CN102917252B - IPTV (internet protocol television) program stream content protection system and method - Google Patents
IPTV (internet protocol television) program stream content protection system and method Download PDFInfo
- Publication number
- CN102917252B CN102917252B CN201110219928.5A CN201110219928A CN102917252B CN 102917252 B CN102917252 B CN 102917252B CN 201110219928 A CN201110219928 A CN 201110219928A CN 102917252 B CN102917252 B CN 102917252B
- Authority
- CN
- China
- Prior art keywords
- key
- cek
- service end
- tid
- program
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
The invention provides IPTV (internet protocol television) program stream content protection system and method. Based on the requirement for protecting a video-audio stream by an IPTV program stream in IP (internet protocol) network transmission, a four-level key system of TIK (terminal identity key), PK (personal key)/DK (domain key), SK (service key) and CW (control word) is used for a real-time program stream, a three-level key system of the TIK, the PK/DK and CEK (content encryption key) is used for a non-real-time program stream, the problem of application safety is solved by authorization and management control of IPTV real-time stream four-level key and non-real-time-stream three-level key, an identity authentication mechanism is introduced, and accordingly transmission safety of the IPTV program stream is increased, and an IPTV system is flexible, reliable, and easy to popularize and implement.
Description
Technical field
The present invention relates to IPTV field, in particular to a kind of IPTV program stream content protective system and method.
Background technology
IPTV (Internet Protocol Television) is the digital audio/video service utilizing IP network to provide, it utilizes broadband networks, adopts stream media technology, there is provided comprise digital television broadcasting, interactive VOD and under be loaded in interior multiple interactive digital media services, there is the functions such as traditional live telecast, video request program, download and time shift, merge telecommunications network, Broadcasting Cable Network and the Internet three network technology, being an important directions of digital audio/video industry development, is the key realizing the integration of three networks.Compared with Digital Television, the advantage of IPTV is that it make use of Internet resources fully, achieve real interaction (such as, program request and time-shifting function) and the personalized service of client, and the various network services such as television services and Internet can also easily be browsed by IPTV, E-mail receiver/send combines, and has the advantage in the competition in future.
IPTV technology is a system integration technology, and its major technique comprises: network technology, audio video encoding technology, content protection technology, IP Set Top Box and EPG technology and the technology such as user management and service management.The class of business that IPTV can provide comprises: TV class business, communication class business and various value-added service.TV class business is the core business of IPTV, comprises the download etc. of live telecast, video on demand and audio/video program.
Equally there is the demand of copyright and content protecting aspect with other digital television business in IPTV, need by security means be content provider, program network operator and validated user provide safety guarantee.Safe practice mechanism for IPTV system has larger difference compared with condition reception (CA) technology mechanism under DVB digital broadcasting mode.Due to the two-way environment of IP network, need to adopt bidirectional authentication mechanism and Content-Authorize to realize the copyright protection of digital content, and the safe mode adopted to adapt to multiple business and the application mode of IPTV.
Summary of the invention
The invention provides a kind of IPTV program stream content protective system and method, in order to improve the fail safe of IPTV program stream transmission.
For achieving the above object; the invention provides a kind of IPTV program stream content protective system; this system comprises the first key management and entitlement management module and content scrambling module that are positioned at service end, and is positioned at the second key management of terminal and entitlement management module and content descrambling module, wherein
First key management and entitlement management module comprise symmetric key administrative unit, unsymmetrical key administrative unit and empowerment management unit:
Symmetric key administrative unit for generation of, store, upgrade, provide PK/DK, SK, CEK, CW key;
Unsymmetrical key administrative unit for generation of, distribution, upgrade or the ECC public private key pair of issuing service end and user terminal and relevant parameter, set up and upgrade the black entry record of ECC, the audit of user profile record;
Empowerment management unit is for generation of authorization messages, realize user authentication and authority of a user information management, the authority of a user provided according to Subscriber Management System authorizes license and the rights of using of program, provides live, the rights management of program request or downloading service, comprises user right information and produces and safeguard;
Content scrambling module comprises real-time scrambling unit and pre-scrambling unit:
Real-time scrambling unit is used for realizing scrambling to programme televised live and program request/program downloading and security control under the effect of cryptographic algorithm and ciphering key W, and according to specified format encapsulation code stream;
Pre-scrambling unit is used for the pre-scrambling realized under cryptographic algorithm, ciphering key EK effect request program and download file content, and by the content after scrambling stored in program server;
Second key management and entitlement management module comprise cipher key management unit, authorization terminal administrative unit:
Cipher key management unit is used for store and management user terminal ECC key, symmetric key and relevant parameter;
Authorization terminal administrative unit is used for the deciphering according to each layer key of RMM and ECM completing user received and authority information, extract the rating condition of user, according to the authorization messages received, the authority information of preservation, renewal, maintenance customer, the transmission of key between controller card is used according to the authority information control key reception received, key, realize the signature/verification computing of interaction data, complete terminal and produce and encryption to the interactive information that service end is submitted to;
Content descrambling module is used under the control of authorization terminal administrative unit, adopts the method corresponding with service end to complete descrambling to live, program request and media content download.
For achieving the above object, present invention also offers a kind of IPTV program stream content protecting method, the method comprises the following steps:
Service end system adopts symmetric cryptographic algorithm SM1, asymmetric cryptographic algorithm SM2 and Haas algorithm SM3, and wherein represent symmetric cryptographic algorithm SM1 with symbol E, symbol PE represents asymmetric cryptographic algorithm SM2, and symbol H represents Haas algorithm SM3;
Service end system produces ECC double secret key, determines self mark SID and elliptic curve parameter and basic point P thereof, and produces the double secret key SIK of service end system based on ECC
puband SIK
pri;
Initialization is carried out to terminal security module, produces for each terminal security module TSM and distribute unique TID, by SID, TID and SIK
pubwrite respectively in TSM, generate the double secret key TIK of terminal use based on ECC
puband TIK
pri, and by TIK
pubcharge to system database;
Service end system is the block cipher SM1 that IPTV terminal equipment adds carrier aircraft cartoon letters and media Reinforced turf, and service end system produces terminal security cipher key T SK at random, and is written in the descrambling module of IPTV terminal equipment;
TSM and user side to operator's off-line or online application registration, and illustrate it is individual's registration or packet registration, and service end cryptographic system is that TSM produces customer management information TM and random number r, uses SIK
prito TM signature, and by TM and signature TM||r||PE thereof
sIKpri(TM||r) TSM is write;
TSM SIK
pubthe validity that checking operator signs to TM, if it is invalid to sign, registers unsuccessfully to terminate, if signature effectively, subscriber card returns TID||TM to service end system and uses TIK
prito the signature T ID||TM||r||PE of TID||TM
tIKpri(TID||TM||r);
Service end cryptographic system extracts TIK according to TID from database
pubthe validity that checking TSM signs to TID||TM, if it is invalid to sign, registers unsuccessfully to terminate, if signature effectively, by TID||TM and subscriber card, the signature to TID||TM is recorded into database;
Service end cryptographic system is connected cipher key T LK to TSM with terminal equipment sorter cartoon letters, i.e. PE
tIKpub(TLK||r) || PE
sIKpri(PE
tIKpub) and E (TLK||r)
tSK(TLK||r) || H (TLK||r);
Service end system utilizes SK generation module to produce SK at random, and produces authority information CS;
Service end system adopts PK or DK to be encrypted SK and CS, obtains the entitlement message RMMS:RMMS=EPK/DK (SK||CS) of SK || H (SK||CS), and RMMS is sent to the client of specifying with the authorization of specifying;
Client PK or DK deciphers RMMS and obtains SK||CS, calculate H (SK||CS) and it compared with the H value received, if equal, accepting SK, otherwise refusal accepts SK;
Service end system utilizes CW generation module to produce CW at random, and produce the controling parameters P using this CW, with SK CW be encrypted and calculate HASH, obtaining ECM:ECM=ESK (CW||P) || H (CW||P), and ECM is sent to client with program stream;
The user side SK of oneself decrypts CW, calculates H (CW||P) and compares with the HASH value in ECM, if equal, accepting CW, otherwise refusal accepts CW;
Client, under authority management module controls, according to controling parameters P and authority information CS, is decrypted broadcast program stream cipher with CW and SM1.
In the above-described embodiments, first complete encryption to IPTV program stream or data content, key management and user authorization management in service end, and and then carry out the certification of interactive information with terminal; Complete the deciphering to program stream content, key at different levels or authority at user terminal, and realize the interactive authentication of terminal and system and right performs, thus realize the protection of programme content and the control of consumer behavior, improve the fail safe of IPTV program stream transmission.
Accompanying drawing explanation
In order to be illustrated more clearly in the embodiment of the present invention or technical scheme of the prior art, be briefly described to the accompanying drawing used required in embodiment or description of the prior art below, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.
Fig. 1 is IPTV program stream content protective system and the Method And Principle figure of one embodiment of the invention;
Fig. 2 is the IPTV program stream content protective system key structure figure of one embodiment of the invention;
Fig. 3 is the IPTV program stream content protecting method real time business Protective Key distribution flow figure of one embodiment of the invention;
Fig. 4 is the IPTV program stream content protecting method non-real-time service Protective Key distribution flow figure of one embodiment of the invention.
Embodiment
Below in conjunction with the accompanying drawing in the embodiment of the present invention, be clearly and completely described the technical scheme in the embodiment of the present invention, obviously, described embodiment is only the present invention's part embodiment, instead of whole embodiments.Based on the embodiment in the embodiment of the present invention, those of ordinary skill in the art, not paying the every other embodiment obtained under creative work prerequisite, belong to the scope of protection of the invention.
In an embodiment of the present invention, the protection of video-voice frequency flow is needed when IP network is transmitted based on to IPTV program stream, identity key TIK, personal key or domain key PK/DK, business cipher key SK and Control Word four layers of key code system are adopted to real time programme stream, identity key TIK, personal key or domain key PK/DK and contents encryption key CEK tri-layers of key code system are adopted to non real-time program stream, by controlling to solve application safety problem to the mandate of IPTV real-time streams four layers of key and non real-time stream three layers of key and management; And the present invention uses the cryptographic algorithm of national independent intellectual property right, introduces ID authentication mechanism, make the transmission security flexibility and reliability of IPTV program stream, be easy to promotion and implementation.
The symbol description that the present invention uses is as follows:
||: link.As C=A||B, represent the low segment data of B as C, using the high segment data of A as C, the bit length of C is the bit length sum of A and B.
E: block cipher SM1.
EK: use the enciphering/deciphering computing that SM1 algorithm and key K are carried out.
PE:ECC public key algorithm SM2.
PEK: the encrypt/decrypt using SM2 algorithm and key K to carry out or signature/solution signature computing.
H: use the Hash computing that SM3 algorithm carries out.
R, r: be random number
C
p/D, C
s, C
c: the service condition or the service regeulations that represent key PK/DK, SK and CEK respectively.
P: represent the controling parameters associated with Control Word.
Fig. 1 is IPTV program stream content protective system schematic diagram according to an embodiment of the invention.As shown in Figure 1, it comprises service terminals system and terminal subsystem; Service terminals system comprises service end key management and entitlement management module and content scrambling module; Terminal subsystem comprises terminal key management and entitlement management module and content descrambling module; Its course of work is, completes encryption to IPTV program stream or data content, key management and user authorization management, and realize the certification with terminal interaction information in service end; Complete the deciphering to program stream content, key at different levels or authority at user terminal, and realize the interactive authentication of terminal and system and right performs, thus realize the protection of programme content and the control of consumer behavior.
Fig. 2 is the IPTV program stream content protective system key structure figure of one embodiment of the invention; As shown in Figure 2, the embodiment of the present invention adopts identity key TIK, personal key or domain key PK/DK, business cipher key SK and Control Word four layers of key code system to real time programme stream, identity key TIK, personal key or domain key PK/DK and contents encryption key CEK tri-layers of key code system are adopted to non real-time program stream, by controlling to solve application safety problem to the mandate of IPTV real-time streams four layers of key and non real-time stream three layers of key and management.
In Fig. 1 embodiment, service end key management and entitlement management module comprise service end cipher key management unit and service end empowerment management unit, service end cipher key management unit realize native system use the function such as generation, storage, renewal, granting of key.Comprise:
Symmetric key manages: the key generations such as PK/DK, SK, CEK, CW, cryptographic storage, secure distribution, safety are changed;
Unsymmetrical key manages: realized by card sending system, comprises the generation of all ECC public private key pairs of service end and user terminal in system and relevant parameter etc., distribution, renewal or issue, and sets up and upgrade the black entry record of ECC, the audit of user profile record etc.;
Service end empowerment management unit realizes user authentication and authority of a user information management, and the authority of a user provided according to Subscriber Management System authorizes license and the rights of using of program, comprising:
Rights management: provide live, the rights management of program request or downloading service, comprises user right information and produces and safeguard;
Authorization messages produces: authorization messages comprises key and authority information, and it associates with key management, Content Management and user management and produces authorization messages.Native system has two class authority message: entitlement management message RMM and authorization control message ECM;
Authorization messages (containing key) is encrypted, and comprises RMM encryption equipment and ECM encryption equipment;
User authentication: as access authentication of user, online registration certification, at line service application authentication etc., comprise signature/verification, PKI enciphering/deciphering module;
The distribution of authorization messages right and payment.
Service end content scrambling module comprises real-time scrambling unit and pre-scrambling unit, realizes the scrambling to programme televised live and program request/program downloading and security control respectively, and according to specified format encapsulation code stream, comprising:
Real-time scrambling device: realize the scrambling to living broadcast content stream under the effect of cryptographic algorithm and ciphering key W.
Pre-scrambler: realize the pre-scrambling to request program and download file content under cryptographic algorithm, ciphering key EK effect, the content after scrambling is stored in program server.
Terminal key management comprises terminal key administrative unit, authorization terminal administrative unit with entitlement management module;
Terminal key administrative unit completes the various key of terminal as the store and management of ECC key, symmetric key and relevant parameter.
Authorization terminal administrative unit has been used for following functions:
Authorization messages is deciphered: according to each layer key of RMM and ECM completing user of reception and the deciphering of authority information, extract the rating condition of user as key, the term of validity, Play Control parameter etc.;
Authority information is safeguarded: according to the authorization messages received, the authority information of preservation, renewal, maintenance customer;
Authority performs: the transmission using key between controller card according to the authority information control key reception received, key, reaches the object controlling program decryption and broadcasting;
Authentication: the signature/verification computing realizing interaction data;
Information upload (UM) is encrypted: complete interactive information generation that terminal submits to service end and encryption etc.
Terminal content descrambling module, under the control of authorization terminal administration module, adopts the method corresponding with service end to complete the descrambling of live, program request and media content download.
Fig. 3 is the IPTV program stream content protecting method real time business Protective Key distribution flow figure of one embodiment of the invention; Fig. 4 is the IPTV program stream content protecting method non-real-time service Protective Key distribution flow figure of one embodiment of the invention.With reference to Fig. 3 and Fig. 4; in embodiments of the present invention, the principle of key distribution and protection is, not only will ensure the confidentiality of key; also will ensure the integrality of key and the reliability in source, all keys of distribution all must guarantee that the authorized user only having certification legal can obtain.
In the embodiment of the present invention, all keys are all adopt successively protected mode distribution; namely the ways of distribution of upper strata secret key encryption lower floor key is adopted; except personal key (PK) and domain key (DK) are that other key under it is all by symmetrical grouping algorithm encipherment protection by except the protection of ECC algorithm.Meanwhile, encrypt distribution after each key bundlees together with service condition, user is merely able to (use C according to specified rule
xrepresent) use key.As follows:
RMM
P/D＝PE
TIKpub(PK/DK||C
P/D)||PE
SIKpri(H(PK/DK||C
P/D))；
RMM
S＝E
PK/DK(SK||C
S)||H(SK||C
S)；
RMM
C＝E
PK/DK(CEK||C
C)||H(CEK||C
C)；
ECM＝E
SK(CW||P)||H(CW||P)。
The distribution of each key is that substep completes.Wherein, ECC double secret key completes distribution to generate when system initialization or terminal security module initialization; Personal key PK/ domain key DK is user when registering, under the protection of user ECC public key encryption by online or the mode of off-line be distributed to user; Business cipher key SK adopts PK or DK encipherment protection, is be distributed to when user applies for business; CW adopts SK encryption, when the programme content of system broadcasts encryption with stream distribution in real time; CEK adopts PK or DK encipherment protection, is distributed to designated user online when user applies for non-real-time service mandate.
Except transmission Control Word is that other key is all distribute independent of programme content with except being distributed by the programme content of scrambling.
When there is multiple similar key in system simultaneously, in cipher key distribution message, key identifier KID to be specified, and in programme content, also will comprise the key identifier KID for encrypting this content.
In embodiments of the present invention, terminal use holds user smart card when applying for the registration of to operator, initialization due to system is safe and reliable, operator and subscriber card all obtain the PKI of the other side credibly before registering, both sides all sign to information mutual in registration process, therefore assailant cannot, by replacing or distort these information, make both sides still can succeed in registration when receiving spurious information.Once user registration success, just possesses distribution RMM
p/Dthe i.e. condition of personal key PK and domain key DK.
With reference to Fig. 3 and Fig. 4, in embodiments of the present invention, service end key management and entitlement management module produce personal key PK and domain key DK, and are kept in the storage medium of front end key management and entitlement management module.Service end system calculates RMM
p/D=PE
tIKpub(PK/DK||C
p/D) || PE
sIKpri(H (PK/DK||C
p/D)), by RMM
p/Dterminal is sent to through multiplexing with Entitlement Management Message RMM.Through demultiplexing, terminal key management calculates (PK/DK||C with entitlement management module
p/D) '=PE
tIKpri(PE
tIKpub(PK/DK||C
p/D)), and verify RMM
p/Dvalidity (calculate PE
sIKpub(PE
sIKpri(H (PK/DK||C
p/D))), and with the H ((PK/DK||C calculated
p/D) ') value compares, equal, thinks (PK/DK) '==PK/DK of deciphering), terminal key management only accepts legal PK/DK and C with entitlement management module
p/D, and be stored in the safety zone of terminal key administration module.
With reference to Fig. 3, in embodiments of the present invention, service end key management and entitlement management module produce business cipher key SK, and are kept in the storage medium of service end key management and entitlement management module.Service end system calculates RMM
s=E
pK/DK(SK||C
s) || H (SK||C
s), by RMM
sterminal is sent to through multiplexing with Entitlement Management Message.Through demultiplexing, terminal key management calculates (SK||C with entitlement management module
s) '=E
pK/DK(E
pK/DK(SK||C
s)), and verify SK||C
sintegrality (calculate h ((SK||C
s) '), and with receive h (SK||C
s) value compares, equal, thinks the SK '==SK of deciphering), terminal key management only accepts legal SK and C with entitlement management module
s, and be stored in the safety zone of terminal key administration module.
With reference to Fig. 3, in embodiments of the present invention, service end key management and entitlement management module produce Control Word and calculate ECM=E
sK(CW||P) || H (CW||P), is sent to terminal by ECM with the programme content of scrambling.Terminal key management calculates (CW||P) with entitlement management module '=E
sK(E
sK(CW||P)), and verify that the integrality of CW||P (calculates h ((CW||P) '), and compare with h (CW||P) value received, equal, think deciphering CW '==CW), terminal key management only accepts legal Control Word with entitlement management module, and CW and P is outputted to descrambling module and be used for content descrambling.
With reference to Fig. 4, in embodiments of the present invention, service end key management and entitlement management module produce contents encryption key CEK and calculate RMM
c=E
pK/DK(CEK||C
c) || H (CEK||C
c), by RMM
cterminal is sent to Entitlement Management Message.Through demultiplexing, terminal key management calculates (CEK||C with entitlement management module
c) '=EP
k/DK(E
pK/DK(CEK||C
c)), and verify that the integrality of CW||P (calculates h (CEK||C
c) '), and to compare with h (CW||P) value received, equal, think the CEK '==CEK of deciphering), terminal key management only accepts legal contents encryption key CEK with entitlement management module, and by CEK and C
coutput to descrambling module for content descrambling.
With reference to Fig. 3 and Fig. 4, in embodiments of the present invention, service end Scrambling Operation carries out scrambling to video-voice frequency flow, the video-voice frequency flow after formation scrambling with symmetric cryptographic algorithm and Control Word or contents encryption key CEK; Terminal descrambling operation carries out descrambling with symmetric cryptographic algorithm and the Control Word decrypted or contents encryption key CEK to the video-voice frequency flow after scrambling, forms the plaintext video-voice frequency flow that can watch.Assailant only, under the prerequisite obtaining Control Word or contents encryption key CEK, could utilize symmetric cryptographic algorithm to carry out descrambling to the audio/video flow after scrambling.
In embodiments of the present invention, the symmetric encipherment algorithm of employing, rivest, shamir, adelman and hash cryptographic algorithm are domestic algorithm, and the fail safe that its fail safe have passed national authorities tissue detects, and is safe and reliable.
In embodiments of the present invention, when distributing PK/DK, service end system calculates the Message Authentication Code H (PK/DK) of PK/DK and utilizes service end private key SIK
prisign, be therefore all believable through the effective PK/DK ciphertext of the authenticated signature of user smart card and H (PK/DK), the PK/DK decrypted is believable.
In embodiments of the present invention, when distributing SK, service end system calculates the Message Authentication Code H (SK) of SK, because PK/DK and SK is secret, and PK/DK is believable, assailant cannot pretend to be service end system to calculate H (SK), and therefore verify that the effective SK ciphertext of H (SK) is all believable through subscriber card, the SK decrypted is believable.
In embodiments of the present invention, when distributing CW, service end system calculates the Message Authentication Code H (CW) of CW, because PK/DK, SK and CW are secret, and SK is believable, assailant cannot pretend to be service end system to calculate H (CW), and therefore verify that the effective CW ciphertext of H (CW) is all believable through subscriber card, the CW decrypted is believable.
In embodiments of the present invention, when distributing CEK, service end system calculates the Message Authentication Code H (CEK) of CEK, because PK/DK and CEK is secret, and PK/DK is believable, assailant cannot pretend to be service end system to calculate H (CEK), and therefore verify that the effective CEK ciphertext of H (CEK) is all believable through subscriber card, the CEK decrypted is believable.
In sum; in embodiments of the present invention; because all cryptographic algorithms itself are all safe; password uses key information and cipher-text information in flow process to be all safe; all needs uses the information of cryptoguard all by available protecting; therefore in whole IPTV service flow process (transmission from system initialization to scrambled program and watch); assailant both cannot obtain secret information surreptitiously to see program; also cannot use the cipher key related information or programme information user cheating smart card of forging, the IPTV program stream content protective system method that therefore the present invention relates to is safe.
In embodiments of the present invention, system adopts ciphering key W, SK, PK/DK can upgrade according to certain cycle and strategy, as required to improve the fail safe of system.The TIK of user upgrades and is about 2 years interval time.With the existence of the user watched authority of user or territory effectively, in right continuing phase, it upgrades interval time is 1-2 to individual subscriber key PK or domain key DK.The renewal of programme televised live business cipher key SK can be one day or one month, is determined the term of validity of SK by operator.Renewal interval interval time of Control Word is made by oneself by service end system, generally can be 30-90 second.And CEK is consistent with the file term of validity of claim, generally do not need to upgrade, the term of validity with encrypted file exists and exists.
As shown in Figure 1, the IPTV program stream content protecting method of one embodiment of the invention, comprises the following steps:
1, system initialization and user registration password flow process and agreement
1) system initialization
A) cryptographic algorithm of certainty annuity use:
Symmetric cryptographic algorithm SM1 (representing with symbol E);
Asymmetric cryptographic algorithm SM2 (representing with symbol PE);
Hash algorithm SM3 (representing with symbol H).
Service end system produces ECC double secret key, determines self mark SID and elliptic curve parameter and basic point P thereof, and produces the double secret key (SIKpub, SIKpri) of service end system based on ECC.
B) TSM (terminal security module, form includes but not limited to it is smart card) initialization:
Produce for each TSM and distribute unique TID;
Service end mark SID, end mark TID and SIKpub is write in TSM;
Terminal use is (TIKpub, TIKpri) based on the double secret key of ECC, and TIKpub is charged to system database;
Operator distributes TSM to user, comprises SM2, SM1, SM3 scheduling algorithm in TSM, and TIKpri, TIKpub, SIKpub, SID and TID.
C) IPTV terminal initialization:
Service end system is the block cipher SM1 that terminal equipment adds the use of carrier aircraft cartoon letters and media Reinforced turf;
Service end system produces terminal security cipher key T SK at random, and is written in IPTV terminal equipment descrambling module.
KLPI110505
2) user's registration
Password flow process and the agreement of user's registration are as follows:
A) user holds TSM and mobile terminal to operator's off-line or online application registration, and illustrates it is individual's registration or packet registration.
B) service end cryptographic system is that TSM produces customer management information TM and random number r, uses SIK
prito TM signature, and by TM and signature write TSM thereof.That is:
TM||r||PE
SIKpri(TM||r)。
C) TSM is with SIK
pubchecking operator validity that TM sign, as invalid in signed, register unsuccessfully to terminate, return TID||TM as effective then subscriber card of signing to system end and use TIK
prito the signature of TID||TM, that is:
TID||TM||r||PE
TIKpri(TID||TM||r)。
D) service end cryptographic system extracts TIK according to TID from database
pubthe validity that checking TSM signs to TID||TM, as invalid in signed, register unsuccessfully to terminate, as signed effectively, then by TID||TM and subscriber card, the signature to TID||TM is recorded into database.
E) service end cryptographic system is connected cipher key T LK to TSM with terminal equipment sorter cartoon letters.Namely
PE
TIKpub(TLK||r)||PE
SIKpri(PE
TIKpub(TLK||r))
With
E
TSK(TLK||r)||H(TLK||r)。
2, RMM is distributed
p/Dpassword flow process and agreement
User PK/DK authorization messages is at RMM
p/Din distribution, concrete password flow process and agreement as follows:
A) operator organizes the authority information C producing and associate with PK/DK for designated user or user
p/D(as the PK/DK key term of validity, the available type of service of service end, key service regeulations etc.).
B) RMM is produced
p/D
RMM
P/D＝PE
TIKpub(PK/DK||C
P/D)||PE
SIKpri(H(PK/DK||C
P/D))；
Work as PK/DK||C
p/Dwhen data are greater than 256bit, digital envelope can be used to produce RMM
p/D:
RMM
P/D＝E
K(PK/DK||C
P/D)||PE
TIKpub(K)||PE
SIKpri(H(K||C
P/D))；
By RMM
p/Dbe sent to client.
C) terminal receives RMM
p/D, deciphering PK/DK.Terminal receives RMM
p/Dafter, use private key TIK
prideciphering RMM
p/D, obtain PK/DK and C
p/Dexpressly, and utilize the PKI SIK of ECC signature verification module and system
pubchecking RMM
p/Dvalidity, if effectively, retain PK/DK and C
p/D, invalid, abandon data decryption.
3, distribution service authorization messages RMM
swith password flow process and the agreement of ECM
After user has applied for live broadcast stream media mandate, password flow process and the agreement of authorization messages distribution are as follows:
1) the business cipher key SK of issue and reception programme televised live
A) system end utilizes SK generation module to produce SK at random, and produces authority information C
s(authority information of programme televised live as the program term of validity, plays condition, service regeulations etc.).
B) system end with PK (or DK) to SK and C
sbe encrypted, obtain the entitlement message RMM of SK
s:
RMM
S＝E
PK/DK(SK||C
S)||H(SK||C
S)；
By RMM
sthe client of specifying is sent to the authorization of specifying.
C) terminal PK/DK deciphers RMM
sobtain SK||C
s, calculate H (SK||C
s), and compare with the H value received, equal, accept SK, otherwise refusal accepts SK.
If user applied for N (N be greater than 1 natural number) kind business when having the rating right of this N item business, can:
RMM
S＝E
PK/DK(SK
0||SK
1||...SK
N-1||C
S)||H(SK
0||SK
1||...SK
N-1||C
S)；
2) issue and receive the ECM receiving programme televised live
A) system end utilizes CW generation module to produce CW at random, and produces the controling parameters P using this CW.
B) with SK CW be encrypted and calculate HASH, obtaining ECM:
ECM＝E
SK(CW||P)||H(CW||P)
ECM is sent to terminal with program stream.
C) the terminal SK of oneself decrypts CW, calculates H (CW||P) and compares with the HASH value in ECM, equal, accepts CW, otherwise refusal accepts CW.
When broadcast items content, terminal defers to P and C
s, under authority management module controls, with CW and SM1, broadcast program stream cipher is deciphered.
4, user applies for program request or downloading service mandate RMM
cpassword flow process and agreement
Password flow process when user applies for demand (telecommunication) service and downloading service mandate and agreement as follows:
1) user sends interactive service authorization requests REQ by interactive channel
t
A) user sends service requesting information
REQ
T＝E
PK/DK(TID||CID||W||r)||PE
TIKpri(H(TID||CID||W||r))
CID: program identification information, as channel, programm name, program ID or KID etc.
W: the relevant informations such as the consumption demand of application business.
A) system end receives REQ
tand certifying signature
System end receives REQ
t, first decipher with the PK/DK of this user, then use user identity public key TIK
pubthe validity of certifying signature, namely calculates PETIK
pub(H (TID||CID||W||r)).As invalid in signed, refusal is authorized and feeds back authentication failure message; As signed effectively, then checking the authority of user by authoring system, authorizing if meet and requiring, continuing, otherwise feedback authorization failure information.
2) system sends program request or download file authorization messages RES
s
RES
S＝RMM
c＝E
PK/DK(CEK||C
C||r)||H(CEK||C
C||r)；
C
c: the application program authority information authorized, as the term of validity, play condition, service regeulations etc.Wherein service regeulations define the broadcasting condition of user.
3) IPTV terminal receives program request or download file by broadcast or interactive channel
IPTV terminal PK or DK decrypts CEK||C
c|| r, calculates H, and and RES
sin H value compare, compare r value, all equal, accept CEK, otherwise refusal accept CEK.Then, terminal is according to authority information C
c, with CEK, program request or download file are decrypted.
If when a user has applied for N kind interactive service and has had the rating right of this N item business, can the CEK of the multiple program of disposable distribution, then above-mentioned CEK can replace with:
CEK＝CEK
1||CEK
2...||CEK
N；
If same program has N number of user to apply for, then need same CEK to be distributed to several users (assuming that the rating authority of this N number of user is the same.)：
RMM
c＝E
PK1(CEK||C
C||r)||E
PK2(CEK||C
C||r)||
...E
PKN(CEK||C
C||r))||H(CEK||C
C||r)。
As can be seen from above-described embodiment, main feature of the present invention comprises:
1) cryptographic algorithm aspect
Add, Descrambling Algorithms, the present invention adopts domestic SM1 block cipher.
Reinforced turf algorithm of the present invention adopts the SM1 block cipher that efficiency is higher, and key length is 128 bits, allows to export 1-128 bit cipher sequence at every turn, and real-time scrambling, low delay, fail safe are high, and after preventing scrambling, error diffusion appears in data.The fail safe that this algorithm is organized by national authorities detects, safe and reliable.
Enciphering and deciphering algorithm, the present invention adopts domestic SM1 block cipher.
Adopt domestic block cipher, there is the feature of fast encrypt, low delay, CBC and CTR two kinds of working methods can be supported, 128 bit key length enhance to resist and crack intensity, existing known all kinds of attacks can be resisted, and detected by the fail safe that national authorities organize, safe and reliable.
Signature/verification signature of the present invention, adopts domestic SM2 asymmetric cryptographic algorithm.
The present invention adopts SM2 asymmetric cryptographic algorithm, carries out signature/verification signature to relevant information, enables user be sure of the authenticity of information source transmit leg, and adopts negotiation mode to generate to personal key, improves the fail safe of system.The fail safe that this algorithm is organized by national authorities detects, safe and reliable.
The present invention adopts domestic SM3 hash cryptographic algorithm, calculates Message Authentication Code checking message integrity.
2) key code system aspect
The main body key code system that native system method adopts is as follows:
1) key code system of live television programming stream is protected:
1st layer: the identity key SIK (Service Identity Key) of system and user and TIK (Terminal Identity Key).ECC double secret key is respectively SIKpri/SIKpub and TIKpri/TIKpub, distributes online and realize authentication when user such as to register at the application and between mechanism for the protection of PK/DK.This key is that off-line produces and writes card.
2nd layer: personal key PK (Personal Key) or domain key DK (Domain Key), the empowerment management being respectively used to realize user or user's group is distributed online with protection SK.
3rd layer: business cipher key SK (Service Key), provides in real time for the control mandate and protection CW realizing classify traffic, separate traffic or service groups.
4th layer: control word ciphering key W (Contron Word), for realizing the transmission protection of media content, with the online distribution of program stream information timing.
2) key code system of video file program request or downloading service is protected:
1st layer: system and user identity key; ECC double secret key is respectively SIKpri/SIKpub and TIKpri/TIKpub; this layer of key and the live the 1st layer of ECC key share, for realizing bidirectional identity authentication under interactive application between user and mechanism and protection PK/DK distributes online.
2nd layer: personal key PK (Personal Key) or domain key DK (Domain Key), this layer of key and the live the 2nd layer of PK/DK key share, and organize empowerment management for realizing user/user and protect CEK to distribute online.
3rd layer: contents encryption key CEK (Content Encryption Key), realizes the encryption of on-demand media stream and media content download.
One of ordinary skill in the art will appreciate that: accompanying drawing is the schematic diagram of an embodiment, the module in accompanying drawing or flow process might not be that enforcement the present invention is necessary.
One of ordinary skill in the art will appreciate that: the module in the device in embodiment can describe according to embodiment and be distributed in the device of embodiment, also can carry out respective change and be arranged in the one or more devices being different from the present embodiment.The module of above-described embodiment can merge into a module, also can split into multiple submodule further.
One of ordinary skill in the art will appreciate that: all or part of step realizing said method embodiment can have been come by the hardware that program command is relevant, aforesaid program can be stored in a computer read/write memory medium, this program, when performing, performs the step comprising said method embodiment; And aforesaid storage medium comprises: ROM, RAM, magnetic disc or CD etc. various can be program code stored medium.
Last it is noted that above embodiment is only in order to illustrate technical scheme of the present invention, be not intended to limit; Although with reference to previous embodiment to invention has been detailed description, those of ordinary skill in the art is to be understood that: it still can be modified to the technical scheme described in previous embodiment, or carries out equivalent replacement to wherein portion of techniques feature; And these amendments or replacement, do not make the essence of appropriate technical solution depart from the spirit and scope of embodiment of the present invention technical scheme.
Claims (6)
1. an IPTV program stream content protecting method, is characterized in that, comprises the following steps:
Service end system adopts symmetric cryptographic algorithm SM1, asymmetric cryptographic algorithm SM2 and Haas algorithm SM3, and wherein represent symmetric cryptographic algorithm SM1 with symbol E, symbol PE represents asymmetric cryptographic algorithm SM2, and symbol H represents Haas algorithm SM3;
Service end system produces ECC double secret key, determines self mark SID and elliptic curve parameter and basic point P thereof, and produces the double secret key SIK of service end system based on ECC
puband SIK
pri;
Initialization is carried out to terminal security module, produces for each terminal security module TSM and distribute unique TID, by SID, TID and SIK
pubwrite respectively in TSM, generate the double secret key TIK of terminal use based on ECC
puband TIK
pri, and by TIK
pubcharge to system database;
Service end system is the block cipher SM1 that IPTV terminal equipment adds carrier aircraft cartoon letters and media Reinforced turf, and service end system produces terminal security cipher key T SK at random, and is written in the descrambling module of IPTV terminal equipment;
TSM and user side to operator's off-line or online application registration, and illustrate it is individual's registration or packet registration, and service end cryptographic system is that TSM produces customer management information TM and random number r, uses SIK
prito TM signature, and by TM and signature TM ‖ r ‖ PE thereof
sIKpri(TM ‖ r) writes TSM;
TSM SIK
pubthe validity that checking operator signs to TM, if it is invalid to sign, registers unsuccessfully to terminate, if signature effectively, subscriber card returns TID ‖ TM to service end system and uses TIK
prito the signature T ID ‖ TM ‖ r ‖ PE of TID ‖ TM
tIKpri(TID ‖ TM ‖ r), wherein || represent link;
Service end cryptographic system extracts TIK according to TID from database
pubthe validity that checking TSM signs to TID ‖ TM, if it is invalid to sign, registers unsuccessfully to terminate, if signature effectively, by TID ‖ TM and subscriber card, the signature to TID ‖ TM is recorded into database;
Service end cryptographic system is connected cipher key T LK to TSM with terminal equipment sorter cartoon letters, i.e. PE
tIKpub(TLK ‖ r) ‖ PE
sIKpri(PE
tIKpub(TLK ‖ r)) and E
tSK(TLK ‖ r) ‖ H (TLK ‖ r);
After user has applied for live broadcast stream media mandate, service end system has utilized SK generation module to produce SK at random, and produces authority information CS;
Described service end system adopts PK or DK to be encrypted SK and CS, obtains the entitlement message RMM of SK
s: RMM
s=E
pK/DK(SK ‖ CS) ‖ H (SK ‖ CS), and by RMM
sthe client of specifying is sent to the authorization of specifying;
Described client PK or DK deciphers RMM
sobtain SK ‖ CS, calculate H (SK ‖ CS) and it is compared with the H value received, if equal, accepting SK, otherwise refusal accepts SK;
Described service end system utilizes CW generation module to produce CW at random, and produces and use the controling parameters P of this CW, to be encrypted and to calculate HASH, obtain ECM:ECM=E with SK to CW
sK(CW ‖ P) ‖ H (CW ‖ P), and ECM is sent to described client with program stream;
The described user side SK of oneself decrypts CW, calculates H (CW ‖ P) and compares with the HASH value in ECM, if equal, accepting CW, otherwise refusal accepts CW;
Described client, under authority management module controls, according to controling parameters P and authority information CS, is decrypted broadcast program stream cipher with CW and SM1.
2. method according to claim 1, is characterized in that, described authority information CS comprises: the program term of validity, broadcasting condition and service regeulations.
3. method according to claim 1, is characterized in that, if client application N item business when having the rating right of this N item business, and RMM
s=E
pK/DK(SK0 ‖ SK1 ‖ ... SKN-1 ‖ CS) ‖ H (SK0 ‖ SK1 ‖ ... SKN-1 ‖ CS).
4. method according to claim 1, is characterized in that, further comprising the steps of:
Client sends interactive service authorization requests REQ by interactive channel
t, REQ
t=E
pK/DK(TID ‖ CID ‖ W ‖ r) ‖ PE
tIKpri(H (TID ‖ CID ‖ W ‖ r)), wherein, CID is program identification information, and W is the consumption demand information of application business;
The REQ that the PK/DK deciphering that described service end system adopts described client corresponding receives
t, and with the user identity public key TIK of described client
pubcalculate PE
tIKpubthe validity of (H (TID ‖ CID ‖ W ‖ r)) certifying signature, if it is invalid to sign, refusal is authorized and feeds back authentication failure message; If signature effectively, checks the authority of user by authoring system, authorize if meet and require, continue, otherwise feedback authorization failure information;
Service end system sends program request or download file authorization messages RES
s,
RES
s=RMM
c=E
pK/DK(CEK ‖ CC ‖ r) ‖ H (CEK ‖ CC ‖ r), wherein, contents encryption key CEK is produced by service end key management and entitlement management module, and CC is the application program authority information authorized;
Described client PK or DK decrypts CEK ‖ CC ‖ r, calculates H, and and RES
sin H value compare, and compares r value, if all equal, accept CEK, otherwise refusal accepts CEK;
Described client, according to authority information CC, is decrypted program request or download file with CEK.
5. method according to claim 4, is characterized in that, if client application N item interactive service when having the rating right of this N item business, N be greater than 1 natural number, the CEK of the N number of program of disposable distribution,
CEK＝CEK
1‖CEK
2…‖CEK
N。
6. method according to claim 4, is characterized in that, if same program has N number of client application, then same CEK is distributed to N number of user:
RMM
c＝E
PK1(CEK‖CC‖r)‖E
PK2(CEK‖CC‖r)‖
…E
PKN(CEK‖CC‖r))‖H(CEK‖CC‖r)。
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110219928.5A CN102917252B (en) | 2011-08-02 | 2011-08-02 | IPTV (internet protocol television) program stream content protection system and method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110219928.5A CN102917252B (en) | 2011-08-02 | 2011-08-02 | IPTV (internet protocol television) program stream content protection system and method |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN102917252A CN102917252A (en) | 2013-02-06 |
| CN102917252B true CN102917252B (en) | 2015-03-25 |
Family
ID=47615458
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201110219928.5A Active CN102917252B (en) | 2011-08-02 | 2011-08-02 | IPTV (internet protocol television) program stream content protection system and method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102917252B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104283859A (en) * | 2013-07-10 | 2015-01-14 | 上海信颐信息技术有限公司 | Encryption and decryption method for advisement player documents |
| CN103634624A (en) * | 2013-11-15 | 2014-03-12 | 四川长虹电器股份有限公司 | Digital television live broadcasting method and system based on IP (Internet protocol) network |
| CN103761467A (en) * | 2013-12-31 | 2014-04-30 | 航天数字传媒有限公司 | Terminal authorization device and system |
| CN103927624A (en) * | 2014-04-18 | 2014-07-16 | 杭州郑达艺学科技有限公司 | Fine arts teaching system |
| CN110300289B (en) * | 2019-07-31 | 2020-08-21 | 北京中安国通科技有限公司 | Video safety management system and method |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2001217843A (en) * | 2000-02-01 | 2001-08-10 | Toyo Commun Equip Co Ltd | Cryptocommunication protocol structure and enciphering ip packet format |
| CN101902611A (en) * | 2009-06-01 | 2010-12-01 | 航天信息股份有限公司 | Method for realizing IPTV digital rights management |
| CN101902610A (en) * | 2009-05-27 | 2010-12-01 | 航天信息股份有限公司 | Method for realizing secure communication between IPTV set top box and smart card |
| CN102111681A (en) * | 2009-12-24 | 2011-06-29 | 航天信息股份有限公司 | Key system for digital television broadcast condition receiving system |
-
2011
- 2011-08-02 CN CN201110219928.5A patent/CN102917252B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2001217843A (en) * | 2000-02-01 | 2001-08-10 | Toyo Commun Equip Co Ltd | Cryptocommunication protocol structure and enciphering ip packet format |
| CN101902610A (en) * | 2009-05-27 | 2010-12-01 | 航天信息股份有限公司 | Method for realizing secure communication between IPTV set top box and smart card |
| CN101902611A (en) * | 2009-06-01 | 2010-12-01 | 航天信息股份有限公司 | Method for realizing IPTV digital rights management |
| CN102111681A (en) * | 2009-12-24 | 2011-06-29 | 航天信息股份有限公司 | Key system for digital television broadcast condition receiving system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN102917252A (en) | 2013-02-06 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN100459697C (en) | IPTV system, enciphered digital programme issuing and watching method | |
| US8761393B2 (en) | Method and apparatus for providing secure internet protocol media services | |
| CN101902611B (en) | Method for realizing IPTV digital rights management | |
| KR100724935B1 (en) | Apparatus and method of interlock between entities for protecting contents, and the system thereof | |
| CN102802036B (en) | System and method for identifying digital television | |
| CN101019370A (en) | Method of providing conditional access | |
| CN104040939A (en) | Secure distribution of content | |
| US9277259B2 (en) | Method and apparatus for providing secure internet protocol media services | |
| CN101719910A (en) | Terminal equipment for realizing content protection and transmission method thereof | |
| CN101277181A (en) | Dynamic multilayer encryption method for managing flow medium digital authority | |
| CN102724568A (en) | Authentication certificates | |
| CN101640785B (en) | Encrypting/decrypting system and encrypting/decrypting method for interactive network television | |
| CN102917252B (en) | IPTV (internet protocol television) program stream content protection system and method | |
| CN102111681B (en) | Key system for digital television broadcast condition receiving system | |
| CN101562520B (en) | Method and system for distributing service secret keys | |
| CN1946018B (en) | Encrypting and de-encrypting method for medium flow | |
| US20220171832A1 (en) | Scalable key management for encrypting digital rights management authorization tokens | |
| CN103546767B (en) | Content protection method and system of multimedia service | |
| CN101505400B (en) | Bi-directional set-top box authentication method, system and related equipment | |
| CN101521668B (en) | Method for authorizing multimedia broadcasting content | |
| CN101500146A (en) | Digital television receiving control method and apparatus based on bi-directional network | |
| CN101552793B (en) | Method for downloading digital multimedia file and program order commission | |
| CN101505402B (en) | Authentication method for uni-directional network digital television conditional receiving system terminal deciphering module | |
| CN100588244C (en) | Method and system for implementing broadcasting network condition receiving | |
| CN101500147B (en) | Digital television receiving control method and apparatus based on bi-directional network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant |