Patent Application
20140304752
The present invention concerns a method to identify at least one content within a data stream, said content being needed by a given application executed on a test device.
The aim of the invention is to detect content needed by a given application, whose implementation (hereafter the test device) is available as a “black-box” (i.e., a device that can be analysed externally by observing its reaction (output R) to different inputs I1, . . . In).
One particular field of application is Pay-TV field in which the content plays the role of security messages and the data stream is the video data broadcast by a satellite.
Some pirates use a satellite ISP or private satellite connection to broadcast via satellite the control words “CWs” (which are one example of the security messages) protecting a payTV operator's content. The control words are extracted from a genuine security module and spread to users having subscribed to this pirate service.
The Satellite Key Sharing pirate STBs or dongles will then only need satellite feeds to get either the video scrambled and the CW to descramble. The pirate decoder receives the audio/video stream in the same manner as the genuine user i.e., through satellite or terrestrial signal and connects in parallel their decoder to this CW stream service. The control word is then passed to the decoder to decrypt the audio/video content and to obtain the audio/video in clear. Each control word is used to encrypt a part of the audio and video stream (AN stream). A slice of NV stream encrypted with the same control word composes a crypto period.
Pirates may change the satellite ISP or private satellite connection very often, so identification of the pirate feed requires fast and automatic tools.
Furthermore, to identify illicit CWs within the satellite streams, the analyzing tools need to access to the satellite beams' footprint.
Depending on the location of the footprint and of the personnel performing the analysis operations, limited internet connectivity may be available between the two, hence requiring optimized solutions to reduce traffic.
As it is well known, in such Pay-TV systems that use a security module, the content is encrypted by means of control words and is then sent to multimedia units connected to a data or content supplier. The controls words are sent to multimedia units in an encrypted form in control messages (ECM). These control messages (ECM) are transmitted by the decoder of the multimedia unit to the security module of this unit. If the decryption rights are present, the control messages are decrypted in order to extract the control words. Said control words are returned to the decoder that uses them to decrypt the content.
According to the invention, a method to identify at least one content within a data stream is provided, said content being needed by a given application executed on a device, this method comprising the steps of:
a) capturing at least one data stream,
b) analyzing and filtering the data stream by:
c) isolating at least one test stream of the data stream and disabling the other sub-streams, and applying the test stream to the application so as to produce an output (R),
d) applying the output to a comparator (comp), said comparator receiving a reference (R′) and determining a distance (D) between the application output (R) and the reference (R′), when the distance (D) is below a predefined level (L), repeating step c) with a new test stream selected among the previous test stream, the new test stream being a subset of the previous test stream, and
when the distance (D) is above or equal to a second predefined level (L2), repeating step c) by selecting a different test stream from the data stream not already applied to the application.
The present invention will be better understood thanks to the attached figure in which the various elements of the invention are illustrated.
The test device (Tst_Dev) implements the application under examination. It is fed with the modified stream (M_S) comprising at least one test stream captured and filtered by the controlled filters (CF) and synchronized by the stream dispatcher (St_Dis). The application (R(x)) is implemented within the test device (Tst_Dev), however the latter is available as a “black box”. The output of the test device (Tst_Dev) if function of its internal status and of its inputs: Output=R(I1, . . . ,In, Status).
The controlled filters (CF) are in charge of capturing one or more data streams (S1, . . . ,Sn) (for instance, from one or more satellite(s)), and obtaining the modified stream containing the test stream from the data stream following the instructions of the stream selector and of handing over a new modified stream (hereafter the test streams Ix, . . . , Iy) to the stream dispatcher (St_Dis). This method requires at least one controlled filter. A controlled filter may disable some of the sub-stream of a data stream by one of the methods described below. A sub-stream is a part of the data stream identified by one or more common characteristics; the characteristic of the sub-stream is composed of a characteristic type (e.g., “packet identifier”, “IP Address”, “payload pattern”, etc.) or a characteristic value (e.g., the number of the packet identifier, a given IP Address, a mask of IP Address, a pattern for the payload, . . . ). The characteristic defining a given sub-stream is referred to herein as the SSC.
Three methods to disable part of the data stream, thus forming the modified stream are proposed. The non-disabled part of the data stream is called test stream. The first method is to remove the sub-streams that are not part of the test stream. The data stream is then cut to remove some of the sub-streams and only the test-streams are sent to the test device.
The second method is to modify the sub-streams that are not part of the test stream. This modification has the aim of avoiding the interpretation of the data by the test device. This can be achieved through the identification of the payload and the modification of said payload, either by a constant or by random data.
Another way to disable the data is to modify the header so that the rest of the data has no meaning.
The third method is to act on the signalization of the data stream. The data stream comprises a signalization table (PAT) describing all available services, the services being then linked to a plurality of sub-streams. This table will be modified to hide some of the services to leave in the data stream only the test-streams visible.
The stream forwarded by the controlled filter to the stream dispatcher is the modified data stream (M-S). The modified stream comprises at least the test streams and, depending on the disabling method, the other sub-streams.
The stream dispatcher (ST_Dis) receives the modified stream from the different controlled filters, ensures the synchronization among the modified stream and feeds it to the test device. The transfer of the feeds between the controlled filters and the stream dispatcher may happen remotely (e.g., via the internet), hence the bandwidth between the components may be a critical factor and the modified stream to be forwarded to the stream dispatcher must be accordingly selected by the stream selector. In the particular case of Pay-TV Satellite Key Sharing, the stream dispatcher has the function of synchronizing at least two streams, one being at least a modified stream and the other one being either a non-modified or a modified stream. The stream dispatcher synchronizes the modified stream (containing the test streams which contain the security messages embedding the control word) with the stream containing the audio/video content, in order to have the correct control word fed to the test device during each crypto period. The security messages can be any data of particular interest to be located into the data stream. In Pay-TV, we understand these messages to be the Entitlement Management Messages (EMM), containing the rights and various configuration for the security module or the Entitlement Control Messages (ECM) containing the control word. The stream of audio/video content can also be filtered to have a modified stream having only a subset of services.
The comparator (Comp) receives the input of the test device and compares it to a reference output R′ (for example, for the SKS, R′=the presence of descrambled video in the TV). The comparator provides to the stream selector an indicator of the distance D between the output of the test device and the reference output R′: D=(d(R(I1, . . . In status), R′). A first predefined level L1 is then used to decide if the application is working satisfactorily and therefore the iterations can stop. The last test stream used, identified by the SSC, is then used for later analysis and action. When the distance D is above a second predefined level L2, the current test stream is discarded and other test streams are selected. The first and the second predefined level can have the same value. The value of the distance D between the first and the second predefined level is then used to determine that the test stream is promising but not precise enough to stop the iteration. This test stream is then used to define a smaller test stream within the previous test stream. This first predefined level L1 is defined according to the kind of application being analyzed. For example, in the case of Pay TV Satellite Key Sharing, R′=“image is descrambled” and the distance D(R,R′)=0 if the test device is able to descramble the NV stream contained in one of the data streams by using the control words used in the test stream currently tested. In this case, we have a go/nogo status for the first and second predefined level. They have in this case the same value. The comparator can also decide to stop the iteration process until the granularity of the test stream is sufficiently small to be identified. In the case of an IP stream, the first iteration will be the whole IP stream. In the successive iterations, the SSC value can then change to either refine the range of the IP address or by selectively testing all IP addresses of the IP data stream.
The comparator, stream dispatcher and test device jointly constitute an analysis module.
The analysis described herein is performed as successive analysis iterations. Each analysis iteration generates a distance D calculation by the comparator. At each analysis iteration, the stream selector adjusts the parameters of the controlled filter until D=0. In order to do so, the stream selector instructs the controlled filter to generate appropriate test streams such that the amount of disabled sub-streams is increased at each analysis iteration. When the maximum level of granularity such that D=0 has been reached, the stream selector interrupts the process, provides as an output the last (e.g., most restrictive) values of the controlled filter that have led to D=0 and declares an identification success. Depending on the nature of the data stream input to the controlled filter, the granularity of the filtering may be at a Satellite Transport Stream level, at PID level, at an IP address level, or it may depend on any other information related to the header or to the content of the packets present in the data streams (i.e., pattern of the data packets). The granularity of the filtering may vary between two analysis iterations. In particular, it may be a given a hierarchical organization.
The successive analysis iteration is one method to converge to the content. The test stream is first selected from a large category, e.g., the streams having IP packets (as opposed to the streams having video data) for a first round of test. If the comparison is positive (i.e., the distance D is below the second predefined level L2 but not below the first predefined level L1), the controlled filter is set so has to have a finer granularity of the streams previously positively detected. In the negative case, the disabled streams of the previous round are now considered has having the content and these sub-streams are then applied to the controlled filter so has to elect one or more test streams among these sub-streams. This recursive approach allows a quick and efficient way to converge to the final sub-stream containing the content, until the comparator gives a distance value below the first predefined level L1.
This output of the stream selector can then sent to other modules that can take appropriate actions depending on the content of the output (e.g., generate emails, . . . )
The stream selector identifies the best strategy to modify the parameters of the controlled filters in order to minimize the overall time necessary to complete the analysis (i.e., to obtain the most restrictive parameters of the controlled filter such that D=0) and to minimize the instantaneous and total bandwidth necessary to transfer the test streams between the controlled filter and the stream dispatcher. In order to do so, the stream selector selects at each iteration which sub-streams must be removed or modified from the data stream (so as to keep only the test streams). The sub-stream characteristic (SSC) is used to determine which sub-stream will be part of the test stream. At each iteration, a new value or type is selected for the SSC by the stream selector via one of the following methods:
The stream selector can predict the test streams where the content is most probably present and retrieve these streams in the right sequence, in order to save bandwidth and transmit only (or first) those to the test device. The likelihood of a test stream containing the content can be estimated by i) observations of the other Test Streams (patterns, behaviour, quantity of data that changes between two packets, . . . ) or ii) by prediction based on inferring from historical data (previous Analysis Iterations or previous analysis on the same application or other applications).
Since each test stream can contain a different number of data packets per second (i.e., different bandwidth), not all test streams have the same “analysis cost”. The stream selector hence considers—in addition to the other parameters already discussed:
The test streams are sent to the analysis part in a way that minimizes the overall “analysis cost”, such that E[Ta] is minimal (E[x] represents the statistical average and Ta is the Total analysis cost) . Ta=SUM(Ti) ¦:i=1 to N; where N is the number of test stream analyzed before the identification success is declared. Ti is proportional to the “test stream bandwidth”. N is function of the Pi distribution (the probability that a given test stream contains the content). Hence the tool will calculate the best sequence, considering the probability and cost of each stream and finding the best trade-off.
In the determination of the best sequence, the stream selector also takes care of identifying the sequence that would maximize the efficiency jointly on the transmission and central analysis (e.g., to ensure that at no moment the analysis module is waiting because of lag on the transmission line, nor that too much data accumulates while waiting to be analyzed).
This application is a National Stage of International Application No PCT/EP2012/054570, which claims priority to U.S. Provisional Patent Application Nos. 61/531,035 filed Sep. 5, 2011 and 61/531,145 filed Sep. 6, 2011.
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/IB2012/054570 | 9/5/2012 | WO | 00 | 6/4/2014 |
| Number | Date | Country | |
|---|---|---|---|
| 61531035 | Sep 2011 | US | |
| 61531145 | Sep 2011 | US |
