WO2009157800A1

WO2009157800A1 - System for protecting information in subscriber networks

Info

Publication number: WO2009157800A1
Application number: PCT/RU2008/000634
Authority: WO
Inventors: Юрий Михайлович БОЛОВИНЦЕВ; Татьяна Ивановна ЛОБОВА; Елена Евгеньевна ШУМАКОВИЧ
Priority date: 2008-06-25
Filing date: 2008-10-03
Publication date: 2009-12-30

Abstract

The invention relates to communications, in particular to data transmitting and processing DVB systems such as : DVB-S, DVB-C, DVB-T, MMDS etc, which invention is used for closing DVB channels and other information implemented according to the DVB standard and is designed in the form of a system for protecting information in subscriber networks. Said system involves forming a check word according to a law of random by using a set of switchable base keys, subsequently encoding the selected components of a traffic flow, forming a control code for each subscriber and transmitting said code together with the check word and a password code by a personalised control message. On subscriber's side, said system involves calling the subscriber's base key according to the accepted password, and recovering the uncoded components according to the check word received in the personalised control message.

Description

System for protecting information in subscriber networks

Description

The proposed technical solution relates to the field of communication, in particular to a DVB data transmission and processing system: DVB-S, DVB-C, DVB-T, MMDS, etc. and is intended for closing DVB channels and other information implemented according to the DVB standard.

(“DVB” (Digital Video Video Broadcast) - a family of European standards for digital television; option “DVB-S” (Digital Video Broadcast - satellite) - the first generation of the standard for satellite systems; “DVB-C” (Digital Video Broadcast - digital) option for a digital cable system; “DVB-T” (Digital Video Video Broadcast - Terrestrial) - standard for terrestrial broadcasting, MMDS (Multi Distributed Distribution System) - Multichannel Multipoint Distribution System).

A signal processing device is known from RF patent Ns 2253189, comprising a signal processing channel for processing a digital input signal including a first component of a scrambled signal and a second component of a scrambled signal. It also comprises means for coupling said input signal with a removable smart card assembly, the removable smart card assembly being configured to process the first component of the scrambled signal to obtain a first descrambled signal that is internal to said smart card assembly, the smart card assembly being reacting to the first descrambled signal is configured to process the second component of the scrambled signal for receiving the second descrambled signal and combining the first component of the scrambled signal of the input signal and the second descrambled signal to obtain the output signal, means for receiving the output signal from the node of the smart card and connected to the specified means

SUBSTITUTE SHEET (RULE 26) for receiving the output signal from the smart card node, means for processing the second descrambled signal and generating a signal adapted for display.

Also provided in this device is a delay means for the first component of the scrambled signal to obtain a delayed signal having a substantially predetermined synchronization ratio with respect to the second descrambled signal, and means for combining the delayed signal and the second descrambled signal to obtain an output signal.

The RF patent Ns 2253189 furthermore describes a signal processing method, according to which a digital input signal is received including a first component of a scrambled signal and a second component of a scrambled signal, characterized in that the input signal is connected to a removable smart card assembly for processing the first component of the scrambled signal and receiving the first descrambled signal, which is internal to the node of the smart card, and for processing when responding to vy descrambled signal to the second scrambled signal component for producing a second descrambled signal and for combining the first component of the scrambled input signal and a second descrambled signal to produce an output signal received from the smart card host output signal and processing the second signal is descrambled to form a signal adapted for display.

In this method, by combining the first component of the scrambled signal of the input signal with the second descrambled signal, a predetermined synchronization relationship is created between the first component of the scrambled signal and the second descrambled signal in the output signal.

This system has the following disadvantages:

SUBSTITUTE SHEET (RULE 26) - when implementing two stages of processing, it does not provide for the transfer of key codes instead of their absolute values, which makes it possible to intercept keys and subsequent unauthorized use of information;

- when applying control signals to the addresses of subscribers, it is possible to replace these signals, or generate new ones, which also leads to problems of unauthorized use of data;

- the structure of control signals is not optimized, which negatively affects the dynamic parameters of the known method for managing a subscriber network. At the same time, the transmission of control signals requires the allocation of additional bandwidth in the overall digital stream.

In the known method, attempts of unauthorized opening are reduced solely to overcoming the laws and codes of encryption keys and do not use additional logical conditions that detect these attempts by characteristic signs and stop the further functioning of the algorithms.

The task is to create an effective system for protecting information in subscriber networks using the appropriate Poccrypt-M system.

The essence of the technical solution lies in the information protection system in subscriber networks, which consists of:

- on the transmitting side of the block of separation of the components of the transport stream (2), the block of scrambling of the selected components and encryption of keys (3), the memory block of the group of secret keys (5), the control processor (6), the block for generating control codes (1) and the block for allocating redundant strip transport stream (TP) and the formation of the output stream (4);

- on the receiving side of the input stream demultiplexing unit (8), the output stream forming unit (7), the secret key memory unit

SUBSTITUTE SHEET (RULE 26) (9), a control code analyzer (10), a descrambling unit (11), and a security processor (12).

The system comprises a block for scrambling the selected components and encrypting keys, including an element for generating a control word according to a random law using a set of switchable base keys; , a control code generation unit for each subscriber together with a control word and a password code as part of a personalized control message, and on the subscriber side, a subscriber base key call block in accordance with the received password and recovery of encrypted components using a control word received as a part of a personalized control message .

A feature of the system lies in the fact that the control code generation unit (1) contains a means for dividing a registered control message into a number of control packages and for their end-to-end numbering and with the simultaneous generation of an electronic signature for each package.

In addition, the scrambling unit for the selected components and key encryption (3) includes basic irreversible encryption elements for implementing an electronic non-volatile key of increased complexity of disclosure. The system "Poccrypt-M" works as follows.

According to a random law, a control word is generated using a set of switchable basic keys, it encrypts selected components of the transport stream, a control code for each subscriber is generated, and it is transmitted along with the control word and password code as part of the name control message, and the subscriber base is called on the subscriber side the key in accordance with the accepted password and recover the encrypted components using a control word received as part of a personalized control message.

SUBSTITUTE SHEET (RULE 26) At the same time, the following actions are performed:

- a personalized control message is divided into a number of management packages with the implementation of their end-to-end numbering and with the simultaneous generation of an electronic signature for each package;

- use the structural redundancy of the multiplexed transport stream to transmit control packets without allocation (or partial allocation) of additional bands;

- on the transmitting and receiving side, elements of basic irreversible encryption are used to implement an electronic non-volatile key of increased complexity of disclosure;

- the correction of the values of the basic keys is carried out individually for various components of the same transport stream, or for various transport streams, while the absolute values of the offset codes, and their code expressions, are sent to the receiving side as part of the control packets, based on which, on the receiving side, in real scale time carry out the adjustment to the new resulting values of the base keys and offset keys;

- on the receiving side, the primary conversion of random control codes is carried out during the passage of any packets accompanying the transport stream and the subsequent encryption is used in real time with the issuance of restored components of the transport stream, regardless of their number;

- the necessary source packets accompanying the transport stream are analyzed and converted to solve the encryption problems of the components of this stream, and input into the same stream by replacing the original packets with the newly formed ones;

SUBSTITUTE SHEET (RULE 26) - use the “mask” method when implementing control operations;

- random processes are formed by arbitrary selection of codes directly from the content of the transport stream;

- the standard cycle of processes is analyzed first of all, on the receiving side, and, if deviations from the standard cycle are detected, external communications are disconnected.

The Poccrypt-M transmitting complex is entrusted with the main functions of the system:

- stream scrambling;

- allocation of excess bandwidth of the transport stream;

- formation of control codes;

- transfer of control codes and keys;

- interaction with the user database.

The structural diagram of the transmitting complex "Poccrypt-M" is presented in figure 1.

The input “open” transport stream goes to the TP component allocation block (2) where, in accordance with the identifiers specified by the operator, the components that need to be scrambled are filtered, from the output of block 2, the selected components are sent to the key scrambling and encryption block (3), where, using the keys stored in the memory block of the group of secret keys (5), they are scrambled.

The following components are used for scrambling in block 3:

- CW (Soptrol Wrd), which is installed in the control processor (6);

- secret key of increased capacity, which is “stitched” in the memory block of secret keys (5). This key is selected from the group of keys by number. The same group of keys is located in the secret key memory unit 9 (Fig. 2) on the subscriber side.

SUBSTITUTE SHEET (RULE 26) the network number specified in the control processor (6), according to which the scrambling algorithm for each network changes somewhat relative to the main one, which allows implementing the multi-network scrambling function and makes it possible to use one transmitting complex by various, unrelated telecom operators. Then, from block 3, the scrambled components go to the output stream former (4), where they are multiplexed by open TP packets from the output of the TP component extraction block (2) and control packets from the output of the control packet generation block (1). From block 4, the scrambled stream enters the output of the transmitting complex. On the receiving side, the input stream enters the input stream demultiplexing unit (8), where scrambled packets that need to be descrambled, as well as auxiliary information: CW key, key number, and control commands for this subscriber are extracted from the entire input stream. From the output of block 8, the scrambled packets are sent to the descrambling block (11), where they are descrambled.

The following components are used for descrambling in block 11 (DVB descrambler):

- CW (Soptrol Word), previously allocated in the demultiplexing unit of the input stream (8);

- a secret key of increased capacity, which is “stored” in the secret key memory block (9) This key is selected from the group of keys by the key number allocated from the input stream in block 8;

- enable / disable code generated in the control code analyzer (10) based on the control information received from the output of block 8;

- confirmation code generated in the block processor protection (12).

From the output of block 11, the descrambled packets arrive at the block for generating the output stream (7) (where they are multiplexed with the input stream. From the output of block 7, the restored stream is sent to the output of the receiving part of the system.

The advantage of the Poccrypt-M system is the use of the Russian standard of cryptographic protection. She provides

SUBSTITUTE SHEET (RULE 26) several levels of information protection, the impossibility of opening the values of the keys used.

In a number of optional options for performing network management functions and transmitting scrambling function support signals at the receiving side, it is not necessary to allocate additional DVB channel bandwidth when transmitting all control signals in the same transport stream as TV programs.

In the commercial use case, work is provided with an almost unlimited number of subscribers when organizing a subscription in real time. For example, with the number of subscribers up to 1 million, the subscription time does not exceed 20 seconds.

SUBSTITUTE SHEET (RULE 26) List of items

In FIG. 1 shows the implementation of the transmitting side:

1- control code generation unit

2- block component selection TP

3- block scrambling selected components and encryption keys

4 - block allocation of excess TP band and shaper output stream

5- block memory group of private keys

6- control processor

Figure 2 shows the implementation of the receiving side:

7- block output stream formation

8- input stream demultiplexing unit

9- secret key memory unit 10-analyzer of control codes 11-unit of decompression

12- protection processor

SUBSTITUTE SHEET (RULE 26)

Claims

Claim

1. The information security system in subscriber networks, consisting of:

- on the transmitting side of the block of separation of the components of the transport stream (2), the block of scrambling of the selected components and encryption of keys (3), the memory block of the group of secret keys (5), the control processor (6), the block for generating control codes (1) and the block for allocating redundant TP bands and output stream formation (4);

- on the receiving side of the input stream demultiplexing unit (8), the output stream forming unit (7), the secret key memory unit (9), the control code analyzer (10), the DVB descrambling unit, and the protection processor (12).

2. The system according to claim 1, characterized in that it contains a block for scrambling the selected components and encrypting keys (3), including an element for generating a control word according to a random law using a set of switchable base keys; an encryption unit for the selected components of the transport stream, a control code generation unit (1) for each subscriber together with a control word and a password code as part of the name control message, and on the subscriber side, a subscriber base key call block in accordance with the received password and recovery of the encrypted components using control word accepted as part of a registered control message.

3. The system according to claim 1, characterized in that the control code generation and transmission unit (1) comprises means for dividing the registered control message into a number of control packets and performing their end-to-end numbering and simultaneously generating an electronic signature for each packet.

4. The system according to claim 1, characterized in that the scrambling and encryption unit of the selected components of the transport stream includes

SUBSTITUTE SHEET (RULE 26) elements of basic irreversible encryption for the implementation of an electronic non-volatile key of increased complexity of disclosure.

SUBSTITUTE SHEET (RULE 26)