HRP20000753A2 - Mechanism for matching a receiver with a security module - Google Patents

Description

Technical area

This invention relates to a system for controlling the transmission of data between a receiver and a security module, especially in the system of coded television programs, as well as to a method of controlling the transmission of coded data.

Background of the invention

The system for decoding coded television programs consists of a receiver and a security module. The module can be fixed or detachable. The job of the receiver is to decode the received signal. The main task of the security module is to control the procedure by checking the authorization for decoding and, if the authorization exists, to supply the data necessary for the work of the decoding module, for example by providing vectors for decoding called "control words".

Existing systems use receivers that interrogate their security modules, and these respond by providing the data needed for decoding. At a given time, for the same broadcast being transmitted, all security modules correspond to the same data. Given that the data transmitted from the security module to the receiver flows slowly (approximately 20 to 30 octets/s), smugglers can use this data for public transmission, for example via the Internet.

One such system is described in the paper "DVD Conditional Access" written by David Cutts in the February 1997 "Electronics and Communication Engineering Journal". It describes a standardized system for decoding audio and video streams coming from different service providers. The security module, called CA (Conditional Access), is in charge of supplying control words CW. This module can additionally use a chip card (Smart Card - SM) in the decoding function. After the data is decoded in the CA module, the control words CW are returned to the decoder to obtain the decoded data.

In an earlier publication entitled "Conditional Access Broadcasting: Datacare 2, an Over-Air Enabled System fbr General Purpose Data Channel", issued on 1 August 1988 in the journal "BBC Research and Development Report" no. 10, an independent module (Module for Conditional Access) responsible for accepting and deciphering the data responsible for decoding is described. That module regulates the key in charge of that system and supplies the control words necessary to decode the video broadcast. In this type of module, after the control words have been deciphered once, they are decoded and transmitted to the decoding unit.

So, the problem is how to make a specific receiver and security module interdependent, so that:

- a specific security module cannot be used except with the receiver for which it is intended;

- the data flow between the security module and the receiver is unique. This uniqueness prevents other receivers, which do not have a dedicated security module, from working using the public transmission of this data.

Presentation of the invention

The proposed solution to the above problems uses at least one encryption key in each receiver. That (or those) key(s) are (are) called pairing keys. At least one of the keys is different for each receiver. That (or those) key(s) is (are) located in the permanent memory of the receiver, either during the production of that receiver, or at some later stage. The receiver does not provide the outside world with any access to that key(s).

One of the possible ways to program that key in the security module is to use a central information system that controls all receivers and which can enter in the flow of video transmission the data needed to program that key in the permanent and secret memory of the security modules. Of course, the formatting of that procedure is secret.

During the transfer of data, which is confidential and/or necessary for the functioning of the system, from the security module to the receiver (usually "control words", but other data can also be transferred in this way), the security module encrypts this data using one or more unique pairing keys common to a single receiver/security module pair. The encryption method is any method known to the security module, while the receiver knows the corresponding decryption method.

Once the data has been received, the receiver therefore decrypts it using a known decryption method and a matching key stored in its permanent memory. The mentioned data is then decrypted and the mentioned receiver can use it.

Thus, the invention proposes a system for controlling data transmission between the receiver and the security module, especially for the coded television program system, in which the transmitted data is encrypted and decrypted using at least one encryption key, stored on the one hand in the receiver, and on the other in the security module .

The invention also relates to a system for decoding coded data and a system of coded television programs that includes a transmission control system.

In addition, the invention also relates to a method of controlling data transmission between the receiver and the security module, especially for coded television programs, characterized by the fact that at least one unique encryption key is stored on the one hand in the receiver, and on the other in the security module, and that the transmitted data is encrypted and decrypted using at least one such unique encryption key.

This solution according to the invention solves the set problems. In fact:

- a security module inserted in a receiver, which is not the one with which said security module was paired, will transmit to that receiver a stream of confidential data and/or data necessary for the functioning of an encrypted system with a key that does not match the one used to decrypt that system. The result is therefore unusable;

- the flow of confidential data and/or data necessary for the functioning of the system resulting from the security module cannot be distributed to multiple receivers. Only a receiver paired with a card equipped for that stream of confidential data and/or data required for system operation can successfully decrypt said stream.

The system may include a pairing verification mechanism. The central information system can write some number specific to the receiver on the security module paired with that receiver, for example the number that the latter chose by chance, or it can simply use its serial number. Thus, the receiver is given the opportunity to freely check its number written on the security module and to compare it with the one stored in its permanent memory.

The advantage of this mechanism is that it does not use wrong data. The result of some encryption followed by decryption with some other key usually gives a pseudo-random result. If this result is not recognized as wrong, and if it is used without change, it may damage the receiver or the devices connected to it.

Some types of receivers contain a detachable decoding module. This module takes over certain operations, including the decoding of received signals. The transmission of confidential data then takes place between a detachable security module and a detachable decoding module. The transmission encryption mechanism described above between the receiver and the security module is then transmitted unchanged to the detachable security module and to the detachable decoding module.

In the same way, the pairing mechanism between the security module and the receiver described above is transferred without change to the detachable security module and the detachable decoding module.

The transmission of decoded signals therefore takes place between the detachable module for decoding and the receiver. The transmission encryption mechanism described above, as well as the pairing mechanism, between the security module and the receiver is then transmitted unchanged to the receiver and the detachable decoding module.

Functions performed by a detachable decoding module and a detachable security module can be performed by a single module, called a detachable security decoding module. The previously described pairing mechanism is then transferred to the detachable security module for decoding and the receiver.

In all the cases described above, the pairing key or keys can be used to encrypt the flow of confidential data and/or data necessary for the system to function in the opposite direction, replacing:

- receiver and detachable security module;

- detachable decoding module and detachable security module;

- receiver and detachable module for decoding;

- receiver and detachable security module for decoding. In all cases where a particular pairing key refers to a single device (receiver or detachable module), the same principles apply to the use of one (or more) pairing key(s) that apply to a group of devices.

Short description of the pictures

Figure 1 shows the circuit that implements the receiver and the detachable security module.

Figure 2 shows a circuit that implements a receiver, a detachable decoding module and a detachable security module.

Figure 3 shows a circuit that implements a receiver and a detachable security decoding module.

Detailed description

Receiver A in Figure 1 receives a stream of coded video data from a source, such as a satellite receiver, or via cable. This flow of a size of several megabits per second is formed in the receiver A, and then transmitted to the control unit B, which is responsible for decoding and for managing the authorization of access to coded video data. To do this, the control unit B periodically examines the detachable security module C (channel 3), which responds to it during confidential data and/or data necessary for the functioning of the control unit B (channel 4). These data exchanges are slow and can be easily processed by microprocessors on commercially available cards. According to the invention, the detachable security module C contains in its permanent memory at least one encrypted key K, which is used to encrypt confidential data and/or data necessary for the operation of the control unit B (channel 4) towards receiver A. This key K is unique to receiver A and written into the detachable security module C, and makes data stream 4 unique to that circuit. Public data transmission 4 will no longer be of any use to other receivers because for them, given that they do not have the same key K, this data stream is completely incomprehensible. Using the data 4, the control unit B can find the decoded video signal 2, which was processed and then transmitted in standard form (PAL, SECAM, NTSC) to the video monitor.

One version of the invention uses encryption of the same type for the data 3 that is sent to the detachable security module C, either with the same key K, or with another key J, unique and specific to the circuit made up of the receiver A and the detachable security module C. way, any attempt to discover the key K from data stream 4 is much more difficult.

Figure 2 shows a version using a detachable decoding module D, which has a built-in control unit B. In this case, the coded video stream 1 is formed in the receiver A and directed to the detachable decoding module D. The mode of operation described for Figure 1 between the receivers A and the detachable security module C is now applied to the dialogue between the detachable decoding module D and the detachable security module C. The key K is written in some secret part of the detachable decoding module D, instead of the receiver A. In this way, the data that the detachable security module module C sends to detachable decoding module D encrypted and worthless to some other detachable decoding module D.

It can be seen that the data transmitted to the receiver A, contained in the stream of decoded video data 6, can be easily used, for example, for illegal copies. According to one version of the invention, the stream 6 is encrypted in the detachable decoding module D, before it is sent to the receiver A, to be decrypted by the decoding unit E'. This operation is performed by the key K' inherent only to the receiver assembly A and the detachable decryption module D. In this way, the data stream 6 no longer has any meaning and can only be understood by the receiver A, which contains the same key K'.

To encoded video stream 1, receiver A can add control data for a detachable decoding module. In order for this data not to become public and thus open the door to understanding the encryption mechanism, this data is encrypted by the encryption unit E, and in this way an encoded video stream 6 containing encrypted control data is created.

Figure 3 shows a version of the invention in which the detachable security module is contained in the detachable security module for decoding F. The task of this module is to decode and manage the authorization of the video signals received by the receiver A. According to the invention, this module contains a unique encryption key, specific to the receiver A and written into a detachable security module for decoding. In this way, the decoded video stream is encrypted using that key and transmitted in that form to the receiver A, which, thanks to the decryption unit E' and using the same unique key, can find the clean video signal.

Analogous to the process described in Figure 2, the control data contained in the encoded video stream 1 can be encrypted by the E unit using a unique encryption key before being transmitted to the detachable security module for decoding.

In all examples described in Figures 1 to 3, pairing control can be performed. In the case of Figure 1, the receiver A writes its personal number, for example its serial number, into the detachable security module C. In this way, the receiver can check at any time whether the detachable security module C is really the one intended for it. In the framework of the example described in Figure 2, the control can be carried out at two levels: first between the detachable decoding module D and the detachable security module C; then between the detachable decoding module D and the receiver A. The second level is particularly important if the decoded data 6 in the direction of the receiver A is encrypted.

In the solution in Figure 3, the pairing control is performed between the receiver A and the detachable security decoding module F.

According to one aspect of the invention, receiver A is an MPEG decoder that uses "control words" (data necessary for signal decoding) to decode the video signal. These "control words" are provided by the detachable security module C. This module, for example an autonomous chip card, contains permanent memory for supplying them.

According to one aspect of the invention, the detachable decoding module is a PCMCIA type card, which contains an MPEG decoder (control unit B).

According to one embodiment of the invention, the detachable security module for decoding F is made in the form of an autonomous chip card containing the MPEG decoder and the security module C.

According to one embodiment of the invention, a unique decryption key K is shared by a group of receivers. This possibility is interesting, for example in a school that has several receivers for which, if necessary, the same detachable security module will be used. Likewise, multiple detachable security modules contain the same decryption key, so they could be used on any of the receivers in that group. In this case, pairing control is performed using a number that is no longer unique to one receiver, but to the entire group of receivers. A combination of a number consisting of two parts, one that determines the group, and the other that determines the receiver, can be made. The uniqueness of the personal number is respected, and the match matching test is then carried out only on the part of that number that indicates the group.

Claims (20)

1. A system for receiving coded television programs containing a receiver (A) connected to security means (C, D, F), with this receiver (A) receiving data for decoding from security means (C, D, F), indicated by , provides at least part of the data (4, 6) transmitted from the security means (C, D, F) to the receiver (A) encrypted with a unique encryption key. 2. The system for receiving coded television programs according to claim 1, characterized in that the unique encryption key is shared by a group of receivers. 3. System for receiving coded television programs according to claims 1 or 2, characterized in that the harem part of the data (3, 5) transmitted from the receiver (A) to the security means (C, D, F) is encrypted with a unique encryption key. 4. System for receiving coded television programs according to claims 1 to 3, characterized in that the receiver (A) contains a personal number that can be entered in the security means (C, D, F), with the said receiver (A) being able in each moment to check the match of that personal number registered in the aforementioned security means (C, D, F). 5. System for receiving coded television programs according to claim 4, characterized in that the personal number contains a part specific to a group of receivers, and a part specific to an individual receiver, and that the matching matching check is carried out on the part specific to the group of receivers. 6. System for receiving coded television programs according to claims 1 to 5, characterized in that the receiver (A) contains a control unit (B), and that the security means consist of a detachable security module (C) in which confidential data is stored and/or data required for the operation of the control unit (B). 7. System for receiving coded television programs according to claims 1 to 5, characterized in that the security means contain a detachable security module for decoding (F) containing a control unit (B) and a security unit (C'), which are responsible for decoding and authorization video data. 8. A system for receiving coded television programs containing a receiver (A) connected to security means (C, D, F), with this receiver (A) receiving data for decoding from security means (C, D, F), indicated by , that these security means consist of a detachable security module (C) and a detachable decoding module (D) containing a control unit (B), and that the detachable security module (C) encrypts at least part of the confidential data using a unique encryption key and/or data required (4) for the operation of the control unit (B) before being transmitted to the detachable decoding module. 9. System for receiving encoded television programs according to claim 8, characterized in that at least part of the data (3) transmitted from the detachable decoding module (D) to the security module (C) is encoded with a unique encryption key. 10. The system for receiving coded television programs according to claims 8 and 9, characterized in that the detachable decoding module (D) contains a personal number that can be entered in the detachable security module (C), with the aforementioned* decoding module (D) can at any time check the correspondence of that personal number entered in the detachable security module (C). 11. System for receiving coded television programs according to claim 10, characterized in that the personal number contains a part characteristic of a group of detachable decoding modules (D) and a part characteristic of an individual detachable decoding module (d), and in that the matching matching check is performed on the part characteristic of a group of detachable decoding modules (D). 12. The system for receiving coded television programs according to claims 9 to 11, characterized in that at least part of the data (5) transmitted from the receiver (A) to the detachable decoding module (D) is encrypted with a unique encryption key. 13. The system for receiving coded television programs according to claims 9 to 12, characterized in that at least part of the data (6) transmitted from the detachable decoding module (D) to the receiver (A) is encrypted with a unique encryption key. 14. System for receiving coded television programs according to claims 12 to 13, characterized in that the receiver (A) contains a personal number that can be entered into a detachable module for decoding (D), with the said receiver (A) being able to check at any time the match of that personal number written in the aforementioned detachable module for decoding (D). 15. The procedure for controlling data transmission between the receiver (A) and the security means (C, D, F) in the coded television program system, with the security means sending the receiver (A) the data necessary for decoding audio and video signals, indicated by the fact that at least one unique encryption key is stored on the one hand in the receiver (A) and on the other hand in the security means, and that the data transmitted between the receiver (A) and the security means is encrypted and decrypted using at least one of the mentioned unique keys for encryption. 16. The method according to claim 15, indicated by the fact that the personal number of the receiver (A) is entered into the security means during the initialization procedure, and that the receiver (A) can at any time check the correspondence of the personal number entered into the aforementioned security means. 17. Detachable security module (C), intended to be connected to the receiver (A) as part of the system for receiving coded television programs, which contains at least one permanent memory intended for storing confidential data and/or data necessary for the operation of the decoding system, means of transmission with the receiver ( A), characterized in that said detachable security module (C) contains transmission encryption means, and that said memory also contains at least one encryption key that acts on the transmission encryption means. 18. Detachable module for decoding (D) which is part of the system for receiving coded television programs and which contains a control unit (B), first transmission means (3, 4) with a detachable security module (C), second transmission means (5, 6) with a receiver (A), and a permanent memory, indicated by the fact that it contains the first encryption means, and that this memory contains at least one encryption key that acts on the first encryption means, responsible for encrypting the transmission of the first transmission means (3, 4 ). 19. Detachable module for decoding according to claim 18, characterized in that it contains other encryption means, and in that this memory contains at least one encryption key that acts on other encryption means, in charge of encrypting the transmission of other transmission means (5, 6 ). 20. A receiver for decoding in a system of coded television programs (A) containing means for transmission to security means (C, D, F), as well as a permanent memory, characterized by the fact that it contains means for encrypting transmissions, both from and to security means (C, D, F), and that this memory contains at least one encryption key that acts on transmission encryption devices.