ITTO990465A1 - PAYMENT TELEVISION DEVICE EQUIPPED WITH MULTIPLE DECODERS WITH DISTRIBUTION OF ACCESS RIGHTS - Google Patents

Description

DESCRIPTION

of the patent for Industrial Invention

The present invention refers to paid services and / or communications, in particular television.

It finds an application in Hertzian broadcasting networks, direct via satellite or cable, in which the information disseminated (sound, image and sometimes data) are "encrypted", that is, modified according to a special coding, to prevent access to this information. A device to remove the encryption or a decoder, rented or sold to users for a well-defined use, allows them to access information "not encrypted", ie in the clear.

Generally, when you have several television receivers and want to receive pay-TV broadcasts on each of the television receivers, you must connect a decoder to each receiver, and you must obtain individual access rights for each decoder.

However, decoders are relatively expensive to purchase or rent, and the process of obtaining access rights from an operator is relatively cumbersome and inflexible, particularly when there are several users to satisfy with different needs.

In document US-57478732, a pay television installation comprises a main decoder and at least one secondary decoder, both equipped with a chip card, and intended for use in the same house. The main decoder implements a cryptographic process in association with the main chip card, to proceed with the authentication and decryption of an access title management message intended for the main decoder and which can only be used by the main decoder. The user then has a secondary chip card in the main encoder, and the main decoder inscribes the secondary access titles. A buffer memory is provided in the main decoder to receive the secondary access titles and transmit them after storage to the secondary chip card.

In this type of installation, there are no means of communication connected to the management center to request the access passes. Furthermore, the memory of the main decoder which stores secondary access titles before transmitting them to the secondary chip card is fragile and vulnerable in terms of data security.

The present invention provides a solution to these problems.

It refers to a pay-TV device intended to cooperate with at least one broadcasting network and an access rights management center, said television device being of the type comprising a main decoder suitable for converting encrypted signals which refer to information subject to payment coming from the broadcasting network in unencrypted signals, capable of direct use, the said main decoder comprising a main access control module adapted to cooperate with a main memory card containing a main user identity, associated with main access rights, and means of communication capable of being connected to the management center.

The pay-TV device further comprises at least one secondary decoder adapted to convert the encrypted signals into unencrypted signals, said secondary decoder comprising a secondary access control module adapted to cooperate with at least one secondary memory card containing an identity secondary user identity associated with secondary access rights, the secondary user identity being linked to the primary user identity according to the redetermined filiation information.

According to a general definition of the invention, the communication means of the main decoder are able to communicate with the management center to request said secondary access rights, according to the identity of the main user, the identity of the secondary user and the filiation information for receiving said secondary access rights thus requested, at the level of the main decoder or of the secondary decoder, through the broadcasting network, in order to transfer them, after reception, to the secondary memory card.

Such a device has the advantage of allowing access rights to be obtained for the memory card (s) associated with each decoder, with the help of a dialogue between the communication means of the (main) decoder equipped with such communication means and the management center, the other (secondary) decoders being able to be decoders equipped with means of communication with the management center and simply dedicated to the conversion of encrypted signals.

As a result, such a device is more ergonomic and less expensive than a device comprising decoders each equipped with means of communication with the management center. Furthermore, such a device according to the invention simplifies the distribution of access rights for one or more secondary memory cards associated with one or more secondary decoders.

According to a first embodiment of the invention, the main decoder comprises a card reader equipped with two reading slots. In this first way, the demand is established when the main memory card is inserted into the first slot and when the secondary memory card is inserted into the second slot. Secondary rights are received at the main decoder level, stored in the main memory card, and then transferred from the main memory card to the secondary memory card.

In relation to document US-5748732, the transfer of rights is carried out without internal storage in the main or master decoder, but with the help of the main board memory, which improves data security.

According to an embodiment of the invention, the main decoder comprises a single slot card reader. In the second way, the demand is established when the main memory card is inserted into the slot of the reader of the main decoder and when the secondary memory card is inserted into the slot of the reader of the secondary decoder. Secondary access rights are received at the secondary decoder level, and stored directly in the secondary memory card (i.e. without internal storage in the primary or master decoder).

Other features and advantages of the invention will appear in the light of the detailed description which follows and of the drawings in which:

Figure 1 schematically represents the operating principle of a pay television system of the prior art;

Figure 2 is a detailed diagram of the distribution of access rights to television broadcasts according to the prior art;

Figure 3 schematically represents an embodiment of the invention;

Figure 4 is an organization chart that illustrates the distribution of secondary access rights according to the invention.

On Figure 1, the decoder DEC comprises an input interface 10 which receives an encrypted analog or digital signal which can be for example:

is a high-frequency analog signal comprising several data channels, in which case the input interface 10 then comprises a demodulator, to switch to a lower frequency, and and a demultiplexer, to separate the individual channels;

is directly an encrypted analog signal concerning a single channel, in which case the input interface 10 simply comprises elements for shaping this signal;

is a digital signal carrying the digital stream, and this input interface 10 can be either a cable or satellite television receiver / tuner or an ATM coupler (asynchronous transfer mode or "Asynchronus Transfer Mode" ), or ADSL (Asymmetric digital subscriber line or "Asymetric Digital Subscriber Line").

In a known way, processing means 20 are capable of transforming the encrypted signals of a single channel into free-to-air signals, which are then applied to the output interface 90, to control for example a television or a monitor, in the case of an application video.

In the case of a digital signal, the output interface 90 can comprise a demultiplexer, to extract the sequences relating to the desired channel from the clear digital stream, and the double-dictated output interface which, in a known way, transforms these sequences into signals suitable for driving a TV or monitor.

The decoder DEC also comprises MCOM communication means connected to the access rights management center GES. These MCOM media form a return path between the DEC decoder and the GES management center.

For example, these MCOM communication means comprise a modulator / demodulator of the telephone MODEM type which connects the decoder to the management center via the switched telephone network RTC or the digital network integrating RNIS services.

The way back between the decoder and the management center finds · applications of interactivity, for example to request access rights or facilitate navigation in programs and channels.

A TCOM remote control is associated with the decoder to allow the user to select his program or to constantly inquire and help him make his choice by consulting a database on current or upcoming emissions.

With reference to Figure 2, the encryption device 100 receives at its input 102 the free-to-air CC components to be encrypted. The synchronization and SSC signaling information are applied in clear text to input 104 of the encryption device. The output 106 of the encryption device, which emits the CE encrypted components, is connected to the 112 input of the free-to-air transformation device 110, whose input 114 receives the synchronization information and the free-to-air signal SSC. After the conversion, the output 116 of the free-to-air transformation device emits the free-to-air components CC.

Encryption / decryption is controlled by a CW control word. The cleartext device must have the same CW control word as the encryption device to return the clear image or sound.

In practice, the control words CW are transmitted substantially in real time in the signal broadcast by the broadcasting network RES, in an encrypted form to protect their transport from the encryption device to the unencrypted device.

On the emission side, an encoding device 120 receives at its input 122 the CW control words to be encoded according to a cryptographic function f under the control of an authorization key SK, also called a Service key, and applied to the input 124 of the coding device.

The cryptograms corresponding to the transformations of the CW check words via the cryptographic function f according to the authorization key SK, i.e. f (CW, SK), are transmitted through output 128 in the signal diffused within service messages called ECM ( Entitlemente Control Messages). Output 126 applies the CW control words in clear text to input 105 of the encryption device 100.

The ECM service messages also include the conditions of CA access to the program (cost, type of subscription, etc.) applied to input 130 of the coding device 120.

All information contained in the ECM service messages are marked by the coding device 120 with the help of the authorization key SK. Output 128 applies the said information marked corresponding to f (ECM.SK) to the signal broadcast by the broadcasting network.

At the level of each DEC decoder, the ECM service messages of the program selected by the user are retrieved and the signature f (ECM, SK) is verified. In the presence of an authentic signature and if the access conditions CA are satisfied, the control words CW are then decoded and transmitted to the clearing device 110, i.e. to the processing means 20 of the decoder DEC described with reference to Figure 1.

The verification of the signature of f (ECM, SK) and the decoding of f (CW, SK) take place thanks to a decoding device 200 which uses the same authorization key SF that at the issue. The input 202 of the decoding device 200 detects the transformations f (ECM.SK) f (CW, SK) through the broadcasting network. The input 204 of the decoding device 200 receives the SK key. The output 206 of the decoding device 200 emits the control words CV at the input 118 of the clearing device 110.

The decoding device 200 as well as the authorization key SK are stored in an access control module 5 '(Figure 1), which, in turn, cooperates with a protected memory 55 (Figure 1).

The memory 55 can be for example a microprocessor chip card, or a microprocessor electronic key, or a PCMCIA type card with safety processor, or a contactless safety card with microprocessor.

The SK authorization key is not diversified, i.e. the same SK authorization key is present in all access cards.

A comparator device 210 is provided to compare the DA access addresses with the access conditions to a CA program transmitted in the ECM service messages in order to establish whether the user has the right or not to watch the program.

The updating of these DA access rights takes place by means of access rights management messages, called EMM (Entitlement Management Messages) transmitted with the program over the network.

In practice, the key SK is transmitted in the signal broadcast by the broadcasting network RES, in an encoded form to protect its transport from the encryption device to the unencrypted device.

On the issuing side, an encoding device 220 receives at its input 222 the key SK to be encoded according to a cryptographic function f under the control of a distribution key, called user key or UK user-key. These UK distribution keys vary from one access card to another. UK keys are applied to input 224 of the coding device 220.

The transformation of the FK key through the cryptographic function f according to the UK distribution key, ie f (SK, UK), is transmitted through output 228 in the signal diffused within the EMM messages.

EMM service messages also include DA access rights associated with the user who holds the UK distribution key. These DA access rights are applied to the input 230 of the encoding device 220. In practice, these DA access rights are stored in a TAB table housed in the GES management center, at a predetermined address which links the ID identity of the card. of access and said access rights. Each identity ID has DA access rights associated with it, as well as a UK distribution key.

All information (in particular the DA rights) contained in the EMM service messages are marked by the encoding device 220 with the help of the UK distribution key.

Output 228 applies the said information marked corresponding to f (EMM, UK) to the signal broadcast by the broadcasting network.

At the level of each DEC decoder, the EMM access rights management messages are retrieved and the signature f (EMM, UK) is verified. In the presence of an authentic signature, the authorization key SK is then decoded and transmitted to the input 204 of the decoding device 200.

The verification of the signature of f (EMM, UK) and the decoding of f (SK, UK) take place thanks to a decoding device 300 which uses the UK distribution key, previously stored in the memory 55 of the access control module.

The input 302 of the decoding device 300 receives the transformations f {EMM, UK) and f (SK, UK) through the broadcasting network. The input 304 of the decoding device 330 receives the UK key. The output 306 of the decoding device 300 emits the key SK at the input 204 of the decoding device 200.

The decoding device 300 as well as the UK distribution key are stored in the access control module 50 (Figure 1) and its memory 55.

UK distribution keys vary from one access control module to another. They are diversified at the level of a generation device 400 whose input 402 receives a master key that participates in the diversification of UK distribution keys and whose input 404 receives information relating to the archives of users and access cards and contained in the TAB table housed in the GES management center.

If the signature of the EMM messages is correct, then the access control module, convinced of the authenticity of the message, performs the access rights management operation after storing the access rights in a memory 310 whose output 312 is connected to the entry 212 of the comparator of rights 210.

The Applicant has posed in particular the problem of improving the access rights distribution procedure when one or more users have several television receivers each connected to a decoder.

Referring to Figure 3, a pay television installation equipped with a primary decoder PRI and a secondary decoder SEC has been shown.

The main decoder PRI comprises the elements described with reference to Figures 1 and 2, in particular an input interface 10 which receives the signals broadcast by the broadcast network RES and communication means MCOM connected to the GES management center through any communication network. such as the RTC auto-switched network or the numerical network to integrate RNIS services.

The SEC secondary decoder comprises a clearing device similar to that of the primary decoder. On the other hand, the secondary decoder is advantageously devoid of MCOM communication means, which have become useless as will be seen below. The secondary decoder may therefore be cheaper than the main decoder to the extent that it is not necessary for it to have a navigator to allow the user to navigate the programs and its remote control may have reduced functions.

The access control module of the secondary decoder is similar to that of the primary decoder. The secondary access control module is adapted to cooperate with one or more secondary cards CS while the main decoder works with a main card CP.

According to the invention, the Applicant has put into practice a dialogue between the main decoder and the management center to allow to distribute access rights to one or more secondary cards of one or more secondary decoders without providing the said secondary decoder or decoders with means communication with the management center.

According to the invention, the identification table TAB contains filiation information FIL between the identity of the main IDP user and one or more IDS secondary access identities. The management of access rights is carried out according to the invention starting from the main card. Thus, according to the invention, it is possible to particularize or customize the services offered by the broadcasting operator to the users of the secondary decoders who can use a secondary decoder at different times as multi-users each having a personalized authorization. Thus, a secondary decoder it can be used by several secondary users, each having a secondary card and rights related to these cards.

For example, the main decoder PRI and main card CP are directed to the family, with an IDP main identification associated with DAP access rights for the family. The secondary decoder SEC and the secondary card (s) CSI, CS2 are directed to family members, with a secondary IDS identity, secondary DAS rights and a respective UK distribution key. An information of filiation is established between the different identities, according to an arborescence chosen and known by the management center.

The DAP access rights can be different from the secondary DAS access rights, and the secondary access rights of each secondary card can also be different from each other.

Furthermore, the main decoder and the secondary decoder (s) are not necessarily located in the same room. In this case, the secondary decoder is distant from the main decoder, the secondary access rights being however linked to the authorizations granted at the time of obtaining and storing said rights which we will describe in more detail below.

Referring to Figure 4, we will now provide an example of the distribution of secondary access rights according to the invention.

When a secondary user wants to use a secondary decoder to access paid broadcasts, it is necessary to have the corresponding DAS access rights in his secondary card. The CP daughter card contains a personal and secret UKS distribution key in its secure memory.

According to the invention, the communication means of the main decoder allow you to communicate with the management center to obtain these secondary access rights.

The first optional step Elr consists in identifying the main board CP at the level of the main decoder.

This identification can be achieved with the help of a personal secret code, previously introduced by the operator in the secret memory of the memory, and verified by the card itself, through the main decoder. Such an identification can be derived to permit multi-user operation.

Stages E2 and E3 consist of a dialogue between the main PRI decoder and the GES management center, through the MCOM media.

According to the invention, the MCOM means of communication issue an RQ request at the management center to obtain secondary access rights DAS1 (stage E2) for the secondary CS card (s).

The request is accompanied by the identification of the main IDP user, and a request for access rights for the identity of the secondary IDS user. A FIL filiation information between the identity of the main IDP user and the identity of the secondary IDS user also accompanies the request.

Advantageously, the request is authenticated according to step E3 with the help of an active authentication set up with the help of the UK distribution key of the main board and 220 encoding means housed in the GES management center and 300 decoding means housed at the level of the main CP board.

After verification and authorization, i.e. authentication of the RQ request, the management center searches for the secondary IDS identity in its TAB identification table (step E4). With the help of the FIL filiation information that links the primary IDP identity and the secondary IDS identity, the management center determines the secondary address where the secondary DAS access rights are located.

According to step E5, the management center assigns and encrypts the secondary access rights DAS for the secondary card CS.

In practice, the DAS secondary access rights are encrypted via the management center 220 authentication means which encrypt the secondary access rights with the help of the UKP distribution key associated with the main card or with the help of the distribution key UKS associated with the secondary card.

According to step E6, the secondary access rights DAS thus coded are transmitted through the broadcasting network RES towards the main decoder or the secondary decoder to be decoded and recorded in the secondary card (step E7).

More precisely, the decoding means 300 of the main CP card or of the secondary card CS establish the cryptographic function f with the help of the corresponding distribution key to decrypt the secondary access rights DAS thus transmitted encrypted.

In practice, it is the decoding means of the main card that decode the access rights when the card reader of the main decoder comprises two insertion slots, while it is the decoding means of the secondary card that decode the access rights when the card reader main decoder board comprises a single introduction slot.

In the case of a two-slot main decoder for card insertion, the request RQ is established when the main memory card CP is inserted into the first slot of the main decoder and when the secondary memory card CS is inserted into the second slot of the main decoder. . Thus, the secondary rights DAS transmitted via the broadcast network RES are first stored in the main memory card CP to be subsequently decoded and finally transferred from the main memory card CP to the secondary memory card CS thus introduced in the main card reader. .

It should be noted that the transfer of DAS rights to the secondary card can take place during normal use of the main decoder. The transfer operation can take place in parallel with the normal operation of the main decoder. The secondary user after withdrawing his secondary card in the main decoder can use it normally on his secondary decoder. It is in fact a transfer of rights of the type from main card to secondary card.

In the case of a single card slot main decoder, the request RQ is established when the main memory card is inserted into the main decoder slot and when the secondary memory card is inserted into the secondary decoder slot. Thus, the secondary rights are transmitted directly to the secondary memory card, through the broadcasting network according to step E7 to be decoded and recorded.

In the case of a transfer via the broadcast network directly to the secondary card level, the main card therefore remains in the primary decoder and the secondary card remains in the secondary decoder.

Finally, according to step E8, after storing the secondary access rights DAS in the secondary card, the clearing and display of the program is made possible.

It should be noted that the dialogue described above can be implemented by means of a validation device (convaiidator) of a professional type located at the level of a predetermined access point. In this case, the main decoder PRI, preferably with two slots for inserting cards, described with reference to Figures 1 to 4, plays the role of access convaidator that allows applications for REQ access rights to be made at the GES management of the operator for one or several main and / or secondary cards, according to the access rights distribution protocol in accordance with the invention.

This distribution of rights can be automated in self-service in a terminal specializing in the sale of operational services. For example, the specialized terminal is able to ensure the edition of pre-payment cards, which allows a secondary decoder to give access to the service connected to the pre-payment without the said secondary decoder having MCOM communication means with the operator's GES management center.

Generally speaking, a parental code is at a level of access to a certain content for the same channel. According to the invention, such a parental code can be attributed to each secondary right by the main decoder according to a distribution procedure similar to that of secondary access rights described with reference to Figure 4.

In this case, the primary access card possesses the access rights image of all secondary access cards and can authoritatively assign a parental level to them. This level is transmitted to the secondary decoder by the broadcasting network as part of a service message. It can also be transmitted via a transfer from main card to secondary card.

The transfer of a parental code can be carried out by verifying the secondary card through the personal code assigned to the secondary card.

In practice, the device according to the invention can be accompanied by means of payment which can be a bank card with a credit agreement and operating through the MCOM means of communication. The means of payment can also be external means, for example Minitei, automatic terminal, invoice control or specialized service center with operators via telephone.

In practice, the means of payment for the main and / or secondary access rights are located in the main decoder.

Claims (7)

CLAIMS 1. - Pay-TV device intended to cooperate with at least one broadcasting network (RES) and an access rights management center (GES), said television device being of the type comprising: a main decoder (PRI) suitable for converting encrypted signals carrying information subject to payment coming from the broadcasting network into free-to-air signals, capable of direct use, said main decoder comprising a main access control module (50 ) adapted to cooperate with a main memory card (55) containing a primary user identity, associated with primary access rights, and means of communication (MCOM) suitable for being connected to the management center (GES), - at least one secondary decoder (SEC) suitable for converting the encrypted signals into clear signals, said secondary decoder (SEC) comprising a secondary access control module suitable for cooperating with at least one secondary memory card (CS) containing a secondary user identity (IDS), associated with secondary access rights (DAS), the secondary user identity (IDS) being linked to the main user identity according to a predetermined parentage information (FIL), characterized in that the communication means (MCOM) are able to communicate with the management center (GES) to request the said secondary access rights (DAS), according to the principal user identity, the secondary user identity and the daughter information , and to receive said secondary access rights so requested, at the level of the main decoder (PRI) or of the secondary decoder (SEC), through the re distribution (RES), in order to transfer them, after receipt, to the secondary card (CS). 2. - Device according to Claim 1, in which the management center (GES) comprises coding means (220) suitable for establishing a cryptographic function (f) with the help of a secret and personal distribution key (UKP) main user, characterized by the fact that the main card (CP) comprises decoding means (300) suitable for establishing the cryptographic function (f) with the help of the distribution, secret and personal key of the main user (UKP) , and by the fact that the coding and decoding means (220 and 300) are able to actively authenticate the request (RQ) of the secondary access rights (DAS). 3. A device according to Claim 2, in which the encoding means (220) of the management center are adapted to encode the secondary access rights (DAS), characterized in that the decoding means (300) of the secondary card or of the main card are suitable for decrypting the secondary access rights thus transmitted encoded. 4. A device according to Claim 1, in which the main decoder comprises a card reader equipped with first and second slots, characterized in that the request (RQ) is established when the main memory card is introduced into the first slot and when the secondary memory card is introduced into the second slot, and by the fact that the secondary rights are received at the main decoder level, stored in the main memory card, and then transferred from the main memory card to the secondary memory card. 5. A device according to Claim 1, in which the main decoder comprises a card reader with a single slot, characterized in that the request (RQ) is established when the main memory card is introduced into the slot of the reader of the main decoder and when the secondary memory card is inserted into the slot of the secondary decoder reader, and by the fact that secondary access rights are received at the secondary decoder level, and stored directly in the secondary memory card. 6. - Device according to one of the preceding claims, characterized by the fact that the user of the main card is able to create and assign parental code rights to the user of the secondary card according to a distribution procedure similar to that of secondary rights. 7. Device according to one of the preceding claims, characterized by the fact that the main decoder (FRI) is capable of being an access convaidator which allows to make requests for access rights (REQ) at the operator's management center (GES) for a or more main and / or secondary boards. 8. A device according to Claim 7, characterized in that the access conveyor constitutes a terminal specialized in the sale of services. 9. - Device according to Claim 8, characterized in that the specialized terminal is suitable for ensuring the edition of pre-payment cards which allows a secondary decoder (SEC) to give access to the service linked to the pre-payment without the said secondary decoder (SEC) having means of communication (MCOM) with the management center (GES) of the operator.