WO2007077387A1

WO2007077387A1 - Method of distributing televisual contents subject to subscription

Info

Publication number: WO2007077387A1
Application number: PCT/FR2006/051444
Authority: WO
Inventors: Laurent Butti; Franck Veysset; Pascal Chauvaud
Original assignee: France Telecom
Priority date: 2005-12-30
Filing date: 2006-12-29
Publication date: 2007-07-12
Also published as: FR2895865A1

Abstract

The invention relates to a method of distribution by a service provider (1) over a communication pathway, of at least one televisual content subject to subscription, to a reception device (4) of a subscriber to said service provider, said televisual content being chopped into time sequences each of which is enciphered with a respective control word (CW), the control words (CW) being calculated by the reception device of said subscriber authorised to access said televisual content on the basis of control messages (ECM) transmitted to said reception device on the same communication pathway as said enciphered televisual content, characterized in that a first control message (ECM) is sent by the service provider (1) in response to a request from the subscriber and to a positive authentication of said subscriber, and in that the control messages (ECM) are transmitted in a secure channel established on said communication pathway.

Description

Method of distributing television content subject to subscription

The invention lies in the field of pay-TV. It relates more specifically to the distribution by a service provider of at least one television content subject to subscription to the receiving device of a subscriber from said service provider.

The invention finds a particularly interesting application in securing a distribution of content subject to subscription or restricted access (the term commonly used is the term "Conditional Access Service" or CAS).

In particular, content distribution systems are used in the field of digital television with subscription to service packages. In a conventional system, the different channels are multiplexed into a digital data stream. The digital data stream corresponding to these bouquets, broadcast to user devices, is encrypted in order to control their use and define conditions for such use. The encryption is achieved through "control words" (the term commonly used is the term "Control Word" or CW), changed at regular intervals to deter any attack to find these control words. In order for the user devices to be able to decrypt the stream encrypted by the control words, they are sent intertwined with the audiovisual stream in "control messages" (the term commonly used is the term "Entitlement Control Message" or ECM). , themselves encrypted by an encryption / decryption key specific to the transmission system. These control messages are analyzed by a security module specific to the user device. The security module usually includes a smart card, deemed inviolable. When decrypting a control message (ECM), it is verified in the security module that the user has the rights to access the stream in question. Rights management is carried out by means of "management messages" (the term commonly used is the term "Entitlement Management Message" or EMM). Messages from management (EMM) are for example sent to a separate phone of the user device receiving the encrypted digital stream; other possibilities exist, such as the periodic sending of encryption / decryption keys by mail.

In a conventional manner, a conditional access system comprises several components:

- a "subscriber management system" (the term commonly used is the term "Subscriber Management System", or SMS) provides the management of subscribers, their subscriptions and requires a "subscriber authorization system" "(The commonly used term is the" Subscriber Authorization System ", or SAS) management message (EMM) that provides information about subscribers and the status of their subscriptions.

- The subscriber authorization system (SAS) translates, at the request of the subscriber management system (SMS), information on subscribers management messages (EMM). The subscriber authorization system (SAS) also verifies that a security module specific to the subscriber receives the necessary authorizations to view a content,

a broadcasting equipment generates the encrypted contents which are transmitted to the subscribers,

the security module extracts the management messages (EMM) and the control messages (ECM) necessary for the decryption of the encrypted received contents. The security module is embedded in a receiving device of the subscriber which allows the display of the contents in clear.

A weakness of such a system lies in the impossibility of verifying in real time the rights of users to view encrypted programs. As a result, we are witnessing the organization of networks of fraudsters distributing codes as well as the necessary software to generate the codes necessary for decrypting broadcast programs.

The advent of ADSL ("Asymmetric Digital Subscriber

"Asymmetric Digital Subscriber Line" and Broadband have enabled the opening of services adapted to new uses and accessible on user-friendly terminals such as PCs (for "Personal Computer" or personal computer) or new phones. The multiplication of Internet access, wired or wireless, offers new connection possibilities and new opportunities to access television content from any location offering high-speed Internet access, such as in a train, a waiting room (airport station), for example when traveling abroad. However, such mobility entails additional risks from a security point of view since if the access is multiplied for a legitimate subscriber, it is also for potential hackers capable of handling an operating system or computer applications so to obtain sensitive data. Therefore, if it is envisaged to distribute subscription-based television content via the Internet using as personal devices personal computers not controlled by an operator or a service provider, we must at the same time seek to secure this distribution and in particular prevent that hackers do not obtain encryption / decryption keys necessary to decrypt encrypted received television contents.

Transposing a traditional CAS model to the Internet is therefore not obvious in order to avoid the risk of fraud.

The document "Pay-TV System with Strong Privacy and Non-Repudiation Protection, Ronggong Song and Larry Korba, Member, IEEE Transactions on Consumer Electronics, May 2003", discloses a prepaid television system in which it is verified that a subscriber who access to n channels of a service has subscribed to this service and has paid well. This system is suitable for a one-time program request but does not specify an implementation in the case of a postpaid service, where security considerations are paramount to mitigate hacker attacks that consist in intercepting and rebroadcasting decryption keys. programs.

The object of the invention is to overcome the disadvantages presented above. To this end, the present invention relates to a method of distribution by a service provider, on a communication channel, of at least one television content subject to subscription, to a device for receiving a subscriber from said service provider. The said television content is divided into time sequences each of which is encrypted by a word of respective control (CW), the control words (CW) being calculated by the reception device of said subscriber authorized to access said television content from control messages (ECM) transmitted to said reception device on the same communication channel as said encrypted television content. The method is characterized in that a first control message (ECM) is sent by the service provider in response to a request from the subscriber and to a positive authentication of said subscriber, and in that the messages of control (ECM) are transmitted in a secure channel established on said communication channel. The authors of the present invention have in fact realized that one could take advantage of the securing of the links on a computer network to dispense with the periodic transmission of management messages (EMM), essential in the case where the control messages (ECM) are transmitted in "broadcast" (English word meaning broadcast), which significantly improves the security compared to conventional broadcasting by radio waves.

It should be noted that by seeking to set up a pay-TV service within a "unicast" computer network (the English word meaning that a message sent in this mode is sent to a single recipient) rather than on a single channel conventional broadcasting communication by radio waves, it could be envisaged to send to each subscriber only the specific television content to which this subscriber is entitled. The invention, on the contrary, broadcasts the same multiplex of content to all subscribers, which considerably simplifies the management of the system at the level of the service provider. This result is obtained while preserving the tolls, by providing each subscriber only control messages (ECM) corresponding to the access rights of this subscriber.

Thanks to the method of the invention, it reduces the management of subscriber access rights, simplifies the receiving device of the subscriber and improves the portability, which is advantageous, especially for a subscriber moving frequently.

In addition, the first control message is thus transmitted by the service provider to each request of the subscriber, unlike a classic model in which the control messages (ECM) are sent regularly. Thus, the subscriber can view a television content when he wishes according to the program of various television content to which he is entitled. According to even more particular provisions, the request is associated with the connection of said subscriber receiving device to the service provider on said communication channel of the television content.

Thus the subscriber can view the television content immediately after establishing the connection without additional operation on his part. Alternatively, the request is associated with a call from the subscriber on another communication channel than the television content.

For example, the request is made from a mobile phone; it is authenticated thanks to a GSM authentication. This embodiment is advantageous when a content previously broadcast in clear passes encrypted mode, which requires sending control messages (ECM), useless until the passage in encrypted mode.

According to particular provisions, the control messages (ECM) following said first message are sent by the service provider without requiring a new authentication of the user. In this embodiment, repeated authentication is avoided.

The risks of piracy are even lower as the control messages can be retransmitted at any time, at the initiative of the service provider, while the subscriber views the television content.

Alternatively, the control messages (ECM) following said first message are sent after at least one reauthentication of the user.

The receiving device sends, in known manner, an authentication token periodically. This procedure avoids the spoofing of the line by an attacker, especially in the case of wireless connections. According to particular provisions, the service provider sends the encrypted control messages (ECM) by means of a chosen session key after authentication of the subscriber with said service provider. Thus, the security of the transmission of control messages vis-à-vis a hacker listening to this transmission is conveniently obtained.

According to particular provisions, said encrypted control messages (ECM) are received by a security module of the reception device which supplies said control words (CW) after decryption of said control messages (ECM) by means of said session key to a unit for decrypting contents.

The encrypted control messages which make it possible to calculate the control words are processed in a security module deemed inviolable. The risks of seeing a hacker recover this information are therefore a priori null. This greatly reduces the risk of fraud especially as the control messages are sent to each new connection, or at any time, at the initiative of the service provider.

According to particular provisions, the method comprises a step during which said security module provides the content decryption unit with signed data identifying the subscriber.

The retransmission by a malicious subscriber of control words provided by the security module is traceable since by transmitting, instead of the expected control word, a signed data that includes the identity of the subscriber, the malicious subscriber gives the service provider a way to identify it.

The invention also relates to a service provider system for the distribution of at least one subscription-subscribed television content to a subscriber, comprising: a content server comprising means for distributing at least one television content subject to subscription, said television content being divided into time sequences each of which is encrypted by a control word (CW), and means for calculating said control words (CW),

- An authentication server comprising means for sending, interleaved on the same communication channel as the content, control messages (ECM) for use in calculating said control words (CW). The service provider system is characterized in that said authentication server further comprises means for authenticating said subscriber, said control messages (ECM) being sent to said subscriber only after verifying the access rights of said subscriber. The invention also relates to a subscriber receiving device of at least one television content subject to subscription, distributed by a service provider, said television content being divided into time sequences each of which is encrypted by a control word (CW) respective control words being calculated from control messages (ECM), said receiving device comprising:

means for decrypting said content,

security means for supplying said control words (CW) to said decryption means,

means of sending, for sending, on the one hand, the television content encrypted to said decryption means, and on the other hand the control messages (ECM) to said security means.

The device is characterized in that it furthermore possesses:

connection means, for connecting to an authentication server of said service provider, authentication means for authenticating the subscriber to said server, and

receiving means for receiving from said server the encrypted television content and the control messages (ECM).

The invention also relates to a security module for use in decrypting subscribed television content distributed by a service provider, said television content being divided into time sequences each of which is encrypted by a respective control word (CW). , the control words being calculated from control messages (ECM), characterized in that it comprises: a security unit intended to supply said control words (CW),

authentication means for authenticating the subscriber with said service provider, and key negotiation and decryption means, for adopting a session key after positive authentication of said subscriber, and for decrypting the encrypted control messages (ECM) using said session key received from said service provider.

Many details and advantages of the invention will be better understood on reading the description of a particular embodiment with reference to the accompanying drawings given in a non-limiting manner and in which:

Figure 1 illustrates the format of a control message (ECM) sent to a security module of a receiving device after the identification and positive authentication of a subscriber.

FIG. 2 shows an exemplary embodiment of a television content distribution method according to the invention.

FIG. 3 shows an alternative embodiment of the television content distribution method illustrated in FIG. 2.

FIG. 4 is a schematic representation of a communication system implementing the method according to the invention.

Figure 5 is a schematic representation of a service provider system according to the invention. Figure 6 is a schematic representation of a receiving device according to the invention.

A video stream is associated with a multiplex of television contents that a content server makes available to subscribers on a computer network, via a communication channel that uses for example the standard protocols of the Internet; it corresponds in practice to several channels. The video stream is divided into time sequences of identical duration. Time sequences are identified by a sequence number. For example, the sequence number is incremented by 1 between two successive time sequences. In a given time sequence, television content is encrypted / decrypted by a control word (the commonly used term is English term "Control Word", or CW) own content and the sequence of time identified by its sequence number.

Television content transmitted in the video stream includes frames and stubborn messages. A stubborn message is transmitted in clear regularly with the frames. The stubborn message identifies the contents and number of the time sequence to which the frames following the stubborn message correspond. The header contains other information such as for example and non-exhaustively an identifier of the video compression algorithm used. A random is a random number, over a minimum length of 64 bits. It is used to calculate a sequence of control words (CW) from an initial control message (ECM). The sequence of control words is used to decipher successive time sequences.

FIG. 1 shows the format of a control message (ECM) sent according to the method according to the invention after an identification and a positive authentication of a subscriber, and a verification of the subscriber's access rights to contents. television. A first field d comprises an Nsequence sequence number which identifies for a current video stream the current time sequence. The field d is incremented for example by 1 from one time sequence to the next.

A second field c2 comprises a hazard Alea used to calculate decryption control words (CW). A third field c3 comprises initialization keys Ki (i = 1, .., n), which are initial values for calculating the control words, where n is the number of television contents to which the subscriber is entitled to access . An initialization key is associated with each of the television contents to which the subscriber is entitled to access. A fourth field c4 comprises a cryptographic function F1 used to calculate a sequence of control words. Values that the c4 field can take are determined by cryptographic algorithms: for example and non-exhaustively, AES (for "Advanced Encryption Standard"), DES (for "Data Encryption Standard"), which are well-known key calculation cryptographic algorithms.

The successive control words CW ₁ , Nsequence (i = 1,..., N, Nsequence = 1,..., M) for decrypting the content i during the Nsequence time sequence are calculated, for example and non-exhaustively, from the following way:

CW i, Nsequence = F1 (CW ,, Nsequence-1, Al ^β a), with Nsequence> 1 and CW, _{j 0} = Ki.

The significant length of the Haze Aléa, fixed at least 64 bits makes impossible an exhaustive computation of the control words for a pirate who would like to see in clear a content which he would recover encrypted and for which he would not have subscribed of subscription to the service provider, and for which therefore, he would have no legal means of decrypting the encrypted content. A fifth c5 field includes Seq security settings

(j = 1, .., p) which identify sequence numbers for which a subscriber's own security module will implement exceptional security procedures as shown in FIG.

A sixth field c6 comprises security functions F2 _j (j = 1, .., p) to be applied to implement the exceptional security procedures. The security functions F2 _j define a particular behavior of the security module during the decryption of the time sequence identified by the number Seq; this behavior is different from the usual behavior of providing the decryption control word. The exceptional security procedures according to the invention make it possible to identify a malicious subscriber who would rebroadcast, for example over the Internet, a succession of control words used to view in clear encrypted sent television contents. Each function F2 _j is a public key signature function, in the case where a public key architecture is deployed, for example and non-exhaustively an RSA signature function (for "River Shamir and Adleman"), which is a well-known signature function. If a secret key security architecture has been deployed, each function F2 _j is for example and non-exhaustively a cryptographic function of MAC (for "Message Authentication Code"), also well known.

The fields c5 and c6 are optional and are informed at the initiative of the service provider to implement punctually exceptional security procedures as illustrated by the method according to the invention described in Figure 2. By filling in the fields c5 and c6 , the service provider is able to trace and find the identity of malicious subscribers who broadcast control words necessary for the decryption of television content to which they are subscribed, for the attention of users who are not subscribed to said content.

FIG. 2 illustrates the steps of the television content distribution method according to an exemplary embodiment of the invention. A service provider 1 is in charge of the distribution on a computer network, via a communication channel that uses for example the standard Internet protocols, encrypted television content subject to subscription. The service provider 1 in FIG. 2 comprises an authentication server 2 in charge of subscriber authentication and verification of their rights of access to said contents, and a content server 3 in charge of content management. television. The authentication server 2 thus performs the functions of the conventional subscriber management system (SMS) and in part those of the conventional subscriber authorization system (SAS). The content server 3 provides functions comparable to the conventional broadcast system.

A reception device 4, associated with a subscriber not shown, is adapted to ask the service provider 1 to receive at least one television content for which the subscriber has subscribed, to display in clear the content on a screen (no represent). The reception device 4 comprises a terminal 5 adapted to communicate with the service provider 1 and the subscriber, and a security module 6, removably connected to said terminal 5 and adapted to store identification and authentication data. subscriber, receiving encrypted control messages (ECM) and calculating control words (CW) that it provides to the terminal 5, for decrypt the content received by the terminal 5 and display the content in clear. The security module 6 ensures in collaboration with the authentication server 2 of the service provider 1 a robust management of the access rights of the subscriber to said content. Once the security module 6 disconnected from the terminal 5, access to the content in clear becomes impossible.

In a particular embodiment of the invention, not shown, the security module 6 when connected to the terminal 5 authenticates the subscriber for his access to the security module 6. The authentication of the subscriber for access to the module For example, the security code 6 consists, in a non-exhaustive manner, in asking the subscriber to enter a subscriber's own authentication code for his access to the security module 6 (the term commonly used is the term "PIN" for "Personal Identification Number").

The security module 6 is for example and non-exhaustively a secure digital portable device (the term commonly used is the English term "dongle") which is connected to a USB port (the English "Universal Serial Bus") of the terminal 5. The dongle has the advantage of being portable and can be used on any terminal with a USB port. It constitutes a "safe" deemed inviolable and therefore offers a high level of security for the data it contains. In an alternative embodiment of the invention, the security module 6 is a smart card accessible from a terminal equipped with a suitable reader.

In an initial step 10, the subscriber connects, via the reception device 4, to the service provider 1 and sends, associated with said connection, a request from said service provider 1 which specifies for example that he wants to view the content he subscribes to. Another example of a request is a request for access to certain content to which it is subscribed, for example a content corresponding to a sporadic sporting event. The message exchanges that take place during the initial step 10 are not detailed. The subscriber's connection is effective only after identification and positive authentication of the subscriber by the service provider 1. The identification and authentication of the subscriber are carried out by the server authentication system 2 of the service provider 1. The identification consists in sending an identifier of the subscriber, for example and non-exhaustively, a subscriber number, stored in a non-represented memory of the security module 6. The identification and authentication can, in a known manner, be carried out at the same time. Authentication uses a pre-existing security infrastructure. In the case of Figure 1, a public key infrastructure, well known to those skilled in the art, is already deployed and uses the security module 6 as a support for a private key specific to the subscriber, associated with a key known public service provider 1. The private key / public key pair is used to authenticate the subscriber. For this, messages are exchanged between the service provider 1 and the receiving device 2. This exchange of messages is known in the context of an authentication based on a public key infrastructure and is not detailed. Alternatively, a conventional secret key infrastructure is already deployed and uses the security module 6 as a support for a secret key shared by the subscriber and the service provider 1. The secret key is used to authenticate the subscriber. Similarly, the exchange of messages, as part of an authentication based on a secret key infrastructure, is known and is not detailed here.

The security infrastructure allows, in known manner, the subscriber and the service provider 1 to communicate securely, on the same communication channel as that used for the distribution of television content, once the authentication of the Successful subscriber. The security of the communication is achieved by encrypting and authenticating all the messages exchanged between the authentication server 2 of the service provider 1 and the terminal 5, to an interface of the terminal 5, not shown, on which the module is connected. 6. For this, a session key is chosen in order to encrypt all the exchanged messages. Thus, a secure channel is created end-to-end between the authentication server 2 and the security module 6. As part of the public key infrastructure, the exchanged messages are encrypted using a security key. session that the service provider 1 and the Receiving device 4 adopted during a key negotiation phase (not shown).

In the alternative embodiment of the invention where a secret key infrastructure is deployed, this secret key is adopted as a session key, or is used to derive the session key.

In another variant embodiment, the request that specifies the television contents that the subscriber wishes to view is not associated with the connection and is subsequently sent by the subscriber.

In a step 11, subsequent to the identification and the positive authentication of the subscriber carried out at step 10 and at the reception of the subscriber's request, the authentication server 2 of the service provider 1 verifies the subscriber access rights to television content. The verification of the access rights consists in verifying that the subscriber is subscribed to a service offered by the service provider 1 and in registering the content to which he subscribes or, if the request sent in step 10 specifies the contents that the subscriber wishes to view, to verify that said subscriber is entitled to said content. At the end of step 11, the authentication server 2 of the service provider 1 sends to the reception device 4, more precisely to the security module 6, a first ECM control message associated with the contents that the subscriber has requested and to which he is subscribed. The sending of the first ECM control message is done in the secure channel established during the initial step 10 after the positive authentication of the subscriber. The format of the ECM control message is in accordance with the format described in connection with FIG.

In an alternative embodiment of the invention, the request that specifies the television contents that the subscriber wishes to view is not associated with the connection established as described in step 10, and is subsequently sent by the subscriber, after establishing the connection. The sending of the request is done for example and non-exhaustively from the receiving device 4 on the same communication channel that used to establish the connection or send the encrypted contents. The sending of the request of the subscriber can be done on another channel of communication than that used to send the encrypted contents, for example using a mobile phone. GSM authentication of the subscriber is performed. The sending of the request triggers the passage to step 1 1 of verification of access rights and the sending of the first ECM control message. Advantageously, this embodiment of the invention will be used when a content previously broadcast in the clear and therefore does not require the sending of a control message, will go into encrypted mode. The subscriber who wants to view the content in encrypted mode, will trigger with the sending of the request, the verification of access rights and the sending of the first ECM control message, unnecessary until the passage in encrypted mode.

In another embodiment of the invention (not shown), control messages that follow the first ECM control message are sent by the service provider regularly to the subscriber without requiring a new authentication of said subscriber. The retransmission of the control messages that follow the first ECM control message makes it possible to reset the initialization keys sent in these control messages and therefore the calculation of the control words used for the decryption of the encrypted content. Regular sending of control messages that follow the first control message (ECM) increases the level of security from the service provider's point of view that resets the data needed to decrypt the content. In an alternative embodiment of the invention (not shown), the control messages that follow the first ECM control message are issued by the service provider after re-authentication of the subscriber. The reauthentication is done in a known manner by the periodic sending of an authentication token by the subscriber to the service provider 1. This authentication mode is a strong authentication that avoids password replay, since the password is different for each token. This authentication mode is particularly recommended in the case of a "wireless" access, for example of the "WiFi" type (of "Wireless Fidelity"), to limit the risk of spoofing by a hacker. line of the subscriber. In a step 12, following the reception of the first ECM control message, the security module 6 of the reception device 4 receives and stores in an unrepresented memory the said ECM control message which includes at least one sequence number, as many initialization keys as content to which the subscriber is subscribed, a random, and optionally, security parameters and associated security functions, according to the format of a control message ECM presented figure 1. The security module 6 calculates first control words (CW) for all the contents for which it has received initialization keys, for the time sequence associated with the sequence number contained in the control message (ECM). The calculation of the control words is continuous and is in accordance with the formula presented above, in relation to the format of the control messages shown in FIG. 1, a current control word being used to calculate a next control word. When calculating subsequent control words associated with a subsequent time sequence, the security module 3 stores the following control words in the place where the first control words were stored. It also stores the next sequence number where the first sequence number was stored. The service provider 1 performs the same calculation of the control words. Thus, at the same time the service provider 1 has the same control words as the security module 3. The service provider 1 uses them to encrypt the stream and the receiving device 4 to decrypt the encrypted stream. In a step 13, the terminal 5 of the receiving device 4 accesses the content server 3 of the service provider 1 and sends a message if in order to access the video stream which contains the television contents to which the subscriber is entitled to access . Access is for example and non-exhaustive via an access to a web server. Advantageously, step 13 takes place after step 12 so that the security module 6 has the necessary data for decrypting the contents of the video stream.

In a step 14, following the receipt of the message if the content server 3 gives access to the video stream to the terminal 5, which is illustrated by the sending of the video stream s2 which includes the contents to which the user is subscribed.

In a step 15, subsequent to the reception of the video stream s2, the terminal 5 of the reception device 4 requests the security module 6, in a message s3, the control word for decrypting, for the current time sequence of the video stream s2, the content that the subscriber wishes to view in clear. For this, the message s3 comprises as parameters the sequence number associated with the current time sequence and a content number chosen by the subscriber.

In a step 16, subsequent to the receipt of the message s3, the security module 6 selects the control word associated with the chosen content number and the time sequence identified by the sequence number. He has this information that he started to calculate and memorize in step 12. At the end of step 16, the security module 6 sends the terminal 5 the control word in a message CW.

In a step 17, subsequent to the reception of the message CW, the terminal 5 decrypts with the control word received in the message CW the encrypted content of the content chosen for the current time sequence and displays it on the screen of the terminal.

FIG. 3 illustrates a variant of the content distribution method presented in FIG. 2. In this variant, the method according to the invention comprises steps specific to exceptional safety procedures. The purpose of the security procedures is to identify malicious subscribers who distribute on the network the control words obtained from the security module 6.

Steps 10, 11, 12, 13, 14 and 15 of FIG. 3 are identical respectively to steps 10, 11, 12, 13, 14 and 15 of FIG. The messages si, s2, s3 are identical to the messages si, s2, s3 of FIG.

The control message ECM ', sent at the end of step 1 1 of verification rights includes in the fields c4 and c5, respectively security parameters and security functions that identify sequence numbers for which exceptional treatment is requested . In a step 18, subsequent to the reception of the message s3 and which differs from the step 16 of FIG. 2, since the sequence number sent to the security module corresponds to the sequence number present in the field optional c5 of the control message ECM ', the security module 6 adopts a different behavior as specified in the field c6 of the message ECM'. It applies the signature function specified in the field c6 of the message ECM 'to a parameter constituted by the identifier of the subscriber and the random Alea received in the message ECM'. The hazard is used in combination with the subscriber identifier to vary the value obtained by applying the signature function. At the end of step 18, the security module 6 sends to the terminal 5 in a message s4 the identifier of the subscriber and the random Aléa signed which constitute data that identifies the subscriber. In the case of a public key infrastructure, the key used to sign the parameter is the private key associated with the subscriber. In the case where a private key infrastructure has been deployed, it is the secret key that is used to generate the MAC code.

In a step 19, subsequent to the reception of the message s4, the terminal 5 can not decipher the current temporal sequence of the content it has received encrypted using the message s4 since the message s4 is not a control word decryption. The content remains encrypted during the duration of the time sequence. If the subscriber is a malicious subscriber who redistributes the control words in real time as he obtains them from the security module 6, for example on the Internet, so that non-subscribed users view in clear content, this malicious subscriber will redistribute, in step 19, the message s4 which is a signed data identifier since said data includes its identifier. The service provider that retrieves this data from the Internet could, through known means of signature verification, identify the malicious subscriber. The security procedure is implemented by the service provider 1 randomly, so that it is impossible for a malicious subscriber to escape. The security procedure is implemented punctually, so that the impossibility of decrypting the content during the duration of the time sequence does not unduly disturb the subscriber.

FIG. 4 represents a communication system that implements the method according to the invention. A service provider 1 has a technical architecture that includes an authentication server 2 and content servers 3. Reception devices 4 consisting of terminals 5 to which are connected via the USB port of said terminals 5, security modules 6 are connected, via broadband links 7, for example ADSL or WiFi type, to a network 9 of the Internet type. The reception devices 4 have access to the service provider 1, whether for access to the contents or for the authentication, via the network 9, by a communication channel that uses the Internet protocol.

A secure channel 8 is built after the identification and the positive authentication of the subscriber 50 with the service provider 1. The secure channel 8 is advantageously used to securely transmit at least one encrypted ECM control message by means of a key adopted by the service provider 1 and the reception device 4, and which depends on the security infrastructure set up. . This control message contains information necessary for calculating the CW control words necessary for the decryption of the video stream received from a content server 3.

With reference to FIG. 5, a functional architecture of a content distribution service provider system according to the invention is presented. The service provider 1 comprises an authentication server 2 and at least one content server 3.

Content server 3 which is in charge of content management comprises the following functional modules:

a distribution module 20, for distributing at least one television content subject to subscription, the content being divided into time sequences each of which is encrypted by a control word (CW),

a control word calculation module 21, for calculating the control words (CW) according to the formula presented above, in relation with FIG. 1.

The authentication server 2 which is in charge of managing subscribers is composed of the following functional modules:

a module for sending control messages 24, for sending, intertwined with the television content and on the same communication channel that the television content, control messages (ECM) intended to be used by the receiving device of the subscriber to calculate the control words (CW) necessary to view in clear the content,

an authentication module 25 for authenticating the subscriber and for sending the control messages to the reception device after a positive authentication of the subscriber and a verification of the access rights of the subscriber to the requested content,

a module for adopting a session key 26, for choosing, in agreement with the reception device, a session key, shared by the reception device to establish a secure channel with the reception device,

a module for sending control messages 27, for sending the control messages to the receiving device encrypted using the session key.

The authentication server 2 also comprises an internal communication bus 28 which enables the functional modules to communicate with each other through unrepresented internal interfaces and to communicate via a second external interface 29 with, for example, the content server 3.

The content server 3 also comprises an internal communication bus 22 which enables the functional modules to communicate with each other through unrepresented internal interfaces and to communicate via a first external interface 23 with, for example and without limitation, the data server. authentication 2.

The service provider 1 includes an internal communication bus 30 which allows the servers of which it is composed to communicate. An external interface 31 further enables the service provider to communicate with external entities, for example with subscriber receiving devices.

FIG. 6 is a schematic representation of the functional architecture of a receiver device 4 of a subscriber according to the invention.

The receiving device 4 comprises a terminal 5 and a security module 6. The terminal 5 comprises the following functional modules:

a decryption unit 40 capable of decrypting an encrypted received television content. The television content is divided into time sequences, each being encrypted by a respective control word (CW), the control words being calculated from encrypted received control messages (ECM),

a connection module 43 intended to connect to the authentication server of the service provider,

a reception module intended to receive, on the one hand, the television content encrypted with the help of the control words (CW) on the part of the content server of the service provider, and on the other hand, the messages of control (ECM) encrypted using the session key, the authentication server of the service provider,

a sending module 42 for sending, on the one hand, the encrypted television content to the decryption unit 40, and on the other hand the control messages (ECM) to a security unit 41 of the security module (6). ).

The security module 6 comprises the following functional modules:

a security unit 41 intended to receive the encrypted control messages (ECM) and to supply the control words (CW) to the decryption unit 40; an authentication module 44 intended to authenticate the subscriber to the authentication server of the service provider using subscriber-specific authentication and authentication data,

a key negotiation and decryption module 46, for adopting a session key and decrypting the encrypted control messages (ECM) using the session key received from the service provider.

The receiving device 4 further comprises an internal communication bus 47 which allows the modules that compose it to communicate with each other through interfaces (not shown). For example, the communication bus is used to transmit the encrypted control messages (ECM) from the sending module 42 of the terminal 5 to the security unit 41 of the security module 6. The receiving device also includes an interface external 48, which allows to communicate with, for example and non-exhaustively, the service provider.

Claims

1. A method of distribution by a service provider (1) on a communication channel, of at least one television content subject to subscription, to a reception device (4) of a subscriber to said service provider, said content television being cut into time sequences each of which is encrypted by a respective control word (CW), the control words (CW) being calculated by the reception device of said subscriber authorized to access said television content from control messages (ECM ) transmitted to said receiving device on the same communication channel as said encrypted television content, characterized in that a first control message (ECM) is sent by the service provider (1) in response to a request from the subscriber and a positive authentication of said subscriber, and in that the control messages (ECM) are transmitted in a secure channel established on said communication channel.

2. The method of distribution of claim 1, characterized in that the request is associated with the connection of said subscriber receiving device with the service provider on said communication channel of the television content.

3. Method according to claim 1, characterized in that the request is associated with a call from the subscriber on another channel of communication than that of television content.

4. A method of distribution according to any one of claims 1 to 3, characterized in that the control messages (ECM) following said first message are sent by the service provider (1) without requiring a new authentication of the user.

5. Dispensing method according to any one of claims 1 to 3, characterized in that the control messages (ECM) which follow said first message are sent after at least one reauthentication of the user.

6. Method according to one of the preceding claims, characterized in that the service provider (1) sends the encrypted control messages (ECM) by means of a session key chosen after authentication of the subscriber from said provider of service.

7. Method according to claim 6, characterized in that said encrypted control messages (ECM) are received by a security module (6) of the reception device (4) which supplies said control words (CW) after decryption of said messages. control (ECM) using said session key to a content decryption unit.

8. Method according to claim 7, characterized in that it comprises a step during which said security module (6) provides the content decryption unit a signed data identifying the subscriber.

9. Dispensing method according to one of the preceding claims, characterized in that said communication channel uses the standard protocols of the Internet.

A service provider system (1) for distributing at least one subscribed television content to a subscriber, comprising: - a content server (3) including means (20) for distributing at least one television content subscribed, said television content being divided into time sequences each of which is encrypted by a control word (CW), and means (21) for calculating said control words (CW), - an authentication server (2) comprising means (24) for sending, interleaved on the same communication channel as the content, control messages (ECM) intended to be used for calculating said control words (CW), characterized in that said authentication server (2) further comprises means (25) for authenticating said subscriber to said content, said messages of control (ECM) not being sent to said subscriber until verification of the access rights of said subscriber.

1 1. System according to claim 10, characterized in that it comprises means (26) for adopting a session key if said authentication is positive, and means (27) for sending said encrypted control messages (ECM) using of said session key.

Subscriber receiving device (4) of at least one television content subject to subscription, distributed by a service provider (1), said television content being divided into time sequences each of which is encrypted by a control word ( CW), the control words being calculated from control messages (ECM), said reception device comprising:

means for decrypting (40) said content,

security means (41) for supplying said control words (CW) to said decryption means (40),

sending means (42), for sending, on the one hand, the encrypted television content to said decryption means (40), and on the other hand the control messages (ECM) to said security means (41), said receiving device is characterized in that it furthermore possesses: connection means (43), for connecting to an authentication server of said service provider,

authentication means (44) for authenticating the subscriber to said server, and

reception means (45) for receiving from said server the encrypted television content and the control messages (ECM).

13. Receiving device according to claim 12, characterized in that it further comprises means (46) for key negotiation and decryption, for adopting a session key, and for decrypting the encrypted control messages (ECM). using said session key received from the service provider.

14. Receiving device according to claim 12, combined with claim 13, characterized in that it comprises:

a security module (6) comprising said security unit (41), said authentication means (44), and said key negotiation and decryption means (46), and

a terminal comprising said decryption unit, said sending means, said connection means, and said reception means, adapted to be removably connected to said terminal (5).

Security module (6) for use in decrypting subscribed television content distributed by a service provider, said television content being divided into time sequences, each of which is encrypted by a respective control word (CW), the control words being calculated from control messages (ECM), characterized in that it comprises:

a security unit (41) intended to supply said control words (CW),

authentication means (44) for authenticating the subscriber with said service provider, and

key negotiation and decryption means (46) for adopting a session key after positive authentication of said subscriber, and for decrypting the encrypted control messages (ECM) using said session key received from said service provider; service.