FR2981182A1 - Method for controlling access to quantified data contents in e.g. digital TV, involves receiving access criterion for data, verifying access criterion with verification module, and transmitting result of verification to security module - Google Patents

Abstract

The method involves providing a receiving equipment (2) that comprises a decoding device and a security module. The receiving equipment is allowed to receive an access message containing a key to decrypt content data in encrypted form. The receiving equipment is utilized to receive an access criterion e.g. valid subscription, for data. The access criterion is verified with an external verification module, and result of verification is transmitted to the security module. An independent claim is also included for an equipment for controlling access to quantified data contents.

Description

The invention relates to the control of access to encrypted contents transmitted by a conditional access transmission system.

In a conditional access content transmission system, access to content is subject to verification of one or more access criteria: these must be satisfied by user rights to authorize access to the content. content. Many digital television or radio systems are "conditional access" systems. The criteria for access to a content may include a valid subscription criterion for the television channel transmitting the content for the current period, an age criterion, a cost criterion, etc. From the outset, it should be noted that the term "content" is intended to denote a set of data that may correspond to part or all of a TV program, a film, a video, a music, etc. A conditional access system, for example that defined in the framework of DVB (Digital Video Broadcasting), is generally based on the following principles: the encoded content is encrypted, with a secret encryption key- decryption called "control word" (CW-Control Word); the "control word", in encrypted form, and the access criterion or criteria for the content are transmitted to a user terminal in an access control message called "ECM" (Entitlement Control Message); an operating key K, able to decipher the control word, as well as information necessary for the management of the rights of the user are transmitted to the user terminal, all in a management message called "EMM" (Entitlement Management Message). The user is equipped with a decoding device, capable of decrypting and decoding the content, and a security module, such as a smart card, whose role is to memorize the rights of the user provided. by the received EMM message (s) and perform access control to the content. The decoding device, for example an STB (Set Top Box), is connected to a reproduction equipment, for example a television screen. Alternatively, it can be integrated with the playback equipment. This reproduction equipment can also be equipped with means to communicate through a network such as the Internet. Access control messages, or ECMs, are transmitted synchronously with the content data to which they relate. During the transmission of a content, a succession of ECM control messages are therefore transmitted synchronously to the transmission of the corresponding content data, the control words present in these ECM messages having a generally limited life (for example of the order of 10 seconds).

Each ECM message transmitted synchronously to content data contains the access criterion (s) for this content data and the control word capable of decrypting the content data. The ECM message once received by the decoding device is transmitted to the security module. This verifies whether the access criterion or criteria are satisfied by user rights stored in the security module. If the verification is positive, the security module decrypts the control word and then transmits it to the decoding device. The latter decrypts and decodes the content data and transmits it to the reproduction equipment for reproduction. The verification operations of the access criterion (s) with respect to the user rights and the decryption of the control word are performed in sequence by the security module which must first have received and stored the user rights. Such a mechanism does not make it possible to subordinate access to a content to the verification of an access condition by a third party service. The present invention aims to improve the situation. For this purpose, it relates to a method for controlling access to data of an encrypted content, by a device comprising a decoding device and a security module, comprising: a step of reception by the security module, by via the decoding module, an access control message containing a key for decrypting content data, in encrypted form, and at least one criterion for accessing the data, - a step of verifying the criterion of access to data; in case of positive verification, a step of decryption and transmission of the decryption key by the security module to the decoding device; characterized in that the step of verifying the access criterion comprises transmitting said access criterion to an external verification module to the security module, via the decoding module; a verification of the access criterion by the external verification module and a transmission to the security module of a result of the verification. Thus, according to the invention, an access criterion present in the access control message received by the security module can be retransmitted by the security module to the decoding device in order to be transmitted to a security verification module. this criterion, external to the security module. This verification module, external to the security module, can be integrated in the decoding module or external to the decoding module (a network server for example). In a particular embodiment, the decoding device being connected to a communication equipment through a communication network, the access criterion comprises a connection condition of the communication equipment to an address of said network.

The access criterion may also include a condition for use of a network service by a user. With this, the access to the content can be subordinated to the fact that the communication equipment is connected for example to an address of a Web site and that a user is in use of a given service proposed by this website. The invention also relates to an equipment comprising a decoding device and a security module, the decoding device being adapted to receive access control messages to content data, an access control message to data of the data content containing a key for decrypting the content data, in encrypted form, and at least one criterion for accessing the content data, and for transmitting them to the security module, said security module comprising means for processing a message received access control arranged to check whether the access criterion present in the message is satisfied and, in case of positive verification, decrypt the decryption key present in the access control message and then transmit it to the decoding device , characterized in that the access control message processing means are arranged to transmit the access criterion to a module of v external erection to the security module, via the decoding device, and to receive in response a result of the verification. The invention will be better understood with the aid of the following description of a particular embodiment of the access control method and of the equipment of the invention with reference to the appended drawings in which: FIG. overall view of a conditional access transmission system; FIG. 2 represents a functional block diagram of a receiver equipment of the system of FIG. 1, able to implement the method according to one particular embodiment of the invention; FIG. 3 represents a flowchart of the steps of the method according to a particular embodiment of the invention. FIG. 1 shows a system 1 for transmitting data over a network, in this case the Internet 100, to receiving equipment 2. For the sake of clarity, a single receiver equipment 2 is shown in FIG. 1. In the particular example described here, the transmission system 1 is intended to transmit audiovisual content of a bouquet of television channels. For each television channel, the transmission server 1 is adapted to transmit synchronously to receiving equipment 2: a stream F of data (here audio, video and possibly textual data) relating to audiovisual content broadcast by the television channel. television and an access control message flow F ', in this case an ECM (Entitlement Control Message), associated with this content data stream F. The transmission system 1 is connected to a control system of access, not shown, for providing ECM access control messages. Each ECM access control message comprises one or more criterion (s) of CA access to content data and a control word CW, in encrypted form, corresponding to a key for decrypting content data. The access control system is adapted to transmit to the receiving equipment 2 rights messages, in this case EMM (Entitlement Management Message), intended to provide the receiving equipment 2 rights for access to channels and / or specific contents, as well as an operating key K for decrypting control words.

Receiving equipment 2 comprises a decoding device 3, a security module 4, a rendering and communication device 5 and a network connection gateway 6, here the Internet 100. The reproduction and communication device 5 is connected to the decoding device 3 and gateway 6. It includes a television screen, incorporating a network communication module and a remote control. It is able to restore content received from the decoding device 3 and to communicate through a communication network, here the Internet. The remote control, not shown, acts as a user interface for controlling the device 5.

The decoding device 3 comprises - a reception module 30, adapted to receive content data streams, ECM access control messages and EMM right messages; an Access Control System (ACS) access control module 31; a decryption and decoding module 32; a module 33 for external verification of rights; a network connection interface 34; an interface 35 for connecting the rendering device 5 and an interface 36 for connecting to the security module 4. The term "external" means that the rights verification module 33 is a module external to the security module 4. The decoding device 3 is connected to the gateway 6 for connection to the Internet via the connection interface 34, to the reproduction and communication device 5 via the connection interface 35 and to the security module 4 via the connection interface 36.

The reception module 30 is intended to receive the flow F of content data and the flow F 'of access control messages and to supply the stream F to the decoding module 32 and the stream F' to the control module of access 31. The external rights verification module 33 comprises an application adapted to check access criteria to content data externally to the security module 4.

Verification can be carried out locally, for example by interrogating the communication module of the device 5, or by interrogating a remote server of the Internet. In the second case, sending a request to the remote server is performed by the network communication module of the device 5, on request of the module 33. In the case where the verification module 33 integrates a network communication module, the sending the request to the remote server could be carried out directly by the module 33. The access control module 31 is adapted to manage the access control to received content data, in cooperation with the security module 4, as will be described in more detail in the description of the process. The decryption and decoding module 32 is adapted to decrypt and decode received content data.

The decoding device 3 further comprises a central control unit, in this case a microprocessor, not shown, to which all the elements which have just been described are connected and intended to control its operation. The security module 4 comprises a memory 40 for storing user rights; a memory 41 for storing an operating key K; a rights management message processing block 42, or EMM; an access control message processing block 43, or ECM; an interface 44 for connection to the decoding device 3.

The module 4 further comprises a central control unit, not shown, to which the elements listed above are connected, and intended to control its operation. User rights and an operating key K have been previously stored respectively in the memories 40 and 41 of the security module following the reception and processing of one or more management messages EMM, by the block 42, in known manner. The operating key K makes it possible to decrypt the control words present in the ECM access control messages subsequently received. The processing block 43 is arranged to process ECM messages provided by the access control block 31, as will be explained in more detail in the description of the method. A particular exemplary embodiment of the method for controlling access to content data according to the invention will now be described with reference to FIG. In a step E1, the decoding device 3 receives a stream F of content data and a stream F 'of access control messages ECM from the transmission system 1. The stream F is transmitted to the decoding module 32 and the flow F 'is transmitted to the access control module 31.

Each new access control message is transmitted by the access control module 31 to the security module 4 for processing, during a step E2. An ECM access control message, relating to a given content, contains one or more criterion (s) for accessing this content and a control word in encrypted form. Each access criterion may be an internal access criterion, intended to be verified in a conventional manner by the security module 4, or an external access criterion intended to be verified by a third party verification module, external to the security module 4. In the case of an internal access criterion, the security module 4 checks in a conventional manner whether the access criterion is satisfied by the user rights stored in the memory 40. illustrative example, the access criterion may be a valid subscription criterion for the television channel broadcasting the content received. In the case of an external access criterion, the data of this access criterion comprise an identifier of a verification module external to the security module 4 and criterion data to be verified. The external verification module may be an application present in the decoding device 3, a module of a Web server or any other module external to the security module 4.

In the particular example described here, the external access criterion comprises a dual condition of connection to a URL of a given website and use of a web service of this site by a user, and the identifier of the external verification module 33 of the decoding device 3. For example, the access criterion may be to be connected to a social network site and to have an active user session on this social network. Any other type of access criterion that could be verified using data external to the security module 4 could be envisaged. For example, the external access criterion could include a condition of belonging of the user to a user. group of a social network or a condition related to any other profile parameter defined by the social network. Another example might be to allow access to the content if the user of the receiving equipment 2 is connected to a given web service and was among the first x users to correctly answer a given question. In another exemplary embodiment, the external verification module 33 is adapted to locally verify particular technical characteristics intrinsic to the receiving equipment (for example processing capacity of the decoding device, presence of components, etc.). Upon receipt of a new ECM access control message, the security module 4 determines whether this message contains an external access criterion, here by detecting the presence of an external verification module identifier in the data of the access criterion, and / or an internal access criterion, during a test step E3.

In the particular example described here by way of illustration, the ECM access control message received by the security module 4 contains an internal access criterion CA1 and an external access criterion CA2 before both of them are satisfied to allow access to the content. In addition, the data of the external access criterion CA2 contain the identifier of the external verification module 33 of the decoding module 3.

The processing of the external access criterion CA2 is carried out as described below: After having determined that the criterion CA2 is an external access criterion, the security module 4 (and more precisely the processing block 43) transmits this criterion CA2 to the access control module 31 of the decoding device 3, during a step E4. During a step E5, the access control module 31 extracts the identifier of the external verification module, in this case the identifier of the module 33, from the data of the external access criterion CA2 and then triggers the establishment of a secure link between the security module 4 and the external verification module 33. The establishment of this secure link is performed following a mutual authentication phase of the security module 4 and the verification module 33. Securing the link can be based on using a PKI or symmetric keys. In the first case, the module 4 and the module 33 each have an asymmetric key pair associated with a cryptographic certificate and perform a keying operation to exchange one or more encryption key (s) for securing their security. communication link. In the second case, the security module 4 and the verification module 33 share at least one symmetric cryptographic key, previously configured. One could however consider not to secure the link between the security module 4 and the verification module 33.

During a step E6, the access control module 31 transmits the criterion CA2 to the external verification module 33. During a test step E7, the external verification module 33 checks whether the external access criterion received CA2 is satisfied. In the particular example described here, it is recalled that the CA2 access criterion is a condition of connection to a given URL and use of a service. In order to verify this access criterion CA2, the external verification block 33 interrogates the network communication module of the rendering and communication device 5, by sending a request, in order to determine whether it is connected to the given URL and whether the service in question is used by a user. The device 5 transmits a response, positive or negative, to the verification module 33. If necessary, depending on the nature of the external access criterion, it could be envisaged that the verification module 33 interrogates a remote server of the Internet by means of the network communication module 5. It could also be envisaged that the verification module 33 integrates a network communication module in order to directly interrogate the remote server of the Internet. In a step E8, depending on the response of the communication device 5, the external verification module 33 transmits to the security module 4 (more precisely to the ECM processing block 43) a positive result, in the case where the device 5 is connected to the web service whose address is specified in the access criteria data, or a negative result, otherwise. The processing of the internal access criterion CA1 is carried out, conventionally, as described below: After having determined that the criterion CA1 is an internal access criterion, the security module 4 (more precisely the processing block ECM 43) checks, in a conventional manner, whether this criterion CA1 is satisfied by the user rights stored in the memory 40, during a test step E9.

Following the verification of the access criterion CA1 and the access criterion CA2, during a test step El 0, the security module 4 (more precisely the processing block ECM 43) determines whether all the criteria of access, here CA1 and CA2, present in the ECM message being processed are satisfied, according to the results obtained following the external verification of the criterion CA2 by the verification module 33 and the internal verification of the criterion CA1 by the block of treatment 43.

In the case of a positive test El 0, in other words if the two criteria CA1 and CA2 are satisfied, the processing block 43 decrypts the control word CW present in the message ECM, using the operating key K, when of a step E11, then transmits it to the decoding module 3 during a step E12. This control word is used by the decoding module 3 to decrypt received content data.

If at least one of the criteria present in the ECM (in this case CA1 and / or CA2) is not satisfied, the processing of the ECM message is interrupted and an error message indicating that access to the content is not allowed is transmitted to the decoding module 3, in a step El 3 for display on the playback device 5. The data of the external access criterion may include a period of validity. In this case, in the event of a positive verification of the criterion, the external verification block 33 can transmit the validity period of the criterion to the security module 4. This makes it possible to avoid repeated exchanges between the verification block 33 and the security module. security 4 with each new ECM received by the security module 4 and containing the same external access criterion. Thus, the method according to the invention makes it possible to subordinate the access to the content to the verification of criteria independent of the access control system, while keeping a security in the decryption of the control word.

Claims (7)

REVENDICATIONS1. A method of controlling access to data of an encrypted content by a device (2) comprising a decoding device (3) and a security module (4), comprising: - a step (E2) of reception by the security module (4), via the decoding module (3), an access control message containing a key for decrypting content data, in encrypted form, and at least one access criterion to the data, - a step (E7) of verification of the criterion of access to the data; in case of positive verification, a step of decryption and transmission of the decryption key by the security module to the decoding device; characterized in that the step of verifying the access criterion comprises - a transmission (E4) of said access criterion to a verification module (33) external to the security module, via the decoding module ( 3); - a verification (E7) of the access criterion by the external verification module (33) and - a transmission (E8) to the security module (4) of a result of the verification. 2. Method according to claim 1, wherein, the decoding device (3) being connected to a communication equipment (5) through a communication network (100), the access criterion comprises a connection condition of the communication device. communication equipment (5) at an address of said network (100). The method of claim 1 or 2, wherein the access criterion comprises a condition for use of a network service by a user. 4. The method of claim 1, wherein the decoding device (3) and the external verification module (33) establish between them a secure connection. 5. Method according to claim 1, wherein the message comprising at least one internal access criterion and an external access criterion, the security module (4) checks the said internal access criterion and transmits the criterion. said external access to the external verification module (33). 6. Method according to claim 1, wherein the external verification module (33) transmits to the security module (4) a period of validity of the external criterion. 7. Equipment comprising a decoding device (3) and a security module (4), the decoding device (3) being adapted to receive access control messages to content data, a control message of accessing content data containing a decryption key of the content data, in encrypted form, and at least one criterion for accessing the content data, and for transmitting them to the security module (4), said security module ( 4) comprising means (43) for processing a received access control message arranged to check whether the access criterion present in the message is satisfied and, in the case of a positive check, to decipher the decryption key present in the message. access control message then transmit it to the decoding device (3), characterized in that the means (43) for processing the access control message are arranged to transmit the access criterion to a module verification device (33) external to the security module (4), via the decoding device (3), and to receive in response a result of the verification.