EP1776833A1

EP1776833A1 - Method and device for reading data received in the protected form and tool for removing appropriate protection

Info

Publication number: EP1776833A1
Application number: EP05796238A
Authority: EP
Inventors: Pascal Nourry; Michaël PICAUD
Original assignee: France Telecom SA
Current assignee: Orange SA
Priority date: 2004-08-09
Filing date: 2005-08-05
Publication date: 2007-04-25
Also published as: US20070248171A1; WO2006021664A1

Abstract

The inventive method for reading data received in the protected form (10) consists in transmitting at least certain protected data to a protection removing tool (3). The protected data is retrieved from a buffer memory (1) of a read stream of said data (100) and is transmitted to the protection removing tool by a security message router (2). In order to transmitting between said security message router (2) and the protection removing tool (3), data is recorded in assigned transfer frames.

Description

METHOD AND APPARATUS FOR READING DATA RECEIVED IN PROTECTED FORM, AND PROTECTIVE WITHDRAWAL TOOL

CORRESPONDING

The present invention relates to a method and an apparatus for reading data received in protected form. It also relates to a data protection removal tool and a system adapted to implement such a reading method. The invention applies in particular to the reading of multimedia data, for example of the MPEG type.

Some multimedia data broadcast over cable or satellite is protected by coding, masking and / or scrambling to ensure that a user of that data is authorized to use it. This is the case, in particular, of confidential data or data to which access is paid. For this, a data reading terminal must be associated with a data protection removal tool, which removes the protection before the data is read.

The DVB standard (Common Interface Specification for Conditional Access and other Digital Video Broadcasting Decoding Applications) provides an interface between the data reading terminal and the protection removal tool which is part of the data transport level. In this case, the data protection implemented is attached to one of the data transport protocol layers. Such a mode of protection is limited to data that is broadcast using this protocol. The data protection removal tool that is associated with the reading terminal is then specific to the transport protocol, and is not universal.

In addition, the following extensions of the MPEG standard: MPEG-2 IPMPX (ISO / IEC 13818-1 FDAM2, ISO / IEC FDIS 13818-11) and MPEG-4 IPMPX (ISO / IEC 14496-1 FDAM3 and ISO / IEC FDIS 14496-13: 2003) propose a messaging system between the data reading device and the removal tool of the protection. This messaging system makes it possible to transmit to the reading terminal commands produced by the protection removal tool. These The commands are placed in transfer frames between the protection removal tool and the reading terminal, which are received by an IPMP message router (for "Intellectual Property Management and Protection") integrated in the reading terminal. Such commands are executed within the reading terminal and may relate to operations performed directly on multimedia data. The operations thus controlled can in particular be performed on data contained in a buffer memory of the terminal. In this way it is possible to remove a data protection which is at the "data" level, and which is independent of the transport protocols used.

In such a protection removal mode, the operations performed on the data are triggered by the protection removal tool, in a non-synchronized manner with respect to the arrival of the data to be read in the reading terminal. In a way, the protection removal tool operates in an anarchic way on the data within the reading terminal. This results in irregular delays in data processing, which can affect the quality of a presentation of the data read to a user. Difficulties also arise in managing interventions of several protection removal tools, when at least two different protections are cumulatively applied to the data.

An object of the present invention is therefore to provide a method of removing a data protection to be read, which does not have the disadvantages mentioned above.

For this, the invention proposes a method of reading data received in protected form, which comprises the following steps, for at least one of the protected data received: a- storing the protected data in an input buffer memory assembly; b- sending, to a security message router, a signal indicating that protected data is present in the input buffer assembly; c- producing a first data transfer frame; d- read the protected data in the input buffer set; e- write the protected data in the first frame; and f- transmitting the first frame containing the protected data item to a tool for removing the protection of the data item. Thus, the invention provides a data transfer from the reading terminal to the protection removal tool, which uses a transport frame dedicated to each data item. Each frame that thus carries protected data constitutes a message exchanged between the reading terminal and the protection removal tool. In the context of the invention, the term "received data" is understood to mean an application datum, that is to say a datum extracted from the transport frames used for the transmission thereof between a sending server and the reading terminal. . Therefore, a protection concerned by the invention is independent of the transport protocols used for transmission between the sending server and the reading terminal. Those skilled in the art will understand that this is therefore a "data" level protection.

According to the invention, steps c, d, e and f are controlled by the security message router in response to the signal indicating the presence of protected data in the input buffer set. Thus, when a data whose protection is to be removed arrives at the input of the reading chain, the security message router triggers the sending of this data to the protection removal tool. The withdrawals of the data protection received successively can therefore be coordinated with each other by the security message router, so that delays in reading this data can be avoided.

Detecting the protected data present in the input buffer assembly before enabling the security message router avoids sending unnecessary data to the security message router. Resources of a terminal in which the invention is implemented are therefore not mobilized unnecessarily. This can be particularly advantageous for a terminal of limited capacity. Situations in which data does not need to be transmitted by the security message router are, for example:

- when a protection is used selectively for certain data, the unprotected data do not need to be sent to the protection removal tool;

- when access or usage rights are defined independently for different data streams, data from only certain streams can be protected so that unprotected data streams do not have to be sent to a protection removal tool; - when a right to access or to use data has been refused, it is not necessary to activate the security message router; and

- avoid transmitting protected data to the security message router when the necessary protection removal tool is not available or is not connected to the security message router. In addition, the use of a signal that indicates the presence of protected data in the input buffer assembly enables data to be directed to specific protection removal tools for separate streams, where different protection removal tools are used.

Finally, this also makes it possible to use several protection removal tools successively for the same data, for example when an encryption and a digital tattoo, or two digital tattoos, are cascaded to data.

In the same way, the router can coordinate the reception of each data after the protection of it has been removed within the tool. For this, the method may further comprise the following steps: g- producing a second data transfer frame; h- write the unprotected data in the second frame; i- transmitting the second frame containing unprotected data to the security message router; and j- storing unprotected data in the input buffer assembly. These steps g to j are performed, in particular, when the protected data is audio or video data and not access control data.

The operation of removing the protection of a piece of data is entirely executed within the dedicated tool for this purpose. Thus, the protection used may be independent of the reading terminal. This makes it possible to implement various protections by adapting only the removal tool of the protection, without having constraints related to the reading terminal.

Steps g to i are executed within the protection removal tool, and step j is controlled by the security message router.

When multiple protections are accumulated for data, respective withdrawal tools of the different protections can be associated with the reading terminal. In this case, for at least one of the received data thus protected, the security message router successively selects one of the protection removal tools from an access control table. It then sends the data to this selected tool so that the protection corresponding to this tool is removed from said data. The method is then repeated for the same data with the next protection removal tool indicated in said access control table. The security message router then has a master function with respect to the protection removal tools that act as slaves. The invention also relates to a data reading terminal and a protection removal tool adapted to implement a method as described above.

Such a reading terminal comprises:

an input buffer assembly for storing received data;

at least one port for input / output of transfer messages;

a security message router connected on the one hand to the input buffer assembly and on the other hand to the transfer message input / output port; means for detecting protected data in the input buffer assembly; and means for sending a signal to the security message router, arranged to be activated when protected data is detected in the input buffer assembly.

The security message router incorporates the following means, arranged to be activated in response to a detection signal of protected data in the input buffer assembly:

means for producing a first data transfer frame;

means for controlling a reading of protected data in the input buffer memory assembly; means for writing a protected data item read in a said first frame; and

means for transmitting a first frame containing protected data read by the input / output port.

The security message router may further comprise: means for reading unprotected data contained in a second frame received on the input-output port; and

means for controlling an entry in the input buffer assembly of unprotected data read in a second said frame.

To coordinate the withdrawals of several protections applied to the data, the reading terminal may comprise several data transfer message input / output ports, storage means of an access control table, and selection means. one of said input / output ports from said access control table, said selection means being arranged to be activated during a transmission of a said first frame containing a protected data.

A tool for removing a protection applied to data, which is adapted to the implementation of the invention, comprises:

an input / output port of frames containing data; means for reading protected data in a first frame received on the input / output port;

means for withdrawing the protection of a piece of data read; means for producing a second data transfer frame;

means for writing in a second frame of data whose protection has been removed; and means for transmitting a second frame containing unprotected data via the input-output port.

The invention also relates to a data reading system comprising a data reading terminal and at least one data protection removal tool as described above, the tool being connected to an input / output port of the data messages. transfer of the reading terminal.

The invention finally relates to a first computer program product intended to be stored in a memory of a terminal as described above, said first program product including instructions at least for the implementation of steps c), d) and e) a data reading method according to the invention.

It also relates to a second computer program product intended to be stored in a memory of a protection removal tool as described above, said second program product including instructions at least for the implementation of the steps g) and h) a data reading method according to the invention.

Other features and advantages of the present invention will appear in the following description of two nonlimiting exemplary embodiments, with reference to the appended drawings, in which:

FIG. 1 is a simplified block diagram of a data reading device according to the invention; and

FIG. 2 is a block diagram of a multimedia player according to the invention.

In these figures, identical references correspond to identical elements or having identical functions with respect to the invention. According to FIG. 1, a reading device 100 comprises an input buffer memory 1 and a security message router 2. memory 1 is arranged within the device 100 to store application-level data, after these data have been extracted from a stream transmitted by an external broadcast server not shown. The router 2 is connected to the memory 1 so that the router 2 can read and write data therein. The router 2 is further connected to a data protection removal tool 3 by an input / output port 4. The protection removal tool can take a number of forms. This can be in particular a module or a card intended to be plugged into a dedicated housing of the device 100. It can also be a box external to the device 100. Optionally, the device 100 can be equipped with several input / output ports similar to the port 4 so that you can connect to multiple data protection removal tools simultaneously. Such tools may correspond to different protections that may be applied to the data broadcast. They can also correspond to the same protection, for example to obtain a higher capacity of withdrawal of this protection for large data flows.

The data extracted from the stream transmitted by the broadcast server are admitted to the memory 1, in a manner known to those skilled in the art (step 10). A test is then performed within the device 100, to detect the presence of a protected datum in the memory 1. Such a test may relate, for example, to a protection indicator present in each datum. When a protected data is detected, a specific signal 20 is transmitted to the router 2, in order to activate a data protection withdrawal sequence. According to a particular mode of implementation of the invention, the detection of a protected datum in the memory 1 and the sending of the signal 20 are carried out by a module 5 for monitoring the contents of the memory 1, dedicated to this task .

In response to the signal 20, the router 2 controls the withdrawal of the protection of the data, as well as a storage in the memory 1 of the data whose protection has been removed (step 70). When several protected data simultaneously detected in the memory 1 are detected, the router 2 furthermore coordinates the protection removal operations of each of those data. In particular, it can control the respective processing of withdrawal of the protection of each of the data in a chronological order determined from timestamps read in the data.

The command, by the security message router 2, of the withdrawal of the protection of a piece of data is carried out as follows. After receiving the signal 20, the router 2 sends a request 30 for transferring the protected data detected. In response to the request 30, the protected data is transmitted to the router 2 (step 40). The router 2 then produces a first transfer frame, having a payload field in which it inscribes the protected data. The first frame with the protected data constitutes the message for transferring the protected data to the tool 3 for removing the protection.

According to a preferred implementation of the invention, the first frame also comprises a data length field, in which the router 2 inscribes a length of said protected datum, simultaneously with the registration of the protected datum in the field. payload. In known manner, such a length field makes it possible to control that the transfer of the message between the router 2 and the tool 3 is correctly performed, by comparing a measured length of the protected data received by the tool 3 to the length read by tool 3 in the length field of the first frame. According to an improvement of the invention, the router 2 can further include, in a dedicated field of the first frame, a time stamp of the protected data. The time stamp thus remains associated with the data when it is transferred for removal of the protection.

Such an inscription of time stamps in the first frames has the following advantages:

- Encryption algorithms are often based on synchronization between data and encryption keys. Time stamps are then convenient information for performing such synchronization. This is particularly useful in the case of encryption algorithms that operate in counter mode, for which particularly fine synchronization is required;

- The registration of time stamps in the first frames allows also to verify certain rights of use of the data based on the timestamps. Such a situation is for example that of a limited listening time for audio content;

the registration of time stamps makes it possible to detect a time window in a sequence by means of a digital tattooing tool. The time stamps of the first data containing the start tattoo and the last data containing the end tattoo allow to calculate the duration of the sequence. An application can be the calculation of the cost of an advertisement according to its duration.

By way of example, the first frame may have the following structure, built by extension of the frames proposed in the MPEG-2 IPMPX and MPEG-4 IPMPX standards:

a first 8-bit field intended to receive an identifier of the frame indicating that it contains a protected datum,

a second field of 16 bits intended to receive the length, expressed in bytes, of the protected data,

a third 32-bit field intended to receive the time stamp attached to the protected data, and a fourth field called "payload" and intended to receive the data.

The fourth field has a variable length which corresponds to the indication inscribed in the second field.

On receipt of the transfer message (step 50), the tool 3 executes the withdrawal of the protection of the data. This retraction performed on the data itself is performed within the tool 3. The elementary operations performed on the data to withdraw the protection may be similar to those performed during a protection withdrawal performed within the device 100, in a manner known from the prior art.

The unprotected data item is then written by the tool 3 in a second frame, intended to transfer the data back to the router 2

(step 60). This return transfer is also performed by the input / output port 4.

The second frame may have a structure similar to that of the first frame described above. In particular, the second frame may comprise:

a first 8-bit field intended to receive an identifier of the second frame indicating that it contains unprotected data, a second field of 16 bits intended to receive the length of the unprotected data,

a third 32-bit field intended to receive a time stamp attached to the unprotected data, and

a fourth field ("payload") intended to receive unprotected data of variable length corresponding to the indication entered in the second field.

Thus, said first and second frames, respectively used for the transfer of the protected data to the tool 3 and for the return transfer of the unprotected data to the router 2, correspond to different message classes, distinguished by respective identifiers registered in the first fields of each frame.

The length of unprotected data is entered in the second field, or field of length) of the second frame at the same time that the unprotected data is itself entered in the "payload" field. As for the first frame, it makes it possible to verify that the return transmission of the unprotected data item is correctly performed.

The time stamp of the unprotected data item is written in the third field of the second frame when the unprotected data item is itself written in the "payload" field. Preferably, this time stamp is identical to that conveyed in the first frame for the same datum. The association of the time stamp with the data is thus preserved throughout the protection removal process.

When the router 2 receives the transfer message unprotected data, it extracts the unprotected data from the second frame and stores it in the memory 1. The data thus returned to the memory 1 can then be transmitted to a chain reading device 100.

When the same data stored in the memory 1 has several cumulative protections applied successively to the data, the the

Router 2 successively transmits the data to protection removal tools connected to respective ports similar to port 4. The transmission of data between the router 2 and each tool is performed in the manner just described. When the router 2 receives back the data from one of the protection removal tools, after this tool has removed the corresponding protection, the router 2 addresses the data to another protection removal tool, determined in according to an order of said protections known from the router 2. For this purpose, configuration data relating to the different data protections and the tools for removing these protections are transmitted to the router 2 in a manner which is described later in the case. an MPEG-4 reading terminal.

Figure 2 illustrates the application of the invention to an MPEG-4 IPMPX data reading terminal. In known manner, such a terminal 110 comprises a demultiplexer 6 receiving as input the MPEG data broadcast by an external server or obtained by reading an MP4 file locally. The demultiplexer 6 is connected at the output to different channels of a reading device 100. Each channel of the device 100 is dedicated to reading data of a certain type, such as audio data, video data, construction data. scenes (designated by BIFS data for "Blnary Format for Scenes"). Each of these channels comprises a respective decoding stage and a common composition stage. A buffer is provided at the input of each stage in each channel to temporarily store the data between two stages.

Thus, the audio data processing channel comprises a first buffer memory 1 disposed between an output of the audio data of the demultiplexer 6 and an audio decoder 7. This first memory is called the audio decoder buffer. The audio data processing channel further comprises a second buffer disposed between an output of the audio decoder 7 and an audio input of a composer 8. This second memory is called the audio composer buffer.

Similarly, the video data processing channel comprises, in the order of processing the video data, a video buffer of the the

decoder 1a, a video decoder 7a and a composer video buffer connected to a video input of the composer 8.

The BIFS data processing channel comprises a BIFS data decoder buffer 1b, a BIFS data decoder 7b, and a BIFS composer 1 "buffer b connected at the output to a BIFS input of the composer 8. A staging module BIFS 9 is connected between the output of the composer BIFS buffer 1 "b and the BIFS input of the composer 8.

The composer 8 is connected to audio and video outputs 101 of the terminal 110. The data of each type (audio, video, BIFS, or other) can be protected at the decoding level thereof or at the level of the composer 8.

In the case of coding level protection, the protection is removed by operating on each protected data stored in one of the decoder buffers corresponding to the type of data. The protected data contained in the memories 1, 1a or 1b are access units, as defined in the MPEG-4 standard. The protected MPEG access units are transferred by the router 2 to appropriate protection removal tools from the corresponding decoder buffer. The protection removal tool to which data is transferred may depend on the type of data. Thus, with reference to FIG. 3, protected data contained in the memories 1, 1a and 1b are respectively transferred by the router 2 to the tools 3, 3a and 3b in order to remove the protections of each of them. The router 2 then records the unprotected data returned respectively by each tool 3, 3a or 3b in the memory 1, 1a or 1b of origin corresponding to the type of data.

In the case of composition-level protection, the protection is removed in an identical manner by operating on the data stored in the dialer buffers, the a and b. The data stored in these memories are called composition units in the MPEG-4 standard. The 3 ', 3'a and 3'b protection removal tools correspond to composer-level protections for the audio, video and BIFS channels respectively.

Advantageously, frames belonging to different classes can be used for data of different types, for data of different stages in the reading chain, namely for MPEG access units or MPEG composition units, or else for data of the same type and the same floor but with different protections. The processing of each data item in the router 2 is then determined simply according to the class of the frame (s) used for this datum. The classes of the frames can be distinguished from each other by a specific flag inscribed in each frame. Optionally, this indicator can be incorporated into the identifiers of the frames introduced above.

Configuration data is required for the operation of the security message router 2. Such data includes in particular a main list of protection removal tools connected to the terminal 110, an auxiliary list of protection removal tools to be activated. when one of the tools of the main list is missing, as well as various configuration parameters of the router 2. Initial values of these data are contained in the MP4 files during a reading in local mode or in a file of initialization SDP ("Streaming Data Protocol" defined in RFC2327) when accessing a broadcast stream. The object that contains this data is called "Initial Object Descriptor" or IOD. This IOD file is read when the read terminal 110 is started. Some of this initial data can then be updated when reading the broadcast MPEG data. For this, the terminal 110 has an additional channel for receiving data contained in the broadcast MPEG stream, disposed between a dedicated output of the demultiplexer 6 and a dedicated input of the router 2. This channel comprises a buffer of the configuration data of the router 2 referenced 102 in FIG. 2 and called the OD buffer (for "Object Descriptor"), as well as a dedicated decoder referenced 103. The buffer memory 102 is connected to receive as input the data of the IOD file, then the setting data. transmitted in the broadcast MPEG stream. The broadcast MPEG stream finally includes configuration and parameterization data protection removal tools themselves. This data, called IPMP data, is transmitted to the protection removal tools 3, 3 ', 3a, 3'a, ... connected to the terminal 110. This IPMP data is isolated by the demultiplexer 6 from the other data contained in the broadcast MPEG stream. They are stored in a dedicated buffer 104 and are then transmitted by the security message router 2 to the relevant protection removal tools.

Claims

A method of reading data received in protected form, comprising the following steps, for at least one of the received protected data: a- storing the protected data in an input buffer set (1); b- sending, to a security message router (2), a signal (20) indicating that protected data is present in the input buffer set (1); c- producing a first data transfer frame; d- reading the protected data (40) in the input buffer set (1); e- write the protected data in the first frame; and f- transmitting the first frame containing the protected data item (50) to a data protection removal tool (3), wherein steps c, d, e and f are controlled by the security message router (2) responsive to the signal indicating the presence of protected data in the input buffer (20).

The method of claim 1, wherein the data is an MPEG access unit or an MPEG composition unit.

The method of claim 1 or 2, wherein the first frame comprises a data length field, and wherein, in step e, a length of said protected data is further inscribed in said length field.

4. A method according to any preceding claim, wherein a time stamp of the protected data is registered with said protected data in the first frame.

The method of any of the preceding claims, further comprising the following steps, performed after removal of the protection of said data: g- producing a second data transfer frame; h- write the unprotected data in the second frame; i- transmitting the second frame containing unprotected data (60) to the security message router (2); and j- storing unprotected data (70) in the input buffer (1).

The method of claim 5, wherein the second frame comprises a data length field, and wherein, in step h, a length of said unprotected data is further inscribed in said length field. the second frame.

The method of claim 5 or 6, wherein a time stamp of unprotected data is inscribed with said unprotected data in the second frame.

The method according to any one of claims 5 to 7, wherein said first and second transfer frames correspond to different message classes, distinguished by respective identifiers registered in each transfer frame.

A method according to any one of the preceding claims, wherein for at least one of the protected data received, the security message router (2) successively selects a protection removal tool among several tools from a table. access control, and wherein said router (2) sends said data to the selected tool to remove protection from said data corresponding to said tool selected, the method then being repeated for said data with a next protection removal tool indicated in said access control table.

10. Data reading terminal (1 10) comprising:

an input buffer set (1) for storing received data;

at least one transfer message input / output port (4);

- a security message router (2) connected on the one hand to the input buffer assembly (1) and on the other hand to the transfer message input / output port (4); means (5) for detecting protected data in the input buffer memory (1); and

means for sending a signal (20) to the security message router

(2), arranged to be activated when protected data is detected in the input buffer set (1), said security message router (2) incorporating:

means for producing a first data transfer frame;

means for controlling a reading of protected data in the input buffer memory (1);

means for writing a protected data item read in a said first frame; and

means for transmitting a first frame containing protected data read by the input / output port (4), said means of the security message router (2) being arranged to be activated in response to a detection signal protected data in the input buffer (20).

11. Terminal according to claim 10, adapted to read a data consisting of an MPEG access unit or an MPEG composition unit.

Terminal according to claim 10 or 11, wherein the security message router (2) further comprises means for writing a message. length of protected data in a length field of a first frame containing said protected data.

Terminal according to any one of claims 10 to 12, wherein the security message router (2) further comprises means for registering, with a protected data in a first frame, a time stamp of said protected data.

The terminal of any one of claims 10 to 13, wherein the security message router (2) further comprises:

means for reading unprotected data contained in a second frame received on the input-output port (4); and

means for controlling an entry in the input buffer memory (1) of unprotected data read in a second said frame.

15. Terminal according to any one of claims 10 to 14, comprising a plurality of input / output ports of data transfer messages, means for storing an access control table, and means for selecting data. one of said input / output ports from said access control table, said selection means being arranged to be activated during a transmission of a said first frame containing a protected data item.

16. Tool (3) for removing a protection applied to data comprising:

an input / output port of frames containing data;

means for reading protected data in a first frame received on the input / output port; means for withdrawing the protection of a piece of data read;

means for producing a second data transfer frame;

means for writing in a second frame of data whose protection has been removed; and means for transmitting a second frame containing unprotected data via the input / output port.

The tool of claim 16, further comprising means for writing a length of unprotected data in a length field of a second frame containing said unprotected data.

The tool of claim 16 or 17, further comprising means for writing, with unprotected data in a second frame, a time stamp of said unprotected data.

A data reading system comprising a data reading terminal (110) according to claims 10 to 15, and at least one data protection removal tool according to claims 16 to 18, connected to an input port / outputting transfer messages from the reading terminal (4).

20. Computer program product, intended to be stored in a memory of a terminal according to any one of claims 10 to 15, characterized in that it comprises instructions at least for the implementation of steps c) , d) and e) a method according to any one of claims 1 to 9.

21. Computer program product, intended to be stored in a memory of a removal tool of a protection according to any one of claims 16 to 18, characterized in that it comprises instructions at least for the implementation steps g) and h) of a method according to any one of claims 5 to 8.