CN102917252A - IPTV (internet protocol television) program stream content protection system and method - Google Patents
IPTV (internet protocol television) program stream content protection system and method Download PDFInfo
- Publication number
- CN102917252A CN102917252A CN2011102199285A CN201110219928A CN102917252A CN 102917252 A CN102917252 A CN 102917252A CN 2011102199285 A CN2011102199285 A CN 2011102199285A CN 201110219928 A CN201110219928 A CN 201110219928A CN 102917252 A CN102917252 A CN 102917252A
- Authority
- CN
- China
- Prior art keywords
- key
- cek
- service end
- user
- program
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Abstract
The invention provides IPTV (internet protocol television) program stream content protection system and method. Based on the requirement for protecting a video-audio stream by an IPTV program stream in IP (internet protocol) network transmission, a four-level key system of TIK (terminal identity key), PK (personal key)/DK (domain key), SK (service key) and CW (control word) is used for a real-time program stream, a three-level key system of the TIK, the PK/DK and CEK (content encryption key) is used for a non-real-time program stream, the problem of application safety is solved by authorization and management control of IPTV real-time stream four-level key and non-real-time-stream three-level key, an identity authentication mechanism is introduced, and accordingly transmission safety of the IPTV program stream is increased, and an IPTV system is flexible, reliable, and easy to popularize and implement.
Description
Technical field
The present invention relates to the IPTV field, in particular to a kind of IPTV program stream content protective system and method.
Background technology
IPTV (Internet Protocol Television) is the digital audio/video service that utilizes IP network to provide, it utilizes broadband networks, adopts stream media technology, the multiple interactive digital media services that comprise in digital television broadcasting, interactive VOD and lower being loaded in are provided, have the functions such as traditional live telecast, video request program, download and time shift, telecommunications network, Broadcasting Cable Network and the Internet three network technologies have been merged, being an important directions of digital audio/video industry development, is the key that realizes the integration of three networks.Compare with Digital Television, the advantage of IPTV is that it has utilized Internet resources fully, (for example realized real interaction, program request and time-shifting function) and the personalized service of client, and the various network services combinations such as IPTV can also easily browse television services and Internet, E-mail receiver/send, in the competition in future, have the advantage.
The IPTV technology is system's integrated technology, and its major technique comprises: network technology, audio/video encoding/decoding technology, content protecting technology, IP set-top box and EPG technology and the technology such as user management and service management.The class of business that IPTV can provide comprises: the TV class is professional, communication class is professional and various value-added service.TV class business is the core business of IPTV, comprises the download of live telecast, video on demand and audio/video program etc.
Equally there is the demand of copyright and content protecting aspect in IPTV with other digital television business, need to provide safety guarantee for content provider, program network operator and validated user by security means.Being used for IPTV security of system technology mechanism compares with condition reception (CA) technology mechanism under the DVB digital broadcasting mode larger difference is arranged.Because the two-way environment of IP network need to adopt bidirectional authentication mechanism and content mandate to realize the copyright protection of digital content, and the safe mode that adopts will adapt to multiple business and the application mode of IPTV.
Summary of the invention
The invention provides a kind of IPTV program stream content protective system and method, in order to improve the fail safe of IPTV program stream transmission.
For achieving the above object; the invention provides a kind of IPTV program stream content protective system; this system comprises the first key management and entitlement management module and the content scrambling module that is positioned at service end, and the second key management and entitlement management module and the content descrambling module that are positioned at terminal, wherein
The first key management and entitlement management module comprise symmetric key administrative unit, unsymmetrical key administrative unit and empowerment management unit:
The symmetric key administrative unit for generation of, storage, upgrade, provide PK/DK, SK, CEK, CW key;
The unsymmetrical key administrative unit is for generation of ECC public private key pair and the relevant parameter of, distribution, renewal or issuing service end and user terminal, sets up and upgrades the black entry record of ECC, the audit of user profile record;
The empowerment management unit is for generation of authorization messages, realize that the user authenticates and the authority of a user information management, license and rights of using that the authority of a user that provides according to Subscriber Management System is authorized program provide the rights management of live, program request or downloading service, comprise that user right information produces and safeguards;
The content scrambling module comprises real-time scrambling unit and pre-scrambling unit:
The real-time scrambling unit is used for realizing scrambling and the security control to programme televised live and program request/program downloading under the effect of cryptographic algorithm and ciphering key W, and according to specified format encapsulation code stream;
Pre-scrambling unit is used under cryptographic algorithm, ciphering key EK effect realization to the pre-scrambling of request program and download file content, and deposits the content after the scrambling in program server;
The second key management and entitlement management module comprise cipher key management unit, authorization terminal administrative unit:
Cipher key management unit is used for store and management user terminal ECC key, symmetric key and relevant parameter;
The authorization terminal administrative unit is used for according to the RMM that receives and the deciphering of ECM completing user each layer key and authority information, extract user's rating condition, according to the authorization messages that receives, preservation, renewal, maintenance customer's authority information, transmission according to key between the authority information control key reception that receives, key use and the controller card, realize the signature/verification computing of interaction data, finish interactive information generation and encryption that terminal is submitted to service end;
The content descrambling module is used under the control of authorization terminal administrative unit, adopts the method corresponding with service end to finish descrambling to live, program request and media content download.
For achieving the above object, the present invention also provides a kind of IPTV program stream content protecting method, and the method may further comprise the steps:
Service end system adopts symmetric cryptographic algorithm SM1, asymmetric cryptographic algorithm SM2 and Haas algorithm SM3, wherein represents symmetric cryptographic algorithm SM1 with symbol E, and symbol PE represents asymmetric cryptographic algorithm SM2, and symbol H represents Haas algorithm SM3;
Service end system produces ECC key pair, determines self sign SID and elliptic curve parameter and basic point P thereof, and produce service end system based on the key of ECC to SIK
PubAnd SIK
Pri
The terminal security module is carried out initialization, for each terminal security module TSM produces and distributes unique TID, with SID, TID and SIK
PubWrite respectively among the TSM, generate the terminal use based on the key of ECC to TIK
PubAnd TIK
Pri, and with TIK
PubCharge to system database;
Service end system is that the IPTV terminal equipment adds the carrier aircraft cartoon letters and media add the block cipher SM1 that descrambling is used, and service end system produces terminal security cipher key T SK at random, and is written in the descrambling module of IPTV terminal equipment;
TSM and user side are registered to operator's off-line or online application, and illustrate it is individual's registration or packet registration, and the service end cryptographic system is that TSM produces customer management information TM and random number r, uses SIK
PriTo the TM signature, and with TM and signature TM||r||PE thereof
SIKpri(TM||r) write TSM;
TSM SIK
PubChecking operator is to the validity of TM signature, if sign invalid then the registration with unsuccessfully end, subscriber card returns TID||TM and uses TIK to service end system if sign effectively then
PriSignature T ID||TM||r||PE to TID||TM
TIKpri(TID||TM||r);
The service end cryptographic system is extracted TIK according to TID from database
PubChecking TSM is to the validity of TID||TM signature, invalidly then registers unsuccessfully finish if sign, if signature effectively then is recorded into database with TID||TM and subscriber card to the signature of TID||TM;
The service end cryptographic system is connected cipher key T LK, i.e. PE to TSM with terminal equipment sorter cartoon letters
TIKpub(TLK||r) || PE
SIKpri(PE
TIKpubAnd E (TLK||r))
TSK(TLK||r) || H (TLK||r);
Service end system utilizes the SK generation module to produce at random SK, and produces authority information CS;
Service end system adopts PK or DK that SK and CS are encrypted, and obtains the entitlement message RMMS:RMMS=EPK/DK (SK||CS) of SK || H (SK||CS), and RMMS is sent to the client of appointment with the authorization of appointment;
Client obtains SK||CS with PK or DK deciphering RMMS, calculate H (SK||CS) and with its with the H value that receives relatively, if equate then to accept SK, otherwise refuse to accept SK;
Service end system utilizes the CW generation module to produce at random CW, and the control parameter P of this CW is used in generation, CW is encrypted and calculates HASH with SK, obtain ECM:ECM=ESK (CW||P) || H (CW||P), and ECM sent to client with program stream;
User side decrypts CW with own SK, calculate H (CW||P) and with ECM in HASH value relatively, if the equal CW that then accepts otherwise refuses to accept CW;
Client according to control parameter P and authority information CS, is decrypted the broadcast program stream cipher with CW and SM1 under authority management module control.
In the above-described embodiments, at first finish encryption, key management and user authorization management to IPTV program stream or data content in service end, and and then carry out the authentication of interactive information with terminal; Finish deciphering to program stream content, key at different levels or authority at user terminal, and realize that terminal and interactive authentication and the right of system carry out, thereby realize the protection of programme content and the control of consumer behavior, improved the fail safe that the IPTV program stream transmits.
Description of drawings
In order to be illustrated more clearly in the embodiment of the invention or technical scheme of the prior art, the below will do to introduce simply to the accompanying drawing of required use in embodiment or the description of the Prior Art, apparently, accompanying drawing in the following describes only is some embodiments of the present invention, for those of ordinary skills, under the prerequisite of not paying creative work, can also obtain according to these accompanying drawings other accompanying drawing.
Fig. 1 is IPTV program stream content protective system and the Method And Principle figure of one embodiment of the invention;
Fig. 2 is the IPTV program stream content protective system key structure figure of one embodiment of the invention;
Fig. 3 is the IPTV program stream content protecting method real time business Protective Key distribution flow figure of one embodiment of the invention;
Fig. 4 is the IPTV program stream content protecting method non-real-time service Protective Key distribution flow figure of one embodiment of the invention.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the invention, the technical scheme in the embodiment of the invention is clearly and completely described, obviously, described embodiment only is the present invention's part embodiment, rather than whole embodiment.Based on the embodiment in the embodiment of the invention, those of ordinary skills belong to the scope of protection of the invention not paying the every other embodiment that obtains under the creative work prerequisite.
In an embodiment of the present invention, based on the protection to video-voice frequency flow when IP network is transmitted needs to the IPTV program stream, real time programme stream is adopted identity key TIK, personal key or domain key PK/DK, business cipher key SK and four layers of key code system of Control Word, non real-time program stream is adopted identity key TIK, personal key or domain key PK/DK and three layers of key code system of contents encryption key CEK, solve the application safety problem by mandate and management control to four layers of key of IPTV real-time streams and three layers of key of non real-time stream; And the present invention uses the cryptographic algorithm of national independent intellectual property right, has introduced ID authentication mechanism, so that the transmission security flexibility and reliability of IPTV program stream, be easy to promotion and implementation.
The symbol description that the present invention uses is as follows:
||: link.Such as C=A||B, expression is with the low segment data of B as C, and with the high segment data of A as C, the bit length of C is the bit length sum of A and B.
E: block cipher SM1.
EK: the enciphering/deciphering computing of using SM1 algorithm and key K to carry out.
PE:ECC public key algorithm SM2.
PEK: encrypt/decrypt or the signature/solution signature computing of using SM2 algorithm and key K to carry out.
H: the Hash computing of using the SM3 algorithm to carry out.
R, r: be random number
C
P/D, C
S, C
C: the service condition or the service regeulations that represent respectively key PK/DK, SK and CEK.
P: represent the control parameter related with Control Word.
Fig. 1 is IPTV program stream content protective system schematic diagram according to an embodiment of the invention.As shown in Figure 1, it comprises service terminals system and terminal subsystem; The service terminals system comprises service end key management and entitlement management module and content scrambling module; Terminal subsystem comprises terminal key management and entitlement management module and content descrambling module; Its course of work is, finishes encryption, key management and user authorization management to IPTV program stream or data content and the authentication of realization and terminal interaction information in service end; Finish deciphering to program stream content, key at different levels or authority at user terminal, and realize that terminal and interactive authentication and the right of system carry out, thereby realization is to the protection of programme content and the control of consumer behavior.
Fig. 2 is the IPTV program stream content protective system key structure figure of one embodiment of the invention; As shown in Figure 2, the embodiment of the invention adopts identity key TIK, personal key or domain key PK/DK, business cipher key SK and four layers of key code system of Control Word to real time programme stream, non real-time program stream is adopted identity key TIK, personal key or domain key PK/DK and three layers of key code system of contents encryption key CEK, solve the application safety problem by mandate and management control to four layers of key of IPTV real-time streams and three layers of key of non real-time stream.
In Fig. 1 embodiment, service end key management and entitlement management module comprise service end cipher key management unit and service end empowerment management unit, the functions such as the generation of service end cipher key management unit realization key that native system uses, storage, renewal, granting.Comprise:
The symmetric key management: the keys such as PK/DK, SK, CEK, CW produce, encrypt storage, secure distribution, safety replacing etc.;
Unsymmetrical key management: realized by card sending system, comprise generation, distribution, renewal or the issue of all the ECC public private key pairs of service end and user terminal in the system and relevant parameter etc., and set up and upgrade the black entry record of ECC, the audit of user profile record etc.;
Service end empowerment management unit realizes that the user authenticates and the authority of a user information management, and license and rights of using that the authority of a user that provides according to Subscriber Management System is authorized program comprise:
Rights management: the rights management of live, program request or downloading service is provided, comprises that user right information produces and safeguards;
Authorization messages produces: authorization messages comprises key and authority information, it and the related generation of key management, Content Management and user management authorization messages.Native system has two class authority message: entitlement management message RMM and authorization control message ECM;
Authorization messages (containing key) is encrypted, and comprises RMM encryption equipment and ECM encryption equipment;
The user authenticates: such as access authentication of user, online registration authentication, at the line service application authentication etc., comprise signature/verification, PKI enciphering/deciphering module;
The distribution of authorization messages right and payment.
Service end content scrambling module comprises real-time scrambling unit and pre-scrambling unit, realizes respectively scrambling and security control to programme televised live and program request/program downloading, and according to specified format encapsulation code stream, comprising:
Real-time scrambling device: under the effect of cryptographic algorithm and ciphering key W, realize the scrambling to living broadcast content stream.
Pre-scrambler: realize the pre-scrambling to request program and download file content under cryptographic algorithm, ciphering key EK effect, the content after the scrambling deposits program server in.
The terminal key management comprises terminal key administrative unit, authorization terminal administrative unit with entitlement management module;
The terminal key administrative unit is finished the store and management of the various keys of terminal such as ECC key, symmetric key and relevant parameter.
The authorization terminal administrative unit is used for finishing following functions:
Authorization messages deciphering: according to the RMM that receives and the deciphering of ECM completing user each layer key and authority information, extract user's rating condition such as key, the term of validity, Play Control parameter etc.;
Authority information is safeguarded: according to the authorization messages that receives, preservation, renewal, maintenance customer's authority information;
Authority is carried out: according to the transmission of key between the authority information control key reception that receives, key use and the controller card, reach the purpose of control program decryption and broadcast;
Authentication: realize the signature/verification computing of interaction data;
Uploading information (UM) encrypts: finish that interactive information that terminal submits to service end produces and encryption etc.
The terminal content descrambling module adopts the method corresponding with service end to finish the descrambling of live, program request and media content download under the control of authorization terminal administration module.
Fig. 3 is the IPTV program stream content protecting method real time business Protective Key distribution flow figure of one embodiment of the invention; Fig. 4 is the IPTV program stream content protecting method non-real-time service Protective Key distribution flow figure of one embodiment of the invention.With reference to Fig. 3 and Fig. 4; in embodiments of the present invention, the principle of key distribution and protection is not only to ensure the confidentiality of key; also will ensure the integrality of key and the reliability in source, all keys of distribution all must guarantee to only have the legal authorized user of authentication to obtain.
All keys all are to adopt successively protected mode distribution in the embodiment of the invention; namely adopt the ways of distribution of upper strata secret key encryption lower floor key; except personal key (PK) and domain key (DK) are that other key under it all is by symmetrical grouping algorithm encipherment protection by the protection of ECC algorithm.Simultaneously, each key bundlees rear encryption distribution with service condition, and the user is merely able to (use C according to specified rule
XExpression) uses key.As follows:
RMM
P/D＝PE
TIKpub(PK/DK||C
P/D)||PE
SIKpri(H(PK/DK||C
P/D))；
RMM
S＝E
PK/DK(SK||C
S)||H(SK||C
S)；
RMM
C＝E
PK/DK(CEK||C
C)||H(CEK||C
C)；
ECM＝E
SK(CW||P)||H(CW||P)。
The distribution of each key is that substep is finished.Wherein, the ECC key is to finishing distribution with offline mode when system initialization or the terminal security module initialization; Personal key PK/ domain key DK is user when registering, and the mode by online or off-line under the protection of user ECC public key encryption is distributed to the user; Business cipher key SK adopts PK or DK encipherment protection, is to be distributed to when the user applies for business; CW employing SK encrypts, and distributes in real time with stream when the programme content that system broadcasts is encrypted; CEK adopts PK or DK encipherment protection, is distributed to online designated user when the user applies for the non-real-time service mandate.
Except the transmission Control Word is with being distributed by the programme content of scrambling, other key all is to be independent of the programme content distribution.
When having a plurality of similar key simultaneously in the system, to specify key identifier KID in the cipher key distribution message, and also will comprise in the programme content for the key identifier KID that encrypts this content.
In embodiments of the present invention, when the terminal use holds user smart card and applies for the registration of to operator, because the initialization of system is safe and reliable, operator and subscriber card have all obtained the other side's PKI credibly before registering, both sides all sign to information mutual in the registration process, therefore the assailant can't be by replacing or distort these information, so that both sides still can succeed in registration receiving in the situation of spurious information.In case user registration success has just possessed distribution RMM
P/DIt is the condition of personal key PK and domain key DK.
With reference to Fig. 3 and Fig. 4, in embodiments of the present invention, service end key management and entitlement management module produce personal key PK and domain key DK, and it is kept in the storage medium of front end key management and entitlement management module.Service end system calculates RMM
P/D=PE
TIKpub(PK/DK||C
P/D) || PE
SIKpri(H (PK/DK||C
P/D)), with RMM
P/DWith Entitlement Management Message RMM through the multiplexing terminal that sends to.Through demultiplexing, the terminal key management is calculated (PK/DK||C with entitlement management module
P/D) '=PE
TIKpri(PE
TIKpub(PK/DK||C
P/D)), and checking RMM
P/DValidity (calculate PE
SIKpub(PE
SIKpri(H (PK/DK||C
P/D))), and with the H ((PK/DK||C that calculates
P/D) ') value relatively, equal then think (PK/DK) of deciphering '==PK/DK), terminal key management and entitlement management module are only accepted legal PK/DK and C
P/D, and it is stored in the safety zone of terminal key administration module.
With reference to Fig. 3, in embodiments of the present invention, service end key management and entitlement management module produce business cipher key SK, and it is kept in the storage medium of service end key management and entitlement management module.Service end system calculates RMM
S=E
PK/DK(SK||C
S) || H (SK||C
S), with RMM
SWith Entitlement Management Message through the multiplexing terminal that sends to.Through demultiplexing, the terminal key management is calculated (SK||C with entitlement management module
S) '=E
PK/DK(E
PK/DK(SK||C
S)), and checking SK||C
SIntegrality (calculate h ((SK||C
S) '), and with the h (SK||C that receives
S) value relatively, equal then think the SK ' of deciphering==SK), terminal key management and entitlement management module are only accepted legal SK and C
S, and it is stored in the safety zone of terminal key administration module.
With reference to Fig. 3, in embodiments of the present invention, service end key management and entitlement management module produce Control Word and calculate ECM=E
SK(CW||P) || H (CW||P) sends to terminal with ECM with the programme content of scrambling.The terminal key management is calculated (CW||P) with entitlement management module '=E
SK(E
SK(CW||P)), and the integrality of checking CW||P (calculating h ((CW||P) '), and with h (CW||P) value that receives relatively, equal then think the deciphering CW '==CW), the terminal key management is only accepted legal Control Word with entitlement management module, and CW and P are outputed to descrambling module for the content descrambling.
With reference to Fig. 4, in embodiments of the present invention, service end key management and entitlement management module produce contents encryption key CEK and calculate RMM
C=E
PK/DK(CEK||C
C) || H (CEK||C
C), with RMM
CSend to terminal with Entitlement Management Message.Through demultiplexing, the terminal key management is calculated (CEK||C with entitlement management module
C) '=EP
K/DK(E
PK/DK(CEK||C
C)), and the integrality of checking CW||P (is calculated h (CEK||C
C) '), and with h (CW||P) value that receives relatively, equal then think the CEK ' of deciphering==CEK), terminal key management and entitlement management module are only accepted legal contents encryption key CEK, and with CEK and C
COutput to descrambling module and be used for the content descrambling.
With reference to Fig. 3 and Fig. 4, in embodiments of the present invention, service end scrambling operation is video-voice frequency flow to be carried out scrambling, the video-voice frequency flow after the formation scrambling with symmetric cryptographic algorithm and Control Word or contents encryption key CEK; The terminal descrambling operation is to carry out descrambling, the plaintext video-voice frequency flow that formation can be watched with symmetric cryptographic algorithm and the Control Word that decrypts or the contents encryption key CEK video-voice frequency flow after to scrambling.The assailant is only under the prerequisite that obtains Control Word or contents encryption key CEK, and the audio/video flow after could utilizing symmetric cryptographic algorithm to scrambling carries out descrambling.
In embodiments of the present invention, the symmetric encipherment algorithm of employing, rivest, shamir, adelman and hash cryptographic algorithm are domestic algorithm, and the fail safe that national authorities tissue has been passed through in its fail safe detects, and is safe and reliable.
In embodiments of the present invention, when distribution PK/DK, service end system calculates the Message Authentication Code H (PK/DK) of PK/DK and utilizes service end private key SIK
PriSign, therefore verified through user smart card that signature and the effective PK/DK ciphertext of H (PK/DK) all were believable, the PK/DK that decrypts is believable.
In embodiments of the present invention, when distribution SK, service end system calculates the Message Authentication Code H (SK) of SK, because PK/DK and SK maintain secrecy, and PK/DK is believable, the assailant can't pretend to be service end system to calculate H (SK), all is believable through the effective SK ciphertext of subscriber card checking H (SK) therefore, and the SK that decrypts is believable.
In embodiments of the present invention, when distribution CW, service end system calculates the Message Authentication Code H (CW) of CW, because PK/DK, SK and CW maintain secrecy, and SK is believable, the assailant can't pretend to be service end system to calculate H (CW), all is believable through the effective CW ciphertext of subscriber card checking H (CW) therefore, and the CW that decrypts is believable.
In embodiments of the present invention, when distribution CEK, service end system calculates the Message Authentication Code H (CEK) of CEK, because PK/DK and CEK maintain secrecy, and PK/DK is believable, the assailant can't pretend to be service end system to calculate H (CEK), all is believable through the effective CEK ciphertext of subscriber card checking H (CEK) therefore, and the CEK that decrypts is believable.
In sum; in embodiments of the present invention; because all cryptographic algorithms itself all are safe; key information and cipher-text information all are safe in the password use flow process; all need to all effectively be protected with the information of cryptoguard; therefore in whole IPTV operation flow (transmission from the system initialization to the scrambled program and watch); the assailant both can't obtain secret information surreptitiously to see program; also can't use cipher key related information or the programme information user cheating smart card of forging, the IPTV program stream content protective system method that therefore the present invention relates to is safe.
In embodiments of the present invention, ciphering key W, SK, PK/DK that system adopts can upgrade according to certain cycle and strategy as required, to improve Security of the system.User's TIK update time interval is about 2 years.Effectively, its update time interval is 1-2 in the right continuing phase with the existence of the user watched authority of user or territory for individual subscriber key PK or domain key DK.The renewal of programme televised live business cipher key SK can be one day or one month, is determined the term of validity of SK by operator.The update time interval interval of Control Word is made by oneself by service end system, generally can be 30-90 second.And CEK is consistent with the file term of validity of claim, does not generally need to upgrade, and exists with the term of validity of encrypted file.
As shown in Figure 1, the IPTV program stream content protecting method of one embodiment of the invention may further comprise the steps:
1, password flow process and the agreement of system initialization and user registration
1) system initialization
A) determine the cryptographic algorithm that system uses:
Symmetric cryptographic algorithm SM1 (E represents with symbol);
Asymmetric cryptographic algorithm SM2 (PE represents with symbol);
Hash algorithm SM3 (H represents with symbol).
Service end system produces ECC key pair, determines self sign SID and elliptic curve parameter and basic point P thereof, and produce service end system based on the key of ECC to (SIKpub, SIKpri).
B) TSM (terminal security module, form include but not limited to it is smart card) initialization:
For each TSM produces and distributes unique TID;
In TSM, write service end sign SID, end mark TID and SIKpub;
The terminal use to being (TIKpub, TIKpri), and charges to system database with TIKpub based on the key of ECC;
Operator distributes TSM to the user, comprises SM2, SM1, SM3 scheduling algorithm among the TSM, and TIKpri, TIKpub, SIKpub, SID and TID.
C) IPTV terminal initial:
Service end system is that terminal equipment adds the block cipher SM1 that carrier aircraft cartoon letters and media add the use that descrambling uses;
Service end system produces terminal security cipher key T SK at random, and is written in the IPTV terminal equipment descrambling module.
KLPI110505
2) user's registration
Password flow process and the agreement of user's registration are as follows:
A) user holds TSM and portable terminal to operator's off-line or online application registration, and explanation is individual's registration or packet registration.
B) the service end cryptographic system is that TSM produces customer management information TM and random number r, uses SIK
PriTM is signed, and TM and signature thereof are write TSM.That is:
TM||r||PE
SIKpri(TM||r)。
C) TSM is with SIK
PubChecking operator is to the validity of TM signature, as signs and invalidly then register unsuccessfully finish, as signs effectively then that subscriber card returns TID||TM and uses TIK to system end
PriTo the signature of TID||TM, that is:
TID||TM||r||PE
TIKpri(TID||TM||r)。
D) the service end cryptographic system is extracted TIK according to TID from database
PubChecking TSM is to the validity of TID||TM signature, as signs and invalidly then register unsuccessfully finish, as signs effectively then TID||TM and subscriber card are recorded into database to the signature of TID||TM.
E) the service end cryptographic system is connected cipher key T LK to TSM with terminal equipment sorter cartoon letters.Namely
PE
TIKpub(TLK||r)||PE
SIKpri(PE
TIKpub(TLK||r))
With
E
TSK(TLK||r)||H(TLK||r)。
2, distribution RMM
P/DPassword flow process and agreement
User PK/DK authorization messages is at RMM
P/DIn distribution, concrete password flow process and agreement are as follows:
A) operator organizes the generation authority information C related with PK/DK for designated user or user
P/D(such as the PK/DK key term of validity, the available type of service of service end, key service regeulations etc.).
B) produce RMM
P/D
RMM
P/D＝PE
TIKpub(PK/DK||C
P/D)||PE
SIKpri(H(PK/DK||C
P/D))；
Work as PK/DK||C
P/DData can use digital envelope to produce RMM during greater than 256bit
P/D:
RMM
P/D＝E
K(PK/DK||C
P/D)||PE
TIKpub(K)||PE
SIKpri(H(K||C
P/D))；
With RMM
P/DSend to client.
C) terminal receives RMM
P/D, the deciphering PK/DK.Terminal receives RMM
P/DAfter, use private key TIK
PriDeciphering RMM
P/D, obtain PK/DK and C
P/DExpressly, and utilize the PKI SIK of ECC signature verification module and system
PubChecking RMM
P/DValidity, if effectively then keep PK/DK and C
P/D, the invalid data decryption of then abandoning.
3, distribution service authorization messages RMM
SPassword flow process and agreement with ECM
After the user had applied for the live broadcast stream media mandate, password flow process and the agreement of authorization messages distribution were as follows:
1) the business cipher key SK of issue and reception programme televised live
A) system end utilizes the SK generation module to produce at random SK, and produces authority information C
S(authority information of programme televised live is such as the program term of validity, broadcast condition, service regeulations etc.).
B) system end uses PK (or DK) to SK and C
SBe encrypted, obtain the entitlement message RMM of SK
S:
RMM
S＝E
PK/DK(SK||C
S)||H(SK||C
S)；
With RMM
SSend to the client of appointment with the authorization of appointment.
C) terminal is deciphered RMM with PK/DK
SObtain SK||C
S, calculate H (SK||C
S), and with the H value that receives relatively, equal then accept SK, otherwise refuse to accept SK.
If when a user has applied for that N (N is the natural number greater than 1) plants business and has the rating right of this N item business, can:
RMM
S＝E
PK/DK(SK
0||SK
1||...SK
N-1||C
S)||H(SK
0||SK
1||...SK
N-1||C
S)；
2) ECM of programme televised live is received in issue and reception
A) system end utilizes the CW generation module to produce at random CW, and produces the control parameter P that uses this CW.
B) CW is encrypted and calculates HASH with SK, obtain ECM:
ECM＝E
SK(CW||P)||H(CW||P)
ECM is sent to terminal with program stream.
C) terminal decrypts CW with own SK, calculate H (CW||P) and with ECM in the comparison of HASH value, equal then accept CW, otherwise refusal is accepted CW.
When the broadcast items content, terminal is deferred to P and C
S, under authority management module control, with CW and SM1 the broadcast program stream cipher is deciphered.
4, the user applies for program request or downloading service mandate RMM
cPassword flow process and agreement
Password flow process and agreement when the user applies for demand (telecommunication) service and downloading service mandate are as follows:
1) user sends interactive service authorization requests REQ by interactive channel
T
A) user sends service requesting information
REQ
T＝E
PK/DK(TID||CID||W||r)||PE
TIKpri(H(TID||CID||W||r))
CID: program identification information, such as channel, programm name, program ID or KID etc.
W: the relevant informations such as consumption demand that application is professional.
A) system end receives REQ
TAnd certifying signature
System end receives REQ
T, with this user's PK/DK deciphering, use again user identity key PKI TIK first
PubThe validity of certifying signature is namely calculated PETIK
Pub(H (TID||CID||W||r)).As the invalid then refusal of signing is authorized and the feedback authentication failure message; As sign effectively, check again user's authority by authoring system, require then to continue if meet to authorize, otherwise feedback authorization failure information.
2) system sends program request or download file authorization messages RES
S
RES
S＝RMM
c＝E
PK/DK(CEK||C
C||r)||H(CEK||C
C||r)；
C
C: the application program authority information of authorizing, such as the term of validity, broadcast condition, service regeulations etc.Wherein service regeulations have been stipulated user's broadcast condition.
3) the IPTV terminal receives program request or download file by broadcasting or interactive channel
The IPTV terminal decrypts CEK||C with PK or DK
C|| r, calculate H, and and RES
SIn the H value relatively, relatively r value all equates then to accept CEK, otherwise refuses to accept CEK.Then, terminal is according to authority information C
C, with CEK program request or download file are decrypted.
If when a user has applied for N kind interactive service and has had the rating right of this N item business, CEK that can a plurality of programs of disposable distribution, then above-mentioned CEK can replace with:
CEK＝CEK
1||CEK
2...||CEK
N；
If same program has N user's application, (the rating authority of supposing this N user is the same to need that then same CEK is distributed to several users.)：
RMM
c＝E
PK1(CEK||C
C||r)||E
PK2(CEK||C
C||r)||
...E
PKN(CEK||C
C||r))||H(CEK||C
C||r)。
Can find out that from above-described embodiment main feature of the present invention comprises:
1) cryptographic algorithm aspect
Add, Descrambling Algorithms, the present invention adopts domestic SM1 block cipher.
The present invention adds Descrambling Algorithms and adopts the higher SM1 block cipher of efficient, and key length is 128 bits, allows each output 1-128 bit cipher sequence, real-time scrambling, low delay, safe, prevent scrambling after data error diffusion appears.This algorithm detects by the fail safe of national authorities tissue, and is safe and reliable.
Enciphering and deciphering algorithm, the present invention adopts domestic SM1 block cipher.
Adopt domestic block cipher, have the characteristics of fast encrypt, low delay, can support two kinds of working methods of CBC and CTR, 128 bit keys length have strengthened the anti-intensity that cracks, can resist existing known all kinds of attacks, and detect by the fail safe of national authorities tissue, safe and reliable.
Signature/verification signature of the present invention adopts domestic SM2 asymmetric cryptographic algorithm.
The present invention adopts the SM2 asymmetric cryptographic algorithm, and relevant information is carried out the signature/verification signature, makes the user can be sure of the authenticity of information source transmit leg, and to the generation of personal key employing negotiation mode, has improved Security of the system.This algorithm detects by the fail safe of national authorities tissue, and is safe and reliable.
The present invention adopts domestic SM3 hash cryptographic algorithm, calculates Message Authentication Code checking message integrity.
2) key code system aspect
The main body key code system that the native system method adopts is as follows:
1) key code system of protection live television programming stream:
The 1st layer: system and user's identity key SIK (Service Identity Key) and TIK (Terminal Identity Key).The ECC key is to being respectively SIKpri/SIKpub and TIKpri/TIKpub, for the protection of the online distribution of PK/DK and when realizing that the user registers and waiting application and the authentication between the mechanism.This key is that off-line produces and write card.
The 2nd layer: personal key PK (Personal Key) or domain key DK (Domain Key) are respectively applied to realize that the empowerment management of user or user's group and protection SK distribute online.
The 3rd layer: business cipher key SK (Service Key) is used for realizing that the control mandate of classify traffic, separate traffic or service groups and protection CW provide in real time.
The 4th layer: control word ciphering key W (Contron Word) is used for realizing the transmission protection of media content, with the regularly online distribution of program stream information.
2) key code system of protection video file program request or downloading service:
The 1st layer: system and user identity key; the ECC key is to being respectively SIKpri/SIKpub and TIKpri/TIKpub; this layer key and live the 1st layer of ECC key share, and are used for realizing that bidirectional identity authentication and the protection PK/DK between the user and mechanism distributes online under the interactive application.
The 2nd layer: personal key PK (Personal Key) or domain key DK (Domain Key), this layer key and live the 2nd layer of PK/DK key share, and are used for realizing that user/user organizes empowerment management and protection CEK distributes online.
The 3rd layer: contents encryption key CEK (Content Encryption Key), realize the encryption of on-demand media stream and media content download.
One of ordinary skill in the art will appreciate that: accompanying drawing is the schematic diagram of an embodiment, and the module in the accompanying drawing or flow process might not be that enforcement the present invention is necessary.
One of ordinary skill in the art will appreciate that: the module in the device among the embodiment can be described according to embodiment and be distributed in the device of embodiment, also can carry out respective change and be arranged in the one or more devices that are different from present embodiment.The module of above-described embodiment can be merged into a module, also can further split into a plurality of submodules.
One of ordinary skill in the art will appreciate that: all or part of step that realizes said method embodiment can be finished by the relevant hardware of program command, aforesaid program can be stored in the computer read/write memory medium, this program is carried out the step that comprises said method embodiment when carrying out; And aforesaid storage medium comprises: the various media that can be program code stored such as ROM, RAM, magnetic disc or CD.
It should be noted that at last: above embodiment only in order to technical scheme of the present invention to be described, is not intended to limit; Although with reference to previous embodiment the present invention is had been described in detail, those of ordinary skill in the art is to be understood that: it still can be made amendment to the technical scheme that previous embodiment is put down in writing, and perhaps part technical characterictic wherein is equal to replacement; And these modifications or replacement do not make the essence of appropriate technical solution break away from the spirit and scope of embodiment of the invention technical scheme.
Claims (7)
1. an IPTV program stream content protective system is characterized in that, comprises the first key management and entitlement management module and the content scrambling module that are positioned at service end, and the second key management and entitlement management module and the content descrambling module that are positioned at terminal, wherein
Described the first key management and entitlement management module comprise symmetric key administrative unit, unsymmetrical key administrative unit and empowerment management unit:
Described symmetric key administrative unit for generation of, storage, upgrade, provide PK/DK, SK, CEK, CW key;
Described unsymmetrical key administrative unit is for generation of ECC public private key pair and the relevant parameter of, distribution, renewal or issuing service end and user terminal, sets up and upgrades the black entry record of ECC, the audit of user profile record;
Described empowerment management unit is for generation of authorization messages, realize that the user authenticates and the authority of a user information management, license and rights of using that the authority of a user that provides according to Subscriber Management System is authorized program, the rights management of live, program request or downloading service is provided, comprises that user right information produces and safeguards;
Described content scrambling module comprises real-time scrambling unit and pre-scrambling unit:
Described real-time scrambling unit is used for realizing scrambling and the security control to programme televised live and program request/program downloading under the effect of cryptographic algorithm and ciphering key W, and according to specified format encapsulation code stream;
Described pre-scrambling unit is used under cryptographic algorithm, ciphering key EK effect realization to the pre-scrambling of request program and download file content, and deposits the content after the scrambling in program server;
Described the second key management and entitlement management module comprise cipher key management unit, authorization terminal administrative unit:
Described cipher key management unit is used for store and management user terminal ECC key, symmetric key and relevant parameter;
Described authorization terminal administrative unit is used for according to the RMM that receives and the deciphering of ECM completing user each layer key and authority information, extract user's rating condition, according to the authorization messages that receives, preservation, renewal, maintenance customer's authority information, transmission according to key between the authority information control key reception that receives, key use and the controller card, realize the signature/verification computing of interaction data, finish interactive information generation and encryption that terminal is submitted to service end;
Described content descrambling module is used under the control of described authorization terminal administrative unit, adopts the method corresponding with service end to finish descrambling to live, program request and media content download.
2. an IPTV program stream content protecting method is characterized in that, may further comprise the steps:
Service end system adopts symmetric cryptographic algorithm SM1, asymmetric cryptographic algorithm SM2 and Haas algorithm SM3, wherein represents symmetric cryptographic algorithm SM1 with symbol E, and symbol PE represents asymmetric cryptographic algorithm SM2, and symbol H represents Haas algorithm SM3;
Service end system produces ECC key pair, determines self sign SID and elliptic curve parameter and basic point P thereof, and produce service end system based on the key of ECC to SIK
PubAnd SIK
Pri
The terminal security module is carried out initialization, for each terminal security module TSM produces and distributes unique TID, with SID, TID and SIK
PubWrite respectively among the TSM, generate the terminal use based on the key of ECC to TIK
PubAnd TIK
Pri, and with TIK
PubCharge to system database;
Service end system is that the IPTV terminal equipment adds the carrier aircraft cartoon letters and media add the block cipher SM1 that descrambling is used, and service end system produces terminal security cipher key T SK at random, and is written in the descrambling module of IPTV terminal equipment;
TSM and user side are registered to operator's off-line or online application, and illustrate it is individual's registration or packet registration, and the service end cryptographic system is that TSM produces customer management information TM and random number r, uses SIK
PriTo the TM signature, and with TM and signature TM||r||PE thereof
SIKpri(TM||r) write TSM;
TSM SIK
PubChecking operator is to the validity of TM signature, if sign invalid then the registration with unsuccessfully end, subscriber card returns TID||TM and uses TIK to service end system if sign effectively then
PriSignature T ID||TM||r||PE to TID||TM
TIKpri(TID||TM||r);
The service end cryptographic system is extracted TIK according to TID from database
PubChecking TSM is to the validity of TID||TM signature, invalidly then registers unsuccessfully finish if sign, if signature effectively then is recorded into database with TID||TM and subscriber card to the signature of TID||TM;
The service end cryptographic system is connected cipher key T LK, i.e. PE to TSM with terminal equipment sorter cartoon letters
TIKpub(TLK||r) || PE
SIKpri(PE
TIKpubAnd E (TLK||r))
TSK(TLK||r) || H (TLK||r);
Service end system utilizes the SK generation module to produce at random SK, and produces authority information CS;
Described service end system adopts PK or DK that SK and CS are encrypted, and obtains the entitlement message RMMS:RMMS=EPK/DK (SK||CS) of SK || H (SK||CS), and RMMS is sent to the client of appointment with the authorization of appointment;
Described client obtains SK||CS with PK or DK deciphering RMMS, calculate H (SK||CS) and with its with the H value that receives relatively, if equate then to accept SK, otherwise refuse to accept SK;
Described service end system utilizes the CW generation module to produce at random CW, and the control parameter P of this CW is used in generation, CW is encrypted and calculates HASH with SK, obtain ECM:ECM=ESK (CW||P) || H (CW||P), and ECM sent to described client with program stream;
Described user side decrypts CW with own SK, calculate H (CW||P) and with ECM in HASH value relatively, if the equal CW that then accepts otherwise refuses to accept CW;
Described client according to control parameter P and authority information CS, is decrypted the broadcast program stream cipher with CW and SM1 under authority management module control.
3. method according to claim 2 is characterized in that, described authority information CS comprises: the program term of validity, broadcast condition and service regeulations.
4. method according to claim 2, it is characterized in that, if a client application N item professional and when having the rating right of this N item business, RMMS=EPK/DK (SK0||SK1||...SKN-1||CS) || H (SK0||SK1||...SKN-1||CS).
5. method according to claim 2 is characterized in that, and is further comprising the steps of:
Client sends interactive service authorization requests REQT, REQ by interactive channel
T=E
PK/DK(TID||CID||W||r) || PE
TIKpri(H (TID||CID||W||r)), wherein, CID is program identification information, W is the professional consumption demand information of application;
The REQT that described service end system adopts PK/DK corresponding to described client deciphering to receive, and with the user identity key PKI TIK of described client
PubCalculate PE
TIKpubThe validity of (H (TID||CID||W||r)) certifying signature is if the invalid then refusal of signing is authorized and the feedback authentication failure message; If signature effectively, checks user's authority by authoring system, require then to continue if meet to authorize, otherwise feedback authorization failure information;
Service end system sends program request or download file authorization messages RES
S, RES
S=RMM
c=E
PK/DK(CEK||CC||r) || H (CEK||CC||r), wherein, CC is the application program authority information of authorizing;
Described client decrypts CEK||CC||r with PK or DK, calculates H, and and RES
SIn the H value relatively, and r value relatively if all equate then to accept CEK, otherwise refuses to accept CEK;
Described client is decrypted program request or download file with CEK according to authority information CC.
6. method according to claim 5 is characterized in that, if a client application N item interactive service and when having the rating right of this N item business, N is the natural number greater than 1, the CEK of a disposable distribution N program,
CEK＝CEK
1||CEK
2...||CEK
N。
7. method according to claim 5 is characterized in that, if same program has N client application, then same CEK is distributed to N user:
RMM
c＝E
PK1(CEK||CC||r)||E
PK2(CEK||CC||r)||
...E
PKN(CEK||CC||r))||H(CEK||CC||r)。
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110219928.5A CN102917252B (en) | 2011-08-02 | 2011-08-02 | IPTV (internet protocol television) program stream content protection system and method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110219928.5A CN102917252B (en) | 2011-08-02 | 2011-08-02 | IPTV (internet protocol television) program stream content protection system and method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102917252A true CN102917252A (en) | 2013-02-06 |
| CN102917252B CN102917252B (en) | 2015-03-25 |
Family
ID=47615458
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201110219928.5A Active CN102917252B (en) | 2011-08-02 | 2011-08-02 | IPTV (internet protocol television) program stream content protection system and method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102917252B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103634624A (en) * | 2013-11-15 | 2014-03-12 | 四川长虹电器股份有限公司 | Digital television live broadcasting method and system based on IP (Internet protocol) network |
| CN103761467A (en) * | 2013-12-31 | 2014-04-30 | 航天数字传媒有限公司 | Terminal authorization device and system |
| CN103927624A (en) * | 2014-04-18 | 2014-07-16 | 杭州郑达艺学科技有限公司 | Fine arts teaching system |
| CN104283859A (en) * | 2013-07-10 | 2015-01-14 | 上海信颐信息技术有限公司 | Encryption and decryption method for advisement player documents |
| CN110300289A (en) * | 2019-07-31 | 2019-10-01 | 北京中安国通科技有限公司 | Video security management system and method |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2001217843A (en) * | 2000-02-01 | 2001-08-10 | Toyo Commun Equip Co Ltd | Cryptocommunication protocol structure and enciphering ip packet format |
| CN101902610A (en) * | 2009-05-27 | 2010-12-01 | 航天信息股份有限公司 | Method for realizing secure communication between IPTV set top box and smart card |
| CN101902611A (en) * | 2009-06-01 | 2010-12-01 | 航天信息股份有限公司 | Method for realizing IPTV digital rights management |
| CN102111681A (en) * | 2009-12-24 | 2011-06-29 | 航天信息股份有限公司 | Key system for digital television broadcast condition receiving system |
-
2011
- 2011-08-02 CN CN201110219928.5A patent/CN102917252B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2001217843A (en) * | 2000-02-01 | 2001-08-10 | Toyo Commun Equip Co Ltd | Cryptocommunication protocol structure and enciphering ip packet format |
| CN101902610A (en) * | 2009-05-27 | 2010-12-01 | 航天信息股份有限公司 | Method for realizing secure communication between IPTV set top box and smart card |
| CN101902611A (en) * | 2009-06-01 | 2010-12-01 | 航天信息股份有限公司 | Method for realizing IPTV digital rights management |
| CN102111681A (en) * | 2009-12-24 | 2011-06-29 | 航天信息股份有限公司 | Key system for digital television broadcast condition receiving system |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104283859A (en) * | 2013-07-10 | 2015-01-14 | 上海信颐信息技术有限公司 | Encryption and decryption method for advisement player documents |
| CN103634624A (en) * | 2013-11-15 | 2014-03-12 | 四川长虹电器股份有限公司 | Digital television live broadcasting method and system based on IP (Internet protocol) network |
| CN103761467A (en) * | 2013-12-31 | 2014-04-30 | 航天数字传媒有限公司 | Terminal authorization device and system |
| CN103927624A (en) * | 2014-04-18 | 2014-07-16 | 杭州郑达艺学科技有限公司 | Fine arts teaching system |
| CN110300289A (en) * | 2019-07-31 | 2019-10-01 | 北京中安国通科技有限公司 | Video security management system and method |
| CN110300289B (en) * | 2019-07-31 | 2020-08-21 | 北京中安国通科技有限公司 | Video safety management system and method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102917252B (en) | 2015-03-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8761393B2 (en) | Method and apparatus for providing secure internet protocol media services | |
| CN100459697C (en) | IPTV system, enciphered digital programme issuing and watching method | |
| KR100724935B1 (en) | Apparatus and method of interlock between entities for protecting contents, and the system thereof | |
| CN101902611B (en) | Method for realizing IPTV digital rights management | |
| CN102802036B (en) | System and method for identifying digital television | |
| US7933414B2 (en) | Secure data distribution | |
| CN101076109B (en) | Two-way CA system of digital TV-set and method for ordering and cancelling programm based on it | |
| CN101019370A (en) | Method of providing conditional access | |
| US9277259B2 (en) | Method and apparatus for providing secure internet protocol media services | |
| CN101719910A (en) | Terminal equipment for realizing content protection and transmission method thereof | |
| CN101277181A (en) | Dynamic multilayer encryption method for managing flow medium digital authority | |
| CN102724568A (en) | Authentication certificates | |
| CN102111681B (en) | Key system for digital television broadcast condition receiving system | |
| CN101640785B (en) | Encrypting/decrypting system and encrypting/decrypting method for interactive network television | |
| CN102917252B (en) | IPTV (internet protocol television) program stream content protection system and method | |
| CN101160965B (en) | Method of implementing preview of network TV program, encryption device, copyright center system and subscriber terminal equipment | |
| CN101562520B (en) | Method and system for distributing service secret keys | |
| CN103546767B (en) | Content protection method and system of multimedia service | |
| CN101521668B (en) | Method for authorizing multimedia broadcasting content | |
| CN101895393A (en) | IPTV (Internet Protocol Television) user security terminal | |
| CN101505400B (en) | Bi-directional set-top box authentication method, system and related equipment | |
| CN102427559A (en) | Identity authentication method based on digital television set card separation technology | |
| CN100588244C (en) | Method and system for implementing broadcasting network condition receiving | |
| CN102238422B (en) | Digital television broadcasting conditional access system | |
| KR102286784B1 (en) | A security system for broadcasting system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |