JP2015012492A - Decoding method, encoding method, receiver device, and transmitter device for limited reception systems - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a limited reception system that can adapt to changes in key length without requiring any major change in system or formula.SOLUTION: By a decoding method for limited reception systems, encrypted individualized information comprising work keys matching identifying information, a pointer indicating the presence range of a plurality of scramble keys encrypted with work keys matching the identifying information in common information in which the scramble keys encrypted with mutually different work keys are superposed are decoded; encrypted scramble keys included in the pointer-indicated range are selected out of the common information; the selected encrypted scramble keys are encrypted with a work key matching the identifying information; and contents encrypted with a decrypted scramble key is decrypted with the same scramble key.

Description

  Embodiments described herein relate generally to a decryption method, an encryption method, a reception device, and a transmission device of a conditional access system.

  Conventionally, there is known a conditional access system (CAS) that encrypts (scrambles) content such as a program using three keys, a scramble key Ks, a work key Kw, and a device key Kd. Yes.

ARIB STD-B25 (6.2), access control system in digital broadcasting, Part 3 Control system during reception (content protection system), Radio Industries Association (ARIB), September 25, 2012

  The above technique assumes that the key length of the scramble key is 64 bits. In the future, if the key length of the scramble key is to be increased from the viewpoint of maintaining security, if this is realized as another new method, the load on the sending side and receiving side will increase, such as the simulification of the method. There is a risk of it. In other words, it is preferable that the key length can be changed without greatly changing the system or the system.

  In the decryption method of the conditional access system of the embodiment, the work key corresponding to the identification information is encrypted with the work key corresponding to the identification information in the common information in which a plurality of scramble keys encrypted with different work keys are superimposed. The encrypted individual information including the pointer indicating the existence range of the encrypted scramble key is decrypted, and the encrypted scramble key included in the range indicated by the pointer is selected from the common information and selected. The encrypted scramble key is decrypted with the work key corresponding to the identification information, and the content encrypted with the scramble key is decrypted with the decrypted scramble key.

FIG. 1 is a block diagram illustrating an example of a schematic configuration of a transmission device and a reception device of a conditional access system according to an embodiment. FIG. 2A is a conceptual diagram showing an example of a data configuration of common information and individual information used in a conventional conditional access system. FIG. 2B is a conceptual diagram illustrating an example of a data configuration of common information and individual information used in the conditional access system of the embodiment. FIG. 3 is a conceptual diagram illustrating an example of a configuration of an individual information descriptor used in the conditional access system according to the embodiment. FIG. 4 is a conceptual diagram illustrating an example of a configuration of a descriptor for an old device of individual information used in the conditional access system of the embodiment. FIG. 5 is a flowchart illustrating an example of a procedure for encrypting individual information in the transmission apparatus of the conditional access system according to the embodiment. FIG. 6 is a flowchart illustrating an example of a procedure in which individual information is decrypted by the receiving device of the conditional access system according to the embodiment.

  Hereinafter, exemplary embodiments will be described with reference to the drawings. In the present specification, the ordinal numbers such as first and second are given for the purpose of distinguishing the constituent elements and the like, and do not mean the order of processing, priority, importance, or the like.

  The conditional access system 100 (CAS) of this embodiment is a standard ARIB STD- of the Association of Radio Industries and Businesses (ARIB), except for parts that are modified or added as components of the invention according to the embodiment. B25 (6.2) “Access control method in digital broadcasting”, part 3 “Control method at the time of reception (content protection method)” extended by ECM-F1 for “work key Kw leak source detection It conforms to “System Configuration”.

  That is, in the conditional access system 100 of the present embodiment, three keys, a scramble key Ks, a work key Kw, and a device key Kd are used.

  The scramble key Ks is a key for encrypting content such as a program. The scramble key Ks is updated at a short cycle on the transmission device 10 side.

  The work key Kw is a key for encrypting the scramble key Ks. The work key Kw is generated on the transmission device 10 side and updated in a long cycle. In the conditional access system 100, a plurality of work keys Kw are used. One work key Kw is distributed per identification unit of the receiving device 20. Each work key Kw is associated with a device ID (identification).

  The device key Kd is a key for encrypting the work key Kw. The device key Kd is set for each identification unit of the receiving device 20, that is, corresponding to the device ID.

  In addition to the scrambled content, encrypted common information (entitlement control message, ECM), encrypted individual information (entitlement management message, EMM), and the like are transmitted from the transmission device 10 to the reception device 20. .

  As illustrated in FIG. 1, the transmission device 10 includes a scramble unit 11, a plurality of encryption units 12, a superposition unit 13, a selection unit 14, an individual information configuration unit 15, an encryption unit 16, and the like.

  The scramble unit 11 (scrambler) encrypts the content with the scramble key Ks.

  The plurality of encryption units 12 encrypt the scramble key Ks with the work key Kw corresponding to each. In the transmission apparatus 10, a plurality of scramble keys Ks encrypted with different work keys Kw are configured. The encryption unit 12 is an example of a first encryption unit.

  The superimposing unit 13 superimposes the scramble key Ks encrypted by the plurality of encrypting units 12 to configure common information (ECM). That is, in the present embodiment, the superimposing unit 13 is an example of a common information configuration unit.

  The selection unit 14 selects the work key Kw corresponding to the device ID.

  The individual information configuration unit 15 configures individual information (EMM) including the work key Kw selected by the selection unit 14 and a pointer. The pointer is information (instruction information) indicating the location and range of the scramble key Ks (encrypted) corresponding to the work key Kw in the common information ECM.

  Here, with reference to FIG. 2A and FIG. 2B, the structural example of common information (ECM) and individual information (EMM) and their corresponding relationship are demonstrated. 2A illustrates the relationship between individual information (EMM) and common information (ECM) in the conventional method, and FIG. 2B illustrates the relationship between individual information (EMM) and common information (ECM) in the method of the present embodiment. Illustrate. The common information (ECM, encrypted) illustrated on the left side of FIGS. 2A and 2B includes scramble keys Ks1 to Ks4 and scramble keys Ks5 and Ks6. The scramble keys Ks1 to Ks4 and the scramble keys Ks5 and Ks6 included in the common information (ECM) are encrypted with the corresponding work keys Kw1 and Kw2 and work keys Kw3 and Kw4, respectively. Each scramble key Ks1 to Ks6 includes an odd key (odd) and an even key (even). Here, the data length of the scramble keys Ks1 to Ks4 is 64 bits used in the conventional method. On the other hand, the data length of the scramble keys Ks5 and Ks6 is set to 128 bits longer (doubled) than that of the conventional method. For this reason, the range in which the scramble keys Ks5 and Ks6 exist in the common information (ECM) is wider (longer) than the conventional scramble keys Ks1 to Ks4.

  Two pieces of individual information (EMM) illustrated on the right side of FIG. 2A include work keys Kw1 and Kw2, respectively. Two pieces of individual information (EMM) illustrated on the right side of FIG. Kw4 is included. The individual information (EMM) in FIG. 2A includes pointers for extracting the scramble keys Ks1 and Ks2 corresponding to the work keys Kw1 and Kw2 from the common information (ECM). EMM) includes pointers for extracting the scramble keys Ks5 and Ks6 corresponding to the work keys Kw3 and Kw4 from the common information (ECM). As is apparent from FIGS. 2A and 2B, the individual information (EMM) including the work keys Kw1 and Kw2 corresponding to the scramble keys Ks1 and Ks2 of the conventional method includes the scramble keys Ks1 and Ks2 according to the conventional method. A pointer for designating the position (start position) where is present. On the other hand, the individual information (EMM) including the work keys Kw3 and Kw4 corresponding to the scramble keys Ks5 and Ks6 of the new method according to the present embodiment includes a pointer that specifies the range where the scramble keys Ks5 and Ks6 exist. Yes. Therefore, as is apparent from a comparison between FIG. 2A and FIG. 2B, according to the present embodiment, scramble keys having different data lengths without changing the overall format of the common information (ECM) are shared information (ECM). The receiving device 20 can acquire the corresponding scramble key Ks more reliably or more easily from the existence range designated by the pointer in the common information (ECM). .

  The range designation pointer in the individual information (EMM) corresponding to the scramble keys Ks5 and Ks6 having a long data length shown in FIG. 2B is ARIB STD-B25 (6.2) as illustrated in FIG. Can be included in the F1Kw setting descriptor defined in (1). The F1Kw setting descriptor in FIG. 3 includes an F1Ks start pointer (start position) and an F1Ks end pointer (end position) for each of the odd key (odd) and even key (even) of the scramble key Ks. As described above, the existence range of the scramble key Ks in the common information (ECM) can be designated by the start position and the end position. As is clear from FIG. 3, the pointer corresponding to the new method including the scramble key Ks3 having a long data length can be introduced by a relatively small modification of the F1Kw setting descriptor (pointer) of the conventional method. . Further, according to the new method according to the present embodiment, even when the data length of the scramble key Ks is variously modified, it is possible to cope with it relatively easily.

  Also, as illustrated in FIG. 4, the F1Kw start descriptor (start position) and the size of F1Ks (the size of the existing range) for each of the scramble keys Ks (odd) and Ks (even) are included in the F1Kw setting descriptor. And information indicating.

  Note that the individual information (EMM) including the pointer of the new scheme as illustrated in FIGS. 3 and 4 cannot be decoded by the receiving device 20 that does not support the new scheme. However, for example, by distinguishing the Descriptor Tag in the examples of FIGS. 3 and 4 between the new method and the conventional method, the reception device 20 of the conventional method ignores the F1Kw setting descriptor (pointer) of the new method. Can do. Therefore, when the F1Kw setting descriptor (pointer) of the new method is changed, it is possible to suppress the occurrence of inconvenience in the receiving device 20 corresponding to the conventional method. Note that the Descriptor Tag is an example of information to be distinguished, and other information may be used to distinguish the new method from the conventional method.

  The encryption unit 16 encrypts the individual information EMM configured by the individual information configuration unit 15. Then, the encrypted individual information (EMM) is transmitted from the transmission device 10 to the reception device 20. The encryption unit 16 is an example of a second encryption unit.

  The transmission device 10 described above is configured as a computer and may include a CPU (central processing unit), a controller, a storage unit, an input unit, an output unit, a communication unit, and the like (not shown). The storage unit is, for example, a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), or a solid state drive (SSD). The CPU and controller of the transmission apparatus 10 can execute various arithmetic processes according to a loaded program (for example, an OS (operating system), an application, a web application, etc.). In the present embodiment, as an example, a scramble unit 11 shown in FIG. 1, a plurality of encryption units 12, a superimposition unit 13, a selection unit 14, an individual information configuration unit 15, by arithmetic processing such as a CPU according to a program, The encryption unit 16 or the like can function.

  On the other hand, as illustrated in FIG. 1, the reception device 20 includes a decoding unit 21, a selection unit 22, a decoding unit 23, a descrambling unit 24, and the like.

  The decryption unit 21 (decryption unit) decrypts the encrypted individual information (EMM) with the device key Kd. Thereby, individual information (EMM, plaintext) is obtained. As described above, the individual information (EMM) indicates the existence range of the work key Kw corresponding to the device ID and the scramble key Ks corresponding to the work key Kw corresponding to the device ID in the common information (ECM). And a pointer. The decryption unit 21 is an example of a first decryption unit.

  The selection unit 22 selects the scramble key Ks encrypted with the work key Kw corresponding to the device ID in the common information (ECM) from the pointer obtained by decrypting the individual information (EMM) in the decryption unit 21. The existence range is acquired, and the existence range in the common information (ECM) is selected.

  The decryption unit 23 decrypts the scramble key Ks selected by the selection unit 22 with the work key Kw obtained by decrypting the individual information (EMM) by the decryption unit 21. Thereby, the scramble key Ks is obtained. The decryption unit 23 is an example of a second decryption unit.

  The descrambler 24 (descrambler) decrypts the content with the scramble key Ks.

  The receiving device 20 described above is configured as a computer, and may include a CPU (central processing unit), a controller, a storage unit, an input unit, an output unit, a communication unit, and the like (not shown). The storage unit is, for example, a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), or a solid state drive (SSD). The CPU and controller of the receiving device 20 can execute various arithmetic processes according to a loaded program (for example, OS (operating system), application, web application, etc.). In the present embodiment, as an example, the decoding unit 21, the selection unit 22, the decoding unit 23, the descrambling unit 24, and the like illustrated in FIG. 1 can function by arithmetic processing such as a CPU according to a program. .

  Note that programs such as the transmission device 10 and the reception device 20 are files that can be installed or executed, respectively, and are a CD-ROM (compact disc ROM), FD (flexible disc), or CD-R (CD recordable). And recorded on a computer-readable recording medium such as a DVD (digital versatile disc). In addition, the program can be introduced by storing it in a storage unit of a computer connected to a communication network and downloading it via the network. Further, the program may be incorporated in advance in a ROM or the like.

  Next, an example of a procedure for encrypting individual information (EMM) in the transmission apparatus 10 will be described with reference to FIG.

  First, the selection unit 14 selects the work key Kw corresponding to the device ID (step S101). Here, when the data length of the scramble key Ks corresponding to the work key Kw is not the length of the conventional method (No in step S102), the individual information configuration unit 15 determines the existence range of the work key Kw and the scramble key Ks. (In this embodiment, individual information (EMM) including a start pointer and an end pointer as an example) is configured (step S103). On the other hand, when the data length of the scramble key Ks corresponding to the work key Kw is the length of the conventional method (Yes in step S102), the individual information configuration unit 15 determines the start positions of the work key Kw and the scramble key Ks. Individual information (EMM) including a pointer to be shown is configured (step S104). Next, the encryption unit 16 acquires the device key Kd corresponding to the device ID (step S105), and encrypts the individual information (EMM) configured by the individual information configuration unit 15 using the device key Kd. To do. Thereby, encrypted individual information (EMM) is obtained (step S106).

  Next, an example of a procedure for decoding individual information (EMM) in the reception device 20 will be described with reference to FIG.

  First, the decryption unit 21 decrypts the encrypted individual information (EMM) with the device key Kd. Thereby, individual information (EMM, plaintext) is obtained (step S201). Next, the selection unit 22 selects the corresponding scramble key Ks in the common information (ECM) according to the pointer acquired by the decryption unit 21 (step S202). Next, the decryption unit 23 decrypts the encrypted scramble key Ks selected by the selection unit 22 with the work key Kw obtained by the decryption unit 21. Thereby, the scramble key Ks is obtained (step S203).

  As described above, in this embodiment, as an example, the individual information (EMM) indicates the existence range in the common information (ECM) of the work key Kw and the scramble key Ks encrypted by the work key Kw. And a pointer. Therefore, according to the present embodiment, as an example, a new method in which the data length of the scramble key Ks is longer than that of the conventional method can be introduced with relatively small modifications. Further, according to this new method, even when the data length of the scramble key Ks is variously modified, it is possible to cope with it relatively easily.

  In the present embodiment, as an example, the pointer indicates the start position and the end position of the scramble key Ks in the common information (ECM). That is, according to the present embodiment, as an example, the existence range of the scramble key Ks in the common information (ECM) is relatively easily indicated by the start position and the end position of the scramble key Ks in the common information (ECM). be able to.

  In the present embodiment, as an example, the pointer indicates the start position of the scramble key Ks and the size of the existing range in the common information (ECM). That is, according to the present embodiment, as an example, the existence range of the scramble key Ks in the common information (ECM) is relatively easily determined by the start position of the scramble key Ks in the common information (ECM) and the size of the existence range. Can be shown.

  In the present embodiment, as an example, the individual information (EMM) is information that distinguishes whether the pointer indicates the existence range or the existence position of the scramble key Ks in the common information (ECM) (in this embodiment, an example) As a Descriptor Tag). Therefore, according to the present embodiment, as an example, both the conventional reception device (not shown) and the new reception device 20 can easily select the corresponding scramble key Ks.

  As mentioned above, although embodiment and the modification of this invention were illustrated, the said embodiment and modification are an example to the last, Comprising: It is not intending limiting the range of invention. These embodiments and modifications can be implemented in various other forms, and various omissions, replacements, combinations, and changes can be made without departing from the spirit of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and equivalents thereof. The present invention can also exhibit various effects brought about by basic results (effects) obtained by the components (steps). Moreover, the above-mentioned effect is an example. Further, the specifications of each component can be changed as appropriate.

  DESCRIPTION OF SYMBOLS 10 ... Transmission apparatus, 11 ... Scramble part, 12 ... Encryption part (1st encryption part), 13 ... Superimposition part (common information structure part), 14 ... Selection part, 15 ... Individual information structure part, 16 ... Encryption Converting unit (second encrypting unit), 20 ... receiving device, 21 ... decrypting unit (first decrypting unit), 22 ... selecting unit, 23 ... decrypting unit (second decrypting unit), 24 ... descrambling part, 100 ... conditional access system.

Claims (7)

Pointer indicating the existence range of the scramble key encrypted with the work key corresponding to the identification information in the common information in which the work key corresponding to the identification information and a plurality of scramble keys encrypted with different work keys are superimposed And decrypting the encrypted individual information including
From the common information, select an encrypted scramble key included in the range indicated by the pointer,
Decrypting the selected encrypted scramble key with a work key corresponding to the identification information;
A decryption method for a conditional access system, wherein the content encrypted with the scramble key is decrypted with the decrypted scramble key.   The decoding method according to claim 1, wherein the pointer indicates a start position and an end position of the scramble key in the common information.   The decoding method according to claim 1, wherein the pointer indicates a start position of the scramble key and a size of an existing range in the common information.   The decoding according to any one of claims 1 to 3, wherein the individual information further includes information for identifying whether the pointer indicates an existing range or an existing position of the scramble key in the common information. Method. Encrypt the content with a scramble key,
The scramble key is encrypted with a plurality of different work keys,
Composing common information on which the plurality of encrypted scramble keys are superimposed;
Select the work key corresponding to the identification information from multiple work keys,
Configuring the individual information including the selected work key and a pointer indicating a range in the common information of the scramble key encrypted by the work key;
Encrypting the individual information with a device key corresponding to the identification information;
Encryption method for conditional access system. Pointer indicating the existence range of the scramble key encrypted with the work key corresponding to the identification information in the common information in which the work key corresponding to the identification information and a plurality of scramble keys encrypted with different work keys are superimposed A first decryption unit for decrypting encrypted individual information including:
A selection unit for selecting an encrypted scramble key included in the range indicated by the pointer from the common information;
A second decryption unit for decrypting the encrypted scramble key selected by the selection unit with a work key corresponding to the identification information obtained by the first decryption unit;
A descrambling unit that decrypts the content encrypted by the scramble key using the scramble key obtained by the second decryption unit;
A reception apparatus for a conditional access system, comprising: A scrambler that encrypts content with a scramble key;
A plurality of first encryption units for encrypting the scramble key with respective work keys;
A common information constituting unit constituting common information on which a plurality of scramble keys encrypted by the plurality of first encrypting units are superimposed;
A selection unit for selecting a work key corresponding to the identification information from a plurality of work keys;
Configuring individual information including the work key selected by the selection unit and a pointer indicating a range in the common information of the scramble key encrypted by the first encryption unit using the work key An individual information component,
A second encryption unit that encrypts the individual information with a device key corresponding to the identification information;
A transmission apparatus for a conditional access system, comprising:

Images