CN112602288A - Method for obtaining a sequence of encryption keys - Google Patents

Abstract

Method for obtaining L encryption keys k_1,m,k_i,m,k_i+1,m,k_L,mThe method of (a), wherein: at time t_1,mPreviously, the receiver group establishes (140) a first connection to the key server and receives during this first connection the key k obtained_1,mThe required information, then for each index i between 2 and L: the receiver group is formed by using the previous key k_i‑1,mPerforming an initialized key derivation algorithm to obtain (150) a subsequent key k_i,mWithout the aid of information other than that received during the first connection; and performing a key derivation algorithm by the receiver group to obtain a key k_i,mAverage time TC of_i,mGreater than 0.2V_i‑1,mWherein V is_1‑i,mIs the previous key k_i‑1,mThe duration of the validity interval of (c).

Description

Method for obtaining a sequence of encryption keys

The invention relates to a method for obtaining a sequence of encryption keys and to a method for securely transmitting digital content by implementing the obtaining method. The invention also relates to a data storage medium, a receiver and a key server for implementing the method for obtaining a key sequence.

It is known to obtain L encryption keys k by means of a group of electronic receivers_1,m,...,k_i,m,k_i+1,m,...,k_L,mThe method of (a), wherein:

the index i is the key k_i,mThe sequence number in the key sequence is,

-L is an integer greater than or equal to two, and

-key k whatever the index i between 1 and L is_i,mIntended only for duration V_i,mInterval of validity of [ t ]_i,m,t_i+1,m[ period, where t_i,mAnd t_i+1,mRespectively the start time and the end time of the validity interval.

In these known methods:

at a time t_1,mPreviously, the receiver group established a first connection with the key server and received the derived key k during this first connection_1,mThe required information, then

For each index i between 2 and L, at a time t_i,mPreviously, the receiver group obtained the key k_i,m。

One such method is disclosed in patent application EP 2567500. In patent application EP2567500, each key k_i,mA single given block CP all for processing multimedia content_i,mThe playing time is called "key validity period". The term key validity period also refers to the block CP_i,mItself. Key k_i，mThus, the CP is set to correspond to the validity period of the key_i,mTime interval of [ t ]_i,m；t_i+1,m[ (i.e. the key validity period CP during the playing of the multimedia content)_i,mTime interval of) ofInterval [ t ]_i,m,t_i+1,m[ period is effective. Therefore, in order to be able to decrypt the key validity period CP_i,mMust be at time t_i,mPreviously, the key k was obtained by the receiver_i,m. Ideally, it must be at time t_i,mObtaining the key k as late as possible in advance_i,mIn order to minimize its exposure to crypto-analysis or attack attempts at the receiver as much as possible. Typically, during the previous key validity period, i.e. in the interval t_i-1,m；t_i，mDuring which the key k is obtained_i，m. Under these conditions, the key k_i，mOnly in the interval t_i-1，m；t_i，mDuring a portion of [ i.e., typically during a duration of up to about ten seconds, is exposed to a cryptanalysis or attack attempt. The short duration of this interval makes it difficult to be attacked.

In order to obtain a key k_i,mThe receiver must be connected to the key server. Therefore, without any specific setup, the receiver must connect to the key server every key validity period. Since the number of receivers that need to be connected to the same key server can be very large, i.e. greater than 1000 or 10000, the number of connections that the key server must be able to manage during the key validity period is also very large.

In order to limit the computer resources required for implementing such a key server, patent application EP2567500 discloses in particular that, during the connection to the key server, not only will the next key validity period CP be decrypted_1，mValid Key k_1,mTransmitted to each receiver, and will also be used to decrypt the next L key validity periods_1，m；...；k_L，mIs transmitted to each receiver. Thus, the receiver does not need to connect to the key server every key validity period, but only every L key validity periods.

Patent application EP2567500 also discloses that transmitting such a key sequence to a receiver in this way before the keys are useful, reduces the security of the method. In practice, for example, during the key validity period CP_1，mPreviously, a sequence k was received as L keys_1，m；...；k_L，mKey k of_L，mAnd only from time t_L，mIt is used after being started. Key k_L，mAnd is therefore exposed to attack attempts during L consecutive key validity periods. In contrast, if none of the keys k is used_i，mTransmitted to the receiver in advance, the same key k_L，mOnly exposed to attack attempts during at most a single key validity period.

In order to remedy this problem while limiting the number of simultaneous connections to the key server, patent application EP2567500 proposes to adjust the number L of keys transmitted in advance to each receiver according to the probability of the receiver being compromised by an attack attempt. Thus, it is possible to both reduce the number of connections to be established with the key server, while maintaining a high level of security.

It is also known from the prior art:

EP2460308A1, and

biming Tian et al: "An effective Self-Healing Key Distribution Scheme", New Technologies, Mobility and Security, NTMS '08', IEEE, 5/11/2008, pages 1-5.

EP24660308 describes a solution for improving the robustness of a secure data transmission system to faults in the data transmission network, such as packet losses. To this end, only in case of network failure, the receiver may construct a new encryption key that may be encrypted in the time interval [ i; the decryption key used during i +1[ time. In case the data transmission network is functioning properly, the number of connections of the receiver to the server is not reduced.

The present invention aims to solve the same problems as described in EP2567500, but does not take into account the safety level of the receiver for this purpose. One subject of the invention is therefore such a method as claimed in claim 1.

Embodiments of the obtaining method may comprise one or more of the features of the dependent claims.

Another subject of the invention is a method for the secure transmission of digital content.

Another subject of the invention is a data storage medium readable by a microprocessor and comprising instructions for implementing the method subject of the present patent application when these instructions are executed by the microprocessor.

Another subject of the invention is a receiver group for implementing the acquisition method according to the subject of the present patent application.

Finally, another subject of the invention is a key server for implementing the acquisition method according to the subject of the patent application.

The invention will be better understood from reading the following description, made with reference to the accompanying drawings, which are given by way of non-limiting example only, and in which:

figure 1 is a schematic view of an encryption system for transmitting and receiving multimedia content;

figure 2 is a flow chart of a method for secure transmission of multimedia content implemented in the system of figure 1;

figures 3 and 4 are flow charts of two different variants of the method of figure 2.

Chapter 1: term(s) for

In the drawings, like reference numerals are used to indicate like elements.

Features and functions well known to those skilled in the art are not described in detail below in the present specification.

Examples of embodiments are given in the specific case of a system for conditionally accessing multimedia content. Therefore, a term specific to this case is used. Several specific definitions for this term are given below. However, to gain more information about this term, the reader is referred to the following documents: "Functional Model of Conditional Access System", EBU Review, Technical European Broadcasting Union, Brussels, BE, No. 266, 12.21.1995.

Herein, the terms "scrambling" and "descrambling" are considered synonyms for "encryption" and "decryption", respectively.

"multimedia content" refers to audio and/or video content that is intended to be reconstituted into a form that can be directly perceived and understood by a human. Typically, multimedia content corresponds to a sequence of images forming a movie, a television program, or an advertisement. The multimedia content may also be interactive content such as games.

"plaintext" data or "plaintext data" corresponds to data before it is scrambled or encrypted. Thus making it directly understandable by a person without having to resort to descrambling operations, and whose visualization is not limited by certain conditions.

In order to keep the visualization of the multimedia content secure and subject to certain conditions, such as paid subscriptions, the multimedia content is distributed in scrambled rather than plain text form. More precisely, each multimedia content is divided into a sequence of key validity periods. The access conditions to the disturbed multimedia content remain unchanged during the whole duration of the key validity period. In particular, the multimedia content is scrambled during the entire duration of the key validity period, using the same encryption key (known by the term "control word"). Generally, the control word varies from one key validity period to the next.

Herein, a "password file" refers to data or information terms that are not sufficient by themselves to discover plaintext data (i.e., data such as that which allows for the establishment of its password file before encryption is applied). Thus, if the transmission of the password file is intercepted, knowledge of the password file alone does not allow clear data to be found. In order to find the plaintext data, the password file must be combined with the secret information. The secret information is typically an encryption key that allows decryption of the cryptographic file. However, the password file may also be a reference to data stored in a table containing a plurality of similar data. In this case, the secret information is a table associating each password file to plaintext data.

Chapter 2: symbol

The symbols defined in this section are used throughout this patent application.

CP_mIs the mth cryptoperiod of validity of the multimedia content.

The subscript "m" is a sequential number that identifies a location relative to a reference point. The reference point may be independent ofThe absolute origin of the multimedia content is either relative to the origin of the transmitted multimedia content. Hereinafter, the reference point is a relative origin. The reference point is the start of the multimedia content. Thus, the key validity period CP₁Is the first key validity period of the multimedia content, the key validity period CP₂Is the second key validity period for the multimedia content and so on.

k_mIs an encryption key, known by the term "control word", and is used only for the scrambling and descrambling key validity periods CP_m. Key k_mThus immediately preceding the key k_m-1Then and immediately after the next key k_m+1Before use.

t_mAnd t_m+1Respectively a key validity period CP_mAt the point where it starts and ends as it is played by the receiver. Thus, time t₁First key validity period CP corresponding to multimedia contents₁Is initiated.

Time interval t_m；t_m+1Corresponding to the key validity period CP during which it is played by the receiver_mThe time interval of (c). Interval [ t ]_m；t_m+1[ also for scrambling key validity period CP_mKey k of_mThe effective interval of (2). In fact, the key k_mTherefore, it can be only in the interval t_m；t_m+1During which it is used to descramble the multimedia content. Outside this time interval, the key k_mIt is not allowed to descramble the multimedia content correctly.

V_mIs the interval [ t_m；t_m+1The length of time of [ is. When all intervals [ t ]_m；t_m+1[ having the same duration, and thus when the duration V is_mIndependently of the subscript m, this time period is simply denoted as V.

ECM_mIs an Entitlement Control Message (ECM). ECM_mThe message containing a validity period CP of the descrambling-permitted key_mKey k of_mECM message of the identifier of.

SE_pIs a key sequence k₁；...；k_m；k_m+1；...；k_NI.e. the key k₁To k is_NIn order ofColumn, where N is the sequence SE_pThe number of keys in the key set.

SR_mIs a key sequence k_m；k_m+1；...；k_m+L-1I.e. the key k_mTo k is_m+L-1Wherein L is the sequence SR_mThe number of keys in the key set. The quantity L is symmetrically less than or equal to a pre-stored threshold value L_max. The threshold value L_maxLess than N and for example two or ten or one hundred times smaller than the number N. Number L_maxIs an integer greater than or equal to two that is pre-stored in the memory 110. Number L_maxIs the sequence SR_mIs measured. Thus, each sequence SR_mComparing sequence SE_pMuch shorter.

k_i，mIs the sequence SR_mThe ith key of (1). The subscript i indicates the key k_i，mIn the sequence SR_mRelative to the first key k of the sequence_mThe position of (a). The index i is the key k_i，mIn the sequence SR_mThe sequence number in (1). For sequence SR_mThe index i of the first key of (a) has a value equal to 1. Thus, the key k_i，mIs equal to the secret key k_i+m-1. The same symbol is also used for the key k_i，mAny variables associated. For example, symbol C_i，mIndication and k_i，mAssociated control information C_i+m-1。

Chapter 3: examples of the embodiments

Fig. 1 shows a system 2 for transmitting and receiving scrambled multimedia content. For example, multimedia content corresponds to a sequence of audiovisual programs such as television programs or movies.

Plaintext multimedia content is generated by one or more sources 4 and transmitted to a transmitting device 6. The device 6 transmits the multimedia content to a plurality of receivers synchronously via a data transmission network 8. The number of receivers is typically very large, i.e. greater than 1000 or 10000. To simplify fig. 1, only three receivers 10 to 12 are shown.

The network 8 is typically a long-range data transmission network, such as an internet network or a satellite network, or any other transmission network, such as a transmission network for transmitting terrestrial digital television (TNT).

The device 6 comprises an encoder 16 which compresses the multimedia content it receives. The encoder 16 processes the digital multimedia content. For example, the encoder operates according to the MPEG2(Moving Picture expert Group-2) standard or the UIT-T H264 standard.

The compressed multimedia content is directed to an input 20 of a scrambler 22. The scrambler 22 scrambles each compressed multimedia content so that its visualization is limited by certain conditions (such as the purchase of access rights by the user of the receiver). The scrambled multimedia content is sent to an output 24 connected to an input of a multiplexer 26.

The scrambler 22 operates by using the corresponding key k_m(known in the field of conditional access systems by the term "control word") to scramble each key validity period CP of the compressed multimedia content_m. In general, the Scrambling conforms to standards such as DVB-CSA (Digital Video Broadcasting-Common Scrambling Algorithm), ISMA Cry (Internet Streaming Media Alliance Cry), SRTP (Secure Real-time Transport Protocol), AES (advanced Encryption Standard), and the like.

Key validity period CP_mDuration V of_mTypically greater than five seconds and preferably between 5 seconds and 10 minutes. In the present embodiment, all the key validity periods CP_mWith the same duration V.

The device 6 also comprises an access control system 28. This system 28 is more known by the abbreviation cas (conditional Access system). Here, the CP is valid for each key_mIn other words, system 28:

-key k to be used for scrambling the key validity period_mTo the scrambler 22, and

-generating an ECM_mA message containing at least a validity period CP to be used for descrambling the key_mKey k of_mId of_m。

ECM_mThe message is here multiplexed with the key validity period CP by means of a multiplexer 26_mAnd (6) associating. To this end, in this example, the ECM_mMessage and key validity period CP_mAre synchronized with respect to each other in time by multiplexing them on the same audiovisual signal transmitted on the network 8. Rather, the key validity period CP immediately precedes it_mKey validity period CP_m-1During the period, ECM will be used_mThe message is transmitted to the receiver.

Here, the receivers 10 to 12 are identical, and only the receiver 10 is explained in more detail.

The receiver 10 comprises a module 70 for receiving the transmitted multimedia content. This module 70 is connected to the input of a demultiplexer 72. The demultiplexer 72 on the one hand validates each received scrambled key validity period CP_mTo the descrambler 74 and, on the other hand, to the processor 76, of the messages ECM and emm (entitlement Management message).

The processor 76 processes confidential information such as encryption keys. In order to protect the confidentiality of this information, it is designed to be as robust as possible to hacking attempts. Which is therefore more robust to these attacks than other components of the receiver 10. This robustness is obtained, for example, by implementing software modules dedicated to protecting secret information.

The processor 76 is generated, for example, by using a programmable microprocessor 77 capable of executing instructions stored on a data storage medium. To this end, the processor 76 also includes a memory 78 containing instructions necessary to perform the method of FIG. 2.

The memory 78 also includes, for example:

a single symmetric secret encryption key shared with the key server 106;

an asymmetric cryptographic secret key and an associated cryptographic certificate, i.e. an associated public key, to authenticate the receiver 10.

The memory 78 also contains a local table 79 containing the currently available key k_m。

The descrambler 74 operates by using the key k transmitted by the processor 76_mTo descramble the scrambled multimedia content. The descrambled multimedia content is transmitted to a decoder 80 which decodes it. Will be decompressed or decodedTo a graphics card 82 which manipulates the display of the multimedia content on a display 84 provided with a screen 86.

The display 84 displays the multimedia content plaintext on a screen 86.

The receiver 10 also includes a transceiver 88 that allows a secure connection to be established between the processor 76 and the headend 90 via a data transmission network 92. For example, the network 92 is a long-range data transmission network, and more specifically a packet-switched network (such as the internet). The secure connection is, for example, a secure tunnel using an encrypted certificate of the processor 76.

The head end 90 comprises a module 100 for managing the access rights of the different users of the system 2. This module 100 is more known by the term "user authorization system". The module 100 generates and updates a database 102. The database 102 associates each user identifier with the access rights acquired by the user. The database 102 is stored in a memory 104.

The headend 90 also includes a key server 106. The server 106 comprises, inter alia, a key k_mA generator 108 and a memory 110.

The memory 110 includes:

counter C of the number of connections per unit time_nbc，

-including each generated key k_mAnd for each key k whose index is greater than or equal to 1_mControl information C of_m。

Counter C_nbcThe number of connections per unit time established by all receivers of the system 2 with the server 106 is counted. In general, the counter C_nbcIncluding the number of such connections recorded during a sliding time window of duration deltat. The sliding window ends at the current time. The time period Δ T is, for example, V to 24 hours, or V to 1 hour.

Typically, the server 106 is generated using a programmable microprocessor 114 capable of executing instructions stored on a data storage medium. To this end, the memory 110 also includes instructions for performing the method of fig. 2.

The operation of the system 2 will now be described in more detail with reference to the method of figure 2. Here, it is assumed that table 79 is initially empty.

The method starts, in response to a request for content transmission, with an initialization phase 114 of the values of the different parameters required for carrying out the subsequent steps. The values of these parameters are stored in memory 110. These parameters are presented step by step in the description of the following steps. So, although it is positioned chronologically before the following steps, in the present description the way in which the values of these parameters are set during stage 114 is explained after these steps. Once phase 114 terminates, the transmission of the multimedia content may begin.

During step 116, generator 108 generates sequence SE one by one_pKey k of_m. Each key k of the sequence_mCorresponding key validity period CP for multimedia content to be transmitted_mAnd (4) scrambling. Over time, generator 108 successively generates key k₁To k is_N. Here, sequence SE_pThe number N of keys in (a) is for example equal to or greater than the key validity period CP of the multimedia content to be scrambled_mThe number of the cells.

To generate a sequence SE_pThe generator 108 obtains the key k₁Starting then, for any index m greater than or equal to two, by performing the operations for deriving the key k_mFrom the previous key k, D1_m-1To derive a subsequent key k_m。

During operation 117, the generator 108 obtains the key k₁E.g. by randomly or pseudo-randomly drawing the set E_kTo obtain the key k₁. Here, set E_kIncluding its binary representation including at most N_kAll integers of bits. Number N_kIs pre-stored in the memory 110. E.g. number N_kIs equal to 16, 32, 48 or 56. Generated key k₁And then stored in table 112.

Next, during operation 118, the generator 108 generates the key k by executing the previous key k_m-1The same algorithm D1 parameterized from the previous oneKey k_m-1To derive each subsequent key k_m. Therefore, it is not possible to locate the key k_m-1Generating a key k beforehand_m. Key k_mAnd thus are generated one by one.

Here, the algorithm D1 is also denoted by PC_pIs parameterized, as will be explained below, which allows increasing or decreasing the average number of operations performed by the receiver for the slave key k_m-1Obtaining a secret key k_m. Parameter PC_pThus allowing to increase or decrease the key k used for deriving performed by the receiver_i，mAverage execution time TC of the second algorithm D2_i，m. Mean time TC_i，mAlgorithm D2 is started to be executed at processor 76 to obtain key k_i，mThe time of day and the processor 76 since the key k has been obtained_i，mWhile the average time elapsed between the times of execution of algorithm D2 is terminated. Mean time TC_i，mThus generally corresponds to the average of the times spent by the processors 76 of the terminals of the system 2 for obtaining the key k by executing the algorithm D2_i，m. In this first embodiment, the parameter PC_pIs a set of integers E_RThe size of (2). Set E_RIncluding binary representation thereof including at most N_RAll integers of bits. E.g. number N_REqual to parameter PC_pThe value of (c).

In this embodiment, algorithm D1 is a key calculation involving a calculation from set E_RRandomly extracting the sequence of the number R. Hereinafter, this type of algorithm is referred to as "random key calculation". For example, each time algorithm D1 is executed, generator 108 performs the following operations to generate a subsequent key k_m：

1) From the set E_RIn which the number R is randomly or pseudo-randomly extracted_mThen, then

2) Calculating the secret key k by using the following relation_m：k_m＝F₁(R_m//k_m-1) Wherein:

the symbol "/" denotes the key K_m-1Value and number R of_mPerforming a combined operation, and

-F₁is a known function of the generator 108 and the receiver.

For example, here, the operation "//" is an exclusive or operation, typically indicated by the symbol XOR. Function F₁Typically a one-way function. For example, function F₁Selected from the group of one-way functions G consisting of symmetric cryptographic functions, asymmetric cryptographic functions and hash functions₁。

In the present embodiment, during additional operation 119, for each key k generated by executing algorithm D1_mThe generator 108 also generates control information C_m. Control information C_mIs from the key k_m-1To obtain a key k_mParameters of the required algorithm D2. In the present embodiment, control information C_mIs to allow the receiver to know the quantity R_mFrom the previous key k_m-1To obtain a key k_mThe information of (1). For example, control information C_mIs calculated by the generator 108 by using the following relation: c_m＝H₁(k_m) In which H is₁Is a one-way cryptographic function. Due to H₁Is a one-way function, i.e. for which it is very difficult to calculate the pre-image from its image, so based on knowing only the control information C_mThe key k cannot be derived_m. Function H₁Is also typically selected from the group of functions G₁. Here, the function F₁And H₁Are consistent. For example, function F₁And H₁Both are the same hash function.

Will be associated with control information C_mAssociated with each key k generated by the execution of the algorithm D1_mIs stored in table 112. The generator 108 will also pass each key k_mTo the system 28.

Trigger step 116 early enough that the value of index m, however, key k_mUsing the key k for the scrambler 22_mTo scramble the key validity period CP_mAre available in a timely manner. In addition, the execution of step 116 is triggered here sufficiently early that at each instant t_mTable 112 already contains at least the key k_mTo k is_m+LmaxAnd associated control information C_mTo C_m+Lmax. Number L_maxIs an integer greater than or equal to one that is pre-stored in the memory 110. Number L_maxIs the sequence SR_mIs measured.

In parallel with step 116 or after step 116, during step 120, device 6 divides the multimedia content into successive key validity periods, by using the corresponding key k_mTo scramble each key validity period CP_mThe scrambled key validity is then transmitted. Containing a secret key k_mId of_mOf (2)_mThe message is multiplexed with the corresponding key validity period of the transmitted multimedia content. This multiplexing allows to Id each identifier_mTransmission and key validity period CP of multimedia content_mThe transmission of (a) is synchronized. Here, the CP is only in the key validity period_mPrevious key validity period CP_m-1During which the identifier Id will be_mTo be transmitted to a receiver. In the first key validity period CP₁In the case of (2), immediately before the first key validity period CP₁Time interval of [ t ]₀；t₁[ period, identifier Id₁To be transmitted to a receiver. Interval [ t ]₀；t₁The duration of [ is equal to the duration V of the key validity period, for example.

The scrambled multimedia content is received substantially synchronously by each of the receivers of the system 2. Thus, for each of these receivers, the following steps are performed substantially in parallel. In the particular case of the receiver 10, the following steps are explained.

In step 122, the content containing the scrambled multimedia content and the ECM is received by the receiving module 70_mAudiovisual signal of a message.

Next, in step 124, the demultiplexer 72 receives from the scrambled multimedia content and ECM as it is received_mExtracting scrambled key validity CP from message_m. The demultiplexer 72 extracts the validity period CP of the disturbed key_mTo the descrambler 74. Extracted ECM_mThe message is transmitted to the processor 76.

At least in response toIn ECM_mEach first receipt of a message and at the latest at a time t_mA predetermined length of time d before, in step 126, the processor 76 verifies whether it has obtained the key k_i，m. To this end, it searches in table 79 whether the table already contains the key k_mThe key corresponding to the ECM contained in the received ECM_mIdentifier Id in messages_m. The duration d is set by the operator of the system 2 to be slightly greater than the time at which the receiver obtains the key k from the server 106_i,mThe time required.

If so, processor 76 will find key k in table 79 in step 128_mTo the descrambler 74. Then there is no key k to obtain_mAnd any connection is established with the server 106.

Next, in step 130, the descrambler 74 operates by using the key k_mTo descramble the received key validity period CP_m。

Next, in step 132, the descrambled key validity period CP_mDecoded by decoder 80 and then transmitted to video card 82.

Finally, in step 134, the video card 82 validates the descrambled and decoded key with the validity period CP_mConverted into a video signal. Here, the video signal is then transmitted to the display device 84.

In response, the device 84 displays the key validity period CP of the multimedia content on the screen 86 in a manner that can be directly perceived and understood by a person_m。

If in step 126, it corresponds to the identifier Id_mKey k of_mNot contained in table 79, the method continues to step 140 and does not directly perform step 128.

In step 140, processor 76 establishes a secure connection with server 106 and transmits a request via the connection to receive get key k_mThe required information. For example, the request contains, inter alia, the key k_mId of_m。

The request is transmitted to server 106 via transceiver 88 and network 92. Processor 76 and server106 are all exchanged via a secure tunnel established through network 92. The establishment of the tunnel requires the server 106 to authenticate and identify the receiver, for example by using cryptographic certificates contained in the memory 78. Thus, the server 106 has the identifier Id of the receiver to which the request is sent_T。

Since the table 79 of the receiver is initially empty, immediately following the first key validity period CP to be descrambled of the multimedia content₁Immediately preceding time interval t₀；t₁During which step 140 is performed systematically by each of the receivers. Next, there is no descrambling key validity period CP in each table 79_mRequired key k_mThen step 140 is performed.

The receipt of the request by the server 106 informs the server at time t_i,mThe key k not previously available_i,m. In response, server 106 counts the connection counter per unit time, C, in step 142_nbcAnd (6) updating. For example, the server 106 counts the number of established connections (including the current connection) between all receivers of the system 2 and itself during a sliding window of duration Δ T. Here, the server 106 only requests during it to obtain the key k_mThe connections of the necessary information are counted.

Next, in step 144, the server 106 obtains the value of the integer L. The number L allows for adjusting the number of key validity periods that will elapse between this connection of the receiver 10 to the server 106 and the next necessary connection of the receiver 10 to the server 106. More specifically, the number L sets the slave key k available to the receiver 10 without reconnecting to the server 106_mThe maximum number of subsequent keys derived in (c). The number L thus sets the key k_mTo k is_m+L-1Sequence SR of_mThe key is obtainable by the receiver 10 based solely on the information contained in the response to its request.

The number L is here set to distribute the connections of the receivers to the server 106 as evenly as possible. For this purpose, a first connection at the receiver 10 (i.e. in order to obtain the key k) is made₁To establish a connection), the server 106 selects a first value that is different from the number L selected for the other receivers of the system 2. For example, server 106 is in interval [ 2; l is_max]To randomly extract the first value. In another example, server 106 is forming interval [ 2; l is_max]The first values are randomly drawn in succession in the subintervals of the partition. Next, during a subsequent connection of the receiver 10, the server 106 uses a second value of the number L that is the same and constant for all receivers of the system 2. The subsequent concatenation is to obtain the key k_mWhere the subscript m is strictly greater than one. The second value of the number L is pre-stored in the memory 110, for example in the phase 114. The second value of the number L is also between 2 and L_max。

In step 146, in response to the request of the receiver 10, the server 106 transmits to the processor 76, via the connection established in step 140, a sequence SR enabling the receiver 10 to obtain the key without establishing a subsequent connection with the server 106_mThe necessary information. In other words, the server 106 transmits to the receiver 10 during the connection so that it can obtain the key k_1,mTo k is_L,mAll information required. To this end, in this embodiment, during this connection, the server 106 transmits and the receiver 10 receives the following information:

-parameter PC_pThe current value of (a);

-a key k_1,mAnd an

-control information C_2，mTo C_L,m。

After the information is transmitted, the connection between the server 106 and the receiver 10 is interrupted. The connection is thus over the key validity period CP_mStarting time t_mThe previous interrupt.

Next, in step 148, processor 76 applies the received key k_1,mStored in table 79, and the method then returns to step 128. Thus, at time t_mBefore, the key k is_1,mIs transmitted to the descrambler 74 so that the key validity period CP can be correctly descrambled in time_m。

In parallel, in step 150Processor 76 immediately triggers the following key to be obtained from the information received in response to its request: k is a radical of_2,mTo k is_L,mThe process of (1). Upon receipt of the key k_1,mThereafter, step 150 is systematically triggered. In particular, the triggering of step 150 is independent of the operational state of networks 92 and 8.

To this end, the processor 76 executes a key derivation algorithm D2 in step 150. Algorithm D2 allows a key k to be derived from a previous key_i-1,mAnd here also from the parameter PC_pAnd slave control information C_i,mTo obtain the following key k_i,m. Thus, the algorithm D2 is executed for the first time to derive the key k from the received key_1,mTo obtain a key k_2,mThen a second time to slave key k_2,mTo obtain a key k_3,mAnd so on until the slave key k_L-1,mTo obtain a key k_L,m。

Here, each time the algorithm D2 is executed by the processor 76, the processor implements the following operations to obtain the key k_i,m：

1) From the set E, the processor 76_RA medium random number R is extracted, then

2) Processor 76 computes candidate key k by using the following relationship_cd：k_cd＝F₁(R//k_i-1，m) Then, then

3) Processor 76 calculates control information C by using the following relationship_cd：C_cd＝H₁(k_cd) Then, then

4) Processor 76 will control information C_cdWith the control information C received in step 146_i,mMake a comparison, then

5) If the control information C_cdAnd C_i,mIf they are identical, the key k_cdIs equal to the secret key k_i，mAnd thus obtain the key k_i,m. Then the key k is compared_i,mStored in table 79 and terminates execution of algorithm D2. In the opposite case, the processor 76 returns to operation 1). Thus, operations 1) to 5) are cyclically repeated until the key k is obtained_i,mOr until processor 76 performs step 126 to determine whether key k has been obtained_i,m Step 140 is then implemented to obtain the key from the server 106. In the latter case, at least at time t_mThe key k is not obtained by the receiver during the previous duration d_i,mAnd step 150 is interrupted before the key is obtained by executing algorithm D2.

Function F implemented by processor 76₁、H₁And/and for constructing sequence SE by generator 108_pThe functions implemented are the same.

Set E_RIs based on the parameter PC_pIs determined by the processor 76 in association with the key k_1,mAnd control information C_i,mReceived at the same time.

Average execution time TC of the algorithm D2_i，mDepending on the set E_RSize C of_a. In fact, set E_RSize C of_aThe larger the key k is extracted to be equal to the allowed key k_i，mNumber R of_mThe larger the average number of random extractions performed before the number R. Here, the average number of the random extractions is equal to C_a/2. In order to obtain a key k_i,mAverage time TC of_i,mThus given by the following relation: TC (tungsten carbide)_i，m＝(C_a/2)t_1-5Wherein, t_1-5Is the time required for the processor 76 to perform operations 1) through 5) once.

After step 146, e.g., in parallel with step 148, server 106 updates counter C in step 160_nbcAnd a predetermined threshold value S stored in the memory 110_nbc-hAnd S_nbc-iA comparison is made. Threshold value S_nbc-hEqual to or strictly greater than the number of connections per unit time: if each receiver is able to calculate the key k in time_2,mTo k is_L,mAnd thus only in the acquisition of the key sequence SR by executing the algorithm D2 except for the first time_mLast key k of_L,mAnd then subsequently to the server 106, the number of connections per unit time can be expected. Thus, the threshold S_nbc-hIs equal to or greater than N_rec/(L.V), wherein:

-N_recis equal toThe total number of system 2 receivers connected to server 106;

the symbol ". multidot..

Threshold value S_nbc-hIt must also be small enough to allow counting at counter C_nbcBecomes much larger than N_rec/(L.V) adjusting the parameter PC before_pThe value of (c). For example, threshold S_nbc-hLess than 2N_rec/(L.V) alternatively less than 1.5N_rec/(L.V)。

If the counter C_nbcIs greater than a threshold value S_nbc-hThis means that an excessively large number of receivers cannot be used at the time t_i，mPreceding termination of the calculation of the key k_i,m. As a result, the number of connections established with the server 106 is much larger than the initial setup. In response, server 106 changes the parameter PC in step 162_pSo that the receiver can calculate the key k after it more quickly_i,m. In this embodiment, for this purpose, the parameter PC is reduced_pTo reduce the set E_RSize C of_a. Next, the method returns to step 116 to determine the PC parameter by considering_pTo generate a sequence SE_pThe subsequent key of (1).

If the counter C_nbcFalls to the threshold value S_nbc-iIn the following, this means that an excessively small number of receivers cannot be used at the time t_i,mPreceding termination of the calculation of the key k_i,m. This generally corresponds to the average time TC_i,mToo small with respect to the duration V. Threshold value S_nbc-iStrictly less than threshold S_nbc-hAnd generally approaches the limit N_rec/(L.V). For example, threshold S_nbc-iBelongs to the interval [ N_rec/(L.V)；1.3N_rec/(L.V)]Or belong to the interval [ N_rec/(L.V)；1.1N_rec/(L.V)]. In this case, in response, server 106 changes the parameters PC in step 164_pTo increase the value used to calculate the key k_i,mAverage time TC of_i,mAnd then returns to step 116 and step 120. For this purpose, the parameter PC is increased_pTo increase the set E_RSize C of_a。

If it is notCounter C_nbcIs the threshold value S_nbc-hTo S_nbc-lThe server 106 then causes the parameter PC to be_pThe current value of (c) remains unchanged.

The method for setting the aforementioned various parameters in stage 114 will now be described.

The second value of the number L saved in advance is set to, for example, the target number N of connections to the server 106 per second_cn. Number N_cnSelected by the designer of the system 2. For this purpose, at each key k_mIn this particular embodiment in which the duration V of the validity intervals is the same, the second value of the number L is determined by using the following relation: l is N_rec/(N_cn.V)。

Parameter PC_pIs set such that the key k is being obtained by the receiver_mExpected average time TC of previously executed algorithm D2_i,mGreater than 0.2V_i-1，mOr 0.5V_i-1,mOr 0.9V_i-1,mWherein V is_i-1,mIs a key validity period CP_i-1,mThe length of time.

For example, the parameter PC_pIs designed so that the value of index i, whatever the value of 2 to L, is per average time TC_i,mThe following conditions (1) to (3) are satisfied:

in this case, the index i, whatever its value greater than or equal to two, cannot be taken at the instant t_i-1,mPreviously obtained key k_i,m. Thus, the key k_L,mOnly at most in the interval t_L-1，m；t_L,mDuring which exposure to attack attempts. Interval [ t ]_L-1,m；t_L,m[ ratio interval [ t ]_1,m；t_L,m[ much shorter. Interval [ t ]_1,m；t_L,mCorresponding to the key k during which the key k is to be used in the known method_L,mTime intervals exposed to attack attempts, such as where the key k is to be used_L,mAt the same time as the key k_1,mTo the receiver at the same time as in patent application EP 2567500.

In which the key validity period CP_mAll equal to V and wherein all mean times TC are mandatory_i,mIn this particular embodiment equal to the constant TC, then, for example, by selecting the parameter PC_pSo that the average time TC is (L-1) V/L to V, to satisfy the conditions (1) to (3).

Here, the maximum number N is determined so that the following condition is satisfied_RTo select the parameter PC_pInitial value of (a): t is t_{1- 5}.C_aV is more than or equal to/2, wherein:

-t_1-5is the time taken by the receiver to perform operations 1) through 5) of step 150,

-C_ais a set E_RAnd C is the number of elements of_aIs equal to 2^NRAnd an

V is the key k_mThe duration of each validity interval of (a).

For example, in stage 114, time t is experimentally measured at the receiver_1-5. The duration V is set and known.

Fig. 3 shows the same method as that of fig. 2, except that steps 116 and 150 are replaced by steps 180 and 182, respectively. To simplify fig. 3 and the following figures, only the modified steps are shown. Unmodified and therefore not shown steps are symbolized in these figures by dashed lines.

Steps 180 and 182 are identical to steps 116 and 150, respectively, except that algorithms D1 and D2 are replaced by algorithms D3 and D4, respectively.

Algorithm D3 is a deterministic key calculation and is no longer a random key calculation. Unlike random key computation, deterministic key computation does not involve an average time TC that may significantly modify the execution of algorithm D4_i,mIs randomly extracted.

Is executed as a slave key k_m-1In generating a key k_mAlgorithm D3 is composed of a one-way encryption function H₂With its own Q_m1 time to make up. Therefore, the key k is obtained by using the following relational expression_m：k_m＝H₂ ^Qm(k_m-1) Wherein:

-H₂is a one-way cryptographic function;

-

indicates the function H₂Is Q with itself_m1 time.

In general, the function H₂Function group G belonging to the preceding definition₁. Here, the function H₂Is a hash function. Function H₂And its own composition is that of the function H₂First time to key k_m-1To obtain a first result H₂(k_m-1) Then in that the function H is₂Second application to first result H₂(k_m-1) To obtain a second result H₂ ²(k_m-1)＝H₂(H₂(k_m-1) And repeat Q as such)_mNext, the process is carried out. In this embodiment, the control information includes a parameter Q_m。

Parameter Q_mThe value of (b) varies according to the subscript m. For example, for each subscript m greater than or equal to two, at approximately V/t₁₈₂Set of values of E_QIn random parameter Q_mA value of (a), wherein t₁₈₂Equal to the receiver performing a linear function H₂The time taken. For example, set E_QIs included in the interval [0.7V/t₁₈₂；1.3V/t₁₈₂]Or interval [0.9V/t₁₈₂；1.1V/t₁₈₂]The set of integers of (1). In this case, the control information transmitted to the receiver 10 includes the parameter Q each time_2，mTo Q_L,mThe value of (c). Thus, when the receiver 10 connects to the server 106 to obtain the sequence SR_mIn response, the receiver receives:

-a key k_1，m，

-control information Q_2，mTo Q_L,m。

Set E_QRatio set E_RMuch smaller. For example, set E_QComprises 10³Or 10⁶An integer number. Here, the subscript m has a value of whatever, the set E_QIs constant in magnitude.

In this embodiment, the complexity parameter PC_pIs a set E_QAverage value M of_QAnd is not the number of integers it contains. Average value M_QIs contained in the set E_QWherein each of these integers is assigned the same weighting factor. Average value M_QThe more increase, for the slave key k_i-1,mTo obtain a key k_i,mCalculated time TC of_i,mThe larger. In stage 114, set E is constructed_QSo that its average value is equal to V/t₁₈₂. In this embodiment, it is not necessary to apply the value M_QAnd thus the complexity parameter PC_pTo be transmitted to a receiver.

Next, in steps 162 and 164, set E is modified_QTo decrease its average value in step 162 and, alternatively, to increase its average value in step 164. For example, to increase the set E by ε_QAdding the integer epsilon to the set E_QEach of the integers of (1).

In step 182, execution by the receiver to slave the key k_i-1,mTo obtain a key k_i,mAlgorithm D4 of (1) is the same as Algorithm D3, except for the parameter Q_i,mIs obtained from the received control information. In other words, in step 182, the receiver 10 obtains the key k by using the following relation_i,m：k_i，m＝H₂ ^Qi，m(k_i-1，m)。

Fig. 4 shows the same method as that of fig. 3, except that steps 180 and 182 are replaced by steps 190 and 192, respectively. Steps 190 and 192 are the same as steps 180 and 182, except that the generator 108 uses the function H_G5And the receiver 10 uses the function H at its side_D6Instead of using the same function H₂To obtain a key k_m. Thus, the following key k is implemented by the generator 108 by using the following relation_mThe calculation of (2): k is a radical of_m＝H_G5 ^Qm(k_m-1)。

Processor 76 calculates by using the following relationshipk_i,m：k_i，m＝H_D6 ^Qi，m(k_i-1，m). Function H_G5Designed to implement function H_D6Much faster coming from key k_m-1In calculating the key k_m. For this purpose, a one-way encryption function H with a back door is used_D6Such as using a one-way encryption function for implementing asymmetric encryption. The operating principle of such a one-way encryption function with a back door is well known. For example, the principle is the same as that used in an asymmetric cryptographic algorithm known as the RSA (Rivest-Shamir-Adleman) cryptographic algorithm. In the following, therefore, only one detailed example of such a function is explained, since a person skilled in the art can derive other possible embodiments without difficulty on the basis of this example.

For example, here, the generator 108 generates the function H by using a function defined by the following relation_G5To calculate a key k_m:k_m＝(k_m-1^(e^Q_m[(P-1)(Q-1)]))[N]Wherein:

- (A ^ B) [ C ] refers to a modular exponentiation, i.e. the power of the number B of the number A, the whole modular division C,

p and Q are large prime numbers, i.e. their binary representation comprises at least 500 or 1000 bits of prime numbers, and they are additionally different from each other,

-N is equal to the product of the number P and the number Q;

-e is the prime number of the product (P-1)/(Q-1) which is greater than 1 and not between a (P-1) (Q-1) and a (P-1) (Q-1) +2s, where "a" is a non-zero natural number and s is a natural number generally equal to or greater than 80, called the safety parameter.

Processor 76 operates by using a function H defined by the following relationship_D6To calculate a key k_i,m：k_i,m＝((k_i-1,m^e)[N])^Qi，m。

The numbers P and Q are only known to the generator 108 and correspond, for example, to its secret key. The numbers N and e are known to the generator 108 and the receiver 10 and then correspond to the public key of the generator 108. Since the numbers P and Q are known, the generator 108 is able to derive the key k from the key k by performing only two modular exponentiations_m-1In calculating the key k_mIn order to obtain a phaseWith the same key, the processor 76 must implement Q_i,mA sub-modular exponentiation.

Chapter 4: modification:

chapter 4.1: method variants

Alternatively, the control information may be omitted. For example, in deterministically computing the key k_i,mIn the case of (2), if it is necessary to execute the function H₂To slave key k_i-1,mIn the construction of a secret key k_i,mNumber of times Q_i,mIs a constant known to all receivers, the server 106 does not need to transmit this control information to the receivers on every connection. In this particular case, the parameter PC_pIs also a constant. Thus, the server 106 will only key k_1,mTransmitted to the receiver and the receiver derives the key k from the key_1,mIn which the key k is derived_2,mTo k is_L,mWithout receiving other information from portions of the server 106.

Sequence SE_pThe number of keys N of (a) may be the number L _max10 or 100 or 1000 times higher than the desired value.

At any given time t_p+1The generator 108 may stop using the sequence SE_pThis includes after the key k has been applied_NFor encrypting the key validity period CP_NBefore. From time t_p+1From now on, the generator starts to use another key sequence SE_p+1. In this case, preferably, at time t_p+1Previously, the server 106 transmitted a signal to the receiver to indicate to it that another sequence SE will be used since that moment_p+1. In response, the receiver immediately establishes a connection with the server 106 to receive the derived key k_1,mAnd deducing the new sequence SE_p+1After L keys k_i,mThe required information.

Sequence SE_pMay also be smaller than the number of key validity periods of the multimedia content to be scrambled. In this case, the key k is generated already_NThereafter, the generator 108 starts generating the intended scrambling key validity period CP_NSubsequent key validity period (e.g. CP)_N+1To CP_2NOr CP_N+1To CP_N+M) Another sequence of keys SE_p+1. Independently ofSequence SE_pIn particular independent of the key k_NGenerating a sequence SE_p+1First key k of_N+1. If necessary, the numbers N and M must still be chosen to be greater than or equal to the number L_max。

The number N may also be a priori indeterminate. In this case, the generator 108 is continuously a sequence SE_pGenerating a new key k_m. In this case, the generator 108 preferably generates a new sequence SE in response to an external instruction to change the key sequence_p+1. For example, when a key pair sequence SE is detected_pOr an attempt to attack, an instruction to replace the key sequence is sent. Successful cryptanalysis of the key derivation algorithm can be detected, for example, from the fact that an increased number of receivers no longer need to connect to the server 106 every L.V seconds to be able to descramble the multimedia content correctly.

As a variant, in step 142, the server 106 updates the counter C only if the last key obtained is not the last key of the current key sequence, i.e. only if a current connection is not expected_nbc。

In a simplified embodiment, the number L is not adjusted to more evenly distribute the receiver's connections to the server 106 over time. In this case, the number L is, for example, a predetermined constant and is the same for all receivers.

As a variant, in order to limit the amount of information that the server 106 transmits to the receiver 10 during each connection, the parameter Q_mIs independent of the subscript m, and the parameter Q_mIt is simply denoted as Q. In this case, the numbers L and N may be selected to be equal. The generator then systematically replaces the sequence SE after having generated the L keys_p。

Alternatively, step 160 is performed non-systematically after step 146. Step 160 is performed periodically, for example, with a predetermined period, in the form of, for example, the number of times step 146 is performed or in the form of a duration. When step 160 is not implemented after step 146, steps 162 and 164 are also omitted and server 106 causes parameter PC_pMaintenance of current value ofAnd is not changed.

For setting parameters PC_pOther methods of the values of (c) are possible. For example, except by setting a counter C_nbcValue of (D) and threshold value S_nbc-hAnd S_nbc-iIn addition to the comparison, to trigger the parameter PC_pSetting of the value of (c). For example, the time TC taken by the processor 76 to execute the derivation algorithm may be measured, for example, by the processor 76_i,mAnd then transmitted to the server 106. In response, the server 106 compares the measured execution time to the duration V. If the measured execution time is less than the duration V, the complexity parameter PC is increased_pThe value of (c). In the opposite case, the value is decreased.

In another example, as the time TC measured by the processor 76 for reception_i,mIn response, the server 106 calculates an average time to execute the derivation algorithm and then compares the average execution time to the duration V. If the average execution time is less than the duration V, the complexity parameter PC is increased_pThe value of (c). In the opposite case, the value is decreased. In this example, the server 106 calculates the average time of execution of the derivation algorithm for all receivers or, for example, a set number of, for example, randomly composed receiver samples. In this example, alternatively or synchronously, the server 106 calculates the average time of execution of the derivation algorithm over a sliding time window of a predetermined magnitude (e.g., on the order of one minute, ten minutes, one hour, or ten hours).

As a variant, the complexity of the derivation algorithm is not adjustable. In this case, as previously described, the parameter PC is selected in, for example, stage 114_pThe value of (c). Then, during execution of the method of fig. 2, the parameter PC can no longer be changed_p. In this embodiment, steps 142, 160, 162 and 164 are omitted.

Can use the parameters PC_pSet so that the average time TC_i,mGreater than the duration V. In this case, in the case of the embodiment of fig. 2, this results in a single subset PP of receivers only (of a size smaller than with the pair of parameters PC described above)_pThe size of the subset PP obtained by the adjustment) will be randomly chosen to allow timely (i.e., at time t)_i,mBefore) obtain key k_i，mThe number R of (2). Receivers not belonging to this subset PP will have to connect to the server 106 to obtain the key k_i，m,. However, this setting still allows reducing the number of receivers connected to the server 106 per key validity period, while increasing the security of the system.

As a variant, the construction sequence SR is transmitted by the server_mAfter the required information, the connection between the server 106 and the receiver 10 is not interrupted.

Chapter 4.2: variations of the derivation algorithm of the key

Other functions than those described above may be used. For example, function F₁Not necessarily a one-way function. It can be as simple as a function of the identity function. However, in this case, the function H₁Is different from function F₁And still be a one-way function.

Other deterministic key computations are possible. For example, algorithm D3 may be replaced by another algorithm in which the pair key k is implemented by using the following relation_mThe calculation of (2): k is a radical of_m＝H₃ ^Q(f(k_m-1，D_m) Whereinsaid:

-D_mis from the set E_DA set containing integers whose binary representation is at most 18 bits or 10 bits;

f is a simple function, such as k_m-1And D_mAddition or multiplication of (c); and

-H₃is of the aforementioned group G₁And preferably a hash function; and

-Q is a complexity parameter.

In this embodiment, the control information contains data D_mAnd a parameter Q. Parameter Q defined in the example of FIG. 3_mThe number of bits required for encoding is preferably at least twice as small as the number of bits required for encoding the data D_mAnd (6) coding is carried out. Thus, in this variant, the bandwidth required to transmit control information to the receiver 10 is reduced.

Other embodiments of the derivation algorithm are possible. For example, a numberR is initialized to 0 and then incremented by 1 at each iteration of operations 1) through 5) of step 150, rather than each time from set E_RThe number R is randomly extracted.

Chapter 4.3: other variations:

here, the method for obtaining the key sequence is explained in the specific case where the generated and received keys are control words directly used for encrypting and decrypting multimedia content. However, these methods may be used to obtain keys other than control words. For example, the generated and received key may be a session key used to encrypt and decrypt control words transmitted to the receiver. In this case, the session key is typically replaced at a frequency 10, 100, 1000, or 10000 times less than the frequency of replacing the control word. For example, the validity interval of the session key may have a duration of greater than one minute, one hour, or 24 hours. In this case, the complexity parameter PC is adjusted_pTo correspond to such a duration of the validity interval.

The method for obtaining a key sequence described herein may also be used to obtain a key sequence for encrypting and decrypting digital content other than multimedia content. For example, the obtained key sequence may be used to encrypt or decrypt a digital document, such as a text file, or any data exchanged over a communication channel.

What has been described herein also applies to systems other than conditional access systems. For example, what has been described herein applies to any system in which key sequences, each associated with a validity interval, are used. For example, the teachings presented herein are transferred without particular difficulty to Digital Rights Management systems known by the acronym DRM ("Digital Rights Management"). In these DRM systems, each key of the sequence is obtained from the license. The license typically contains a validity interval for the key.

At key k_i，mWhat has just been described in the specific case of a decryption key may also be applied to key k_i，mFor encrypting the digital content rather than for decrypting the digital content. More generally, what has been described herein may also be used to obtain information for other purposes (such as authenticity verification)Integrity verification of the digital data, initialization of the pseudo-random generator, and others).

As a variant, the duration V of the validity interval_i，mNot constant. In this case, time TC_i，mE.g. different for obtaining each key k_i，m. By using, for example, the control information Q_mTo set the time TC_i，m. In this case, normally, the control information Q_mIs selected such that the time TC_i，mIs 0.5V_i-1，mTo V_i-1，mPreferably 0.9V_i-1，mTo V_i-1，m. Preferably, the control information Q_mChosen such that the execution time is such that no matter which interval belongs to [ 2; l is]Is what is i, time TC_i，mThe above conditions (1) to (3) are satisfied. When these conditions are met, the interval t can be reached by the receiver at the earliest time_i-1，m；t_i，m[ in obtaining the secret key k_i,m. Thus, the key k_i,mMay be only for a duration of V_i-1,mInterval of [ t ]_i-1,m；t_i,mThe interval is attacked.

As a modification, the above condition (2) is omitted.

In another variant, the execution of the derivation algorithm is distributed over a group of M receivers that can safely exchange information with each other. The number M is greater than or equal to two and preferably greater than or equal to 100 or 1000. For example, receivers in the same group of receivers are connected to each other via a public or private network. Receivers belonging to one receiver group do not belong to another receiver group. The exchange of information between the set of receivers is encrypted, for example by using a key known only to the set of receivers. For example, in the case where the derivation algorithm is a random key calculation, set E will be_RInto M separate subsets of the same size. Each of these subsets is assigned to a respective receiver of the group. As a pair of receiving keys k_1,mEach receiver of the group tries to calculate k as described above but by selecting only the number R from the subset assigned to it_2,m. Obtaining a secret key k_2,mThe first receiver of the group then transmits the key toOther receivers of the same group. Once the key k has been applied_2,mDistributed to all receivers of the same group, these receivers have stopped obtaining the key k_2,mAnd starts with the same derivation algorithm as described above for key k_2,mSaid similar way to perform the derivation algorithm to obtain the key k_3，m。

The receiver group is thus equal to TCr_i,mTime TC of/M_i，mTo perform a derivation algorithm, wherein TCr_i，mIs the average time that the same derivation algorithm is performed but by the single receiver of the group, which therefore has to be derived from the entire set E_RInstead of selecting the number R only in the subset. This variant therefore allows to increase the set E_RAnd thus increasing the safety of the process.

In case the derivation algorithm is a deterministic key calculation, the execution of the derivation algorithm may also be distributed between each receiver of the group to benefit from the computational power of all processors 76 of these receivers. Distributing algorithm execution among different microprocessors so that portions of the algorithm are executed by each of the microprocessors in parallel is well known and will not be described in detail herein. Distributing the execution of the derivation algorithm over all receivers of the group, as in the case of a random key derivation algorithm, allows for increased security, since it makes obtaining the key more complicated. In particular, this increases the computational power required to be able to perform the derivation algorithm fast enough by illegal receivers.

If the key k just received by the receiver 10 is illegally distributed and recovered_i，mRequired time length TA₁Is known, the complexity parameter PC can be adjusted_PSo as to make time TC_i，mOnly included in the interval [ V-TA ]₁；V]In (1).

If the key k received by the receiver 10 is illegally distributed and recovered_1，mRequired time length TA₂Is known and the derivation algorithm is known by the illegal receiver, the complexity parameter can be adjusted so that the time TC is_i，mSatisfies only the following conditions：TA₂+(L-1)TC_i，m≥(L-1)V。

Chapter 4: advantages of the described embodiments:

in the method, the receiver can only complete the key k after it has been completed_i-1,mIs calculated before obtaining the key k_i,m. Therefore, the receiver must compute the key k in order of increasing index i_i，m. In addition, a key k is calculated_i，mAverage time TC of_i,mLong, i.e. here greater than or equal to 0.2V_i-1,m. Thus, although at time t_1,mPreviously received acquisition Key k_1，mTo k is_L，mAll information required can only be found at this time t_1，mThe key k after it is obtained long later_2，mTo k is_L，m. E.g. only at time t_R+TC_2，m+TC_3，m+...+TC_L,mAfter which the key k is obtained_L，mWherein, t_RIs that a get key k is received_1,mTo k is_L,mThe time of each required message. By contrast, in a known method such as that described in patent application EP2567500, at the instant t_RTo obtain a key k_L,m. In other words, the method described herein will be applied to the key k_L,mIs delayed from obtaining TC_1,m+...+TC_L,m. Since the key k is obtained in the receiver later than in the known receiver_L,mAt time t_L,mCan be used to attack the key k before_L,mIs shorter than in the known method, which improves the safety of the method.

Furthermore, as in the method of EP2567500, in order to obtain the sequence SR_mThe receiver only needs a single connection to the key server 106. Thus, the method also allows reducing the number of connections or information exchanges between the server 106 and each of the receivers. Finally, the method may be applied without having to determine the security level associated with each of the receivers.

According to the use for indicating at time t_i,mThe key k not previously available_i,mTo dynamically adjust the parameters PC_PThe fact that the value of (c) is such that the root can be reachedThe actual performance of the receiver is automatically adjusted according to the situation.

Using different values of the number L for different receivers or groups of receivers thus allows a better distribution of different connections to the server 106 in time.

The fact that the execution of the derivation algorithm is distributed over a plurality of receivers allows to improve the security of the method in terms of collusion attacks. In fact, in order to obtain the sequence SR more quickly_mAn attacker may attempt to distribute the execution of the derivation algorithm over multiple illegal receivers. However, the number of legitimate receivers is generally much larger than the number of illegitimate receivers. This therefore allows increasing the parameter PC_PTo account for detection of collusion attacks. It becomes more difficult to successfully implement such collusion attacks.

If the receiver fails to obtain the key k in time from the information received in the first connection_i,mThe fact that the receiver retains the ability to establish a second connection with the server 106 to obtain the key allows the claimed method to be implemented with some receivers, some of which are slower than others or than receivers desiring to perform the derivation algorithm. This allows for a floating of the receiver diversity and their computational performance, if necessary.

The derivation algorithm includes repeating the same one-way function by Q_i,mThe fact that it allows obtaining a system that can be determined in advance and therefore can be included more reliably in the interval [ V ]_i-1,m/2；V_i-1,mAverage time TC in_i,m。

The fact that the one-way function is a one-way cryptographic function with a back-gate allows shortening the generation sequence SE_pThe time required.

The fact that the key derivation algorithm is a random key calculation allows the generator 108 to perform much fewer operations to calculate the key k than the receiver would have to perform to calculate the same key_i,m。

Implementing the calculation of the random Key k_i,mThe fact that the derivation algorithm is carried out thus makes it possible to obtain the time taken to carry out the derivation algorithm, at that timeThe cells are longer on the receiver side and much shorter on the generator side.

Receiving only the sequence SR of L keys obtained during the first connection_mThe information required so that the receiver 10 can be forced to obtain the key k at the latest_L,mA new connection is then established with the server 106.

Claims (16)

1. Method for obtaining L encryption keys k by electronic receiver group_1，m，...,k_i,m,k_i+1，m，...,k_L,mThe method of (a), wherein:

the index i is the key k_i,mThe sequence number in the key sequence is,

-L is an integer greater than or equal to two, and

-said key k, whatever the value of said index i between 1 and L_i,mOnly during a time period of V_i,mInterval of validity of [ t ]_i，m，t_i+1，m]A period is used, wherein t_i，mAnd t_i+1，mRespectively the start time and the end time of the validity interval,

wherein:

at a time t_1，mPreviously, the set of receivers establishes (140) a first connection with a key server and receives during this first connection the key k obtained_1，mThe required information, then

-for each index i between 2 and L, at said instant t_i，mPreviously, the receiver group obtains (150) a key k_i，m，

Characterized in that, for each index i between 2 and L, and in increasing order of these indices:

-the receiver group is passed through the execution of the key k before the use_i-1，mPerforming an initialized key derivation algorithm to obtain (150; 182; 192) a subsequent key k_i,mWithout having recourse to information other than that received during said first connection, and

-performing a key derivation algorithm by the receiver group to obtain a key k_i,mAverage time taken TC_i,mGreater than 0.2V_i-1,m。

2. The method of claim 1, wherein for at least one subscript i ranging from 2 to L:

at a time t_i-1,mThereafter and at time t_i,mBefore, the receiver group verifies (126) whether obtaining the key k has been completed_i,mIn the above-described manner, the process (a),

if at said time t_i,mObtaining key k has not been done before_i,mThe receiver group establishes (140) a second connection with the key server and transmits a second connection to the key server for indicating at time t_i,mThe key k not previously available_i,mAnd in the opposite case, the receiver group does not transmit to the key server a message indicating at time t_i,mThe key k not previously available_i,mThe information of (1).

3. The method of claim 2, wherein:

-indicating at said time t in response to receiving_i,mThe key k not previously available_i,mThe key server changing (162) a complexity parameter PC of a key derivation algorithm_pThe value of (C), the parameter PC_pCorresponds to an average execution time TC less than the current average execution time_i,mOr is or

-in response to not receiving a signal indicating at said time t_i,mThe key k not previously available_i,mThe key server changing (164) a parameter PC_pSuch that the value of said parameter corresponds to an average execution time TC greater than the current average execution time_i,m。

4. The method of claim 3, wherein indicating at the time t is in response to receiving_i,mThe key k not previously available_i,mThe information of (2):

-the key server updating (142) a counter of the number of connections established per unit time, then

-the key server comparing (160) the value of the counter with a predetermined high threshold, and then, in response, if the value of the counter crosses the predetermined high threshold, the key server modifying (162) the value of a complexity parameter to reduce the number of connections established per unit time, and/or

-the key server comparing (142) the value of the counter with a predetermined low threshold value, and then, in response, the key server altering (164) the value of the complexity parameter to increase the number of connections established per unit time if the value of the counter crosses the predetermined low threshold value.

5. The method according to any of the preceding claims, wherein the method for obtaining a key sequence is carried out for a first receiver group and a second receiver group, and the key server uses (144) a first value of the index L for the first receiver group and a different second value of the index L for the second receiver group.

6. The method of any preceding claim, wherein the group of receivers comprises a plurality of receivers and execution of the derivation algorithm is distributed over each of the receivers of the group.

7. The method of any one of claims 1 to 5, wherein the group of receivers comprises a single receiver and the derivation algorithm is implemented by the single receiver.

8. The method according to any one of the preceding claims, wherein for at least one subscript i ranging from 2 to L:

-at said time t_i-1,mAfter and at time t_i,mBefore, the receiver group verifies (126) whether obtaining the key k has been completed_i,mIn the above-described manner, the process (a),

-if the obtaining of the key k has not been completed_i,mThe process of (2):

a stationThe set of receivers establishes (140) a second connection with the key server and receives the derived key k during the second connection_i,mThe required information without performing a key derivation algorithm, and then

Obtaining the key k from the required information received during the second connection_i,mWithout performing the key derivation algorithm, and then

The receiver group is programmed by executing the key k before the use_i,mPerforming an initialized key derivation algorithm to obtain (150; 182; 192) a subsequent key k_i+1,mWithout the aid of information other than that received during the second connection, wherein the previous key k_i,mIs obtained by using information received during the second connection; and

-obtaining said key k if it has been completed_i,mBy using the previous key k, the receiver group does not establish the second connection and by performing the process of_i,mPerforming an initialized key derivation algorithm to obtain (150; 182; 192) a subsequent key k_i+1,mWithout having to resort to information other than that received during the first connection.

9. The method according to any of the preceding claims, wherein the receiver group when it executes a key derivation algorithm performs the following operations:

1) by using said previous key k_i-1,mTo initialize the value of the variable, and then

2) Converting the value of the variable by using a one-way function to obtain a new value of the variable, and then

3) Iterating the operation 2) a predetermined number of times Q by taking the new value of the variable obtained at the end of the previous iteration of operation 2) as the value of the variable to be converted_i,m。

10. The method of claim 9, wherein the one-way function is a one-way encryption function with a back door.

11. The method according to any of claims 1 to 8, wherein the receiver group, when it executes a key derivation algorithm, performs the following operations:

1) from the set E_RTo select a number R, then

2) Calculating a candidate key k by using the following relation_cd：k_cd＝F(R//k_i-1，m) Wherein F is a predetermined function, the symbol "//" indicates the numbers R and k_i-1,mIs then combined, and

3) calculating the control information C by using the following relational expression_cd：C_cd＝H(k_cd) Where H is a one-way function, then

4) The control information C is transmitted_cdWith control information C received during said first connection_i,mMaking a comparison, and

5) if the control information C_cdAnd C_i，mCorresponding, then the calculated key k_cdIs equal to the secret key k_i,mThus obtaining said key k_i,mOtherwise, the receiver group is for the set E_RTo repeat said operations 1) to 5).

12. The method of any one of the preceding claims, wherein a key derivation algorithm is performed by the receiver group to obtain a key k_i，mAverage time taken TC_i，mLess than or equal to V_i-1。

13. A method for securely transmitting digital content, wherein:

-the device dividing (120) said digital content into successive key validity periods, using a key k₁To k is_NOf the ordered sequence of corresponding keys k_mTo encrypt each key validity period CP_mAnd transmits each encrypted key validity period to the receiver group,

-the receiver group using the corresponding key k of the ordered sequence of keys_mTo decrypt (130) each received key is validDuring the period of time of the operation,

characterized in that the receiver group obtains (150; 182; 192) a key sequence by implementing the method according to any one of the preceding claims.

14. A data storage medium readable by a microprocessor, the data storage medium comprising instructions for carrying out the method of any one of the preceding claims when the instructions are executed by the microprocessor.

15. A group of receivers for implementing the method of any one of claims 1 to 13, each receiver of the group comprising a microprocessor (77) programmed to implement:

at a time t_1，mPreviously, the receiver group establishes a first connection with a key server and receives during this first connection the key k obtained_1，mThe required information, then

-for each index i between 2 and L, at said instant t_i，mBefore, the receiver group obtains the key k_i，m，

Characterized in that, for each index i between 2 and L, and in increasing order of these indices, each microprocessor is further programmed to carry out the following steps:

-the receiver group is passed through the execution of the key k before the use_i-1，mPerforming an initialized key derivation algorithm to obtain a subsequent key k_i，mWithout having recourse to information other than that received during said first connection, and

-performing a key derivation algorithm by the receiver group to obtain a key k_i，mAverage time taken TC_i,mGreater than 0.2V_i-1,m。

16. A key server for implementing the method of any one of claims 3 to 4, the server comprising a microprocessor (114) programmed to perform the steps of:

-atTime t_1,mBefore, the key server establishes a first connection with the receiver group and transmits the key k obtained during this first connection_1,mThe information that is required is, for example,

characterized in that the microprocessor (114) is further programmed to perform the steps of:

-indicating at said time t in response to receiving_i,mThe key k not previously available_i,mThe key server changing a complexity parameter PC of a key derivation algorithm_pThe value of (C), the parameter PC_pCorresponds to an average execution time TC less than the current average execution time_i,mOr is or

-in response to not receiving a signal indicating at said time t_i,mThe key k not previously available_i,mThe key server changing (164) a parameter PC_pSuch that the value of said parameter corresponds to an average execution time TC greater than the current average execution time_i，m。

Images