-to-multipoint connection between the network head and several receivers of the multiplexed contents, and
on a point-to-point link established with a terminal using the unicast address of this terminal, transmits the license key individually to this terminal by way of this point-to-point link,
characterized in that, before the transmission of the license key:
the network head carries out a step of authenticating the terminal, and
if the terminal has been successfully authenticated, the network head sends to the terminal a license transmission message containing the license key or a cryptogram of the license key, by way of the point-to-point link established, and
if the terminal is not successfully authenticated, the network head acts in such a manner as to prevent the complete unscrambling by this terminal of the scrambled multimedia program broadcast,
wherein the network head carries out a phase of establishing a secure tunnel on the point-to-point link established, during which, if the terminal has been successfully authenticated:
the network head establishes, by random selection, a session key common to the terminal and to the network head, then
sends to the terminal the license transmission message encrypted with this session key,
wherein, during the phase of establishing the secure tunnel:
a) if the terminal has been successfully authenticated, the terminal cooperates with the network head to establish the common session key (Ks) and decrypts the license transmission message received by means of the common session key, and
b) if the terminal is not successfully authenticated, the terminal is prevented from unscrambling the multimedia program.
9. Method according to claim 7, wherein the terminal also carries out a step of authenticating the network head and, if the network head has been successfully authenticated, the terminal obtains the license key from the license transmission message whereas, if the network head has not been successfully authenticated, the terminal is prevented from unscrambling the multimedia program.
10. Method according to claim 9, for a terminal capable of encrypting or decrypting cryptograms by means of a predetermined unique key (KECMU), this unique key (KECMU) identifying this terminal in a unique manner from among all of the terminals connected to the network, and wherein, during the step of authenticating the network head, the terminal checks that the network head is capable of correctly encrypting or decrypting data with the unique key (KECMU) determined by the network head on the basis of:
pre-recorded data which are known to the network head and which have not been transmitted to it by the terminal, and
data (UA) transmitted by the terminal to the network head, the pre-recorded data and the transmitted data each being insufficient by themselves to permit the determination of the unique key (KECMU) of this terminal.
11. Method for receiving multimedia programs broadcast by means of a broadcasting method according to claim 5, and by means of a terminal equipped with a security processor containing a processor key (KProcU), wherein the security processor decrypts the cryptogram of the license key (KTerm) by means of the processor key (KProcU).
12. Method according to claim 7 for a terminal equipped with a receiver containing a key (Klicense) for encrypting the license key and with a removable security processor containing a processor key (KProcU), the processor key initially being known solely to the security processor and the key for encrypting the license key initially being known to the receiver, wherein the security processor and the receiver carry out consecutively a first and second decryption of a cryptogram of the license key (KTerm), the first and second decryptions being carried out by means of a different first and second decryption key, respectively, selected from the group composed of the processor key (KProcU) and the key (Klicense) for encrypting the license key.
13. Network head, characterized in that this network head is capable of implementing a method for broadcasting scrambled multimedia programs according to claim 1.
14. Terminal for receiving scrambled multimedia programs, characterized in that this terminal is capable of implementing a receiving method according to claim 7.
15. Receiver of scrambled multimedia programs, characterized in that it is capable of being associated with a removable security processor in order to form a receiving terminal according to claim 14.
16. Removable security processor, characterized in that it is capable of being associated with a receiver of scrambled multimedia programs in order to form a receiving terminal according to claim 14.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. An improved gaming network for providing applications to one or more gaming systems, said gaming network comprising:
a plurality of application servers servicing application requests from at least one gaming system, wherein each of said plurality of application servers includes a multi-tiered architecture having a plurality of software layers; and
a load balancer automatically distributing application requests from said at least one gaming system among said plurality of application servers.
2. The gaming network of claim 1, wherein said plurality of application servers host a plurality of applications or web services for said at least one gaming system.
3. The gaming network of claim 1, wherein said multi-tiered architecture includes at least one of an application programming interface, at least one application, an operating system, and a data access interface layer.
4. The gaming network of claim 1, wherein said plurality of application servers transmit information to said at least one gaming system subscribed to said plurality of application servers.
5. The gaming network of claim 1, wherein application servers within said plurality of application servers include different applications.
6. The gaming network of claim 1, wherein said plurality of application servers respond to said request if said at least one gaming system bears a valid license token.
7. The gaming network of claim 1, wherein said plurality of application servers provide local live update of one or more applications on one or more of said plurality of application servers.
8. The gaming network of claim 1, wherein said load balancer distributes said requests based on a status of said plurality of application servers.
9. The gaming network of claim 1, further comprising a database server storing data for retrieval by said plurality of application servers.
10. The gaming network of claim 9, wherein said load balancer balances requests among a plurality of database servers.
11. The system of claim 1, wherein request comprises a request for a downloadable game.
12. An updatable gaming network, said gaming network comprising:
an application server servicing requests from at least one gaming system, said application server including a local live update application for automatically updating and validating an application on said application server, wherein said application server includes a multi-tiered architecture having a plurality of software layers.
13. The gaming network of claim 12, wherein said local live update application automatically updates one or more applications on said application server.
14. The gaming network of claim 12, wherein said local live update application updates an application on said application server at execution of said application.
15. The gaming network of claim 12, further comprising a stubloader running at a gaming system, said stubloader querying said local live update application to update an application to be executed at said gaming system.
16. The gaming network of claim 15, wherein said stubloader detects alteration of an application prior to an execution of said application.
17. The gaming network of claim 16, wherein said stubloader detects alteration of said application in conjunction with said local live update application.
18. The gaming network of claim 15, wherein said stubloader verifies said application and stores an indication of verification of said application.
19. The gaming network of claim 15, wherein said stubloader verifies a license for use of said application at said gaming system.
20. The gaming network of claim 12, further comprising a load balancer automatically distributing requests from said at least one gaming system among a plurality of application servers.
21. The gaming network of claim 20, wherein said load balancer balances requests among a plurality of database servers.
22. The gaming network of claim 12, further comprising a database server storing data for retrieval by said application server.
23. The gaming network of claim 12, wherein said application comprises a downloadable game.
24. A method for gaming system control in a gaming environment, said method comprising:
receiving a request for an application to execute at a gaming system; and
automatically routing said request to an appropriate multi-tiered application server to provide said application at said gaming system.
25. The method of claim 24, further comprising verifying that said gaming system is authorized to execute said application.
26. The method of claim 24, wherein said request is routed based on a status of a plurality of application servers.
27. The method of claim 24, further comprising distributing a request for data among a plurality of database servers.
28. The method of claim 24, further comprising updating an application at said gaming system prior to execution of said application.
29. The method of claim 28, wherein said updating step further comprises automatically updating said application.
30. The method of claim 24, further comprising detecting alteration of an application prior to execution of said application.