Abstract

A method for providing authentication, authorization and access control of software object residing in digital set-top terminals creates a fingerprint ("signature") for each software object, associates each fingerprint with a service tier, encodes each association and creates an association table containing the information and downloads the association table to the digital set-top terminal. In addition, the method utilizes an entitlement management message, sent to each set-top terminal, indicating what software objects the set-top terminal may utilize, and provides a system routine at the digital set-top terminal that is invoked whenever software object is about to be utilized. The entitlement management message contains the access rights given to a particular set-top terminal, which must match the software object's access requirements for the software object to be utilized. The entitlement management message may also contain set-top terminal resource control access rights that a given software object may utilize. When the software object requires the utilization of a set-top resource, a second conditional access routine may be invoked to determine the authorization rights for using the resource. Measures to protect such means are also described. As such the method provides multiple system cable operators (MSO's) with additional capabilities to maintain secure control of features and applications running on their networks and within the associated set-top terminals.