Note: Descriptions are shown in the official language in which they were submitted.
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
1
TITLE OF THE INVENTION
Automatic Initialization of an Advanced Set-Top Box in a Cable
Television System by Downloading Software or Firmware over the Cable
System
RELATED APPLICATIONS
This application claims priority from a previous U.S. provisional patent
application entitled "Software and Firmware Initialization and Upgrade
Management System and Method for an Advanced Set-Top Box in a Cable
Television System," Serial No. 60/130,328, filed April 21, 1999.
FIELD OF THE INVENTION
The present invention relates to the field of initializing a set-top terminal
of a
cable television system and upgrading the software or firmware in the set-top
terminal. More particularly, the present invention relates to the field of
providing an
automatic identification and acquisition of an appropriate base platform code
and
other code objects for the terminal over the cable network.
2 0 BACKGROUND OF THE INVENTION
In a typical cable television system, subscribers are provided with a set-top
box or terminal. The set-top terminal is a box of electronic equipment that is
used
to connect the subscriber's television, and potentially other electronic
equipment,
with the cable network. The set-top box is usually connected to the cable
network
2 5 through a co-axial wall outlet.
The set-top box is essentially a computer that is programmed to process the
signals from the cable network so as to provide the subscriber with the cable
services. These services from the cable television company typically include
access
to a number of television channels and, perhaps, an electronic program guide.
3 0 Additional premium channels may also be provided to subscribers at an
additional
fee. Pay-per-view events and video-on-demand may also be provided over the
cable
17-04-2001 ~ US 000010018
2
network. The set-top box is programmed to provide these and other services to
the
subscriber.
However, the services of the cable company need not be limited to
providing television programming.f ~ Some cable companies are now offering
Internet access and e-mail over their cable networks at speeds much faster
than are
available over conventional telephone lines. It is anticipated in the future
that
more and more services will be provided over the cable network, including even
basic telephone service. Eventually, each home or office may have a single
connection, via the cable network, to all electronic data services.
When a new set-top terminal is added to the cable network, it must be
initialized. To initialize a set-top terminal, the terminal must be provided
with the
programming required to allow it to function within the specific cable network
to
which it is connected and to thereby provide the services for which the
subscriber
has paid. Additionally, as the cable network and the services provided evolve,
the
set-top terminal must also evolve to be able to provide subscribers with alI
the
services of the cable network. This set-top box evolution will primarily
involve
changes to the programming, or perhaps a re-initialization, of the set-top
box. By
upgrading the soft- or firmware of the set-top box, the box can be made to
perform
more efficiently or offer new services as the cable network evolves.
2 o In European Patent Application No. 0 907 285 A1, to initialize new set-top
terminals and upgrade the programnning in the existing population of set-top
boxes
on a cable network, it is preferable to transmit the necessary progranuning to
the
set-top boxes via the cable network itself. Otherwise, a technician must visit
each
subscriber to install or upgrade the set-top boxes. Such field installations
and
2 5 upgrades would obviously be at significant expense. The headend is the
facility
from which the cable network operator broadcasts television signals and
provides
other services over the cable network. Software that is provided to the
population
of set-top terminals could be broadcast from the headend over the cable
network.
However, there are a variety of problems associated with initializing and
3 o upgrading set-top terminals by broadcasting programming from the headend.
For
CA 02370214 2001-10-15 AMENDED SHEET
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
3
example, over time the population of set-top terminals will likely include
different
makes and models of set-top terminals with different capacities. The software
required to initialize or upgrade each make and model of set-top terminal may
be
different. Consequently, there is a need in the art for a method of matching
the
proper programming code to the capabilities of the set-top terminal being
initialized
or upgraded. Additionally, there is a need to automate the initialization
process so
as to eliminate or decrease the time required by a technician to install,
upgrade or
re-initialize a set-top terminal.
SUMMARY OF THE INVENTION
It is an object of the present invention to meet the above-described needs and
others. Specifically, it is an object of the present invention to provide a
method and
mechanism for matching the proper programming code being broadcast over the
cable plant to the capabilities of the set-top terminal being initialized or
upgraded.
Additionally, it is a further object of the present invention to automate the
initialization process so as to eliminate or decrease the time required by a
technician
to install, upgrade or re-initialize a set-top terminal.
Additional objects, advantages and novel features of the invention will be set
2 0 forth in the description which follows or may be learned by those skilled
in the art
through reading these materials or practicing the invention. The objects and
advantages of the invention may be achieved through the means recited in the
attached claims.
To achieve these stated and other objects, the present invention may be
2 5 embodied and described as a method of initializing a set-top terminal in a
cable
television system by automatically executing a boot code object stored in a
memory
unit of the set-top terminal upon provision of power to the set-top terminal.
The
boot code then automatically locates, acquires and executes a base platform
code
object. The base platform code object can process television signals, but
cannot
3 0 provide any higher set-top terminal functions.
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
Acquiring the base platform code object may include locating a transmission
of the base platform code object within a data transport stream broadcast over
the
cable television system and downloading the base platform code. Alternatively,
locating and acquiring the base platform code object may include identifying
the
base platform code object already stored in the memory unit of the set-top
terminal.
The method of the present invention preferably further includes checking the
authentication and authorization of the base platform code object before
executing
the base platform code object. Once the base platform code object is launched,
the
method includes passing control of the set-top terminal to the executing base
platform code object from the boot code object.
With the boot code object in control of the set-top terminal, the method of
the present invention proceeds by locating, acquiring and executing an
operating
system object under the direction of the executing base platform code object.
As
before, the operating system object may be downloaded from the data transport
stream of the cable television system or pulled from the memory unit of the
set-top
terminal. In the former case, the set-top terminal may receive an
initialization
message over the cable television system specifying where in the data
transport
stream to locate and download the operating system object. The operating
system is
2 0 then checked for authorization and authenticated before being executed.
The method of the present invention also preferably comprises providing two
set stack points within the memory unit of the set-top terminal; always
storing the
base platform code object in the memory unit beginning at a first of the two
set
stack points; and always storing the operating system object in the memory
unit
2 5 beginning at a second of the two set stack points. The method may also
include re-
executing the boot code obj ect in response to a reset message received over
the
cable television system. Preferably the boot code object is stored in a read-
only
memory portion of the memory unit.
The present invention also encompasses the hardware and system elements
3 0 of a set-top terminal required to implement the method described above.
These
include a central processor of the set-top terminal for executing the various
code
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
objects stored in memory and a tuner and modem allowing the set-top terminal
to
receive and/or transmit data over the cable television system.
5 BRIEF DESCRIPTION OF THE DRAWINGS
The accompanying drawings illustrate the present invention and are a part of
the specification. Together with the following description, the drawings
demonstrate and explain the principles of the present invention.
Fig. 1 is a block diagram illustrating the three different stages at which
different programming packages have control of the set-top terminal during the
initialization process of the present invention.
Fig. 2 is a flow chart illustrating the steps of the initialization process
for a
set-top terminal according to the present invention.
Fig. 3 is a block diagram of the various memory devices and some code
objects used in a set-top box according to the present invention.
DETAILED DESCRIPTION OF THE INVENTION:
The present invention addresses the problems involved in initializing new
set-top boxes or re-initializing existing set-top boxes using programming code
2 0 broadcast over the cable network. This process includes providing those
code
obj ects to the set-top boxes that are necessary to allow those set-top boxes
to
function within the cable system and provide the services purchased by
subscribers.
Stated in broad principle, the present invention aims to provide a set-top
terminal architecture that includes a resident boot code object. As shown in
Fig. 3,
the boot code object (302) resides in the set-top terminal (300), preferably
in read-
only memory (ROM) (301 ) and can automatically execute and initialize or re-
initialize the set-top terminal. The boot code will preferably be
automatically
executed by the central processor (not shown) of the set-top terminal.
Execution of
the boot code may be triggered by and immediately follow connection of power
to
3 0 the set-top terminal. The present invention may additionally require
connection of
the transport stream signal from the cable system before execution of the boot
code
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
6
is triggered. Once the boot code is executing, no further action by the
user/installer
need be required. Moreover, no specific interaction is required between the
headend
and the set-top terminal that is initializing or booting.
As will be described in detail below, the boot code of the present invention
will automatically find, download and begin execution of the correct software
code
object or objects needed to initialize the set-top terminal. The boot code
will locate,
identify and download the required programming from among potentially many
code objects that might be multiplexed on the transport stream coming from the
headend facility of the cable television system. The boot code recognizes the
hardware configuration of the set-top terminal in which it resides via an
internal
ROM coded identifier. This identifier is matched against a value carried in an
object download locator message from the transport stream to insure that the
boot
code obtains and downloads objects appropriate to the set-top terminal in
which the
boot code is resident.
Functionally, the boot code of the present invention will identify an
appropriate control channel frequency, find the stream of control data packets
within that control channel, identify and download the correct object from
among
the objects on the transport stream, verify that the downloaded code is
authorized
2 0 and error-free, and start the downloaded code without direct assistance by
a
technician or intervention from the headend. The term "boot code" as used
herein
comprises the minimal code needed to accomplish this functionality.
There are essentially two distinct phases of programming a set-top box
addressed by the present invention. The first is the initial programming of
the set-
2 5 top box. The second is upgrading the programming or re-initialization of
the set-top
box after that box has been placed in service.
The initial programming of the set-top box is often performed by the cable
system operator after the set-top box has purchased from a manufacturer.
Because
each cable network is designed and built at different times by different
service
3 0 providers, each cable network may have a different design, architecture
and code
objects. Moreover, the specific services offered may vary among cable
networks.
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
Therefore, to adapt the set-top box to function with the specific environment
of a
service provider's cable system and to provide the specific group of services
currently offered by that particular service provider, the set-top box must be
programmed accordingly or "initialized."
The process of initialization of a set-top terminal according to the present
invention will now be explained. In order for a set-top terminal to be
initialized, i.e.,
accept and utilize the initial programming it receives, it must have some base
programming that instructs it how to accept and use that initial programming.
This
base programming within the context of the present invention is called the
boot
code. As described above, the boot code is computer code resident in the
permanent
memory of the set-top terminal that is loaded, preferably into read-only
memory, at
the factory and cannot be changed once a terminal has been deployed.
As shown in Fig. 1, there are three general tiers or classifications of
programming that run on or have control of the set-top terminal during
different
stages in the initialization and operation of the terminal according to the
present
invention. Referring to Fig. 1, the first classification of code is the boot
code (1).
The boot code is preferably located in the read-only memory of the set-top
terminal,
but may alternatively be loaded in the Flash memory. While running the boot
code
2 0 ( 1 ), the set-top terminal cannot provide any services to the subscriber.
The function
(2) of the boot code ( 1 ) is to search the data transport stream received
from the
headend facility to locate, acquire and begin execution of the base platform
code (3)
which is the next tier or classification of programming.
The boot code ( 1 ) is designed to authenticate the base platform code after
the
2 5 base platform code is downloaded. The boot code ( 1 ) will preferably re-
authenticate the base platform code every time it launches the base platform
object
(3). When the base platform code (3) is executing, the execution of the boot
code
( 1 ) is terminated and control of the set-top terminal passes to the base
platform code
(3).
3 0 The base platform code (3) may be factory loaded. However, under the
principles of the present invention, the base platform code (3) is preferably
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
transmitted to the set-top terminal from the cable headend during the
initialization
of the terminal. This allows the operator of the cable system to customize the
base
platform code (3) for optimal operation on the specific cable system where the
set-
s top terminal is deployed. Preferably, the base platform code (3) is
transmitted over
the cable plant on an out-of band (OOB) transport stream. However, it is
within the
scope of the present invention for the base platform code (3) to be
transmitted on an
in-band control channel.
The base platform code (3) has two functions. The first function of the base
platform code (3) is to provide the basic capability of allowing a subscriber
to watch
television using the signal from the cable television system. The second
function is
to control the download (5) of the next classification of code objects, i.e.,
the target
operating system (O/S) and resident applications (6). The base platform code
(3),
while allowing subscribers to watch television, does not generally support any
additional functions of the set-top terminal. However, the base platform code
(3)
can acquire, authenticate, authorize and execute objects of the third and
final
classification of programming (e.g., the O/S) (5).
The third classification of programming, the operating system and resident
applications (6) provide the additional set-top terminal functions available
from the
2 0 cable system. The operating system (O/S) is typically code from a third
party (such
as Microsoft's WinCET"~) that provides access, with the resident applications,
to all
authorized set-top terminal capabilities. The operating system typically uses
an
additional embedded code module provided by the manufacturer of the set-top
terminal which interfaces the operating system with the particular hardware of
that
2 5 set-top terminal to enable the operating system to function with that
specific set-top
terminal.
Resident applications are computer programs that run on the set-top terminal
under the operating system. The resident applications work with the operating
system to provide the capabilities of the set-top terminal that are in
addition to
3 0 watching television. The native suite is a specified group of software
applications,
including the operating system and perhaps various resident applications, that
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
provide the intended functions of the set-top terminal. Specific elements of
the
native suite are determined by the system operator.
As indicated in Figs. 1 and 3, the boot code ( 1 ) is preferably factory-
loaded
in the read-only memory (ROM) of the set-top terminal and is executed as soon
as
AC power is provided to the set-top terminal. Alternatively, the boot code may
be
executed in response to a reset signal (4) received, for example, from the
headend,
i.e., the system operator. This allows the system operator to re-initialize
the set-top
terminal whenever desired.
The reset signal (4) is preferably received by the base platform code (3)
which then terminates execution of the operating system and resident
applications
(6), if running, and begins execution of the boot code (1). Alternatively, the
reset
signal (4) may cause the base platform code (3) to terminate and reload the
native
suite (6) rather than execute the boot code ( 1 ).
As described above, whenever executed, the boot code ( 1 ) acquires and loads
the base platform code (3). The base platform code may be provided to the set-
top
terminal over the cable network from the headend or, alternatively, may be
factory-
loaded along with the boot code. The base platform code is preferably stored
in
Flash memory (303) as shown in Fig. 3. The boot code (1) will either download
the
base platform code (3), for example, over an out-of band channel from the
headend
or, if the base platform code was factory-loaded, identify the base platform
code (3)
in memory. The boot code (1) authenticates the base platform code (3) from
whatever source it is obtained and then executes the base platform code (3) .
The base platform code (3) then acquires the operating system and,
preferably, the other objects of the native suite (6). The operating system
and the
other objects are downloaded from the headend over the cable network. The base
platform code (3) will acquire the operating system and other objects when
first
executed or, while running, in response to an initialization message (4) from
the
system operator. The initialization message (4) maybe provided over the cable
3 0 network. The operating system and resident applications (6) are then
executed
when the native suite is acquired, authorized and authenticated.
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
Fig. 2 is a flowchart providing a more detailed explanation of the
initialization sequence according to the present invention. As shown in Fig.
2, when
the set-top terminal is first powered, or an appropriate reset signal has been
5 received, the boot code is executed (229). The boot code must first
determine
whether the set-top box has or must acquire the base platform code. To
determine
this, the boot code first checks the flash memory for the base platform code,
the last
known carrier (LKC) frequency of the control channel from the headend, and an
Entitlement Management Message Provider Identification ( EMM Provider ID)
10 (201, 202).
If any of three following conditions are discovered, the boot code will
conclude that it must acquire the base platform code and will hunt for the out-
of
band channel or the in-band channel from which the base platform code can be
obtained. The boot code seeks to acquire the base platform code if ( 1 ) the
base
platform code, last known carrier and EMM Provider ID are not stored in the
Flash
memory, (2) the base platform code in the Flash memory fails an authentication
check or (3) non-volatile memory indicates that hunting for the control
channel
(likely an out-of band channel) is required.
If the Flash check determines that a base platform code object exists, the
2 0 boot code proceeds to execute that base platform object after appropriate
authorization and authentication as described below. If both the base platform
and
the O/S are loaded in Flash, the boot code authorizes and authenticates the
base
platform and then launches the base platform and passes control of the set-top
terminal thereto. The base platform object, in turn, authorizes and
authenticates
2 5 (A&A) the O/S. The authenticated O/S is then run and control passes to the
O/S.
If the base platform code is not loaded in Flash memory, the boot code loads
the base platform off of the out-of band transport stream (203, 204, 207).
However,
before it is written to Flash memory, a successful authentication is required
(206,
205). When the authenticated base platform code is executed, the boot code
passes
3 0 control to the base platform (211,228). If the base platform code fails
the
authentication check (205), the failed base platform code is deleted (208) and
a
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
11
counter is incremented (209) that tracks the number of attempts to acquire and
authenticate a base platform code. If the counter is below a predetermined
acceptable number of attempts, the base platform code is again downloaded
(207).
Alternatively, if the acceptable number of attempts to download the base
platform
code is exceeded, the set-top terminal may signal the headend for a service
call
(210).
Under the principles of the present invention, the boot code locates the base
platform object using a boot code message or "bootcode control message" that
is
sent periodically on the out-of band transport stream (204). Use of the
bootcode control message will now be described in detail.
When the boot code determines the need to download the base platform
object, it first hunts for the control channel. A table of possible carrier
frequencies
at which the control channel or channels are being broadcast is included in
the boot
code. These frequencies may be both in-band and out-of band. The boot code
will
cause the set-top terminal to tune each of these frequencies in turn until the
control
channel is located and a carrier lock is obtained. If no control channel is
received at
a particular frequency for a predetermined period of time, the set-top
terminal will
tune the next frequency in the table.
2 0 The control channel is a stream of data packets that can be received and
used
by the set-top terminal. In order to broadcast a number of different objects
simultaneously, the headend will divide objects to be transmitted over the
control
channel into packets. The packets of the various objects being transmitted can
then
be interspersed or time-multiplexed together so that several objects are all
2 5 transmitted essentially simultaneously. The packets for each particular
object will
have a common packet identifier or "PID." Thus, a set-top terminal can
identify the
packets for the object it is working to acquire. By acquiring all the packets
with a
particular PID, the complete object can then be reassembled by the set-top
terminal
from the set of packets with that particular PID.
3 0 According to the present invention, a set-top terminal can start anywhere
in
the progression to acquire an object and wrap around until all the necessary
packets
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
12
are downloaded. For example, the set-top terminal may load the first packet it
receives with a PID X. That packet may be packet 50 of 100 marked by PID X.
The terminal then continues to collect packets 51 to 100 with PID X, then 1 to
49.
With all 100 packets obtained, the terminal can reassemble the packetized
object.
The headend may need to broadcast a number of objects simultaneously
because there may be different types or classes of set-top terminals in the
population. Each class of set-top terminals may need a different version of,
for
example, the base platform code, the O/S or a resident application. Therefore,
when
the boot code is going to initialize the set-top terminal and must acquire the
base
platform code, the boot code must determine where to acquire the base platform
appropriate to the set-top terminal on which it is running.
Thus, once the carrier lock is achieved and the control channel is being
received, the boot code will begin collecting packets from the transport
stream on
the control channel that are identified with PID 1. PID 1 is dedicated to the
conditional access message in the MPEG standard. The packets of PID 1 will
provide the boot code running on the set-top terminal with a Conditional
Access
Table (CAT) of EMM Provider IDs each of which identifies a PID for a set of
packets on the transport stream that constitute an EMM stream (Entitlement
2 0 Management Message).
The boot code will begin with the first EMM and begin loading packets from
the transport stream that are marked with the EMM PID given by the first EMM
Provider ID. The EMM PID packets being acquired will contain the boot code
message of the present invention which, in turn, includes a platform
identifier.
2 5 The boot code which is factory-installed in the set-top terminal will also
include a platform identifier that is specific to the type of terminal in
which the boot
code is resident. When running, the boot code will attempt to match the
platform
identifier provided at the factory with the platform identifier from the boot
code
message of the EMM PID packets.
3 0 If no match is found, the boot code will select the next EMM Provider ID
in
the CAT and check the packets of the EMM PID identified by that EMM Provider
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
13
ID descriptor for a boot code message with a matching platform identifier.
This
continues until the matching platform identifier is found (203). It may be
possible
to search multiple EMM PID's simultaneously to reduce the EMM validation time
and the time required to find the matching boot code message.
If all the EMM Provider IDs in the CAT of PID 1 are checked and no match
is found for the platform identifier, the boot code will look for another
control
channel on another carrier frequency by returning to the table of carrier
frequencies.
When another frequency with a control channel is identified and locked, the
boot
code will extract PID 1 and repeat the process outlined above. This continues
until
a boot code message with a platform identifier matching the platform
identifier of
the boot code is found.
When the boot code finds a boot code message with a matching platform
identifier, the boot code will extract a download PID (DL PID) specified by
the
matching boot code message. The download PID (DL PID) is the identifier for
the
packets that carry the code object, e.g., the base platform code object, that
is
appropriate for the type of set-top terminal with the platform identifier in
the boot
code message. The boot code can then download the base platform code object by
acquiring the packets with the DL PID and reassembling the data in those
packets
2 0 into the base platform code.
As shown in Fig. 2, once the base platform code has been downloaded or
identified as already resident in Flash memory, an authentication check (206)
is
performed to verify that the base platform code has been accurately and
completely
received and has not been altered by an unauthorized party.
2 5 If the base platform fails the authentication check, it is deleted (208).
A load
counter may then be checked to determine the number of times the set-top
terminal
has attempted to acquire a valid base platform code (209). If the counter
exceeds a
predetermined limit, the set-top terminal may signal the headend for a service
call or
may indicate the need to request a service call to the subscriber (210). If
the load
3 0 counter is not exceeded, the boot code will revert to the process
described above and
attempt again to download the base platform code (207).
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
14
Alternatively, if the base platform code is authenticated, it is then launched
(211 ). The base platform code will then determine if the native suite,
including the
O/S, is loaded in the Flash memory (214). If it is not, the base platform code
will
seek to download the native suite.
With the base platform code running, the system operator may provide the
set-top terminal with a set of "initialization messages" that provide, for
example,
channel maps, tables and EMM information (219, 212). These messages should be
provided before the native suite is loaded. The initialization messages may
instruct
the set-top terminal where to acquire the native suite.
After the native suite has been downloaded, or is found already existing in
Flash memory, an authorization check is performed on the native suite (215,
220,
224, 223). The download of the native suite will include an Object Conditional
Access Message (OCAM) that is recorded by the set-top terminal. The
authentication signature and authorization code for the native suite object
are
provided in the OCAM and used to authorize and authenticate the native suite
in the
manner described below.
If the authorization check is not successful, the native suite code will be
deleted (225, 217) and the base platform code will again attempt to acquire
the
2 0 native suit (221 ). If the authorization check is successful, the native
suite and any
resident applications associated with it, are loaded and an authentication
check is
performed (222). As before, if the authentication check fails, the downloaded
code
will be deleted (217) and a load counter will be checked (216) to see if
another
attempt to download the code should be made or a service call signaled (213).
2 5 Alternatively, if the authentication check (222, 218) is successful, the
native
suite and any associated resident applications will be executed beginning with
the
O/S (226, 227). The base platform code performs the authorization and
authentication on the O/S code. If the O/S passes the authorization and
authentication checks, the O/S is executed and control is transferred to the
O/S. The
3 0 BIOS (Basic Input/output Software) may perform the authorization and
authentication of the remainder of the native suite (215, 224, 222).
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
In summary, various portions of the boot process include an object
authorization and authentication (A&A) process for newly acquired or located
objects. The authorization check of the native suite is done within the base
5 platform. The authorization of the base platform is, in turn performed by
the boot
code, which can only authenticate a base platform object. When running, the
O/S of
the native suite performs the authentication and authorization of subsequently
loaded obj ects. These checks are required so that, given an interruption in
power,
etc., the authorization status of the terminal can be verified. If, at any
point an
10 authorization or authentication check fails, the object being checked is
disabled.
Authentication is performed as follows. When a code object is broadcast
over the cable network, it is associated with an authorization code and an
authentication signature. For the base platform object, the authorization code
is
preferably given in an object id field of the boot code message. The
authentication
15 signature is preferably given in an object description field of the boot
code
message. For other objects, such as the O/S and the native suite, the
authorization
code and authentication signature are provided in an OCAM downloaded with the
object.
The authentication signature is computed mathematically using a specific
2 0 algorithm with the code object itself as the input for the algorithm. The
signature is
then re-computed by the set-top terminal using the same algorithm and the
downloaded code as input. If the signature computed by the set-top terminal
matches the one transmitted with the code, the code can be implemented with
confidence that its has been transmitted properly, without inadvertent or
malicious
2 5 alteration.
The present invention provides for two basic ways to upgrade the basic
platform in a population of set-top terminals once those terminals have been
placed
in full service. These two methods of upgrade are (1) a universal upgrade of
the
entire population (i.e., the entire population tuned to a particular control
stream) and
3 0 (2) a targeted upgrade of a subset or subsets of the population. Both
methods may
make use of the boot code to perform the upgrade.
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
16
A universal upgrade is accomplished by broadcasting an order from the
headend for all set-top terminals on the control stream to delete their
existing base
platform object. The boot code then begins executing, assumes control, and
performs the initialization procedure outlined above, including replacing the
deleted
base platform with a base platform downloaded over the cable network.
A targeted upgrade applies to a single terminal or a small group of terminals
on a given control channel. Each terminal has a specific single-cast address
and can,
therefore, be addressed by the headend and instructed to delete the existing
base
platform code and re-initialize with upgrade code. Alternatively, each
terminal has
one or more multi-cast addresses that are shared by other terminals in the
population. Four such multi-cast addresses for each terminal are preferred.
With a
multi-cast address, the headend can signal a code purge and re-initialization
for a
specific class of terminals that share that particular multi-cast address.
In a targeted upgrade, the base platform, using standard download messages,
sets up download parameters in a start-up database in non-volatile memory (See
Fig.
3) and allows the boot code to take control. The boot code then uses the
parameters
to acquire the upgraded base platform code, replacing the original base
platform
code. This is done while the older version of the base platform code is still
spinning
2 0 at a location indicated by the boot message.
In addition to the examples given above, an upgrade need not disturb the
base platform code. Rather, the upgrade or reset signal, whether universal or
targeted, may instruct the set-top terminals) to terminate and delete only the
operating system (O/S), the entire native suite, or one or more particular
resident
2 5 applications. Control then returns to the base platform code which will
acquire and
authenticate a new O/S, entire native suite, or portions of the native suite
as
necessary. In this way, the native suite (or just the O/S) can be upgraded
without
requiring the base platform code to be reacquired as well.
Fig. 3 illustrates four memory units of a set-top terminal (300) according to
3 0 the present invention. A read-only memory unit (ROM) (301 ) contains the
boot
code (302). A flash memory unit (303) contains the base platform code (304)
and
CA 02370214 2001-10-15
WO 00/64181 PCT/US00/10018
17
the O/S object (306). Aside from these objects, additional flash memory is
available
(305). Two stack pointers (307, 308) designate absolute locations in the Flash
memory (303) for the base platform code (304, 308) and the O/S (306, 307). It
is
important that these two objects are always located at the same location in
Flash
(303).
A non-volatile memory unit (310) preferably has both a managed and a non-
managed segment. The base platform code (304) may store parameters and other
data in the non-managed portion of the non-volatile memory unit (310).
Finally, a random access memory unit (RAM) (309) is provided.
Downloaded objects such as the base platform code, the O/S, etc. may be stored
in
the RAM (309) until authenticated. Once authorization and authentication are
successfully completed, the objects may be transferred from the RAM (309) to
the
Flash memory unit (303) for long-term storage.
The preceding description has been presented only to illustrate and describe
the invention. It is not intended to be exhaustive or to limit the invention
to any
precise form disclosed. Many modifications and variations are possible in
light of
the above teaching.
The preferred embodiment was chosen and described in order to best explain
2 0 the principles of the invention and its practical application. The
preceding
description is intended to enable others skilled in the art to best utilize
the invention
in various embodiments and with various modifications as are suited to the
particular use contemplated.
