FR2779599A1 - System for television broadcasting to multiple users with right of access - Google Patents

Abstract

The system comprises a center for management of right of access (GES), principal (PRI) and secondary (SEC) deciphering devices including entry interfaces (10) and modules for controlled access in connection with memory cards. Medium of communication (MCOM) links principal decoder to management center in case of a request for secondary right of access (DAS), for identification of principal user, an identification of secondary user and information regarding affiliation, and transfer of right of access to the secondary user card (CS). The procedure includes the identification of principal user card (CP), the request for secondary right of access (RQ), a verification and authorization of the request (RQ), a search for the identification by table (TAB) of secondary user and the address of secondary rights, an encipherment of secondary rights, a transmission within the broadcasting network, decipherment and recording of the secondary rights, decipherment and visualization of authorized program.

Description

An ecruiped pay-TV device with several decorations

  donors with distribution of access rights.

  The present invention relates to services and / or communications.

  toll, particularly television.

  It finds an application in radio broadcasting networks, direct by satellite or by cable, in which the information broadcast (sound, image and sometimes data) is "scrambled", that is to say modified according to a specific coding, to prohibit the access to this information. A descrambler or decoder, rented or sold to users for

  well-defined use, allows them to access information

  "descrambled", that is to say in the clear.

  Generally, when you have several receivers

  television broadcasters and wish to receive broadcasts

  Pay TV on each of the TV receivers

  We must connect a decoder to each receiver, and we must obtain individual access rights for each decoder. However, decoders are relatively expensive to purchase or rent, and the procedure for obtaining access rights from an operator is relatively cumbersome to set up and inflexible, especially when there is

  several users to satisfy with different needs.

  The present invention provides a solution to these problems.

  It relates to a pay television device intended to cooperate with at least one broadcasting network and an access rights management center, said television device being of the type comprising a main decoder capable of converting scrambled signals carrying information subject to toll coming from the broadcasting network in descrambled signals, susceptible of direct use, said main decoder comprising a main access control module able to cooperate with a main memory card containing a user identifier main, associated with main access rights, and means of communication capable of being linked to the management center. According to a general definition of the invention, the device also comprises at least one secondary decoder capable of converting scrambled signals into descrambled signals, said secondary decoder comprising a secondary access control module capable of cooperating with

  at least one secondary memory card containing an identification

  trusting secondary user, associated with secondary access rights, the secondary user identifier being linked to the main user identifier according to information from

predetermined parentage.

  According to the general definition of the invention, the means of communication of the main decoder are suitable for dialoguing with the management center to request said secondary access rights, as a function of the main user identifier, of the identifier secondary user and parentage information, and the main decoder or the secondary decoder is capable of receiving, via the broadcasting network, said secondary rights thus required, in order to

  transfer them to the secondary memory card.

  Such a device has the advantage of making it possible to obtain access rights for the memory card or cards associated with each decoder, by means of a dialogue between the means of

  communication of the decoder equipped with such means of communication

  tion and the management center, the other decoders being able to be decoders without means of communication with the management center and simply dedicated to the conversion of

scrambled signals.

  As a result, such a device is more ergonomic and less expensive than a device comprising decoders each equipped with means of communication with the management center. In addition, such a device according to the invention

  simplifies the distribution of access rights for one or more

  several secondary memory cards associated with one or

several secondary decoders.

  Other characteristics and advantages of the invention

  will appear in the light of the detailed description below.

  after and drawings in which: - Figure 1 schematically shows the operating principle of a pay television system of the prior art; - Figure 2 is a detailed diagram of the distribution of

  rights of access to television programs according to prior art

laughing;

  FIG. 3 schematically represents an embodiment

  tion of the invention; and - Figure 4 is a flowchart illustrating the distribution

  secondary access rights according to the invention.

  In FIG. 1, a DEC decoder comprises an interface

  input 10 which receives an analog or digital signal em-

  scrambled which can be for example: - either a high frequency analog signal comprising several data channels, in which case the input interface 10 then comprises a demodulator, to switch to a lower frequency, and a demultiplexer, to separate the individual channels ; - Either directly a scrambled analog signal relating to a single channel, in which case the input interface 10 simply comprises elements for shaping this signal; - either a digital signal carrying the digital stream, and

  this input interface 10 can be either a receiver / syn-

  cable or satellite television tuner, either an ATM type coupler (asynchronous transfer mode or "Asynchronus Transfer Mode"), or ADSL (Asymmetric Digital Subscriber Line or "Asymetric Digital Subscriber Line"). In known manner, processing means 20 are capable of transforming the scrambled signals of a single channel into

  descrambled signals, which are then applied to the inter-

  outlet face 90, for example for controlling a television

  or a monitor, in the case of a video application.

  The output interface 90 in the case of a digital signal can comprise a demultiplexer, for extracting from the clear digital stream the sequences relating to the desired channel, and the output interface itself, which, in known manner, transforms these signal sequences suitable for driving

a TV or monitor.

  The DEC decoder further comprises MCOM communication means connected to the GES access rights management center. These MCOM communication means form a return path between

  the DEC decoder and the GES management center.

  For example, these MCOM communication means include a telephone MODEM type modulator / demodulator connecting the decoder to the management center via the PSTN switched telephone network or the ISDN services integrated digital network. The return path between the decoder and the management center finds interactivity applications, for example to request access rights or facilitate navigation in

programs and channels.

  A TCOM remote control is associated with the decoder to allow the user to select his program or to keep informed and help him make his choice by consulting a

  database on current or future emissions.

  With reference to FIG. 2, the scrambling device 100 receives at its input 102 the components in clear CC to be scrambled. The synchronization and signaling information SSC is applied in clear to the input 104 of the scrambler. The output 106 of the scrambler, delivering the scrambled components CE, is connected to the input 112 of the descrambler 110 whose input 114 receives the synchronization and signaling information in clear SSC. After conversion, the output 116 of the descrambler delivers the

components in clear CC.

  Scrambling / descrambling is controlled by a control word CW. The descrambler must have the same CW control word as the scrambler to restore the image or

its clear.

  In practice, CW control words are transmitted sensi-

  in real time in the signal broadcast by the RES broadcast network, in encrypted form to protect their

  transport from the scrambler to the descrambler.

  On the transmission side, an encryption device 120 receives at its input 122 the control words CW to be encrypted according to a

  cryptographic function f under the control of an auto key

  rization SK, also called service key or service_key, and

  applied to input 124 of the encryption device.

  The cryptograms corresponding to the transformed control words CW by the cryptographic function f according to the authorization key SK, that is to say f (CW, SK), are transmitted by the output 128 in the signal broadcast to the inside service messages called ECM (Entitlement Control Messages). Output 126 applies the CW control words in

  clear at input 105 of scrambler 100.

  ECM service messages also include the conditions

  CA access to the program (cost, type of subscription, etc.)

  applied to the input 130 of the encryption device 120.

  All the information contained in the ECM service messages is signed by the encryption device 120 using the authorization key SK. The output 128 applies said signed information corresponding to f (ECM, SK) to the signal broadcast by the broadcasting network. At each DEC decoder, the ECM service messages of the program selected by the user are retrieved and the signature f (ECM, SK) is verified. In the presence of an authentic signature and if the access conditions CA are satisfied, the control words CW are then decrypted and transmitted to the descrambler 110, that is to say to the processing means 20

  of the DEC decoder described with reference to FIG. 1.

  Verification of the signature of f (ECM, SK) and decrypts it-

  ment of f (CW, SK) is done using a deciphering device

  ment 200 using the same SK authorization key as on transmission. The input 202 of the decryption device 200 receives the transforms f (ECM, SK) and f (CW, SK) via the broadcasting network. The input 204 of the decryption device 200

  receives the SK key. Output 206 of the decryption device

  ment 200 delivers the CW control words to entry 118 of the

descrambler 110.

  The decryption device 200 as well as the authorization key

  SK station are stored in an access control module 50 (Figure 1) which itself cooperates with a protected memory

(figure 1).

  The memory 55 can be for example a smart card with

  microprocessor, or an electronic microprocessor key

  or a PCMCIA type card with secure processor, or a secure contactless card with microprocessor. The SK authorization key is not diverse, i.e. the same SK authorization key is present in all

access cards.

  A comparator device 210 is provided for comparing the access rights DA to the conditions of access to a program CA transmitted in the ECM service messages in order to establish

  whether the user has the right or not to watch the program.

  These DA access rights are updated by means of

  access rights management messages, called EMM (Entitle-

  Management Messages) transmitted with the program via the network. In practice, the key SK is transmitted in the signal broadcast by the broadcast network RES, in encrypted form to protect its transport from the scrambler to the descrambler. On the transmission side, an encryption device 220 receives at its

  input 222 the key SK to be encrypted according to a cryptographic function

  phique f under the control of a distribution key, called user key or userkey UK. These UK distribution keys vary from one access card to another. UK keys are

  applied to the input 224 of the encryption device 220.

  The transform of the key SK by the cryptographic function f according to the distribution key UK, i.e. f (SK, UK), is

  transmitted by output 228 in the signal broadcast internally

laughter of EMM messages.

  The EMM service messages also include the access rights DA associated with the user holding the distribution key UK. These access rights DA are applied to the input 230 of the encryption device 220. In practice, these access rights DA are stored in a table TAB housed in the management center GES, at a predetermined address connecting the identifier ID of the access card and said access rights. Each ID identifier is associated with

  DA access rights, as well as a UK distribution key.

  All information (including DA rights) contained

  in the EMM service messages are signed by the device

  encryption code 220 using the UK distribution key.

  The output 228 applies said signed information corresponding to f (EMM, UK) to the signal broadcast by the broadcasting network. At each DEC decoder, the EMM access rights management messages are retrieved and the signature f (EMM, UK) is verified. In the presence of an authentic signature, the authorization key SK is then decrypted and transmitted to

  the input 204 of the decryption device 200.

  Verification of f's signature (EMM, UK) and decrypts it

  ment of f (SK, UK) is done through a deciphering device

  ment 300 using the UK distribution key, previously

  stored in memory 55 of the access control module.

  The input 302 of the decryption device 300 receives the

  transformed f (EMM, UK) and f (SK, UK) via the broadcasting network.

  The input 304 of the decryption device 300 receives the UK key. The output 306 of the decryption device 300 delivers

  the key SK at the input 204 of the decryption device 200.

  The decryption device 300 as well as the UK distribution key are stored in the control module

  access 50 (Figure 1) and its memory 55.

  UK distribution keys vary from one access control module to another. They are diversified at the level of a generation device 400 whose input 402 receives a master key participating in the diversification of distribution keys UK and whose input 404 receives information relating to the files of users and access cards and contained in the TAB table housed in the GES management center. If the signature of the EMM messages is correct, then the access control module, convinced of the authenticity of the message, executes the operation of management of the access rights after storage of the access rights in a memory 310 whose output 312 is connected to input 212 of the comparator

rights 210.

  The Applicant notably posed the problem of improving the procedure for distributing access rights when one or more

  several users have several television receivers

  each connected to a decoder.

  Referring to Figure 3, there is shown a pay television installation equipped with a main PRI decoder and

a SEC secondary decoder.

  The main decoder PRI comprises the elements described with reference to FIGS. 1 and 2, in particular an input interface 10 receiving the signals broadcast by the broadcast network RES and communication means MCOM connected to the management center GES through a network of any communication such as the PSTN network or the network

  digital ISDN service integration.

  The SEC secondary decoder includes a descrambler similar to that of the main decoder. On the other hand, the secondary decoder is advantageously devoid of means for

  MCOM communication, become useless as we will see below

  after. The secondary decoder can therefore be cheaper than

  the main decoder insofar as it is not necessary

  may have a browser to allow the user to navigate through programs and its remote control may have

reduced functions.

  The access control module of the secondary decoder is similar to that of the main decoder. The secondary access control module is able to cooperate with one or more secondary cards CS while the decoder

  main works with a main CP card.

  According to the invention, the Applicant has set up a dialogue between the main decoder and the management center to enable distribution of access rights to one or more secondary cards from one or more secondary decoders without equipping the said decoder or decoders. secondary means of

  communication with the management center.

  According to the invention, the identification table TAB contains filiation information FIL between the identifier of the main user IDP and one or more access identifiers

secondary IDS.

  Access rights are managed according to the invention from the main card. Thus, according to the invention, it is possible to particularize or personalize the services offered by the broadcasting operator to the users of the secondary decoders who can use a secondary decoder at different times such as multi-users each having a personalized authorization. Thus, a secondary decoder can serve several secondary users, each having a secondary card and the rights assigned to these cards. For example, the main decoder PRI and the main card CP are assigned to the family, with a main identifier IDP associated with DAP access rights for the family. The secondary decoder SEC and the secondary card or cards CS1, CS2 are assigned to family members, with a secondary identifier IDS, secondary rights DAS and a respective distribution key UK. Parentage information is established between the different identifiers, according to a chosen tree structure known to the management center. The DAP access rights can be different from the DAS secondary access rights, and the secondary access rights for each secondary card can also be different.

each other.

  In addition, the main decoder and the secondary decoder (s) are not necessarily located in the same room. In this case, the secondary decoder is distant from the main decoder, the secondary access rights however being linked to the authorizations granted at the time of obtaining and storing said rights which will be described more

in detail below.

  Referring to Figure 4, we will give an example of

  distribution of secondary access rights according to the invention.

  When a secondary user wants to use a secondary decoder to access pay programs, it is necessary to have corresponding access rights DAS in their secondary card. The secondary CP card contains in its protected memory a personal distribution key

and secret UKS.

  According to the invention, the means of communication of the main decoder will make it possible to dialogue with the center of

  management to obtain these secondary access rights.

  The first step E1, optional, consists in identifying the

  main CP card at the main decoder.

  This identification can be carried out using a secret personal code, introduced beforehand by the operator into the secret memory of the memory, and verified by the card itself, through the main decoder. Such a

  identification can be adapted to allow a function

multi-user operation.

  Steps E2 and E3 consist of a dialogue between the main PRI decoder and the GES management center, via the

MCOM means of communication.

  According to the invention, the communication means MCOM send an RQ request to the management center to obtain secondary access rights DAS1 (step E2) for the one or more

CS secondary cards.

  The request is accompanied by the main user ID

  pal IDP, and a request for access rights for the secondary user IDS. Parentage information

  FIL between the main user IDP and the user ID

  proud of secondary user IDS also accompanies the request. Advantageously, the request is authenticated according to step E3 using active authentication implemented using the distribution key UK of the main card and encryption means 220 housed in the GES management center. and decryption means 300 housed at the level of the

main CP card.

  After verification and authorization, i.e. authentication

  cation of the request RQ, the management center will search in its identification table TAB (step E4), the secondary identifier IDS. Using FIL parentage information

  connecting the main identifier IDP and the secondary identifier

  daire IDS, the management center determines the secondary address

  daire where are the secondary DAS access rights.

  According to step E5, the management center will assign and encrypt the secondary DAS access rights for the card

secondary CS.

  In practice, the secondary access rights DAS are encrypted by the authentication means 220 of the management center which encrypt the secondary access rights using the distribution key UKP associated with the main card or the using the UKS distribution key associated with the card

secondary.

  According to step E6, the secondary access rights DAS thus encrypted are transmitted via the broadcasting network RES to the main decoder or the secondary decoder to be decrypted and recorded in the secondary card (step E7). More specifically, the decryption means 300 of the main card CP or of the secondary card CS establish the cryptographic function f using the corresponding distribution key to decrypt the secondary access rights

DAS thus transmitted encrypted.

  In practice, it is the means for decrypting the main card which decrypt the access rights when the card reader of the main decoder comprises two slots.

  of introduction, while these are the means of deciphering

  secondary card which decrypt the access rights when the card reader of the main decoder does not

  includes only one insertion slot.

  In the case of a main decoder with two introductory slots,

  tion of cards, the request RQ is established when the main memory card CP is inserted into the first slot

  of the main decoder and when the second memory card

  Daire CS is introduced into the second slot of the main decoder. Thus, the secondary rights DAS transmitted via the broadcast network RES are first stored in the main memory card CP to then be decrypted and finally transferred from the main memory card CP to the secondary memory card CS thus introduced into the reader of

main card.

  It should be noted that the transfer of DAS rights to the secondary card can take place during normal use of the main decoder. The transfer operation can be carried out in parallel with the normal operation of the main decoder. The secondary user after removal of

  his secondary card in the main decoder can use it

  normally use its secondary decoder. It is in fact a transfer of rights of the main card type to

secondary card.

  In the case of a main decoder with a single card insertion slot, the request RQ is established when the main memory card is inserted into the slot of the main decoder and when the secondary memory card is inserted into the slot of the secondary decoder. Thus, the secondary rights are transmitted directly to the secondary memory card, via the broadcasting network according to

  step E7 to be deciphered and recorded.

  In the case of a transfer by the broadcasting network directly to the level of the secondary card, the main card therefore remains in the main decoder and the card

  secondary remains in the secondary decoder.

  Finally, according to step E8, after storage of the secondary access rights DAS in the secondary card, descrambling

  and viewing the program are made possible.

  It should be noted that the dialogue described above can be implemented by a validation device (validator) of professional type located at a predetermined access point. In this case, the main PRI decoder, preferably with two card insertion slots, described with reference to FIGS. 1 to 4, plays the role of the access validator enabling requests for access rights REQ to be made to the operator's GHG management center for one or more primary and / or secondary cards, according to the protocol for distributing access rights in accordance with the invention.

  This distribution of rights can be automated freely.

  service in a terminal specializing in the sale of operator services. For example, the specialized terminal is able to provide editing of prepayment cards, which allows

  a secondary decoder to give access to the service linked to the pre-

  payment without said secondary decoder having MCOM communication means with the operator's GES management center. In general, a parental code is at a level of access to a certain content for the same channel. According to the invention, such a parental code can be assigned to each

  secondary rights by the main decoder according to a procedure

  distribution time similar to that of access rights

  secondary described with reference to Figure 4.

  In this case, the main access card has the image of the access rights of all the secondary access cards and can authoritatively assign a parental level. This level

  is transmitted to the secondary decoder by the broadcasting network

  sion as part of a service message. It can also be transmitted by a transfer from main card to secondary card. The operation of transferring a parental code can be carried out by verifying the secondary card with the personal code

assigned to the secondary card.

  In practice, the device according to the invention can be accompanied by means of payment which can be a bank card with credit agreement and operating via the MCOM communication means. The means of payment can also be external means, for example Minitel, terminal

  automatic, invoice order or specialized operation server

by phone.

  In practice, the means of payment for the main and / or secondary access rights are located in the decoder

main.

Claims (9)

Claims   1. Pay-TV device intended to cooperate with at least one broadcasting network (RES) and one access rights management center (GES), said television device being of the type comprising: - a main decoder (PRI) capable of converting scrambled signals carrying information subject to toll from the broadcasting network into descrambled signals, capable of direct use, said main decoder comprising a main access control module (50) able to cooperate with a main memory card (55) containing a main user identifier, associated with main access rights, and - means of communication (MCOM) suitable for being linked to the management center (GES), characterized in that that it further comprises at least one secondary decoder (SEC) capable of converting the scrambled signals into descrambled signals, said secondary decoder (SEC) comprises ant a secondary access control module able to cooperate with at least one secondary memory card (CS) containing a secondary user identifier (IDS), associated with secondary access rights (DAS), the identifier d 'secondary user (IDS) being connected to the main user identifier according to predetermined parentage information (FIL), in that the means of communication (MCOM) are suitable for dialoguing with the management center (GES) to request said secondary access rights (DAS), as a function of the main user identifier, the secondary user identifier and the parentage information, and to receive said secondary access rights thus required, at level of the main decoder (PRI) or of the secondary decoder (SEC), via the broadcasting network (RES), in order to be transferred to the secondary card (CS).   2. Device according to claim 1, in which the management center (GES) comprises encryption means (220) capable of establishing a cryptographic function (f) to   using a distribution key (UKP), secret and personal   nelle to the main user, characterized in that the main card (CP) comprises decryption means (300) suitable for establishing the cryptographic function (f) using the distribution key, secret and personal to the main user (UKP), and in that the encryption and decryption means (220, and 300) are capable of actively authenticating the request (RQ) for secondary access rights (DAS).   3. Device according to claim 2, in which the encryption means (220) of the management center are suitable for encrypting the secondary access rights (DAS), characterized in that the decryption means (300) of the card   secondary or main card are suitable for deciphering   frer the secondary access rights thus transmitted encrypted.   4. Device according to claim 1, in which the main decoder comprises a card reader equipped with first and second slots, characterized in that the   request (RQ) is established when the main memory card   blade is inserted into the first slot and when the secondary memory card is inserted into the second slot, and in that the secondary rights are received at the main decoder, stored in the memory card   main, and transferred from the main memory card   pale towards the secondary memory card.   5. Device according to claim 1, wherein the main decoder comprises a card reader with a single slot, characterized in that the request (RQ) is established when the main memory card is inserted into the slot of the reader of the main decoder and when the secondary memory card is inserted into the reader slot of the   secondary decoder, and in that the secondary access rights   daires are received at the secondary decoder, and   stored directly in the secondary memory card.   6. Device according to one of the preceding claims,   characterized in that the user of the main card is able to create and assign rights of the parental code type to the user of the secondary card according to a distribution procedure similar to that of the secondary rights.   7. Device according to one of the preceding claims,   characterized in that the main decoder (PRI) is capable of being an access validator enabling requests for access rights (REQ) to be made to the operator's management center (GES) for one or more cards primary and / or secondary.   8. Device according to claim 7, characterized in that the access validator constitutes a terminal specialized in the sale of services.   9. Device according to claim 8, characterized in that the specialized terminal is capable of ensuring the editing of   prepayment cards, which allows a second decoder   (SEC) to give access to the service linked to the prepayment without said secondary decoder (SEC) having means of communication (MCOM) with the operator's management center (GES).