KR100877955B1 - The method of generating download contents protection solution image - Google Patents

Abstract

A solution image generation method without using a cable card is provided to prevent subordinating to a present cable card, and prevent self-heating, malfunction, and price rise. A universal contents protection server produces and transfers system information to a universal contents protection host(S502). A universal contents protection host requests certification(S504). The universal contents protection server processes authentication(S505). The universal contents protection server transfers an authentication result to the universal contents protection host(S506). The universal contents protection host produces an image request message(S507). The universal contents protection host requests the universal contents protection server to download the image(S508). The universal contents protection server produces the image(S509). The universal contents protection server transfers image generation information to the universal contents protection host(S510). The universal contents protection host connects to the universal contents protection server(S511). The universal contents protection host downloads and verifies the image from the universal contents protection server(S513). The universal contents protection host transfers a download completion message to the universal contents protection server(S514).

Description

The method of generating download contents protection solution image}

The present invention relates to a general-purpose content protection device and method thereof in a digital broadcasting system. More particularly, the present invention relates to various reception restriction systems and various digital services in a digital broadcasting environment for protecting contents by using a conditional access system and a digital rights management system. In the general-purpose content protection method to which the rights management system can be applied, the present invention relates to a method for generating a download content protection solution image.

In general, it protects the rights and interests of content providers and restricts the illegal copying and the creation of contents such as royalty charges and payment agency. Digital Right Management (DRM) technology, which supports distribution and management at once, is used for content protection in digital broadcasting.

In addition, in order to provide such a reception restriction service, a chip containing subscriber information is provided with a reception restriction system that supports the authentication and billing functions of subscribers for paid digital broadcasting service, and is separated from the STB (Set Top Box) main body. The cable card technology has been disclosed to be independent of STB solutions.

In addition, such an example is disclosed in Republic of Korea Patent Publication No. 0688089 (February 22, 2007) and the like.

That is, in the above document, as shown in FIG. 1, the cable broadcasting receiver first multiplexes the multiplexer 10 filtering the program selected by the subscriber from the first inputted broadcast stream, and the multiplexer output from the multiplexer 10. And a demultiplexer (20) for correcting a program clock reference (PCR) by demultiplexing the multiple streams output from the cable card (30). When the broadcast streams are output from the multiplexer 10, the multiplexer 10 receives them and filters the programs selected by the subscriber (e.g., program 2 of channel 1, program 1 of channel 2, program k of channel N), and then multiplexes the cable card. And the demultiplexer descrambling in the cable card 303 is demultiplexed and the program clock reference (PCR) in the demultiplexer 20. The technique of distributing to each program stream through correction is presented.

However, in the above-described technology disclosed in the Republic of Korea Patent Publication No. 0688089, such a cable card (Cable Card) has a problem that causes the self-heating and failure, and the price of the set-top box.

In addition, the Republic of Korea Patent Publication No. 0688089 has a problem that can not be used flexibly for a service provider or a user because it depends on a particular CAS (Content Addressed Storage) Vendor.

An object of the present invention is to solve the problems described above, it is not dependent on the existing cable card because it does not use a cable card, general purpose in a digital broadcasting system to solve the problems of self-heating, failure and price increase It provides a method of creating an image protection solution for download contents.

Another object of the present invention is not dependent on a specific CAS, DRM, ASD Vendor, and in a digital broadcasting system that can receive a content protection service by flexibly downloading and using CAS, DRM, and ASD Clients to STB according to the content service provider. It is to provide a method of creating download contents protection solution image in general contents protection method of.

According to the method for generating a download content protection solution image according to the present invention, the dependency of the cable card hardware of the conventional reception restriction system can be avoided, and the cost of the cable card used per set-top can be reduced by the download method. Obtained.

In addition, according to the method for generating a download content protection solution image according to the present invention, the effect of being applicable to an IPTV (Internet Protocol Television) system in addition to the digital cable broadcasting system is obtained.

In addition, according to the method for generating a download content protection solution image according to the present invention, the bidirectional data processing is possible, and the user's download history management can be obtained.

In order to achieve the above object, the method for generating a download content protection solution image according to the present invention is a content protection solution image generation method downloaded from a general-purpose content protection server in an environment supporting digital broadcasting, and (a) the (B) the image generating server parsing the header data and accessing the universal content protection server by the image generation server of the universal content protection server; The content protection server determines whether the image exists in the download server of the general-purpose content protection server; (d) If the image generation server does not exist in the step (c), CAS, DRM, ASD Downloading the solution image to the FTP server by connecting to the image server, (e) the image Generating, by the generation server, the downloaded solution image as the download content protection solution image data, (f) generating, by the image generation server, a secret key for encrypting the solution image data, (g) generating the image Encrypting the image data with the generated secret key by the server, (h) performing the step (g) by the image generating server, and performing an electronic signature on the image data encrypted with the private key of the download server, ( i) the image generating server comprises the step of integrating the electronic signature, image data, image header.

Hereinafter, with reference to the accompanying drawings will be described a preferred embodiment of the present invention, through which the object and features of the present invention will be more clearly.

2 is a block diagram of a general-purpose content protection system according to the present invention, FIG. 3 is a diagram illustrating components constituting the general-purpose content protection system according to the present invention, and FIG. 4 is a general-purpose content protection server according to FIG. 3. 5 is a view showing the detailed function of the universal content protection host according to Figure 3, Figure 6 is a view showing the content protection solution image file structure used in the universal content protection system according to the present invention, 7 is a diagram illustrating a procedure of downloading a content protection solution image to a universal content protection host by the image generation server according to the present invention, and FIG. 8 is a flowchart illustrating an image generation server generating a download content protection solution image according to the present invention. 9 is a diagram showing the download content protection solution image according to the present invention in a secure storage. 10 is a conceptual diagram illustrating a file caching of a download content protection solution image of a universal content protection server system according to the present invention, and FIG. 11 is a personalized update method of a downloadable universal content protection system according to the present invention. 12 is a diagram illustrating an image upgrade of a downloadable universal content protection system according to the present invention, and FIG. 13 is a view related to SO change of a downloadable universal content protection system according to the present invention.

As shown in FIG. 2, the Universal Contents Protection System according to an embodiment of the present invention includes a Universal Contents Protection Server 200 and a Universal Contents Protection Host that service in conjunction with the communication convergence server 100. 300).

Bangtong convergence server is also possible to configure the system including the existing Bangtong convergence server 100 and the universal content protection system 200.

The universal content protection server 200 may download the middleware S / W, the set-top box library (STB lib), etc., as well as the downloadable content protection S / W to the universal content protection host 300.

The universal content protection host 300 is flexibly interoperable with the general content protection server 200 as well as the system for restricting the reception of SOs (System Operators).

3 and 4, in the diagram illustrating the components constituting the universal content protection server 200 according to an embodiment of the present invention, the universal content protection server 200 is a download proxy server 201, The image generating server 202, the key server 203, the policy server 204, the multiple-use system manager 205 (MSO Manager: Multiple System Operator Manager), and the operating system 206 are configured.

The download proxy server 201, image generation server 202, key server 203, policy server 204, MSO Manager 205, operating system 206, etc. of the general-purpose content protection system will be described in detail.

The download proxy 201 communicates directly with the universal content protection host 300, the image generation server 202, the policy server 204, the key server 203, the operating system 206, and the like. It acts as a proxy and authenticates messages to and from the server.

The key server 203 performs authentication processing on the general-purpose content protection host 300, the download proxy 201, and the image generation server 202, and performs key management for image encryption processing.

The image generation server 202 performs a function of providing software to the universal content protection host 300 by imaging software such as CAS (Conditional Access System), DRM (Digital Right Management), and ASD (Authorized Service Domain). Handles encryption and digital signatures on images.

The policy server 204 manages host information and image information registered through the MSO Manager 205 and manages an image distribution policy.

In addition, the image distribution information is generated based on the registered policy and distributed to the download proxy 201, and the universal content protection host 300 determines the image details to be downloaded.

The MSO Manager 205 is a client of the policy server 204, and the MSO manager manages host information and image information, and manages a policy for image distribution.

Software images and policies registered through the MSO Manager 205 are distributed by the policy server 204.

The operating system 206 performs the configuration of the general-purpose content protection server 200, monitors the service processing status, reports to the administrator, monitors the system operation process, and allows the administrator to take action according to the error that occurs. Include reporting.

As shown in FIG. 5, a detailed function of the general-purpose content protection host 300 according to an embodiment of the present invention will be described.

The universal content protection host 300 is composed of an eSTB 310 (embedded Set Top Box) and an SM 320 (Secure Micro).

The eSTB 310 includes a general content protection system (GCPS) router 314, and the GCPS router transmits all messages related to universal content protection transmitted from the universal content protection server 200 to the universal content protection host 300. Route.

The GCPS Router 314 is responsible for routing, filtering, and queuing all general content protection messages exchanged with the SM 320 and the like.

SM 320 includes SM Manager 322, SM bootloader 321, DRM Client 323, CAS Client 324, ASD Client (not shown) and the like.

The SM Manager monitors the GCPS message while the CAS Client 324 is operating in the SM 320 and routes the GCPS message to the GCPS Router 314 or the SM Bootloader 321.

The SM Bootloader 321 serves to boot the SM as one of the logical firmware of the SM 320, load the DRM Client 323 and the CAS Client 324 into RAM, and load them for use.

As another function of the SM Bootloader 321, the SM Bootloader 321 includes a secure download function.

The secure downloader performs a process of verifying the downloaded image, separates the signature, and decrypts the encrypted image and loads it into the secure RAM.

The DRM Client 323 image should be delivered as a downloadable image file that can be loaded into Secure RAM.

The DRM client 323 issues a local license based on the DRM message and validates the license of the content to enable PVR (Personal Video Recorder) and re-play the content. .

For example, the DRM Client 323 receives the DRM message from the SM Manager 322 and stores it, issues a local license for the corresponding content at the time of PVR, and the DRM Client 323 uses the license usage count and duration. Based on the information of the license, the validity of the license is checked and determined, and the encryption key according to the encryption algorithm is generated and managed.

The CAS Client 324 image should be delivered in a type that allows downloadable image files to be loaded into Secure RAM.

As shown in FIG. 6, in the structure of the content protection solution image 400 file used in the universal content protection system according to an embodiment of the present invention, the content protection solution image 400 file downloaded from the universal content protection system. Includes an image header 401 including information about an image to be downloaded and image data 402 which is the content of the image, and the downloaded content image file further includes signature data 403 (Signature Data) required for verification request. Include.

Specifically, the download content protection solution image 400 basically includes one content protection solution image (CAS or DRM or ASD), but in the case of the first download, two or more images of CAS, DRM, and ASD are selected. The download content protection solution of the image 400 can be generated and transmitted.

Therefore, the download image header 401 includes information about the image.

For example, the packed image number is the number of images of the content protection solution included in the download content protection solution image, and the total image length represents the total size of the download content protection solution image. , Reserved means additional information, and this information is included in the image header 401.

As shown in Figure 7, the image generating server in the universal content protection server according to an embodiment of the present invention to download the content protection solution image (CAS Client image, DRM Client image, ASD Client image) to the universal content protection host In the procedure, the step of downloading the download universal content protection image to the open type is the step of generating the system information (SI) by the universal content protection server 200 (S501), the universal information protection host ( Step S502, determining whether the system information is new system information (S503), requesting authentication (S504), processing authentication (S505), and transmitting the processed authentication result. Step (S506), image request message generation step (S507), the image request message transmission step (S508), the universal content protection request to download the image to the universal content protection server 200 Generating an image in the server 200 (S509), transmitting the image generation information to the universal content protection host 300 (S510), access to the universal content protection server 200 from the universal content protection host 300 The step (S511), the step of downloading the image (S512), the step of verifying the downloaded image (S513), and the step of transmitting a download complete message (S514).

As shown in FIG. 8, the image generation server 203 of the universal content protection server according to an embodiment of the present invention uses the contents protection solution image (CAS Client image, DRM Client image, ASD Client image) as a universal content protection host ( In the flowchart of generating a download content protection solution image for downloading in 300), the step of generating the download content protection solution image 400 in order to download the content in an open manner may include generating data (S601), image ID, and download URL. And parsing the temporary file path to access the server (S602), determining whether an image based on the corresponding image ID exists (S603), and if so, terminating the process. Generating step (S601), if not present, CAS, DRM, ASD solution to connect to the FTP server image generation server 202 Downloading step (S604), the downloaded protection solution image generation server 202 to download step (S604), the downloaded content protection solution image (CAS, DRM, ASD image) to download the image data of the content protection solution image (402 Step S605, generating a secret key to encrypt the image data (S606), encrypting the image data 402 with the generated secret key (S607), and then a private key of the download server (Private). Performing an electronic signature on the image data encrypted with the key) (S608), and integrating the electronic signature, the image data, and the image header (S609).

Thereafter, uploading the downloaded content protection solution image 400 made of the electronic signature to a downloadable server (TFTP, FTP, HTTP, Carousel) (S610), requesting a secret key to the LKS (S611), the secret key The method may further include a downloading step including encrypting with the public key of the SM.

The secret key encrypted with the public key of the SM is transmitted to the general content protection host 300.

The digital signature method is a general syntax expression that may have a result for cryptographic application such as an electronic envelope, and is PKCS # 7.

As shown in FIG. 9, a flowchart of storing a downloaded content protection solution image downloaded from a universal content protection host in a universal content protection host in the universal content protection server system according to an embodiment of the present invention is a universal content protection server 200. After downloading the download content protection solution image 400 to the general-purpose content host 300, the download content protection solution image 400 is a procedure to load the secure storage (Secure Storage).

The procedure for loading the download content protection solution image 400 into a secure storage may include performing designing for the sender verification on the downloaded download content protection solution image 400. Decrypting the downloaded content protection solution image 400, and storing the decrypted download content protection solution image 400 in a secure storage (not shown) of the universal content protection host 300. It includes.

Specifically, the integrity of the download content protection solution image 400 downloaded from the Secure Micro 320 of the universal content protection host 300 is verified.

Subsequently, perform a signing for the sender identification with the public key of the image generation server 202, and then extract the decryption key of the download content protection solution image 400 with the SM's private key and use the decryption key. The download content protection solution image 400 is decrypted.

Thereafter, the download content protection solution image 400 is stored in a secure flash, the update field is checked, and the system is initialized and rebooted.

Thereafter, copy the download content protection solution image 400 from the backup area of the secure flash to the download content protection solution image 400 area and copy the existing download content protection solution image 400 to a secret storage, For example, it can be loaded into Secure RAM.

As shown in Figure 10, the download content protection solution in the downloadable universal content protection server system according to an embodiment of the present invention, the caching step of the caching concept of the image 400 file is a download content protection generated when the first image download request By caching the solution image 400 file and the key used for encryption, it is possible to reuse the cached image and key when requesting the download of the same file to improve response speed and request processing capacity per hour.

Specifically, when the universal content protection host requests the image download information from the download proxy 201 when the first image is downloaded, the download proxy 201 responds to the image download information, and the download proxy 201 is the image generation server 202. Request image encryption and personalization, the download content protection solution image 400 file is generated by the image generation server 202, and the encryption key is stored in the key server 203.

Then, the download content protection solution image 400 file is downloaded to the universal content protection host.

Subsequently, when an image download request is added, an encryption key for the download content protection solution image 400 file generated at the first request is obtained from the key server 203, and the cached image storage location is searched for an image generation server ( By reusing and downloading the downloaded content protection solution image 400 file from 202, response speed and request processing capacity per hour can be improved.

As illustrated in FIG. 11, in the personalized update step of the downloadable universal content protection system according to an embodiment of the present invention, system information (SI: System Information) including update information is included in the plurality of universal content protection hosts 300. In an environment of broadcasting), personalized update information that delivers update request information for a specific universal content protection host 300 may be delivered.

In detail, the personalized update information is periodically broadcast by adding personalized system information together with common system information in the universal content protection server system.

After receiving the system information, the general-purpose content host 300 filters the personalized system information to determine whether to update, and then compares common update information.

Thereafter, the general content protection server 200 may request an update of personalized system information.

As shown in Figure 12, in the initial image download and image upgrade of the downloadable content security system according to an embodiment of the present invention, specifically SO 'I' provides a CAS service of Company A, and newly The CAS system is introduced to provide CAS services using the universal content protection system.

When a new subscriber accesses the universal content protection host 300 STB to the universal content protection server 200, the initial image is downloaded and loaded into the universal content protection host 300 STB to start a service.

In addition, the operator of SO'Ⅰ 'upgrades and registers CAS image version of company B through MSO Manager, and downloads the upgrade version from STB by transmitting system information from the universal content protection system.

That is, when the operator of SO'Ⅰ 'upgrades and registers the CAS image version of the company B through the MSO Manager, the upgraded image is downloaded to the STB STB 300 and the existing image is deleted from the STB.

 As shown in Fig. 13, the SO change of the downloadable universal content protection system according to the embodiment of the present invention specifically moves the subscriber from SO'∥ 'to SO'I' using the universal content protection system. In one case, if SO'Ⅰ 'is providing CAS service of B company using the universal content protection system, if the subscriber connects the universal content protection host 300STB to SO'I' universal content protection system, The image is downloaded.

That is, when the customer tries to use the universal content protection host 300 STB used in SO'∥ 'in SO'Ⅰ', the customer can download CAS B of company B and receive the SO'Ⅰ 'service. .

As mentioned above, although the invention made by this inventor was demonstrated concretely according to the said Example, this invention is not limited to the said Example, Of course, it can change variously in the range which does not deviate from the summary.

1 is a view showing an embodiment of a cable broadcast receiver according to the prior art;

2 is a block diagram of a general-purpose content protection system according to the present invention;

3 is a diagram illustrating components constituting the general-purpose content protection system according to the present invention;

4 is a block diagram illustrating a general-purpose content protection server according to FIG. 3;

5 is a view showing a detailed function of the universal content protection host according to FIG.

6 is a view showing a content protection solution image file structure used in the general-purpose content protection system according to the present invention;

7 is a view showing a procedure of downloading a content protection solution image to the universal content protection host in the image generation server according to the present invention;

8 is a flow chart for generating an image download content protection solution image generation server according to the present invention,

9 is a diagram illustrating a procedure for loading a download content protection solution image in a secure storage according to the present invention;

10 is a conceptual diagram of file caching of a download content protection solution image of a general-purpose content protection server system according to the present invention;

11 is a conceptual diagram of a personalized update method of a downloadable universal content protection system according to the present invention;

12 is a diagram of an image upgrade of a downloadable universal content protection system according to the present invention;

13 is a view of SO change of the downloadable universal content protection system according to the present invention

* Description of the symbols for the main parts of the drawings *

100: convergence server

200: Universal Content Protection Server

300: Universal Content Protection Host

Claims (10)

In the content protection solution image generation method that is downloaded from the universal content protection server of the environment supporting digital broadcasting to the universal content protection host, (a) generating, by the image generating server of the universal content protection server, header data for making the image; (b) the image generation server parsing the header data and accessing the universal content protection server; (c) the universal content protection server determining whether an image exists in a download server of the universal content protection server; (d) if the image generation server does not exist in the step (c), accessing the CAS, DRM, ASD solution image to the FTP server and downloading the image generation server; (e) generating, by the image generating server, the downloaded solution image as downloaded content protection solution image data; (f) the image generating server generating a secret key for encrypting the solution image data; (g) encrypting the image data with the generated secret key by the image generating server; (h) performing the step (g) of the image generating server and performing an electronic signature on the image data encrypted with the private key of the download server; and (i) integrating the electronic signature, image data, and image header by the image generation server. The method of claim 1, The step (c) is a method for generating a download content protection solution image, characterized in that the process is terminated when the corresponding image exists. The method of claim 1, The header data is a download content protection solution image generation method comprising the number of pack images, the total image length. The method of claim 3, wherein The number of pack images is the number of content protection solution images contained in the download image, the total image length is the download content protection solution image generation method, characterized in that the overall size of the download content protection solution image. The method of claim 1, The download server of the step (c) is TFTP, FTP, HTTP, Carousel Server, characterized in that the download content protection solution image generation method. The method of claim 1, The image data generation method of the download content protection solution, characterized in that the image data of step (e) is composed of two or more selected from among CAS, DRM, ASD. The method of claim 6, And the image data comprises an image type and an image length. The method of claim 7, wherein The image type indicates a type of CAS, DRM or ASD, and the image length indicates the size of the image data. The method of claim 1, The step (f) is a method of generating a download content protection solution image, characterized in that the secret key is a key of the common encryption method. The method of claim 1, The step (h) is a method for generating a download content protection solution image, characterized in that the digital signature method is PKCS # 7.

Images