Patent Application
20050188192
The invention is located in the field of content protection and relates more specifically to a process for protecting against the re-routing of a multiplex transmitted by an operator to at least one receiver terminal.
The invention relates also to a transmission system comprising a transmitter and a receiver adapted to implement the process.
In order to protect transmitted contents, operators use access control techniques based on scrambling the transmitted contents by means of secret keys transmitted to subscribers with pre-defined access conditions. On reception, content descrambling is authorised if the access conditions are verified by the receiver terminal.
With these systems, operators can also control the way the transmitted content is used by the receiver terminals. However, these systems do not make it possible to prevent a transmitted multiplex, uncoded or in scrambled form, from being re-routed and being replaced by a pirate multiplex.
a shows diagrammatically the satellite transmission of a multiplex comprising audio-visual programs and the possible fraudulent re-routing of this multiplex. The situation can also be applied to any other transmission system, such as transmission via terrestrial network, or via cable network.
With reference to
On transmission, as shown in
In the prior art, the detection of such a substitution by the receiver terminal 8 is based on verifying the conformance of the content of the tables describing the transmitted programs against tables pre-defined by the operator. This conformance can be tested on multiple parameters such as the network identifiers, the value of the packet channel addresses (PID) used, etc. However it is possible with common metrology equipment to enter all these parameters into a real signal and to copy them in order to reconstitute an identical signal making detection of this type inoperative.
Another detection possibility, provided at receiver terminal level by the access control system, consists in verifying the presence and integrity of the entitlement control messages (ECM) associated with the programs. However, such detection is impossible when the operator transmits an uncoded program that does not comprise any ECMs. Additionally, entitlement control messages and the data constituting the tables can easily be recorded in a real signal and then artificially associated with an uncoded pirate program.
The purpose of the invention is to prevent a multiplex from being re-routed during transmission and to prevent this multiplex from being replaced by a pirate multiplex.
To this end, the invention advocates a process that allows a multiplex replacement to be detected from an analysis of the content of this multiplex.
The process according to the invention comprises the following stages:
On transmission,
and on reception,
The process according to the invention additionally comprises a stage consisting in verifying the temporal coherence of said variable data item.
In a first embodiment, said authentication message is protected by means of a symmetrical secret key.
In a second embodiment, said authentication message is protected by means of an asymmetrical private key.
In both embodiments, the variable data item may be constituted by the current date or by a counter status.
The process according to the invention applies particularly to a multiplex comprising at least one video component or one audio component encoded according to the MPEG (Moving Picture Experts Group) standard or at least one audio component encoded according to the DAB (Digital Audio Broadcasting) standard. These components may be all or partly scrambled and the authentication message may be integrated with any component, video, audio, or multiplex data. It should be noted that this message may be associated individually with each program of the multiplex or overall with the whole multiplex.
In a first alternative, the authentication message is inserted into a specific private flow dedicated to the authentication function.
In a second alternative, the authentication message is inserted as a private descriptor into a table describing the services carried by the multiplex.
When the multiplex carries audio-visual programs that are all or partly scrambled, the authentication message may be carried by an ECM message associated with a multiplex program, or by an Entitlement Management Message (EMM) associated with the whole multiplex.
It may also be constituted by a data block inserted into a pre-existing ECM message or EMM message.
The multiplex transmission system according to the invention comprises:
The invention also relates to a transmitter comprising means for associating with the transmitted multiplexes at least one authentication message protected by a cryptographic function and means for associating with said message at least one variable data item the evolution of which over time is pre-defined.
Preferentially, said cryptographic function is susceptible of being generated exclusively by the operator.
The receiver according to the invention comprises means for verifying the authenticity and integrity of said message, and means for verifying the temporal coherence of said variable data item.
Other characteristics of advantages of the invention will emerge from the following description, given as a non-restrictive example with reference to the appended figures wherein:
The invention will be described in the context of a transmission of a multiplex comprising a video component encoded according to the MPEG standard or an audio component encoded according to the MPEG standard, fully or partly scrambled.
With reference to
At the reception end the system comprises a calculation module 40 comprising a program for verifying the authentication message and the variable data generated by the generators 34 and 36 respectively.
The audio-visual programs are firstly scrambled fully or partly by the module 30, multiplexed with the authentication message and a variable data item generated by the generators 34 and 36 respectively so as to form a multiplex which will be transmitted via a transmission network 42 to a number of receiver terminals equipped with security processors.
At reception terminal level, the calculation module 40 analyses the multiplex received in accordance with the stages described in
At stage 50, the multiplex is demodulated and demultiplexed, and at stage 52, the authentication message and the variable data item which is associated with it are extracted from the multiplex in order to be analysed.
At stage 53, the presence of the authentication message is verified.
If the authentication message does not exist, the module 40 prohibits access to the multiplex. If the authentication message does exist, the following stage 54 consists in the calculation module 40 verifying the authenticity and integrity of the authentication message by means of the secret keys generated on transmission.
The purpose of this stage is to detect the unauthorised generation of this message.
If the message detected is not authentic, the module 40 prohibits access to the multiplex. If this message is authentic, the following stage 56 consists in verifying the coherence of the associated variable data item.
The purpose of this stage is to detect a fraudulent re-use of the authentication message previously extracted from a operator multiplex and recorded.
Regardless of any other access condition or of the fact that the program is uncoded, access to the program is refused by the terminal equipment (stage 57) if at least one of the conditions in stages 53, 54 and 56 is not verified.
If the authenticity and integrity of the authentication message are verified and if the coherence of the variable data item is also verified, the conventional entitlement control criteria, possibly associated with the multiplex programs are then examined.
It should be noted that the structure above comprises no field 60 containing the identifier (ident_oper) when the operator is known implicitly, nor a field 62 containing the cryptographic system identifier (ident-Crypto) when the cryptographic system is known implicitly.
Furthermore, the third field 64 containing the variable data item (Data_Coherence) may be uncoded or encrypted.
| Number | Date | Country | Kind |
|---|---|---|---|
| 03 51129 | Dec 2003 | FR | national |
