Patent Application
20050055551
The invention relates to a protocol for the remote management of control of access to encrypted or scrambled information.
Control of access to encrypted information has experienced an unprecedented rise through the advent of network information transmission technologies.
These techniques, whose purpose is to ensure the transmission of information to the greatest number of users, currently make it possible to offer a very large number of services because of the rate of growth in the calculation and memory capacities of integrated circuits, doubling approximately every five years, and, as a consequence, in the power for processing transmitted information.
Techniques of control of access to encrypted information were originally suggested in the context of applications in the transmission and display of information on television receivers for entertainment, information and other purposes.
Such techniques have in particular found application in the system known as “ANTIOPE”, standing for “Acquisition Numerique et Télévisualisation d'Images Organisées en Pages d'Ecriture” (the Digital Acquisition and Television Display of Images Organised as Written Pages), the system known as “TITAN”, standing for “Terminal Interactif de Télétexte à Appel par Numérotation” (Interactive Numbering Called Teletext Terminal), or the system known as “EPEOS”, standing for “Enregistrement Programmé des Emissions sur Ordre des Sources” (the Programmed Recording of Emissions on Order of Sources).
These systems, which use a procedure known as “DIDON”, standing for “Diffusion de Données Numériques” (the Broadcasting of Digital Data), for the broadcasting of information relate to a broadcast videotext system, an interactive videotext system, and a programme forwarding system respectively by the remote control from an emission source of the action of recording by receiving equipment, such as a video recorder.
Application of the access control process to such systems has been proposed. Such an application raises the problem of locking the information upon broadcast, by encryption or scrambling, and then unlocking the encrypted or locked information upon reception having regard to user authorisation criteria and the specific features of the system being controlled.
In particular, an access control system applied to the aforesaid systems has been developed and described in French patent application 79 02995 (2 448 825) made available to the public on the 5th Sep. 1980. In the aforesaid access control system a double key process comprising a service key which is used to lock the information, this key being changed randomly at brief intervals of the order of several minutes, and a so-called subscriber key, which may take several values Ci according to the nature of the subscription, are used. This key also changes randomly at longer intervals, of the order of a month. It is recorded on a subscription medium such as a smart card or a credit card which is inserted into each receiver set.
Special messages are composed when broadcasting and transmitted together with the locked data. These messages make it possible to restore the service key in the receiver set, then to open the electronic lock which locks the transmitted locked information.
Such a process has been the subject of many technological developments, which have given rise to the establishment of standard UTE C90-007 “Conditional Access System for Digital Broadcasting Systems”.
In general, on the basis of the teaching in the aforesaid French patent application, the arrangements adopted in the text of the standard mentioned above relate to the definition of specifications for systems controlling conditional access to scrambled or encrypted information which makes it possible to ensure that television and radio programmes, data viewing services or other types of services are only accessible to users who fulfil very specific conditions and satisfy very specific criteria essentially associated with payment for viewing the aforesaid programmes or services.
With this object such systems make it possible to ensure the remote management of controlling access to scrambled information through a service key transmitted between the broadcasting centre and at least one receiver set. The transmitting centre comprises the module calculating a control word, CW, containing at least the service key, and a module encrypting the control word, CW, using an operating key, SOK. A module generating control messages for access entitlement, ECM messages, containing at least the encrypted control word and control parameters for access entitlement and a module generating management messages for access entitlement, EMM messages, are provided. ECM messages and EMM messages can be multiplexed in the flow of transmitted encrypted information.
Each receiver set comprises at least one terminal for unscrambling the scrambled information and an access control module comprising a security processor (PS) housed for example in an access control card inserted into the terminal. The security processor comprises the operating key, SOK, and access entitlements, stored in secure internal memory, and a de-encryption module, the security processor making it possible to restore the service key from the operating key and the encrypted control word subject to verification of one of the recorded access entitlements, from the control parameters for access entitlement.
Each unscrambling terminal comprises an unscrambling module which can de-encrypt the transmitted scrambled information using the restored service key for use by an authorised subscribing user holding the access control card.
Such systems, which have been developed in the context of the provisions of the aforesaid standard UTE C 90-007, are satisfactory inasmuch as on the one hand the calculations for restoration of the service key and the secrets, the operating key, necessary for performance of these calculations are located in a protected memory zone of the access control card, the operating key never being accessible through external reading, and on the other hand transmission and management of access entitlement stored in the memory of the security processor is rendered wholly independent of access control as such, which is subject to holding the current operating key, in order to permit restoration of the current service key, and then unscrambling of the scrambled data using the latter.
This invention relates to the use of a remote management protocol for controlling access to scrambled information enabling application of the access control process to all types of on-line service, associated in particular with electronic transaction operations, regardless of the nature of the scrambled data transmission.
Another object of this invention is, in particular, the use of a remote management protocol for controlling access to encrypted information of a very high security level, the dialogue between the unscrambling terminal and the security processor, the preferred point of attack by pirates and code breakers, being subjected to a local security protocol.
Another object of this invention is also to provide specific messages, such as EPM messages, constituting messages linking the management of access entitlements and ensuring a link between ECM messages and EMM messages.
Another object of this invention is finally to provide a remote management protocol for access control to scrambled information applied in a great variety of services, such as the secure on-line conduct of electronic transactions through the intermediary of-a return path via the transmission of programmable messages, which will make it possible to process state variables representative of a great variety of situations and environments, regardless of the nature of the service and the transaction in question.
The remote management protocol for controlling access to scrambled information using a service key and transmitted via a network, to which the invention relates, is implemented between a broadcasting centre and at least one receiver set. The transmission of scrambled information is accompanied by a control word containing at least the service key, a control word which has been encrypted using an operating key. This transmission of the cryptogram of the control word is carried out by means of access entitlement control messages, ECM messages, containing at least this encrypted control word and access entitlement control parameters. The ECM messages are transmitted and multiplexed in the flow of scrambled information with the access entitlement management messages, EMM messages. Every receiver set comprises at least one terminal for unscrambling the scrambled information and an access control module provided with a security processor. The security processor comprises the operating key and the entered access entitlements allocated to a subscribing user stored in the protected memory of the security processor makes it possible to restore the service key from the operating key and the encrypted control word subject to verification of the entered access entitlements. Every unscrambling terminal can be used to unscramble the scrambled information using the restored service key for use by an authorised subscribing user.
It is noteworthy in that it comprises at least transmitting a control message comprising data fields forming at least one input template, control applicative data and cryptographic redundancy or a digital signature from the broadcasting centre to at least one receiver set and/or the security processor associated with the latter. The input template includes the security attributes applied to the command applicative data. The cryptographic redundancy or digital signature makes it possible to authenticate and guarantee the integrity of the control message from the security attributes.
It also comprises subjecting the exchange of action instructions and responses to those action instructions between the unscrambling terminal and the security processor to a specific local security protocol which makes it possible to protect against local listening at the unscrambling terminal/security processor interface, to carry out a sequence of tasks constituting the performance of at least one action instruction in a secure way.
The protocol to which this invention relates finds application in remote management of control of access to scrambled or encrypted information transmitted periodically over a network, regardless of the nature of the transmission system used, only the requirements for synchronising the transmission of scrambled or encrypted information, the encrypted control word and the service key associated with the latter, if appropriate the operating key used, having to be satisfied.
This will be better understood from a reading of the description and an examination of the drawings below in which:
a represents, by way of illustration, an organisation chart of the essential stages in implementing the remote management protocol for controlling access to scrambled information according to this invention.
b represents, by way of illustration, a variant embodiment of the protocol to which this invention relates as illustrated in
a to 2c represent, by way of illustration, the specific structure of the reply command messages respectively which make it possible to implement the protocol according to this invention.
a shows, by way of illustration, an organisation chart of the essential stages which make it possible to implement a local security protocol used between the unscrambling terminal and the security processor with which the access control module associated with the latter is fitted in order to ensure the transmission of command messages towards the secure processor.
b shows, by way of illustration, an organisation chart of the essential stages which make it possible to implement a local secure protocol passed between the security processor with which the access control module is fitted and the unscrambling terminal to ensure the transmission of reply messages to that terminal, if necessary to the broadcasting centre or the broadcasting management centre.
c shows, by way of illustration, a process for indexing reply command messages respectively which can be implemented in the context of the local security protocol in order to increase the security and reliability of the latter.
d shows, by way of illustration, a variant embodiment of the local security protocol shown in
A more detailed description of the interactive process for the remote management of control of access to scrambled information according to this invention will now be provided in connection with
With reference to the aforementioned
Messages transmitted by message broadcaster E are designed to ensure the remote management of access control to scrambled information using a service key and transmitted in a system between the broadcasting centre transmitting E messages and at least one receiver set PR. The concept of scrambling information covers the operations of symmetrical encryption of that information using secret keys and of non-symmetrical encryption using public keys and private keys respectively.
The transmission of encrypted information is accompanied by a control word CW containing at least the service key. The control word is encrypted using an operating key referred to as SOK. Transmission of the encrypted control word takes place using access entitlement control messages referred to as ECM messages containing at least the encrypted control word and access entitlement control parameters.
The ECM messages are transmitted and may be multiplexed in the flow of encrypted information together with access entitlement management messages referred to as EMM messages.
The process of transmitting encrypted data and the multiplexing of ECM messages and EMM messages satisfies for example the provisions of standard UTE C90-007 previously mentioned in the description. For this reason, the aforesaid process will not be described in greater detail.
In general, it should not be forgotten that the access control module associated with each unscrambling terminal T comprises the operating key SOK as well as the entered access entitlements allocated to a subscribing user, who is the authorised holder of the access control module. The operating key and the entered access entitlements are placed in memory in the secure memory of the aforesaid access control module. The latter also comprises a security processor and cryptographic resources which make it possible to restore the service key used to encrypt the transmitted scrambled information, from the operating key and the encrypted control word. Restoration of the service key is brought about following checking of the entered access entitlements, or at least one of the entered access entitlements from the control parameters for the transmitted access entitlements.
Each unscrambling terminal is capable of unscrambling scrambled information broadcast for use in clear by the authorised subscribing user using the restored service key.
Finally, and in the context of implementing the process to which this invention relates, each receiver set can advantageously be connected to the broadcasting centre, broadcaster E, through a return path which ensures interactive implementation of the remote management process according to this invention.
As shown in
The input template includes the security attributes which are to be applied to the command applicative data DAC. The authenticity data make it possible to authenticate the command message, as will be described below in the description.
Stage A is followed by a stage B comprising submitting the exchange of action instructions between the unscrambling terminal T and the security processor PS of the access control module to a specific local security protocol. A specific local security protocol can be used to provide protection against local listening at the unscrambling terminal/security processor interface, to carry out a sequence of tasks comprising the execution of at least one action instruction in a secure way.
In accordance with a particularly advantageous aspect of the protocol according to this invention it is pointed out that the specific local security protocol mentioned above implemented in stage B can take into account the destination of the command messages MC to the unscrambling terminal T and the access control module respectively, as will be described below in the description. In fact, depending upon the maximum security requirement sought it is possible to implement different variants for execution of the local security protocol with a view in particular to ensuring maximum security for the exchange of data between the unscrambling terminal T and the security processor of the access control module. The maximum security level may be defined as reserving execution of all the encryption/de-encryption operations to the internal organs of the module, in particular to the security processor of the latter, as will be described below in the description.
Where the receiver set or sets PR are provided with a return path connecting each of these receivers to the broadcasting centre E or to a management centre for the latter GE, aforesaid stage B can then, as shown in
In
It comprises data fields comprising at least one input template G′E, reply applicative data DAR and state data denoted ST.
It may also include authenticity data RC. The input template includes security attributes applied to the reply applicative data. According to an advantageous aspect of the protocol to which this invention relates the absence of an input template G′E in the reply message MR corresponds to an absence of the security applied to the reply applicative data. In particular it will be understood that the reply applicative data DAR will not necessarily have been encrypted, depending upon the operation performed, and that as a consequence in such a situation the field or a part of the field of the reply applicative data DAR may be simply transmitted in clear.
On the other hand, when the transmitted command message MC relates to sensitive data, the field or a part of the field forming the command applicative data DAR may be encrypted.
The field containing the authenticity data provided by the cryptographic redundancy or the digital signature RC may be calculated from a signature calculation protocol using for example a public key.
In general, it is pointed out that the specific local security process relates to the exchange of messages between unscrambling terminal T and security processor PS.
In a preferred non-restrictive embodiment the local link between unscrambling terminal T and the access control module, comprising a card, is a link according to protocol ISO 7816. This being the case the exchange of local messages between the unscrambling terminal T and the access control card corresponds to command messages of the type known as C_APDU and reply messages referred to as being of the R_APDU type. The exchange protocol for this type of messages will not be described in detail because it corresponds to a protocol which is in itself known.
Finally, as regards calculation and transmission of reply messages MR, particularly along the return path, it is pointed out that the aforesaid return path may constitute for example a telephone link in the switched telephone system, this link being, as appropriate, being associated with any link in a hertzian network or other conventional type of network in order to ensure the transmission of each reply message MR to broadcaster E or the broadcasting management centre GE associated with the latter.
A more detailed description of the structure of command messages MC and reply messages MR respectively will now be provided in connection with
As shown in
In general it is indicated that each command message MC, where such a command message includes a reply template GR, can be used to fix the security conditions and attributes which have to be applied to the reply applicative data in addition to the command message MC question.
In this way it is possible to manage not only the security of command messages, but also all reply messages by changing the values contained in the field forming the reply template GR for successive command messages MC.
As also shown in
A list of action instructions is shown in
[ACT0[ACT1[ACT2 . . . [ACTn]]]]
The notation in the aforesaid list of action instructions corresponds to a conventional notation for lists. In particular it will be understood that each action referred to as ACT0 to ACTn may then be executed sequentially by the recipient of the command message MC, this recipient being, in accordance with a particularly advantageous aspect of the process according to this invention, either unscrambling terminal T or the aforementioned security processor of the access control module.
A particularly advantageous way of implementing the process according to this invention will now be described in connection with
This embodiment makes it possible to introduce great flexibility into use of the aforesaid messages. In this embodiment the aforesaid messages, command and/or reply messages, then constitute generic messages referred to as EXM. Because of their very great flexibility in use and the structure associated with the latter which makes it possible to introduce such flexibility of use, EXM messages may take the form of ECM messages or EMM messages, or again specific management messages as will be described in the description below.
With this object, as shown in
In
Data=(Action|(IfBlock[ThenBlock][ElseBlock]))+
In particular, it will be understood that in the above relationship Data refers either to command applicative data DAC in clear, or as appropriate encrypted data designated by CKDAC, or reply applicative data in clear designated by DAR, or as appropriate encrypted data designated as CKDAR. The notation in the above relationship is a metalinguistic description notation of the Backus-Naur-Form type which will be explained in the description below.
As far as the above relationship is concerned, it is pointed out that the command message and/or reply message and the command and/or reply applicative data constitute a structured logic phrase which may include the logical relationship:
In
As a result of the structure of the command messages MC and reply messages MR respectively as described above in the description in connection with
Examples of the general structure of reply command messages respectively are now provided below in the description using a metalinguistic description notation similar to the BNF (Backus-Naur-Form) form in which:
A semantic description of the messages will now be provided in the description.
By the term message is meant any command message MC destined for the security processor PS of the module or access control card respectively of terminal T originating from broadcaster E or broadcasting management system GE. For this reason it will be taken that all command messages MC are in fact intended for the security processor equipping either the module or the access control card, whether real or virtual.
All reply messages MR follow a command message MC and have as their destination terminal T or upstream equipment in the transmission system. The general structure of the messages is then as follows, according to Table T1 given below:
In the case of MC command messages:
The command applicative data are preceded by one or two templates, InputTemplate and ReplyTemplate, only the input template indicating the security attributes used in the present message.
When the command applicative data requires two templates, the latter precede the applicative data in the message.
Preferably, the information described in the input or reply templates of a command message MC are transmitted in clear.
The command applicative data indicate the specific actions which are to be taken into account by the access module or control card or the unscrambling terminal T.
In general, command applicative data are transmitted from distant equipment, i.e. broadcaster E, and are transmitted in encrypted form so as to ensure confidentiality of the data.
In the case of reply messages MR:
The reply message MR associated with a command message MC may be utilised either locally by unscrambling terminal T or by upstream equipment such as the transmitter or transmitter management system GE through the intermediary of the return path as previously mentioned in the description. In the former case, when reply message MR is utilised locally by terminal T the reply message is not subjected to general encryption, but only to the local security protocol, as will be described below in the description.
On the other hand, when the reply message is intended for transmission along the return path, this reply message MR is subjected to a general encryption process using for example a specific management key.
Of course, reply messages MR may also optionally contain authenticity data, cryptographic redundancy or a digital signature to authenticate and guarantee the integrity of the reply message itself. The field relating to these authentication data is absent when the associated input template is absent.
As far as the state field, designated by ST, is concerned, a reply message MR always includes a state or state field providing a report on the structure of the message, i.e.:
More specific indications relating to the input template data field of command and reply messages will now be provided.
With reference to the general structure of the messages previously mentioned in the description in connection with Table T1, it will be pointed out that the templates define the parameters necessary for the security mechanisms applied to the command applicative data and reply applicative data respectively.
This being the case, the two input templates GE or G′E and the reply template GR may include the following information, as shown in Table T2:
In the aforesaid table the file reference designated by RefFile indicates the file in which the key references apply. This is the name of a dedicated file or master file, i.e. the name of a service distributed by the broadcaster of encrypted data subject to conditional access. As a general rule, RefFile=SOID. SOID designates a broadcast service identifier parameter, standing for Service Output Identifier in English.
The algorithm references designated Algolds specify the algorithms used in the current message for the cryptographic functions associated with the message as described in Table T3.
In the above table, AlgoAuthenid indicates the message authenticity function, AlgoConfid indicates the confidentiality function for the reply applicative data and AlgoCipherid indicates the encryption function for the reply command specific applicative data respectively.
The key reference Keyids specifies the keys used in the current message while implementing the functions defined according to Table T4.
In which KeyAuthenid represents the authenticity verification key for the message, KeyConfid indicates the confidentiality key for the reply command applicative data and KeyCipherid indicates the encryption key for the specific applicative data respectively.
The initial data references RefInits are the values used in the current message to initialise the message authenticity functions designated InitAuthen and the confidentiality of the applicative data InitConf respectively.
The general structure of the messages is as a consequence as follows:
The command message MC/reply message MR pair then has the following structure as shown in Table T5:
With reply template: the structure of the command and reply messages respectively is as follows, as shown in Table T6:
As a general rule, the provisions applicable to the templates are as follows:
More specific indications will now be provided relating to the data structures constituting the command and reply applicative data fields respectively.
With reference to the general structure of command and reply messages respectively, it will not be forgotten that the command applicative data for a command message MC include:
It will not be forgotten that the command message, or reply message as appropriate, complies with the structured logic phase and may include the logical relationships:
Such a structure may be repeated within a structure of data designated by TData, the combination of conditions and actions being coded on the basis of a TLV coding process according to an ASN.1 data structure with labels of the TData type.
In general, it is pointed out that a single condition is a condition comprising just one action.
A logical combination of conditions comprises at least logical operators such as the conventional operators OR, AND, NOR and NAND carrying out OR, AND, NOT-OR and NOT-AND logic operations.
Depending upon the context of the applicative data processed, unscrambling terminal T is capable of selecting between a long reply and a short reply respectively provided in a reply message MR associated with a command message MC.
The applicative data for a long reply advantageously include:
The applicative data for a short reply include for each defined action:
Thus each command message MC may include a field or a bit specifying the reply format of the corresponding reply message associated with the latter. The long or short reply format may be selected by the unscrambling terminal T depending upon the application context and the detail of the information required in the context of that application context. A plurality of reply formats may be provided.
An example of a long or short single command message MC or single reply message MR respectively is provided in Table T7:
The general structure of the command and reply applicative data respectively makes it possible to code the combination of conditions. Such a structure may be recursive and in this case is represented as shown in Table T8:
The execution rules are then as follows:
By way of a non-restrictive example it is pointed out that the command and reply applicative data respectively carried in a message such as a command message MC or reply message MR respectively may be:
A more detailed description of the specific local security protocol constituting stage B in
In general it should not be forgotten that the interface between the unscrambling terminal and the security processor of the access control module and in particular the access control card where the latter constitutes for example a microprocessor card is the preferred point of attack for pirates and code breakers when attempting to compromise the control word CW when the latter is transmitted from the security processor PS to the unscrambling terminal T. In fact all the calculations for restitution of the control word CW are performed within the security processor, which has a maximum degree of security, it being possible for the secrets necessary for restitution of the control word to be accessed by external reading.
More particularly it will not be forgotten that the command applicative data in each command message received at the unscrambling terminal T may be in clear or on the other hand may be encrypted and these are referred to as DAC and CKDAC respectively in these two situations.
It will not be forgotten that the encrypted command applicative data CKDAC have been subjected for example to a general encryption process from a specific management key referred to as K available to the authority responsible for the management of access control and, in particular, the broadcasting of for example scrambled data.
In order to implement the local security protocol it is pointed out that the unscrambling terminal T and the access control module, in particular the access control card for example constituting the latter, are provided with cryptographic encryption/de-encryption, calculation and authenticity verification resources. In a simplified way it is pointed out that these cryptographic resources include encryption algorithms and keys respectively for specific calculation and authenticity verification symbolically represented by an encryption/de-encryption, calculation and authenticity verification key referred to as CL. This key is shared locally by each unscrambling terminal and by each access control module and may be specific to each pair so constituted.
This being the case, as shown in
In
CCL(MC)→CLMC
In this relationship it is shown that the operation CCL indicates both encryption of at least either the command applicative data in clear, DAC, or the encrypted command applicative data, CKDAC, of the command message MC and calculation of the signature values for example in order to give rise to the corresponding encrypted values and signature values permitting authentification of the values referred to as CLMC for the command applicative data in clear or for the encrypted command applicative data.
According to a particularly advantageous feature of the specific local security protocol to which the invention relates it is pointed out that the local encryption and local authentification process is independent of the encryption process previously used on transmission of the command message, i.e. in particular the general process of encryption using the previously mentioned management key K.
Stage B1 is then followed by a stage B2 comprising transmitting encrypted local command messages formed from locally secure command data CLd MCfrom unscrambling terminal T to the security processor PS of the access control module.
In
The local security protocol then consists of subjecting encrypted local command messages to a process of local de-encryption and local authentification in security processor PS with which the access control module is provided, in a stage B3, in order to restore the applicative data field for the aforesaid command.
The operation performed in stage B3 is denoted:
DCL(CLMC)→MC
In this relationship DCL(.) refers to the aforesaid local de-encryption and authentification operation.
Following stage B3 either command applicative data in clear DAC or command applicative data encrypted according to the general encryption process CKDAC comprising the command message MC are available.
Stage B3 is then followed by stage B4 comprising subjecting the applicative data field to an authentification process to restore suites of action instructions which can be executed in accordance with at least one task from the aforesaid command applicative data field.
It is pointed out that in
AK(DAC,CKDAC)→DAC, CKDAC
In the above relationship the operation AK(.) indicates the authentification process, which may for example comprise an operation of verifying the signature from the management key K used in the general encryption and authentification process by the operator managing the protocol to which this invention relates and broadcasting of the corresponding service. In fact it is pointed out that this operation may be carried out on the basis of security attributes transmitted with the command message MC, these attributes making it possible to identify and thus restore the management key K stored in the memory of security processor PS.
At the end of stage B4 command application in clear DAC or command applicative data CKDAC encrypted in accordance with the general encryption process are available, as mentioned previously in the description.
When the command applicative data are in clear, DAC data, stage B4 is then followed by a stage B5 consisting of executing the suite of action instructions which can be executed according to a task. The execution is shown in Stage B5, on the left hand side of
On the other hand, when the command applicative data are encrypted on the basis of general encryption, CKDAC data, execution stage B5 may as shown on the right hand side of
DK(CKDAC)→DAC,
In the relationship mentioned above, DK(.) indicates the operation of decryption proper using management key K. Stage B5a may precede stage B4 or be carried out at the same time.
Stage B5a is followed by a stage B5b of executing the command applicative data DAC.
A more detailed description of the specific local security protocol implemented when establishing reply messages will now be provided in connection with
With reference to aforesaid
Stage B6 is then followed by a stage B7 comprising subjecting the reply applicative data DAR to a security process by local encryption and local authentification of the reply message MR to give rise to reply applicative data which have been locally rendered secure.
In stage B7 the abovementioned process is shown symbolically by the relationship:
CCL(MR)→CLMR
In the above relationship, as when implementing stage B1 in
Stage B7 is itself followed by a stage B8 comprising transmitting local reply messages containing locally secure reply applicative data from security processor PS to unscrambling terminal T.
In
LM(CLMR).
When the access control module comprises an access control card connected to the unscrambling terminal using a local link according to protocol ISO 7816, the aforesaid local reply messages comprise messages referred to as being of the R-APDU type.
The specific local security protocol as shown in
In
DCL(CLMR)→MR
In this relationship the operation DCL(.) designates the local decryption and authenticity verification operation performed using the local encryption and authentification key CL.
The local security protocol implemented in respect of the reply message and the reply applicative data DAR as described in connection with
Furthermore, the local security protocol may advantageously be accompanied by a process of indexing the command and reply messages so as to strengthen the security and reliability of the whole while allowing filtering or replaying to be detected, and thus the elimination of messages which are accidentally and/or unintentionally repeated by unauthorised persons.
With this aim, as shown in
The current value is compared with the previous value j or i respectively of the command or reply message index respectively satisfying the abovementioned comparison.
If there is a negative reply to this comparison for the current command or reply message respectively, an error message is created, and a mutual unscrambling terminal/security processor authentification process may for example be initiated.
On the contrary, if the abovementioned comparison results in a positive reply the local security process or protocol may then be continued on the basis of the current command or reply message respectively.
The abovementioned indexing process may for example be implemented subsequently to stage B4 in
Finally, a preferred implementation of the local security protocol in which the access control module security processor plays a predominant part in controlling all the command messages received and processed by the unscrambling terminal and/or control access module security processor will now be described in connection with
In general it is indicated that the security processor PS is provided with a function of discriminating the destination of the command messages MC in order to ensure full control over the transmission and execution of command and reply messages respectively under the authority of the local security protocol implemented.
With this aim, as shown in
If there is a negative reply to the aforesaid test the command message MC or the command in question being intended for security processor PS and the authentification stage in stage B4 having had a successful outcome, execution according to stage B5 in
On the contrary, if there is a positive reply to test B4a, the current command message MC or the command in question being intended for unscrambling terminal T, this message being denoted MC*, a local security stage B4b is called, this consisting of subjecting the command applicative data DAC, CKDAC or the command message MC* to a process of local encryption using the local encryption key CL. This operation implemented in security processor PS corresponds to that carried out in stage B1 of
Aforesaid stage B4b is then followed by a stage B4c consisting of transmitting encrypted command applicative data or the encrypted command message, i.e. data CLMC*, to unscrambling terminal T, whether these data have been encrypted by means of a general encryption procedure through the use of a management key K or on the contrary have not been subjected to such a general encryption process. In the former case general decryption is performed by security processor PS before transmission to unscrambling terminal T.
Following transmission to terminal T in stage B4c the aforesaid encrypted command applicative data are subjected to a decryption operation in a stage B4d in terminal T itself. This decryption operation substantially corresponds to the operation described in connection with stage B3 in
Aforesaid stage B4d is itself followed by a stage B4e comprising either execution of the command applicative data in clear DAC in the unscrambling terminal or, on the contrary, transmitting the command applicative data encrypted by the general encryption process, data referred to as CKDAC, to broadcasting centre E or to the centre managing this broadcasting centre GE.
An example of an embodiment of a linking message known as an EPM message between an EMM message and an ECM message of the prior art will now be described in connection with
With reference to the aforesaid figure, in a stage E0 the receiver set PR receives a credit of units CU through an EMM message denoted EMM (CU, IEP). Following receipt of the aforesaid EMM message unscrambling terminal T presents the aforesaid message to security processor PS by transmission, the latter adding the credit of units to the electronic token holder mentioned in message EMM. By way of example it is pointed out that in the case of an electronic token holder EP the identification number may be a number IEP. The aforesaid transmission operation is carried out in stage E1.
After the abovementioned stage security processor PS adds the credit of units in the electronic token holder mentioned in stage E2, the crediting operation being denoted:
NCR=CR+CU
where CR designates the previous credit value and NCR designates the new credit value.
Operations E0, E1 and E2 are carried out on the initiative of the access control manager in order to confer a sufficient credit of units to allow the latter to offer access to all customers allocated the aforesaid credit of units.
With this aim stage E2 is then followed by a stage E3 which is carried out on the initiative of the access control manager through the transmission and, of course, corresponding reception by receiver set PR of a message referred to as EPM which is designed to ensure the link between the aforesaid EMM message and any subsequent ECM message as will be described below.
The EPM message, in the form EPM(MIDF, COST), broadcasts a film or programme reference number, denoted for example MIDF, which will be broadcast and which the subscriber can accept or reject within the context of the access offer made. In addition to this the aforesaid EPM message comprises a cost value, referred to as COST, corresponding to the purchase cost of the film or programme in question.
Following a stage E3, a stage E4 is envisaged which comprises requesting the subscriber's approval of the offer of access so submitted via terminal T. In practice the EPM message is first presented to security processor PS which indicates that the subscriber's approval is necessary.
In the absence of any subscriber approval in stage E4 the offer of access is classified as being without follow-up in stage E5. Conversely if the subscriber notifies approval of the aforesaid access offer in stage E4, terminal T transmits the EPM message with the subscriber's approval, a message linking with the corresponding MIDF and COST fields to security processor PS.
Stage E6 is then followed in security processor PS by a stage E7 which consists of debiting electronic token holder EP, this operation being denoted:
NNCR=NCR−COST
the electronic token holder thus being debited by the value COST, i.e. the number of units corresponding to the programme purchased. Furthermore, the identification or reference number of the film or programme purchased, the MIDF number, is entered in the memory of security processor PS. Preceding stage E7 is then followed by a stage E8 which is performed when the film or programme purchased through ECM messages of a conventional type is broadcast. The aforesaid ECM messages are received by the receiver set in stage E8 and in particular by terminal T and are of course accompanied by the cryptogram of the control word CCW and are presented by terminal T to security processor PS by transmission in stage E9. The identification number for the programme or film broadcast in these two stages is denoted DIDF.
Security processor PS then begins a verification stage E10 consisting of verifying the identity of the identification number of the broadcast film or programme DIDF and the identification number of the programme or film for which access was offered by the EPM message, i.e. the MIDF identification number.
If the reply to aforesaid verification stage E10 is negative a stage E11 terminating access to the broadcast film or programme identified as DIDF is called. On the other hand if there is a positive reply to the aforesaid verification test E10 an operation of decrypting the cryptogram of the control word is carried out, this operation being denoted:
DK(CCW)→CW.
in stage E12, in order to restore the control word CW.
Stage E12 is then followed by transmission of the control word CW containing the service key to unscrambling terminal T in order to open up access to the broadcast programme or film having identification number DIDF.
Finally the invention relates to any software product recorded on a recording medium which can be executed by an information system computer for implementing a remote management protocol for control of access to scrambled information using a service key transmitted in a network between a broadcasting centre and at least one receiver set, each receiver set comprising at least one scrambled information unscrambling terminal comprising an access control module provided with a security processor, this protocol possibly corresponding to stages such as those previously described in connection with
According to one particularly noteworthy aspect of the software product to which the invention relates, the latter, when executed by a computer, makes it possible to manage the stages comprising transmission of a command message from the broadcasting centre to at least one receiver set and/or to a security processor associated with the latter. As shown in
It can then manage a step comprising submitting the exchange of action instructions between the unscrambling terminal and the security processor to a specific local security protocol designated by B in
The software product recorded on a recording medium which can be executed by a computer in an information system according to the invention also makes it possible to manage the stages of the local security protocol as illustrated and described previously in connection with
| Number | Date | Country | Kind |
|---|---|---|---|
| 01 13532 | Oct 2001 | FR | national |
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/FR02/03528 | 10/15/2002 | WO |
