KR20040067287A - Conditional Access System - Google Patents

Abstract

PURPOSE: A limited receiving system is provided to enable a host to communicate through a key security module only without a direct interface path with a descrambler and a key register, and to always encipher a transmitted key value, thereby perfectly preventing a key from leaking or being modulated. CONSTITUTION: A smart card(20) inputs a packet necessary for extracting a key through a host interface(31), and extracts a key value for performing a descrambling process from the packet. A key register(32) stores the key value. A descrambler(33) descrambles scrambled TSs(Transport Streams) by using the key value. A key security module(36) inputs the key value to encipher the key value, deciphers the enciphered key value at the request of the descrambler(33), and transmits the deciphered key value. A system parser(35) analyzes the TSs, and transmits the packet for key extracting to a host(10). The host(10) transmits the packet to the smart card(20).

Description

Conditional Access System

The present invention relates to a conditional access system, and more particularly, to a conditional access system related to security enhancement.

With the recent increase in the importance of information payment and personal information protection, the importance of encryption and decoders is increasing day by day. In particular, as the number of paid TVs increases, there is a growing concern about illegal key acquisition and leakage of personal information protection. In order to supplement and improve this, research on security strength and methodology in the restricted reception system is being actively conducted.

Recently, such a limited reception system is a representative example of a multimedia device using a bidirectional communication function, and is mainly used in connection with a digital receiver, that is, a digital TV.

In particular, the interactive service enables efficient information transmission, such as a video on demand (VOD) function that searches for various types of programs and watches them at a desired time, or real-time information transmission that was possible only with a conventional personal computer.

In order to perform the above functions, the digital TV must have a communication medium such as a modem for transmitting the request information to the broadcaster, and interface with the broadcaster through a conditional access system (CAS).

In the digital TV transmission / reception system, which is connected to the conditional access system, the resource and subscriber management system (RSMS) (hereinafter referred to as "RSMS") manages the legality of the user's pay-TV program, viewing time, amount, and smart card. (Referred to as RSMS), a transmitter, a transmission medium, a digital TV, a limited reception system for storing a broadcast viewing history of a user in a built-in smart card and communicating with the RSMS to receive only broadcast information desired by the user. It consists of PSTN / PSDN, a public telecommunication network.

The transmission / reception operation of the digital TV transmission / reception system configured as described above is as follows.

First, program / program related data is transmitted to a digital TV through a transmission medium such as a transmitting station and a communication satellite.

The digital TV then signals the transmitted digital information and displays video, audio and additional information data on the screen.

The RSC communicates with the CA system through the modem and the PSTN / PSDN.

Therefore, the digital TV checks whether the viewer views the paid program according to the data communication between the limited reception system and the RSMS, and when the user wishes to watch, the RSMS watches the paid program of the viewer from the smart card embedded in the limited reception system. Read the information to determine the viewing permission according to the amount of view available.

In this case, referring to the configuration of the conventional reception system 30 according to the related art, as shown in FIG. 1, a packet required for key extraction through the host interface 31 and the host interface 31, for example, an Entitlement Control Message (ECM) ), An interface with the smart card 20 and the smart card 20 that receive an Entitlement Management Message (EMM) and extract an encrypted control word (ECW), that is, an encrypted key value, from the packet. A key register 32 for receiving and storing the decrypted key value CW through the smart card interface 34, the smart card interface 34, and the host interface 31 from the smart card 20, and the key. Descramble for reading the key value CW from the register 32 and using it to descramble the scrambled transport stream TS. (33), a system for analyzing the transport stream input from the descrambler (33) and transmits a packet (e.g., EMM / ECM) necessary for key extraction to the host (10) through the host interface (31) A host 10 for transmitting a packet required for key extraction from the system parser 35 and the system parser 35 to the smart card 20 through the host interface 31 and the smart card interface 34 is provided. It is configured to include.

In the prior art, there is a possibility that the key value is leaked or modulated in the process of storing the key value decrypted from the smart card 20 in the key register 32 through the host interface 31.

That is, there is a vulnerability of confidentiality and integrity in the interface between the smart card 20 and the host 10 and the interface between the host 10 and the key register 32, and the host 10 accesses the key register 32. By doing so, an illegal key leakage can also occur.

In addition, storing a key value in an external key register may cause a more serious leak of valid key values.

In the conventional receiving system according to the prior art, the key value decrypted from the smart card is stored in the key register through the host interface, so that the key value may be leaked or modulated in the process, and the possibility of key leakage and modulation if an external key register is used. Has a higher security problem.

Accordingly, an object of the present invention is to provide a limited reception system capable of improving a security function by preventing leakage or tampering of a key value.

1 is a block diagram showing the configuration of a conditional access system according to the related art.

2 is a block diagram showing the configuration of a conditional access system according to the present invention.

3 is a block diagram showing a detailed configuration of the key security module of FIG.

The present invention provides a smart card that receives a packet for key extraction through a host interface and extracts a key value for descrambling from the packet, a key register for storing the key value, and a scrambled transport stream. : Descrambler for descrambling TS) using key value, and input key value through host interface and encrypt it according to its own encryption algorithm to manage input / output to key register and host interface And a key security module for decrypting and transmitting at the request of a descrambler, a system parser for analyzing a transport stream input from the descrambler and transmitting a packet for key extraction to a host through a host interface; Host packets required for key extraction from the parser. It characterized in that it comprises a host that is transmitted through the face and sent to the smart card.

Hereinafter, with reference to the accompanying drawings, a preferred embodiment of the conditional access system according to the present invention will be described in detail.

Figure 2 is a block diagram showing the configuration of a conditional access system according to the present invention, Figure 3 is a block diagram showing a detailed configuration of the key security module of FIG.

As shown in FIG. 2, the conditional access system according to the present invention receives a packet (eg, EMM / ECM) required for key extraction through the host interface 31 and the host interface 31, and decodes the packet from the packet. Encrypted Control Word (ECW) for scrambling, that is, smart card 20 for extracting key values, smart card interface 34 for interfacing with smart card 20, for storing key values The descrambler 33, the smart card 34, and the host interface 31 for descrambling the scrambled transport stream (TS) input from an external key, the key register 32. Receives a key value through the key and encrypts it according to its own encryption algorithm to manage input / output to the key register 32 and the host interface 31, and The key security module 36 which transmits the decrypted key value (Control Word: CW) according to the request, analyzes the transport stream inputted from the descrambler 33, and generates a packet (e.g., EMM / A system parser 35 for transmitting an ECM to the host 10 through the host interface 31, and a packet required for key extraction from the system parser 35 are transmitted to the host interface 31 and the smart card. It comprises a host 10 for transmitting to the smart card 20 via the interface 34.

In this case, as shown in FIG. 3, the key security module 36 encrypts a key value input through the host interface 31 using an AES (Advanced Encryption Standard) algorithm and stores the key value in the key register 32 or the key register 32. Cryptographic module 41 for reading the encrypted key value to transmit through the host interface 31, and read the encrypted key value stored in the key register 32 and decrypted by AES (Advanced Encryption Standard) algorithm And a decryption module 42 for transmitting to the descrambler 33.

The operation of the conditional access system according to the present invention configured as described above is as follows.

First, the system parser 35 receives a descrambled transport stream, stores a specific packet (eg, EMM / ECM) necessary for extracting a key value, and informs the host 10 of this.

The host 10 then transmits the packet to the smart card 20 via the smart card interface 34 when the key related packet is stored.

The smart card 20 extracts a key value ECW for descrambling the scrambled transport stream from the packet and transmits the key value ECW to the key security module 36 through the smart card interface 34 and the host interface 31. do.

Subsequently, the encryption module 41 of the key security module 36 converts the received key value into an advanced encryption standard (AES) algorithm and an encryption & decryption key (EDK), that is, a local key (entered by a key manager) required for encryption / decryption. Encrypt the key value ECW stored in the key register 32 by encrypting using.

At this time, AES (Advanced Encryption Standard) algorithm is a next-generation block-level encryption algorithm, which is designated as a US standard encryption algorithm, and is expected to have a wide range of applications. have.

And the decryption module 42 of the key security module 36 requests the key value to descramble the scrambled transport stream from the key register 32 when the descrambler 33 requests the key value. Read and decrypt using AES (Advanced Encryption Standard) algorithm and EDK (Encipher & Decipher Key) and transmit the decrypted key value (CW) to the next descrambler 22.

As described above, in the present invention, the host 10 has no direct interface path with the key register 32 and the descrambler 33, and has a structure in which communication is possible only through the key security module 36.

And the key value transmitted on the interface of the present invention is always encrypted by the key security module 36.

In addition, the encryption module 41 and the decryption module 42 in the key security module 36 are designed to be separated from each other, that is, to operate independently.

The limited reception system according to the present invention has a structure in which a host does not have a direct interface path with a key register and a descrambler, can communicate only through a key security module, and a key value transmitted on an interface is always encrypted so that Leakage or tampering can be completely prevented, and external key registers, which were difficult to use due to security issues, can be applied to improve the applicability of the product.

Claims (3)

A smart card that receives a packet for key extraction through a host interface and extracts a key value for descramble from the packet; A key register for storing a key value; A descrambler for descrambling a scrambled transport stream (TS) using a key value; A key security module that receives a key value through the host interface and encrypts it according to its own encryption algorithm, manages input / output to the key register and the host interface, and decrypts and transmits it according to a request of the descrambler; A system parser for analyzing a transport stream input from the descrambler and transmitting a packet for key extraction to a host through the host interface; And a host for transmitting a packet required for key extraction from the system parser to the smart card through a host interface. According to claim 1, The key security module An encryption module for encrypting the key value input through the host interface and storing the key value in the key register or reading the encrypted key value from the key register and transmitting the same through the host interface; And a decryption module for reading and decrypting an encrypted key value stored in the key register and transmitting the decrypted key value to a descrambler. The method of claim 2, And each of the encryption module and the decryption module is configured to encrypt and decrypt a key value input by an AES (Advanced Encryption Standard) algorithm.