GB2453924A

GB2453924A - Encrypted Mobile TV broadcast with encrypted content key while key encryption key is delivered over phone network

Info

Publication number: GB2453924A
Application number: GB0718826A
Authority: GB
Inventors: Mark Priestley; Timothy Wright
Original assignee: Vodafone Group PLC
Current assignee: Vodafone Group PLC
Priority date: 2007-09-27
Filing date: 2007-09-27
Publication date: 2009-04-29
Also published as: EP2061244B1; GB0718826D0; ES2479115T3; EP2061244A1

Abstract

In the art is known to encrypt 11 broadcast content 13, such as TV programmes, with a traffic encryption key (TEK). This TEK is then encrypted with a session encryption key (SEK) and the encrypted TEK 15 is broadcast with the content. The SEK is separately distributed 43 to user terminals 1 over a point to point network, such as a mobile phone network 3, where is used to decrypt the TEK and thus the content. The SEK may be protected with user terminal public/private keys during this distribution. The known SEK is a symmetric key and is therefore vulnerable when sent to broadcasters for encrypting the TEK. The invention proposes making the SEK and asymmetric public/private key pair, such that only the public part SEK_pub 27 is sent to the broadcaster. Hence even if it is compromised the TEK and the content cannot be accessed without the private part SEK_priv.

Description

PROTECTION OF BROADCAST CONTENT

The present invention relates to a method of controlling the use, by a USer terminal registered with a telecommunications network, of content broadcast by broadcasting means and encrypted by a key. The present invention also relates to apparatus for controlling use of broadcast content.

Mobile TV broadcast over a broadcast hearer (e.g. DV B-H) has security issues which are not present when the same content is delivered over a point-to-point hearer (e.g. streamed over a 3G network). Over a broadcast hearer the content is broadcast and so can in principle he received by anyone with the right type of receiver. However, to be able to charge for the broadcast content the service provider needs to be able to control who can and cannot access the services.

This is typically achieved by encrypting the broadcast content and providing mechanisms for legitimate subscribers to obtain the keys necessary to decrypt that content. The generic term for these mechanisms and the channel encryption is service protection. There are a number of standardised service protection solutions.

Generally service protection uses a hierarchy of keys in which each layer of keys is used to protect the content or keys in the layer below. In this document the terms "encrypt" and "encrypted" are used to mean that a key is either used directly to encrypt the content in question or a key derived from the referenced key is used to encrypt the content in question. Integrity and/or authenticity of the content being encrypted may be provided by other cryptographic mechan is ins.

The content is encrypted using Traffic Encryption Keys (TEKs), in conjunction with a standardised protection protocol (e.g. IPsec. SRTP), before being broadcast. TEKs change frequently (often every minute or less) to prevent an attack based on accessing the TEKs within a device and redistributing the TEKs to unauthorised receivers.

Legitimate subscribers cannot decrypt the broadcast channel without access to the TEKs. TEKs are themselves encrypted using Service Encryption Keys (SEKs). The encrypted TEKs are sent, along with the encrypted content, over the broadcast channel. In terrestrial and satellite digital TV systems these protected TEKs are called Entitlement Control Messages (ECMs). In the OMA BCAST specillcalions these protected TEKs arc called "keystrearn messages" or Short Term Key Messages (STKMs).

Legitimate subscribers cannot extract the TEK from the keystream messages without access to the relevant Service Encryption Key (SEK). Only legitimate subscribers should have access to the Service Encryption Key.

A service provider will usually assign a separate SEK for each channel they broadcast. If a user subscribes to more than one channel they will require a SEK for each channel to which they subscribe.

Service Encryption Keys (SEKs) can have lifetimes of tens of minutes to months, although by definition they should be significantly longer lived than the TEKs that they protect. By changing the lifetime of a SEK the Service Provider can control the duration of subscription thai can be offered to their users (although other mechanisms are possible). In some cases SEKs can have a lifetime equal to that of a single programme, for example a pay per view him or sporting event. In such a case SEKs are often called "Programme Encryption Keys" or PEKs. Some solutions, such as l8Crypt/DRM profile, allow nesting of PEKs and SEKs, e.g. PEKs are encrypted using SEKs.

SEKs are normally sent over a point-to-point channel and arc encrypted using another key, referred to herein as a "User Key". The User Key is unique to a particular subscriber and may be the highest level key within the service protection key hierarchy. The DVB-H TPDC I 8Crypi. profile and OMA BCAST DRM profile specifications use OMA DRM Version 2 Rights Objects (ROs) [OMA DRM] to securely send the SEK to individual terminals. The OMA BCAST Sniartcard Profile uses the MIKEY protocol IIETF MIKEYI to securely send the SEK to the user's USIM (via the user's terminal).

In both cases these messages are referred to as Long Term Key Messages (LTKMs).

Conventionally, the SEKs, and any keys derived from SEKs to encrypt the TEKs are symmetric keys. This means that the same key is used to encrypt the TEK as is used to decrypt the TEK.

Service Protection platfi)rms must support a STKM generator and an LTKM generator. A number of mobile network operators (MNOs) may for reasons of economy share elements of a Service Protection platform, e.g. the STKM generator. It is less likely that MNOs will share an LTKM generator as this generates messages that are specifically for their customers and typically sent over the cellular network and not the broadcast bearer.

A problem with the MNOs sharing the STKM generator is that the STKM generator needs access to the SEK in order to generate the STKMS (e.g. the TEKs encrypted by the SEKs). However, SEKs are operator-specific, and are very valuable keys. Releasing the SEKs to the shared STKM generator in the broadcast platform is a security risk to the MNOs. lithe SEK became known to an unauthorised entity, that entity could decrypt the protected broadcast content by using the SEK to extract the TEK from the STKM and then using the extracted TEK to decrypt the protected content.

According to a first aspect of the present invention, there is provided a mcthod of controlling use, by a user terminal registered with a service provider, of content broadcast by broadcasting means and encrypted by a first key, the method including providing the first key, encrypted by a second key, to the broadcasting means for broadcast to the terminal with the encrypted content; and selectively providing a key corresponding to the second key to the user terminal by point to point communication between the telecommunications network and the user terminal; wherein the second key and the corresponding key are different but related keys, and the corresponding key enables decryption of the encrypted content.

For example the corresponding key may enable the extraction of the first key.

which in turn enables the decryption of the broadcast content.

In the embodiment the first key is a Traffic Encryption Key (TEK). The second key and the corresponding key are respective parts of a Service Encryption Key (SEK) public/private key pair (SEK_pub/SEK_priv).

The first key/TEK may he directly encrypted by the second key/SEK_pub or the second key/SEK_pub may be used to derive another key that are used to encrypt the first key/TEK. If the first key/TEK is encrypted by a key derived from the second key/SEK, then the terminal must perform the corresponding derivation function using the corresponding key/SEK_priv to obtain the key needed to decrypt the TEK.

In the embodiment the first key/TEK, encrypted by the second key/SEK_pub, and data relating to the keys and services that they protect, comprises a Short Term Key Message (STKM). As the STKM is generated by encrypting the first key/TEK with the second key/SEK_pub and combing the SEK encrypted TEK with data relating to the keys and services that they protect, the STKM generator can be shared between a plurality of Service Providers (e.g. Mobile Network Operators) without a significant security risk, in contrast to the prior art. Even if the second key/SEK_pub became known, this would not enable the unauthorised extraction of the first key/TEK from the STKM. The first key/TEK may only he extracted from the STKM by an entity that has the corresponding key/SEK_priv. As the corresponding key/SEK_priv is transmitted by a point to point communication from the Service Provider to the mobile terminal, it is less likely that this will be intercepted. This is especially true in the embodiment where the corresponding key/SEK_priv is sent protected by a User Key (UK) shared between the Service Provider and the user terminal -preferably in a secure module thereof. The UK may he pre-conligured on the user terminal at the time of manufacture, on a smartcard for insertion into the user terminal, or generated "on-the-fly" using information pre-provisioned at the tinle of manufacture.

The embodiment provides signilicant security improvements by using a public/private key pair for the SEK, in contrast to the symmetric SEKs of the prior art described above. The embodiment allows the broadcasting means and a STKM generator to be shared between a plurality of Service Providers without significantly compromising security. Such an arrangement of shared resources was not possible with the prior art arrangement, without compromising security.

In the embodiment the corresponding key/SEK_priv enables the first key/TEK from the STKM to he decrypted. The secure module on the mobile terminal then is able to use the decrypted first key/TEK required to decrypt the encrypted content received on the broadcast channel and to reproduce that content on the mobile terminal.

In the embodiment security may he further enhanced by securing the corresponding key/SEK_priv in the secure module. The secure module may he implemented by the mobile terminal, for example, or may be implemented on a sniartcard such as a Universal Integrated Circuit Card (UICC) that may optionally also implement a Subscriber Identity Module (SIM) or Universal SIM (USIM) or other application. Smartcards are highly secure, tamperproof hardware elements that arc (rusted by the Mobile Network Operators. The risk of the corresponding key/SEK_priv being obtained illegitimately from the Smaricard is very small.

According to a second aspect of the present invention, there is provided apparatus for controlling use, by a user terminal registered with a telecommunications network, of content broadcast by broadcasting means and encrypted by a first key, the apparatus including means for providing the lrst key. encrypted by a second key, to the broadcasting means for broadcast to the terminal with the encrypted content and means for selectively providing a key corresponding to the second key to the user terminal by point to point communication between the telecommunications network and the user terminaL wherein the second key and the corresponding key arc different but related keys, and the corresponding key enables decryption of the encrypted content.

The telecommunications network may be a GSM, GPRS or UMTS cellular network, for example.

For a better understanding of the present invention an embodiment will now be described by way of example, with reference to the accompanying drawing, the single figure of which shows schematically the elements of a broadcast system in accordance with an embodiment of the invention.

Mobile terminal I includes a display 2 and keypad 4. The terminal 1 is registered with a Mobile Network Operator (MNO) 3 (or other service provider) and is provided with secure module 5. The secure module 5 is implemented on a smart card in the embodiment, but this is not essential.

Optionally, the smart card may inc]ude a Subscriber Identity Module (SIM or USIM), which may allow the MNO 3 to authenticate the user of the terminal I using GSM or UMTS authentication. The secure module 5 allows the service provider to securely share a key specific to the user, the "User Key" (UK), with the secure module 5. The User Key may he pre-provisioncd at manufacture of the secure module 5 or generated "on-the-fly" using information j)re-provisioned at the time of manufacture.

If the secure module 5 comprises a SIM or USIM, or if a SIM/USIM is provided elsewhere for use by the terminal, authentication information may he stored on the SIM/USIM under the control of the MNO 3. The MNO 3 itselF stores details of each of the SIM/USIM issued under its control. In operation of MNO 3, the terminal I is authenticated (for example, when the user activates the terminal in the network with a view to making or receiving calls) by the network sending a challenge to the terminal I incorporating the SIM/USIM in response to which the SIM/USIM calculates a reply (dependent on the SIM/USIM predetermined information held Ofl the authentication means 5 -typically an authentication algorithm and a unique key Ki) and transmits it back to the MNO 3. The MNO 3 includes an authentication processor which generates the challenge and which receives the reply from the terminal I. Using information pre-stored concerning the content of the relevant SIM/US1M authentication means 5, the authentication processor calculates the expected value of the reply from the mobile terminal 1. If the reply received matches the expected calculated reply, the SIM/USIM and the associated mobile terminal are considered to he authenticated. The SIM/USIM used by the terminal 1 may be a SIM of the type defined in the GSM or UMTS standards specifications, or may be a simulation of a SIM -that is, software or hardware that performs a function corresponding to that of the SIM. The SIM may be in accordance with the arrangement described in WO-A-2004 036513.

The MNO 3 comprises a User Key (UK) generator or store, which is operable to generate or retrieve the User Key for each user. The User Key of the user is stored in the secure module authentication means 5 in store 39.

The terminal I is operable to receive broadcast content, such as content broadcast by DVB-H. The broadcast content is also receivable by other terminals, such as terminal I. Broadcast platform 7 receives content 9, br example, video, from a content provider (not shown). The broadcast platform 7 comprises a content encrypter II which is operable to encrypt the content 9 using a Traffic Encryption Key (TEK) generated by TEK generator 12. The broadcast platform 7 is operable to transmit the encrypted content 1 3 to the mobile terminal I. To facilitate decryption of the encrypted content 13 by the mobile terminal 1, the broadcast platform 7 also broadcasts Short Term Key Messages (STKMs) 15 which include the TEKs. The STKM 15 includes the TEK in encrypted form. The TEK is encrypted by a Service Encryption Key (SEK). In accordance with an important feature of the embodiment, the SEK used to encrypt the TEK is the public part of a public/private key pair.

MNO 3 includes an SEK generator 17 that is operable to generate the public and private key pair (SEK_pub and SEK_priv).

When the SEK public and private key pair is generated by SEK generator 17 in MNO, in addition to a public key message 27 being sent to a STKM 2() generator 21, the corresponding private key is passed to LTKM generator 41.

The LTKM generator 41 generates LTKMs 43 which comprises the private key protected by the User Key (UK) for mobile terminal I. The LTKM 43 is transmitted by a point-to-point channel. That is, the LTKM 43 is transmitted only to the mobile terminal I and is not broadcast to a multiplicity of terminals.

For example, the LTKM may be transmitted by SMS, WAP push or by any other convenient mechanism, such as over an IP bearer.

The mobile terminal I includes a message processor 37 in the secure module 5 for processing LTKM message 43. On receipt of the LTKM 43 by the mobile terminal 1, the mobile terminal I passes the LTKM 43 to the message processor 37. The message processor 37 retrieves the User Key (UK) from the storage location 39. The User Key retrieved from the store 39 of the secure module 5 enables the extraction of the private key (SEK_priv) from the LTKM 43. The private key is then stored in store 44 on the secure module 5.

When the broadcast platform 7 wishes to broadcast an STKM 15, the broadcast platform issues an STKM request 19 to the STKM generator 21. The STKM request 19 includes the TEK from the broadcast platform 7 to he included in the STKM. On receipt of the STKM request 19, the STKM generator 21 determines whether it has an appropriate SEK public key (SEK_pub) stored in public key store 23 in order to generate the STKM. If it is determined that the relevant SEK public key is not present in the public key store 23, the STKM generator 21 issues an SEK request 25 to the MNO 3. The SEK generator 17 of the MNO 3 then generates an SEK public and private key pair in the manner described above. The SEK public key (SEK_pub) generated by the SEK generator 17 or stored in the public key store 23 is transmitted to the STKM generator 21 in message 27. The generated SEK private key (SEK_priv) is stored in private key store 29 in MNO 3. The private key is transmitted to the mobile terminal I and stored in store 44 in the manner described above.

On receipt of the message 27, the STKM generator 21 stores the SEK public key in public key store 23. As the STKM generator 21 now has the appropriate public key to generate the STKM in response to the STKM request 19 received from the broadcast platform 7. The STKM generator 21 then retrieves the relevant public key from the public key store 23 and generates the STKM 33, which is transmitted to the broadcast platform 7. The broadcast platform 7 then transmits the STKM 33 to the mobile terminal I in STKM 15.

The mobile terminal I includes a filter or de-rnultiplexer 35 which receives data from the broadcast platform 7 arid separates out the STKM I 5 from the broadcast encrypted coiitent 13.

When the STKM 15 is extracted from the broadcast data received by the mobile terminal 1 by the filter/de-multiplexer 35, the STKM is passed to the message processor 37, which is also operable to process the STKM message 15. The extracted content is passed to content decryption module 45. The message processor 37 retrieves the private key (SEK_priv) from the store 44 and uses this to extract the TEK present in the STKM message 15. Because the private key (SEK_priv) retrieved from the store 44 is the private key corresponding to the pub]ic key (SEK_pub) used to protect the TEK, the TEK can he extracted by the message processor 37 using the corresponding private key. The message processor 37 then passes the extracted TEK to the content decryption module 45, which decrypts the encrypted content 13 using the TEK and allows the content to be consumed -for example, it to be displayed on the screen of the mobile terminal I and reproduced through the loudspeakers of the mobile terminal I. A second MNO 47 shares the broadcast platform 7 and the STKM generator 21 with the first MNO 3. When the STKM generator 21 receives an STKM request 19 from the broadcast platform 7, the STKM request 19 enables the STKM generator 2110 identify for which MNO an STKM has been requested and therefbre which SEK public key is required. For example, if the relevant public key is not present in the store 23 and an SEK from the second MNO 47 is required. the STKM generator 21 is operable to obtain from the second MNO 47 an SEK public key by sending an SEK request to second MNO 47. in a similar manner to the sending of the SEK request message 25 to the MNO 3.

The second MNO 47 comprises an SEK generator, private key store and LTKM generator which operate in a similar manner to the SEK generator 17.

private key store 29 and LTKM generator 41 of the MNO 3. The second MNO 47 establishes User Keys (UKs) for its subscribers and stores these on the secure modules of its subscribers in a similar manner to the first MNO 3. The second MNO 47 also sends LTKM 43, similar to the LTKM 43 sent by the first MNO 3.

II

The broadcast platform 7 and the STKM generator 21 can he shared by the MNOs 3,47 with little risk of a security compromise because only the SEK public keys of the MNOs 3,47 are provided to the shared STKM generator 21 (for subsequent broadcast by the broadcast plattbrni 7). The corresponding SEK private keys are never provided to the shared STKM generator 21. The SEK private keys are transmitted by a point to point communication in LTKMs 43 by MNO 3 (and the corresponding LTKM for the MNO 47). Further, the LTKM are protected using the relevant User Key (UK) to further enhance security.

Although two MNOs 3.47 are shown in the embodiment, it should he understood that the broadcast platform 7 and STKM generator 2 1 may he shared by a multiplicity of MNOs.

The scheme used to broadcast the content is DVB-H in the embodiment.

However, other broadcasting schemes can be used, such as DVB-T, T-DMB, DAB-IP, ISDB-T, TDtv or Media FLO.

In the embodiment, the content is video (moving pictures and sound).

However, it should be understood that the content could he of other types -e.g. sound oniy, still pictures (slide show), etc. In the embodiment, the STKM generator 21 and the broadcast platform 7 may be a single Unit.

The secure module 5 may he implemented in hardware or software.

Claims

1. A method of controlling use, by a user terminal registered with a telecommunications network, of content broadcast by broadcasting means and encrypted by a first key, the method including providing the first key, encrypted by a second key, to the broadcasting means for broadcast to the terminal with the encrypted content and selectively providing a key corresponding to the second key to the user terminal by point to point communication between the telecomniunications network and the user terminal: wherein the second key and the corresponding key are different hut related keys, and the corresponding key enables decryption of the content.

2. The method of claim I, wherein the second key and the corresponding key are a public, private key pair.

3. The method of claim I or 2, wherein the point to point communication between the telecommunications network and the user terminal sends the corresponding key encrypted by a further key.

4. The method of claim 1,2 or 3, wherein the second key and the corresponding key are generated by the telecommunications network, and wherein the second key is provided by the telecommunications network to encryption means to enable encryption of the first key.

5. The method of claim 4, wherein the encryption means is shared by a plurality of telecommunications networks.

6. The method of any one of claims 1 to 5, wherein the broadcasting means is shared by a plurality of telecommunications networks.

7. The method of claim 4 or 5, wherein the broadcast means transmits the first key to the encryption means, and wherein the encryption means encrypts the first key using the second key received from the telecommunications network, and transmits the lrst key. encrypted by the second key, to the broadcast means, for onward broadcast to the user terminal.

8. The method of any one of claims 1 to 7, wherein the user terminal includes authentication means for storing authentication data for authenticating the user terminal with the telecommunications network.

II)

9. The method of any one of claims I to 8. wherein the user terminal includes a secure module for storing the corresponding key.

10. The method of any one of claims I to 9, wherein the user terminal includes means for receiving the broadcast encrypted content and the broadcast first key, encrypted by the second key, and for separating the encrypted content from the first key, encrypted by the second key.

11. The method of any one of claims I to 10, wherein the user terminal includes an application for accessing the corresponding key and for receiving the first key, encrypted by the second key, and for deriving the first key therefrom to enable consumption of the content.

12. The method of any one of claims 1 to II. wherein the content is broadcast by at least one of DV H-H and DVB-T.

13. The method of any one of claims I to 12, wherein the telecommunications network compn ses a mobile or cellular telecommunications network, such as GSM, GPRS, UMTS or 4G/SAE/LTE.

14. Apparatus for controlling use, by a user terminal registered with a telecommunications network, of content broadcast by broadcasting means and encrypted by a first key, the apparatus including means for providing the first key, encrypted by a second key, to the broadcasting means for broadcast to the terminal with the encrypted content: and means for selectively providing a key corresponding to the second key to the user terminal by point to point communication between the telecommunications network and the user terminal: wherein the second key and the corresponding key are different but related keys, and the corresponding key enables decryption of the content.

15. The apparatus of claim 14, wherein the second key and the corresponding key are a public, private key pair.

16. The apparatus of claim 14 or 15, wherein the point to point communication between the telecommunications network and the user terminal sends the corresponding key encrypted by a further key.

17. The apparatus of claini 14,15 or 16, including first key encryption means, and wherein the second key is provided to the encryption means to enable encryption of the first key.

18. The apparatus of claim 17, wherein the encryption means is shared by a plurality of telecommunications networks.

19. The apparatus of any one of claims 14 to I 8, wherein the broadcasting means is shared by a plurality of telecommunications networks.

20. The apparatus of claim 17 or 18, wherein the broadcast nieans transmits the first key to the encryption means, and wherein the encryption means is operable to encrypt the first key using the second key.

21. The apparatus of any one of claims 14 to 20, including the user terminal.

IS

22. The apparatus of claim 21, wherein the user terminal includes authentication means for storing authentication data for authenticating the user terminal with the telecommunications network.

23. The apparatus of any one of claims 14 to 22, wherein the user terminal includes a secure module for storing the corresponding key.

24. The apparatus of claims 2 I,22 or 23, wherein the user terminal includes means for receiving the broadcast encrypted content and the broadcast first key, encrypted by the second key, and for separating the encrypted content from the first key, encrypted by the second key.

25. The apparatus of any one of claims 2 I to 24, wherein the user terminal includes an application for accessing the corresponding key and for receiving the first key, encrypted by the second key, and for deriving the first key therefrom to enable consumption of the content.

26. The apparatus of any one of claims 14 to 25, wherein the content is broadcast by at least one of DVH-H and DVB-T.

27. The apparatus of any one of claims 14 to 26, wherein the telecommunications network comprises a mobile or ccl]ular teleconimunications network, such as GSM, GPRS, UMTS or 4G/SAE/LTE.

28. A method of controlling use of content, substantially as hereinbefore described with reference to and/or substantially as illustrated in the accompanying drawing.

29. Apparatus substantially as hereinbefore described with reference to and/or substantially as illustrated in the accompanying drawing.