WO2002045428A1

WO2002045428A1 - An enciphering system for cable tv network

Info

Publication number: WO2002045428A1
Application number: PCT/CN2001/001585
Authority: WO
Inventors: Qin Zhang
Original assignee: Cathay Roxus Information Technology Co., Ltd.
Priority date: 2000-11-28
Filing date: 2001-11-28
Publication date: 2002-06-06
Also published as: CN1355654A; AU2002221506A1; CN1476724A

Abstract

An enciphering system includes head-end, network and user terminal. The head-end inlcudes CA-condition access server and nultiplexer. The user terminal includes stream receiver and I/O device. The head-end also includes scrambler which comprising digital signal processor and memory for performing the scrambling function by using corresponding program according to the command of the server. The user terminal includes demultiplexer comprising digital signal process and memory, descrambler and decoder for perfoming the function of demultiplexing, descrambling and decoding the signal by performing the corresponding program stored in the memory.

Description

Encryption system of cable television network

Technical field

The invention relates to an encryption system, in particular to an encryption system implemented in a software platform on a cable television network.

Background technique

Early cable television encryption systems (usually used in analog transmission systems) scrambled the transmission signals in the channel at the front end, which was easy to crack and copy, and would cause the loss of television signals, which have gradually been replaced by digital systems.

The encryption systems currently used in digital space transmission systems generally include: front-ends, network systems, and user terminals. The front end includes CA-Condition Access server, multiplexer, scrambler, etc. The network system generally uses HFC network; the user terminal consists of code stream receiver, descrambler, demultiplexer, smart card and output unit. And other composition. As shown in Figure 1.

This type of cable TV encryption system no longer scrambles the transmitted analog signals, but performs digital encryption processing before sending digital TV programs or broadcast data to the cable network, which avoids the loss of analog TV signals and is more secure. .

The encryption system used in digital transmission systems has gone through a long period of development. Initially, due to system security considerations, various encryption system manufacturers often developed and developed encryption systems on their own, and because most encryption products encrypt an application, they are vulnerable to hardware types, application software, and network aspects. Because of this, the compatibility of encryption systems is very poor. Because service providers directly provide end users with receiving devices made according to their own needs, different encryption systems that implement the same function often cannot be replaced with each other, and multiple encryption systems that implement different functions cannot work because they follow their own standards. Together, in this way, the selection of the encryption system for cable TV operators is bound to be limited by matching with existing front-end equipment. At the same time, with the rapid development of cable television network services, if you want to rely on a single encryption system to achieve Broadcast (VOD-Video On Demand), Internet TV, data communication, data broadcasting, private virtual network (PVN-Private Virtual Net), Internet services and other future functions are obviously unrealistic.

For this reason, the design of existing encryption systems separates the scrambling system from the authorization management system, as shown in Figure 2.

The design of more common encryption systems such as DVB encryption system and OpenCAS all reflect this idea. This type of encryption system implements content-based and multi-user management encryption methods. The same content can be scrambled by different conditional access vendors, and the same conditional access vendor can also scramble different content. The only prerequisite is to add The interface definition between the interference system and the conditional access system conforms to the unified standard specification.

The DVB same-density standard uses a common scrambling algorithm and a shared key. This type of encryption system uses CW-Control Word as a key, and uses a certain general scrambling algorithm to scramble a composite transport stream (TS-Transport Stream) containing multiple programs and data. The client's descrambler uses Control words (CW) obtained by smart card decryption to descramble programs and data. The specific process is shown in Figure 3.

First, the conditional access server generates a control word according to the authorization requirements for program playback.

(CW-Control Word), and create ECM-Entitlement Control Message Generator. ₀ ECM is encrypted using SK-Service Key and password algorithm. The scrambler uses control words (CW) and scrambling algorithms to scramble programs and data transmission streams. To prevent illegal intrusion and hacking, control words

(CW) changes every 5-20 seconds, and the entitlement control information (ECM) messages change accordingly.

At the same time, the conditional access (CA) server obtains the user's address information, authorization information, etc. from the customer management system and combines it with the service key (SK) to form authorization management information (EMM — Entitlement Management Message). Entitlement management information (EMM) is encrypted using a master key (PK—Private Key) and a strong encryption algorithm such as the 3DES algorithm or the RSA algorithm. The front end of the encryption system generates the user terminal master when the smart card is initialized. Key (PK), and the front end stores this master key (PK) in its own database. Both the entitlement control information (ECM) and the entitlement management information (EMM) are inserted into the scrambled composite transport stream according to a certain transmission period, and are transmitted to the client via the HFC network together.

The smart card in the receiving device (usually a digital set-top box) of the user terminal first obtains the authorization control information (ECM) and authorization management information (EMM) from the transport stream, and then uses the master key (PK) to complete the EMM decryption to obtain the authorization information and The service key (SK), then use SK to decrypt the authorization control information (ECM) to obtain the control word (CW), and pass the decrypted control word (CW) to the descrambler of the set-top box. The descrambler uses the CW and the The descrambling algorithm corresponding to the front end completes the descrambling of programs and data.

Because this type of encryption system uses a common scrambling algorithm and key, the front end of the system can use conditional access servers of different conditional access (CA) vendors, provided that these conditional access servers comply with the DVB same-density standard. Therefore, such a system can carry multiple ECM and EMM information generated by different conditional access servers in a set of programs to end users with different needs, and the set-top box of the user terminal always serves a single CA system. This makes the compatibility with the dense system very good and the cost is very low. However, in order for the same secret to work, different service providers must agree to transmit through it, reuse the information of other conditional access systems, and access to their respective set-top boxes. This is always an obstacle for newly added cable operators. Another disadvantage of the same secret is that it increases the occupied bandwidth, because each conditional access system must copy the conditional access information.

The DVB multi-density standard and the POD (Point of Deployment) standard integrate the functions of the decryption and descrambling algorithms into a plug-in conditional access module with a universal interface, reflecting the idea of machine-card separation. Therefore, a user terminal of such a system can configure multiple different conditional access modules outside the receiving device, so that the same set-top box can serve multiple conditional access systems. The general interface definition of this type of conditional access module is static, so it can only support the existing conditional access system. The constant resource is its essential defect, plus The cost of the conditional access module is too high, and it has not been widely used.

We can see that the above-mentioned hardware-based encryption system, regardless of the standard, has certain defects. If an illegal user uses optical etching, back tracking, clock modification, etc. to read, tamper with, or copy the information in the smart card, when enjoying the service illegally, the cable TV operator cannot monitor this situation and replace the algorithm and key in time. Security Sex is difficult to secure. Moreover, once the descrambling algorithm needs to be updated, the user terminal must replace the descrambling chip with a new one, and the cost is also high. In addition, the encryption system in the form of hardware is limited by its architecture, and it is difficult to add new functions according to the needs of practical applications.

For example, none of the existing encryption standards defines the interoperation function between the front-end system and the user terminal, and it is impossible to achieve real-time update and upgrade of the algorithm. Existing systems also cannot support other flexible conditional access services such as non-real-time file decryption. It can be seen that the existing encryption systems implemented in the form of hardware still fail to truly meet people's general and easy-to-use requirements for encryption systems in terms of security, openness, flexibility, and manageability.

Disclosure of invention

Therefore, the object of the present invention is to provide a new encryption system, which can easily perform the operation of replacing the scrambling algorithm without having to replace the scrambling chip and descrambling chip, so as to meet the requirements of low cost; meanwhile, the present invention can eliminate the need to replace the encryption. The hardware part of the system realizes the function expansion and upgrade to meet the requirements of openness and flexibility;

The present invention is achieved through the following technical solutions: The encryption system of the present invention includes: a front-end system, a network system, and a user terminal system. The front-end system includes a conditional access server and a multiplexer. The user terminal system includes a code. A stream receiver and an output device,

The front-end system further includes a scrambler, which is composed of a digital signal processor and a memory, and completes the scrambling function by calling a corresponding program in the memory according to an instruction of a conditional access server;

The user terminal system includes a demultiplexer, a descrambler, and a decoder composed of a digital signal processor and a memory, and the functions of demultiplexing, descrambling, and decoding are performed by a digital signal. The number processor calls the corresponding program in the memory to complete.

The conditional access server in the front-end system includes functions such as basic client authorization, key management, authorization control information, and authorization management information generation, as well as conditional access management functions. The conditional access server also encapsulates a set of authentication APIs and authorization APIs for call by the billing management system and network management system.

The software platformization implementation scheme of the encryption system proposed by the present invention abandons the dedicated scrambling chip and descrambling chip necessary for the hardware implementation form of the encryption system, builds the encryption system on a general-purpose computing platform, and relies on the advantage that the software can be continuously updated. The cable television network performs high-speed and real-time replacement of encryption algorithms and keys, which facilitates the addition and expansion of functions, so that the encryption system can adapt to current and future standards. The invention also uses a high-speed digital processor to provide a physical basis for program encryption, identity authentication, encryption algorithms, real-time updating of keys, and creation of multiple hybrid encryption mechanisms. Therefore, the encryption system involved in the present invention has higher reliability, security, and delay, and provides conditions for the expansion of the business of cable television operators.

Brief description of the drawings

FIG. 1 is a schematic diagram of a structure of an encryption system of a conventional cable television network.

Figure 2 is a schematic diagram of the separation of the scrambling system and the authorization management system in the encryption system of the existing cable television network.

Figure 3 shows the specific process of descrambling in the DVB same-secret standard by using the control word (CW) obtained by decryption of the smart card to descramble programs and data.

Fig. 4 is a structural diagram of a front-end system of an encryption system of a cable television network of the present invention. Fig. 5 is a block diagram of a terminal system of an encryption system of a cable television network according to the present invention. Fig. 6 shows the architecture of the user terminal system of the present invention.

Fig. 7 shows the architecture of the conditional access system of the present invention.

FIG. 8 shows a schematic diagram of a shared front-end platform between a multiplexer and a scrambler in the front-end system of the present invention.

Best Mode for Implementing the Invention The encryption system of the present invention includes: a front-end system, a network system, and a user terminal system. As shown in FIG. 4, the front-end system of the present invention includes a conditional access (CA) server, a multiplexer, a scrambler, an algorithm management server, and an application program interface API.

The scrambler in the front-end system is a system platform with software upgrade function. Its hardware and functions are separated. The scrambler is composed of a hardware DSP processor and a memory. Function modules such as scramble control and scramble algorithm library are stored in the memory. After the scrambler obtains the conditional access control information provided by the conditional access (CA) server, it starts the scramble control module in the scrambler to call the scramble algorithm in the scramble algorithm library, The mixed data stream is scrambled by a single method, multiple methods, or a mixed method. The scrambler can also support the DVB same-density standard and can be compatible with a wide range of other conditional access (CA) systems.

The algorithm management server in the front-end system can implement the loading, configuration and maintenance of various scrambling / descrambling algorithms, and provides a set of algorithm upgrade application programming interface (API-Application Programming Interface). System operators can base on this API The interface is designed by itself or a third party is commissioned to design an algorithm that complies with the interface specification and update the existing algorithm.

The multiplexer in the front-end system of the present invention can share the front-end platform with the scrambler, as shown in FIG. 8, that is, the front-end memory also stores a multiplexing function module and a configuration management module. The platform is equipped with an Ethernet adapter card, and the external management program can realize the configuration management of different functional modules through the Ethernet interface, and realize the multiplexing function.

The encryption system can implement the corresponding function of each conditional access module by calling the conditional access application program interface (referred to as CA API), or can design and add new functional modules based on this API.

The conditional access system's conditional access management module is responsible for managing conditional access modules from different manufacturers that comply with different encryption standards, as well as downloading and replacing algorithms.

The conditional access status monitoring module of the conditional access system is responsible for monitoring user authentication. Methods such as method upgrades, conditional access services, etc. When an abnormal situation is found, an alarm is recorded and recorded for future inquiry.

The conditional access test module of the conditional access system can use authentication methods such as parity check and hash operation to realize the authentication of all conditional access characteristics and conditional access processing software (including the processing program in the smart card, user information, etc.) If once the characteristics of the smart card of the user terminal or any part of the conditional access system is found to be tampered, that is, the authentication fails, the current conditional access service is immediately closed, and the use of the illegal user is prohibited. In addition, this module can also realize the testing of various algorithms, and the testing of ECM and EMM processing by different CA manufacturers.

The EMM processing module is responsible for the processing of EMM information from different CA manufacturers. The ECM processing module is responsible for the processing of ECM information from different CA manufacturers. The scrambling / descrambling module is responsible for using a certain algorithm to scramble / descramble the data. The front-end system corresponds to the corresponding conditional access function in the user terminal system.

The network system of the present invention may be a fiber optic coaxial cable hybrid network (HFC) network, a digital satellite broadcasting network, a microwave network (MMDS), or an Ethernet network.

The user terminal system of the present invention is shown in FIG. 5. In addition to the hardware part of the user terminal system, which includes a code stream receiver and an input / output device, the rest is a high-speed DSP and a memory (DSP-Digital Signal Processor). , Equivalent to the CPU in the computer).

The code stream receiver of the user terminal system of the present invention uses a FPGA-Field Programmable Gate Array to transmit the received digital signals to the DSP at high speed to complete the code stream receiving function.

The hardware and functions of the user terminal system are also separated. For example, functions such as demultiplexing, smart card driving, and MPEG decoding are implemented by software in the memory. In addition, a conditional access test module, a conditional access status monitoring module, a conditional access management module, an EMM processing module, an ECM processing module, and a descrambling module are stored in its memory. All these conditional access modules are encapsulated into APIs, which are called by the application layer. The user terminal is The conditional access management module, conditional access status monitoring module, and conditional access test module perform conditional access management and monitoring by calling the conditional access API. The EMM processing module and ECM processing module complete the processing of each EMM and ECM information respectively. The software descrambling module realizes descrambling of the data stream. After the descrambled data is decoded by the MPEG decoding module, it is processed and output accordingly. The user terminal system may also call a software download API for conditional access management to implement online upgrade and replacement of the scrambling algorithm.

The specific working process of the encryption system of the present invention will be described below.

I. Scrambling of data

1. Conditional access server

The conditional access server of the present invention mainly includes seven parts: a conditional access (CA) management system, a customer authorization system (SAS-Subscriber Authorization System), a key management system (KM-Key Management), and a synchronizer (SCS) -SimulCrypt Syncronizer), EMMG-Entitlement Management Message Generator, ECMG-Entitlement Control Message Generator, and conditional access algorithm management system.

The conditional access management system is responsible for detecting and authenticating client set-top boxes and smart cards, testing various algorithms, managing and scheduling conditional access systems that comply with different encryption standards provided by multiple different manufacturers, and downloading and replacing algorithms. Wait.

The key management system (KM) is responsible for generating control words (CW) and business keys (SK). The same password synchronizer is responsible for transmitting the control word (CW) generated by KM through the DVB same password standard interface and transmitting it to the authorization control information generator (ECMG) of the access manufacturer with different conditions. The information is encrypted and then sent to the same-level synchronizer (SCS). The SCS is responsible for synchronously receiving ECM information from different conditional access vendors and passing it to the multiplexer for insertion into the composite transport stream. At the same time, the SCS also passes the control word (CW) to the digital scrambler, which controls the scrambler to change the CW and algorithm used for scrambling simultaneously. The authorization management information generator (EMMG) receives the EMM information generated by the customer authorization system (SAS), and then uses this information to communicate with the business secrets. The key (SK) completes the production of the EMM and encrypts it with the customer's master key PK, and then passes it to the multiplexer for insertion into the composite transport stream.

2. Multiplexer

The multiplexer implements the same-dense interface of the DVB standard to receive data such as EMM and ECM, and composes all data information into a TS-Transport Stream and sends it downward.

3. Scrambler

The scrambler in the present invention is composed of a DSP chip, a memory, and an I / O interface. The corresponding scrambling control module and scrambling algorithm library are stored in the memory. The scrambling control module in the memory can implement the processing of the scrambling strategy. For example, you can choose to scramble only audio, only scramble video, and intermittently scramble audio / video. The scrambling algorithm library in the memory contains both the DVB general scrambling algorithm and other standard algorithms such as DES and 3DES. Because the functions of the scrambler are all implemented by software modules and have nothing to do with hardware, when the scrambling algorithm needs to be replaced, only the corresponding program needs to be upgraded, and it is not necessary to replace the scrambling and descrambling chip. It is easy to adapt to new requirements. Moreover, when needed, the algorithm management system in the conditional access server may select a new algorithm from the algorithm management server of the front-end system and load the scramble algorithm library of the scrambler, thereby facilitating the quick and easy algorithm replacement.

In addition, since the scrambler in the present invention supports the DVB same-density standard, it can be compatible with a wide range of other conditional access (CA) systems, and it can flexibly select different scrambling algorithms. Therefore, the scrambler can serve according to data Different levels of algorithms are set for different data services. For example, for confidential data services such as e-mail, high-level algorithms will be used to ensure encryption. The method is that, by inserting user authorization control information (ECM information) in the composite transport stream, an algorithm and a key are specified for a subsequent code stream of the insertion point. However, in the existing encryption system, because the structure of the scrambler exists in a chip manner, the number of algorithms that can be provided is limited, especially the reliability of the existing algorithms is poor, and when new algorithms are needed to ensure the encryption, there are already Encryption system will not meet this requirement begging.

Data descrambling

Fig. 6 shows the architecture of the user terminal system of the present invention. Fig. 7 shows the architecture of the conditional access system of the present invention.

The difference between the present invention and the existing user terminal equipment based on the hardware structure is that the present invention uses a DSP processor and a memory to replace the descrambler and the like of the chip structure. Most of the functions on the user side will be implemented on a general-purpose high-speed digital processor (DSP or CPU). For example, functions such as demultiplexing, smart card driver, and MPEG decoding are implemented by software in the memory. In addition, a conditional access test module, a conditional access status monitoring module, a conditional access management module, an EMM processing module, an ECM processing module, and a descrambling module are stored in its memory. All of these conditional access modules are encapsulated into APIs, which are called by the supply layer.

The user terminal system calls the conditional access API. The conditional access test module implements authentication of all conditional access features and conditional access processing software (including processing software in the smart card). If the authentication fails, the current conditional access service is closed.

The user terminal system calls the conditional access API by the conditional access status monitoring module, which monitors user authentication, algorithm upgrade, and conditional access services, etc. When an abnormal situation is found, it alerts and records in time for future query.

The user terminal system calls the conditional access API. The conditional access management module manages the conditional access modules that comply with different encryption standards provided by multiple manufacturers, and implements functions such as downloading and replacing algorithms.

After receiving the transmission information from the HFC network, the code stream receiving device of the user terminal of the present invention calls the EMM and ECM processing modules to obtain the EMM and ECM information, and then calls the smart card driver API to transmit the EMM and ECM information to the smart card (including the virtual card) . The smart card uses the loaded master key (PK) to decrypt the EMM information to obtain the business key

(SK), and then use the SK to decrypt the obtained ECM information to obtain a control word (CW) and send it to the descrambler. Then, the descrambling API is called to descramble the code stream. Finally solved by MPEG The code module decodes to obtain digital television services.

It can be seen that the encryption system of the present invention can also realize comprehensive management and monitoring of the conditional access system, which greatly improves the security of the system. Moreover, since the encryption system of the present invention provides a large number of application program interface APIs, corresponding functions can be completed by calling the application program interface APIs of each functional module. When it is necessary to replace and upgrade the scrambling / descrambling algorithms or other functions, only The corresponding application program can be modified, and the functions can be easily expanded and upgraded, which greatly improves the flexibility and versatility.

3. Flexible support for multiple conditional access services

The encryption system of the present invention is built on a general-purpose computing platform, so it can complete various flexible conditional access functions according to the needs of users. Taking the application of flexible customization services as an example, some user-customized programs have been pre-encrypted by the front-end server using private keys and algorithms. At this time, the encryption system of the present invention can complete the authentication of the front-end and the user terminal and establish a secure channel, and obtain the key and algorithm for encrypting the customized program from the private key library and algorithm library of the front-end server. After obtaining the key and algorithm, a specific user terminal completes the descrambling of the program and watches its own customized program content. Other users cannot obtain the service. However, due to the limitation of the existing architecture, the existing encryption system cannot flexibly load new algorithms and keys for specific services, and realize the non-real-time descrambling function of the program.

Fourth, API packaging

As an application example of the present invention, the API of the functions described in the present invention is encapsulated as follows:

1) Smart Card Driver API (CA Smart card Driver)

The smart card API implements the interaction between the application and the smart card. The API mainly includes:

ICC-CheckStatus (Card Num): Check the status of the smart card, such as presence or absence, version information, etc.

ICC-ReadBin (offset, Data, datalea): Read binary data from smart card ICC-WriteBin (offset, Data, Datalen): write binary data to the smart card ICC-ResetICCard (Card Num): reset the smart card

ICC-ExtemalAuthenticate (KeyIndwx, Key, Keylen): Realize security authentication with smart card

ICC-PINChange (oldPIN, NewPin, remain-Times): Modify the PIN code of the smart card

ICC-unlocldPIN (Key): Cancel PIN code verification function of smart card

2) CA descrambling API (CA Descrambler)

CA descrambling API to descramble TS streams

CADescrambler (TS_ID, ServiceID, MPEG_Packet, Scrambler Parameter):

Descramble specified TS data according to related parameters

3) ECM / EMM data processing API (CA ECM / EMM)

The ECM / EMM data processing API is responsible for obtaining ECM and EMM information from the TS stream according to related parameters. The API mainly includes:

CAGetECM (CA— System— ID, TS—ID, ServicelD, ECMData, Datalen):

Obtain ECM information based on CA system ID number and service description class

CAGetEMM (CA— System— ID, TS—ID, EMMData, Datalen):

Get EMM information based on conditional access system ID number and service description class

4) Conditional Access Test API (CA Tester)

Conditional access test API implements the testing of various functions of the conditional access system. The API mainly includes:

CAModuleTester (CA_ System— ID, CAModuleTestResult):

Certification and testing of CA modules of different CA vendors running on the platform

CAAlgorithmTester (CAAlgorithmTestResult):

Certification and testing of different CA descrambling algorithms running on the platform CASmartCardTester (CardNum, CASmartCardTestResult):

Authenticate and test the smart cards used in the system

5) CA Monitor

Conditional access monitoring API implements the status of conditional access functions running on the platform and records them in a logo file

CAMonitorlnitial (CAMonitorlnitialParameter): Initialize the CA monitoring module

C A Monitorclose (): Close the CA monitoring module

GetCAModuleLog (CamodulelogFile): Obtain the log file of each CA module test

GetCAAlgorithmLog (CAAlgorithmLogFile): Get the test file of the algorithm module

GetSmartCardLog (CASmartCardLogFile): Get the test file of the smart card

6) CA Management

The conditional access management API is responsible for the management of all modules in the conditional access system. The API mainly includes:

CAModuleInitial (CA_ System— ID, CAModuleParameter):

Initialize and run a CA vendor's conditional access module on the platform

CAModuleClose (CA_ System— ID, CAModuleParameter):

Stop the conditional access module of a CA vendor

CAAlgorit ir ^ ownload (CAAlgorithmPID, CAAlgorithmFlag, CAAl gorithmparameter): Download an algorithm from the TS stream

CAAlgorithmUpgrade (CAAlgorithmFlag, CAAlgorithmParameter, C AAlgorithmAdd): upgrade an algorithm on this platform

CASmartCardAppDownload (CASmartCardAppPID, CA_System_ID, CASmartCardAppParameter): Download a new application to the smart card CASmartCardAppUpgrade (CASmartCardAppPID, CA_System_ID ₅ C ASmartCardAppParameter): Upgrade the processing software in the smart card.

V. Replacement and upgrade of scrambling / descrambling algorithms

When the security algorithm of the system leaks or the user requests to replace the algorithm, the front-end system will update the algorithm in the scrambler through the algorithm management system in the conditional access server. At the same time, the conditional access server transmits the private data (PD-Private Data) containing the algorithm to the scrambler for scrambling, and multiplexes it into the composite transport stream through a multiplexer, and delivers it to all user terminals along the specified channel.

After receiving the new algorithm information, the user terminal demultiplexes and descrambles to obtain the contained private data (PD) information, and judges whether the transmitted data is the new algorithm according to the defined algorithm upgrade protocol. If it is determined that the transmitted algorithm is a new version, the software download API of conditional access management is called, the new algorithm is downloaded into the memory, and the original algorithm is overwritten.

Through the above method, the encryption system of the present invention can conveniently and quickly replace and upgrade the scrambling algorithm without having to replace the scrambling and descrambling chips. At the same time, the range of scrambling algorithms is also greatly expanded. Not only can existing algorithms be used, but also third-party self-design and development, which greatly improves the adaptability and confidentiality of the system.

Industrial applicability

After the implementation of the present invention, the performance of the existing encryption system will be improved, which is specifically embodied in the following aspects:

The invention provides a specific implementation scheme for realizing the replacement according to a certain rule or the user and the algorithm at any time, and improves the security of the system. This kind of security is different from that provided by hardware-specific chips. The security of hardware-only chips can only depend on the complexity of an algorithm. If the encryption strength of the algorithm cannot meet the requirements of new services, the security of the network will be affected . The invention can not only change the scrambling algorithm and key through the front-end conditional access server, but also can update the scrambling algorithm at a high speed through the download software of the user terminal, and the download speed can also be changed with the upgrade of the computing capacity of the processor The fault is improved, thereby further ensuring the security of the system. In addition, the encryption system implemented in the form of hardware cannot monitor the use status of the user terminal in real time. When a smart card is breached and illegal users enjoy network services, it is impossible to take measures in time to avoid losses. The encryption system of the present invention can monitor abnormal conditions of user terminals through modules such as conditional access test, conditional access status monitoring, and conditional access management. Once the illegal user information is detected, the current service is shut down to minimize losses.

The invention specifically realizes that different encryption methods can be adopted according to the different required encrypted content and the required complexity of encryption, and the problem of incompatibility of the system is solved. The software platform solution enables the encryption system to be compatible with other encryption systems that comply with the corresponding standards, as well as other conditional access (conditional access) systems that comply with the corresponding interface specifications, thereby making the cable television network an open system. .

The encryption system implemented in hardware requires a special scrambling / descrambling chip, which requires a certain cost, and the software platform encryption scheme separates the functions from the hardware chip, so the scrambling algorithm can run with other functional software, such as MPEG Decoding, network management software, etc. share the same processor, thereby achieving resource sharing, saving the cost of the descramble / descrambling chip, and reducing the cost of the system.

For an encryption system implemented in hardware, the encryption method must be attached to the scrambling chip, but the technology systems of various manufacturers are not completely compatible, resulting in a monopoly state of the encryption system. The software platform encryption solution can adapt to future business expansion and standards. Cable TV operators can choose different encryption solutions for different services, and different encryption solutions are compatible. They do not need to rely on a certain vendor at all. The business provided the conditions.

The invention can also realize the comprehensive management and monitoring of the encryption system, thereby satisfying the security requirements and being easy to manage.

Claims

Rights request

What is claimed is: 1. An encryption system comprising: a front-end system, a network system, and a user terminal. The front-end system includes a conditional access server and a multiplexer, and the user terminal system includes a code stream receiver and an output device.

The user terminal system includes a demultiplexer, a descrambler, and a decoder composed of a digital signal processor and a memory. The functions of demultiplexing, descrambling, and decoding are performed by the digital signal processor calling a corresponding program in the memory carry out.

2. The encryption system according to claim 1, wherein the user terminal system further comprises a smart card, and the function of the smart card is completed by the digital signal processor calling a corresponding program in a memory.

3. The encryption system according to claim 1, wherein the front-end system further comprises an application program interface for the front-end, and the application program interface is called by a conditional access server to implement basic functions and new additions of the conditional access server Functions.

4. The encryption system according to claim 1, wherein:

The front-end system includes an algorithm management server, and the scrambler implements updating and upgrading of the algorithm by calling a program in the algorithm management server.

5. The encryption system according to any one of claims 1 to 4, characterized in that the conditional access server in the front-end system further comprises a conditional access management module.

6. The encryption system according to claim 1 or 2, wherein the memory of the user terminal system stores an authentication and authorization application program interface.

□.

7. The encryption system according to claim 2, wherein the user A user-side application program interface is stored in the memory of the terminal system, and the system is upgraded by calling the application program interface.

8. The encryption system according to claim 7, wherein the client application program interface has a conditional access test module, a conditional access status monitoring module, and a conditional access management module.

9. The encryption system according to claim 7, wherein the user-side application program interface has an authorization management information processing module and an authorization control information processing module.

10. The encryption system according to claim 1, wherein the scrambler of the front-end system inserts user authorization control information in the composite transport stream by calling different encryption algorithms stored in the storage of the front-end system. In this manner, an algorithm and a key are specified for the subsequent code stream of the insertion point, and the data stream mixed by the multiplexer is scrambled with different encryption levels.

The encryption system according to claim 1 or 2, wherein the memory of the user terminal system further comprises an MPEG decoding module, and the MPEG decoding module completes decoding the descrambled data.

12. The encryption system according to claim 1 or 2, wherein the memory of the user terminal system further comprises a software download module, and a new algorithm generated by a front-end system conditional access server is called by calling a software download API, Download to the memory of the user terminal system.

13. The encryption system according to any one of claims 1 to 4, wherein the network system is a fiber-optic coaxial cable hybrid network network, a digital satellite broadcasting network, a microwave network, or an Ethernet network.