KR20080004002A - User watching entitlement identification system using one time password and method thereof - Google Patents

Abstract

A user watching rights authentication system using OTP and a method therefor are provided to receive limited watching rights based on a real user, not a real subscriber, limit age for a paid service for adult, and intensify security by using the OTP. A user watching rights authentication system using OTP(One Time Password) includes a user terminal(11), a broadcasting system server(13) and a receiver(14). The user terminal requests the OTP by key input. The broadcasting system server permits connection through the user terminal, generates the OTP according to the request of a user, transmits the generated OTP to the user terminal, inserts the OTP into a broadcasting signal, and encodes and transmits the OTP. The receiver decodes and receives the broadcasting signal encoded by the input of the OTP.

Description

{User Watching Entitlement Identification System Using One Time Password And Method Thereof}

1 is a system configuration diagram schematically showing a viewing authority authentication system for a paid service in a conventional digital broadcasting.

2 is a system configuration diagram schematically showing a user viewing authority authentication system using OTP according to a preferred embodiment of the present invention.

3 is a flowchart schematically illustrating a user viewing authority authentication method using an OTP according to a preferred embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

11: phone terminal 12: call center

13: broadcast system server 14: user receiver

20: user terminal 30: broadcasting system server

310: authentication server 320: CA server

330: transmission server 40: receiver

The present invention relates to a user viewing authority authentication system and a method for a paid broadcasting service using a one time password (hereinafter, referred to as 'OTP'). More specifically, the present invention relates to a limited time in response to a user's real-time OTP request. The present invention provides a user viewing authority authentication system and method for generating an OTP (public key, secret key), carrying a public key in a broadcast signal, encrypting and transmitting the same, and decrypting the secret key to receive a broadcast.

1 is a system configuration diagram schematically showing a viewing authority authentication system for a paid service in a conventional digital broadcasting.

Referring to FIG. 1, in order to receive a paid digital broadcast in a conventional digital broadcast, a user calls a call center 12 directly through a telephone terminal 11 and requests viewing authority over a telephone, and the call center 12 user Check whether the user is a real subscriber through the authentication of the user, and broadcast system server 13 manually modifies the viewing authority of the user and transmits a broadcast signal so that the user can receive the digital pay TV through the receiver 14 of the real subscriber. Could.

However, if the above method is an authentication method through a dialogue between the user and the call center, it is not only time-consuming but also difficult to grant temporary viewing authority, and only the actual subscriber can modify the viewing authority. In other words, if the user to watch the different, the actual subscriber and a number of other users when watching the broadcast through a single set-top box there was a problem that the user can not obtain the viewing rights arbitrarily.

In addition, in the related art, since authentication is possible based on a receiver based on an application of a real subscriber, there is a problem that age limitation is difficult because authentication for a real user is not possible, such as an adult paid service.

The present invention has been made to solve the above problems, the object of the present invention can be granted a limited viewing rights for a particular program based on the actual user, if the age restriction, such as adult paid services are required The present invention provides a system for authenticating viewing rights and a method thereof.

In order to achieve the above object, the user viewing authority authentication system using the OTP according to the present invention allows a user terminal requesting a one-time password (OTP) by a key input and access through the user terminal, and requests from the user. The system generates a one-time password (OTP), transmits the generated one-time password (OTP) to the user terminal, inserts it into a broadcast signal, encrypts it, and sends the one-time password (OTP). And a receiver for decoding and receiving the encrypted broadcast signal.

The broadcast system server checks the identification number (PIN) of the user and generates an one-time password (OTP) when there is a one-time password (OTP) request from the user terminal. It is characterized in that it comprises a CA server for restricting the viewing authority by inserting a password (OTP) into the EMM and ECM of the broadcast signal and transmitting server for transmitting the encrypted broadcast signal from the CA server.

In addition, the receiver receives a one-time password (OTP) transmitted from the user terminal to decode the entitlement management message (EMM) and the entitlement message (ECM) of the encrypted broadcast signal to obtain a key for viewing the broadcast And a smart card.

Here, the smart card is characterized in that the charging information is recorded when the one-time password (OTP) is input.

The user terminal is characterized in that the application for communication with the authentication server and the information for personal authentication is stored.

The broadcasting system server may further include a billing server configured to perform billing after user authentication in a one-time password (OTP) request.

The authentication server and the user terminal generate a seed value through a one-way hash algorithm through program ID or viewing time information, user identification number (PID), time synchronization information, or challenge message, and asymmetry using the generated seed value. It is characterized by simultaneously generating a one-time password OTP by a key algorithm or a symmetric key algorithm.

In addition, the one-time password described above is composed of a pair of public key and a public key based on the public key, the public key is transmitted to the transmission server, characterized in that the secret key is input to the receiver.

On the other hand, the user viewing authority authentication method using the OTP according to the present invention, in the user viewing authority authentication method for granting the viewing authority by the user's application, (a) requesting a one-time password (OTP) through the user terminal; And (b) generating a one-time password (OTP) after user authentication, and (c) transmitting the generated one-time password (OTP) to a user terminal and a broadcasting system server, and (d) to the broadcasting system server. Transmitting the broadcast signal encrypted with the transmitted one-time password (OTP) through a broadcasting network; and (e) receiving the broadcast by decoding the broadcast signal transmitted by inputting the generated one-time password (OTP) to a receiver. Characterized in that it comprises a.

And, step (b) is a step of (b ') authenticating a user by a user identification number (PID) and (b' ') generating a one-time password (OTP) by an asymmetric key algorithm or a symmetric key algorithm. Characterized in that it comprises a.

Here, after the user authentication step of the step (b ') characterized in that it further comprises the step of storing the charge information for the program through the charge server to process the charge.

And, step (b) is to authenticate the user by the user identification number (PID) and the seed value obtained through the one-way hash using the user identification number (PID), program ID and challenge message or synchronized time information And calculating the one-time password by applying the seed value to the asymmetric key algorithm or the symmetric key algorithm.

In addition, the step (d) is the step of encrypting the credential management message (EMM) and the credential control message (ECM) with the one-time password received by the CA server and the encrypted credential management message (EMM) and credential control message ( And inserting an ECM into a broadcast signal and transmitting a broadcast signal into which the encrypted credential management message (EMM) and the credential control message (ECM) are inserted through a broadcast network.

And, the step (e) is a step of inputting the generated one-time password (OTP) to the receiver and decrypting the credential management message (EMM) inserted into the broadcast signal with the one-time password (OTP) smart of the receiver Acquiring a viewing right by a card and acquiring a key to descramble a broadcast signal by decrypting an entitlement control message (ECM) inserted into the broadcast signal with the one-time password OTP. It is characterized by including.

Here, when the one-time password (OTP) is input to the receiver, the charging information for the program is recorded on the smart card, and further comprising the step of performing the charging process.

In addition, the one-time password described above is composed of a pair of public key and secret key, the public key is transmitted to the broadcast system server, the secret key is characterized in that the input to the receiver.

Hereinafter, specific configurations and operations will be described in detail with reference to the drawings and the embodiments.

2 is a view illustrating a system for authenticating a user's right to pay digital service according to the present invention, including a user terminal 20, a broadcasting system server 30, and a receiver 40.

The broadcast system server 30 checks a user's identification number (PIN) and generates an OTP when a one-time password (hereinafter referred to as 'OTP') request for a specific program is received from the user terminal. Receive and broadcast the EMM and ECM from the CAS server 320 and the CAS server 320 restricting viewing authority by inserting and encrypting the OTP generated from the 310 and the authentication server 310 into the EMM and the ECM of the broadcast signal. It is configured to include a transmission server 330 is inserted into the signal and transmitted.

Here, the OTP generation may be generated alone in the authentication server 310 and transmitted to the user terminal 20 and the transmission server 330, but the time information of the authentication server 310 and the user terminal 20 is synchronized It can be generated at the same time by sharing a user identification code (PID) with.

In this case, the generated OTP may be formed of one key in which the secret key generated or transmitted in the user terminal 20 and the public key transmitted to the transmission server 330 are the same as the private key, and the public key (asymmetric). The secret key generated or transmitted in the user terminal 20 and the public key transmitted to the transmission server 330 may be formed differently. A specific OTP forming method will be described later.

In addition, the broadcast system server 30 further includes a billing server (not shown) that stores billing information of the user and processes billing after user authentication from the authentication server 310 when there is an OTP request from the user terminal 20. Can be configured.

The user terminal 20 can be anything as long as it can be connected to the Internet, such as a mobile communication terminal, PDA. The user terminal 20 stores an application for communication with the authentication server 310. In addition, information for personal authentication (for example, a user identification code (PID)) is stored so that the OTP can be issued with a simple key operation.

The receiver 40 plays a role of receiving and displaying a broadcast signal transmitted from the transmission server, and includes a smart card (not shown) for controlling the decryption of the encrypted broadcast signal by granting a viewing authority for a paid service. It is composed.

The smart card may also perform a function of recording charging information when an OTP is input from the user terminal 20.

Here, if the user terminal 20 can receive a digital broadcast, the user terminal 20 can also play the role of the receiver 40.

3 is a flowchart schematically illustrating a user's viewing authority authentication method for a paid data service according to an exemplary embodiment of the present invention.

Referring to FIG. 3, a user first requests issuance of an OTP using a user terminal (S110). More specifically, a user accesses an authentication server of a broadcasting system server through a user terminal and performs user authentication by a PIN. . If necessary, a login procedure is performed.

Thereafter, the authentication server generates an OTP (S120).

Challenge-Response and Time-Synchronous can be used as a security solution that changes OTP whenever a user connects to the authentication server and requests authentication.

First, in the challenge-response method, when a user logs in to the authentication server, the authentication server sends a challenge message to the user terminal, the user generates and responds to the OTP using a PIN and a challenge, and the authentication server responds to the same challenge. It generates the OTP using the registered PIN and compares it with the user's response to authenticate.

In the time synchronization method, a 64-bit secret key is generated for each time t determined by the administrator of the authentication server by the random number generation algorithm. At this time, each user is assigned a specific key and the specific keys are stored in the intelligent token and authentication server database.

Here, when the user logs in and passes a PIN and a six-digit random number, the random number is generated by the algorithm in the token with the initial value of the secret key and time (t) stored in the token. When the 10 numbers are sent to the authentication server, the PIN is used as an index to find the corresponding secret key, and the generated 6 random numbers match the transmitted values.

Since the challenge-response method and the time synchronization method described above are obvious to those skilled in the art, detailed description thereof will be omitted.

In order to generate the OTP, the authentication server 310 and the user terminal 20 of the broadcasting system server share a PIN, and are stored in the authentication server 310 and the user terminal 20, respectively.

When a user inputs a program ID to the user terminal 20 to obtain a viewing right of a specific program, the user terminal 20 transmits it to the authentication server 310. In addition, the user terminal 20 sends a challenge message or the user terminal 20 and the authentication server 310 to determine the time stamp (Time Stamp).

The ID of the receiver or receiver smart card ID to be incidentally watched may be transmitted to the authentication server 310. If the user wants to watch for a predetermined time instead of a specific program, time information (for example, 14: 00-16: 00) to apply for viewing authority on an hourly basis. In this case, the charging server (not shown) may store the charging information set based on the input program ID or time information and perform the charging process.

Here, in the case of the challenge-response method, the challenge message and the time synchronization method, the synchronized time information is used as a seed value for generating the OTP, and the information (challenge message or synchronized time information) is authenticated with the user terminal. The server will share.

When the user terminal and the authentication server share information (challenge message or synchronized time information), a seed is generated using a one-way hash.

At this time, a seed may be generated through a hash algorithm by a function such as Seed = H (PIN, program ID or viewing time information, synchronized time information, or challenge message). Security can be further enhanced by generating a seed based on the PIN.

Once a seed is created, it is composed of a pair of public and private keys with an asymmetric key (RSA) algorithm through a function such as OTP {Public, Private} = RSA (Seed). OTP can be generated. At this time, the calculation of the two algorithms are performed simultaneously in the user terminal and the authentication server.

In addition, the OTP can be generated by applying the challenge message and time synchronization information to the asymmetric key algorithm without a one-way hash step.

Here, a hash algorithm and an asymmetric key (RSA) algorithm for generating an OTP may use a commonly used algorithm, and the hash algorithm and the asymmetric key (RSA) algorithm may be combined and used as one algorithm. In addition, a public key may be generated using a symmetric key algorithm instead of an asymmetric key algorithm.

However, it is preferable to implement the asymmetric key algorithm because it is vulnerable to security when using the symmetric key algorithm.

In addition, any algorithm commonly used to generate OTP may be used to generate the OTP.

When the OTP is generated, the authentication server 310 transmits the generated OTP to the CA server 320 (S130).

The OTP may be generated by the authentication server 310 alone and transmitted to the user terminal 20, but for enhanced security, the authentication server 310 and the user terminal 20 synchronize time information and perform algorithm calculation simultaneously. It is preferable to configure OTP to be generated at the same time. In this case, the public key is generated at the authentication server 310 and the secret key is simultaneously generated at the user terminal 20.

More specifically, when the OTP is generated, the authentication server 310 transmits a public key to the CA server 320 of the broadcasting system server, and the private key generated by the user terminal 20 is a receiver ( In 40). At this time, when the OTP is generated by the public key algorithm, the same public key is generated in the authentication server 310 and the user terminal 20 and transmitted to the CA server 320.

Thereafter, the CA server 320 receiving the public key inserts the public key into the broadcast signal (S140).

The CA server 320 receives the disclosure from the authentication server and displays the entitlement management massage (hereinafter referred to as 'EMM') and the entitlement control massage (hereinafter referred to as 'ECM'). Encrypts the data into the broadcast signal.

Here, the ECM is a message for modifying the authority of the receiver smart card receiving the broadcast, and the EMM is a message used to generate a key for viewing a specific program.

Next, the transmission server 330 transmits the broadcast signal in which the EMM and ECM are inserted through the broadcast network (S150).

Since the broadcast signal is transmitted after the EMM and the ECM are encrypted by the public key, the broadcast receiver cannot watch the broadcast unless the receiver of the receiver watching the broadcast has a secret key (a public key in the case of symmetry).

After that, the receiver 40 inputs the secret key decodes the broadcast signal to watch the broadcast (S160).

More specifically, since a broadcast signal is transmitted by encrypting an EMM that can give a viewer right to a smart card of the receiver 40 with a public key, a user transmits a secret key transmitted to the user terminal 20 or generated by the user terminal 20. When input to the receiver 40, the smart card (not shown) of the receiver 40 decrypts the encrypted EMM with a secret key to obtain the viewing authority of the smart card.

In addition, in the state where the smart card has the viewing authority, the smart card decrypts the ECM encrypted with the public key with the secret key and feeds the smart card to obtain a key for descramble the broadcast. To watch. Here, if the user terminal and the receiver are the same, the secret key input step may be omitted.

In addition, billing information may be recorded on the smart card at the same time as the secret key is input to the receiver to perform billing.

In addition, the CA server 320 encrypts only a predetermined time (for example, a specific program broadcast time) of the predetermined program when the OTP (public key, secret key) is generated, and the transmission server 330 transmits it. The user may be allowed to acquire the viewing authority only for a limited time.

 By the above method, the user can acquire the temporary viewing right for the paid data service, and can freely receive the viewing right even without being a subscriber of the receiver.

As described above, the viewing authority authentication system using the OTP and the method according to the present invention can be granted temporary viewing authority based on the actual user rather than the actual subscriber base, and not only age restriction for adult pay service is possible. However, there is an excellent effect to enhance security using OTP.

Although the detailed description of the present invention described above has been described with reference to the preferred embodiment of the present invention, the protection scope of the present invention is not limited to the above embodiment, and those skilled in the art will appreciate It will be understood that various modifications and changes can be made in the present invention without departing from the spirit and scope of the invention.

Therefore, the technical scope of the present invention should not be limited to the contents described in the detailed description of the specification but should be defined by the claims.

Claims (16)

A user terminal for requesting a one-time password OTP by key input; Broadcast to allow access through the user terminal, generate a one-time password (OTP) according to the user's request, transmit the generated one-time password (OTP) to the user terminal, insert it into a broadcast signal, and transmit the encrypted signal. A system server; And a receiver for decrypting and receiving the encrypted broadcast signal by receiving the one-time password (OTP). The method of claim 1, The broadcast system server An authentication server for verifying an identification number (PIN) of a user and generating a one-time password (OTP) when there is a one-time password (OTP) request from the user terminal; A CA server for restricting viewing authority by inserting and encrypting the one-time password OTP generated from the authentication server into the EMM and ECM of the broadcast signal; User viewing authority authentication system using a one-time password, characterized in that comprises a transmission server for transmitting an encrypted broadcast signal from the CA server. The method of claim 1, The receiver is configured to include a smart card to obtain a key for viewing the broadcast by decrypting the entitlement management message (EMM) and the entitlement authority message (ECM) of the encrypted broadcast signal is input to the one-time password (OTP) User viewing authority authentication system using a one-time password, characterized in that. The method of claim 1, The user terminal is a user viewing authority authentication system using a one-time password, characterized in that the application for communication with the authentication server and information for personal authentication is stored. The method of claim 1, The broadcasting system server is a user viewing authority authentication system using a one-time password, characterized in that it further comprises a billing server for performing the billing after user authentication when a one-time password (OTP) request. The method of claim 2, The authentication server and the user terminal generate a seed value through a one-way hash algorithm through program ID or viewing time information, user identification number (PID), time synchronization information, or challenge message, and an asymmetric key algorithm using the generated seed value. Or a one-time password (OTP) by a symmetric key algorithm simultaneously. The method of claim 3, wherein The smart card is a user viewing authority authentication system using a one-time password, characterized in that the charge information is recorded when a one-time password (OTP) is input. The method according to any one of claims 1 to 7, The one-time password above And a public key generated from a pair of public keys and a private key, wherein the public key is transmitted to the transmission server and the secret key is input to a receiver. In the user viewing authority authentication method for granting viewing authority by user's application, (a) requesting a one-time password (OTP) through a user terminal; (b) generating a one-time password (OTP) after user authentication; (c) transmitting the generated one-time password OTP to a user terminal and a broadcasting system server; (d) transmitting a broadcast signal encrypted with a one-time password (OTP) transmitted to the broadcasting system server through a broadcasting network; and (e) receiving the broadcast by decoding the broadcast signal transmitted by inputting the generated one-time password OTP to the receiver and receiving the broadcast. The method of claim 9, Step (b) is (b1) authenticating the user by a user identification number (PID); (b2) generating a one-time password (OTP) by an asymmetric key algorithm or a symmetric key algorithm. The method of claim 9, Step (b) is Authenticating a user by a user identification number (PID); Calculating a seed value obtained through a one-way hash using the user identification number (PID), program ID and challenge message or synchronized time information; And generating a one-time password by applying the seed value to an asymmetric key algorithm or a symmetric key algorithm. The method of claim 9, Step (d) Encrypting a credential management message (EMM) and a credential control message (ECM) with the one-time password received by the CA server; Inserting the encrypted credential management message (EMM) and credential control message (ECM) into a broadcast signal; And transmitting a broadcast signal having the encrypted credential management message (EMM) and credential control message (ECM) inserted through the broadcasting network. The method of claim 9, Step (e) is Inputting the generated one-time password (OTP) to a receiver; Decrypting the entitlement management message (EMM) inserted into the broadcast signal with the one-time password OTP to obtain a viewing authority by the smart card of the receiver; And decrypting the entitlement control message (ECM) inserted into the broadcast signal with the one-time password OTP to obtain a key for descrambling the broadcast signal to watch the broadcast. How to authenticate the user viewing authority using a password. The method of claim 10, And storing the billing information for the program through the billing server after the user authentication step of step (b1) to process billing. The method of claim 13, When the one-time password (OTP) is input to the receiver, the charging information for the program is recorded on the smart card to perform the charging process, characterized in that the user viewing authority authentication method using a one-time password further comprises . The method according to any one of claims 9 to 15, The one-time password consists of a pair of public key and a private key, the public key is transmitted to the broadcast system server, the secret key is input to the receiver user viewing authority authentication method characterized in that the input.

Images