JP2001333056A - Limited reception system and limited reception method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a limited reception system with high security that attains encryption/decoding processing for a scramble key Ks in a short time. SOLUTION: The limited reception system is configured such that an IC card 40 is provided with a scramble key Ks encryption means 45, a receiver 1 is provided with a decoding means 18 for an encrypted Ks, and the IC card outputs the encrypted Ks to the receiver, either of the receiver and the IC card is provided with a key generating means 46 that generates a session key and a session key encryption means 47 that encrypts the session key, and the other is provided with a key acquisition means 19 that acquires the encrypted session key and a session key decoding means 15 that decodes the encrypted session key, the other decades the encrypted session key transmitted from the one so as to allow the receiver and the IC card to share the session key in common, and the encryption means and the decoding means for the scrambled key use the session key shared in common to encrypt and decode the scrambled key.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a conditional access apparatus for receiving pay broadcasts and a conditional access method, and more particularly, to maintaining security of a scramble key.

[0002]

2. Description of the Related Art MP is a conventional standard conditional access method.
In EG2SYSTEMS (ISO / IEC13818-1), the transmitting side scrambles and transmits contents such as video and audio with a scramble key Ks, and transmits the scramble key Ks
After s is stored in ECM (Entitlement Control Messages: program information), this ECM is encrypted with the work key Kw and transmitted. Also, the work key Kw is set in advance in the EMM
(Entitlement Management Messages: individual information), encrypted with the individual key Km, and transmitted.

FIG. 3 shows the configuration on the sending side.
Content generation unit that generates content such as video and audio
51, a Ks generation unit 52 for generating Ks, a scrambler 57 for scrambling video / audio contents with Ks,
An ECM generation unit 53 that generates an ECM storing Ks;
w, a Kw generating unit 54, an ECM encrypting unit 58 that encrypts an ECM using Kw, an EMM generating unit 55 that generates an EMM storing Kw, and a Km unit holding an IC card-specific Km. 56 and E to encrypt EMM using Km
MM encryption unit 59, scrambled content,
A multiplexing unit 60 that multiplexes the encrypted ECM and EMM.
And

The ECM stores program tier information and current time, which are program identification information, in addition to Ks.
encrypted with w. Further, a non-encrypted module identification flag is attached to the ECM.

[0005] In addition to the Kw, the EMM stores individual tier information for identifying a viewing right of a corresponding receiver and information on a viewing contract, and these are encrypted with Km.
The EMM is provided with a non-encrypted module identification flag and the ID of the corresponding receiver.

[0006] The signal multiplexed by the multiplexing section 60 is converted into a TS packet (Transport Stream Packet) and transmitted.

On the other hand, as shown in FIG. 4, a receiving side for watching a program includes a receiver 1 and an IC card (security module) 40 inserted into the receiver 1. , A descrambling unit 16 for decoding the scrambled video and audio, and the security module 40 includes an EEPROM for holding the Km and the card ID.
M44, an individual information decoding unit 42 for decoding EMM using Km, and a program information decoding unit 43 for decoding ECM using Kw.

The receiver 1 has the same ID as its own card ID.
Is received, the individual information decoding unit 42 receives the EMM, and the individual information decoding unit 42 stores the Km stored in the EEPROM 44.
And outputs Kw, individual tier information, contract information, and the like included in the EMM to the program information decoding unit 43. The program information decoding unit 43 holds these pieces of information.

[0009] When the receiver 1 receives the video and audio of the scrambled program and the ECM including the scramble key Ks, the scrambled video and audio are sent to the descrambling unit 16, and the ECM is Program information decoding unit
Sent to 43. The program information decoding unit 43 decodes the ECM with the held Kw, compares the program tier information with the individual tier information, and identifies the presence or absence of the channel viewing right. If the channel viewing right is recognized, the decrypted Ks is output to the descrambler 16. The descrambling unit 16 descrambles the video and audio using the Ks. Thus, the user can view the scrambled program.

However, in this case, since an unencrypted Ks is passed from the security module 40 to the receiver 1, a malicious viewer can extract the Ks via the interface of the security module 40 and extract the Ks. There is a risk of unauthorized use during descrambling.

Japanese Patent Application Laid-Open No. 9-46672 discloses that in order to improve such a point, the security module 40 and the receiver 1 hold a common key (secret key), and the security module 40 encrypts Ks with the common key. To receiver 1
A method in which the receiver 1 extracts Ks by decrypting the same with a common key is described. In this case, since the common key is exchanged naked between the receiver and the security module, there is a possibility that the common key may be obtained improperly. If this common key is obtained improperly, Ks may be obtained improperly. Would be.

Japanese Patent Application Laid-Open No. 11-308184 describes a conditional access apparatus in which the confidentiality of Ks is enhanced by a public key cryptosystem. This device, as shown in FIG.
The receiver 1 transmits a public key (encryption key Ke) and a secret key (decryption key K).
d), and the encrypted Ks
And a Ks decryption unit 18 for decrypting Ks using Kd, and the security module 40 includes a Ks encryption unit 45 for encrypting Ks using Ke.

In the public key cryptosystem, what has been encrypted with the public key cannot be decrypted unless it is a secret key. Also, what is encrypted with the secret key cannot be decrypted unless it is a public key.

The Ks encryption unit 45 of the security module
Encrypts Ks using the public key Ke generated by the key generation unit 17 of the receiver 1, and the Ks decryption unit 18 of the receiver 1 decrypts the encrypted Ks using the secret key Kd. I do.

In this method, there is no problem even if the public key is known elsewhere. Also, since the secret key does not go out of the receiver 1, high security can be maintained.

[0016]

However, the conventional conditional access apparatus using the public key cryptosystem has the following problems.

In the method using a public key for encrypting Ks,
The processing load of encryption / decryption is large, and the time required from encryption to decryption is lengthened. The time required for the common key (secret key) method with a small processing load is about 0.1 second, while the time required for the public key encryption method is several seconds.
Therefore, in a system in which Ks is sent at one-second intervals, the processing cannot be performed in time.

Further, the conventional conditional access apparatus cannot switch whether or not to encrypt Ks. For example, there may be a case where the receiver has the encryption function of Ks, but the old security module does not have the encryption function. In such a case, if the receiver does not have the function of switching Ks encryption, the old security module cannot be used in the receiver.

The present invention is to solve such a conventional problem, and can perform Ks encryption / decryption processing in a short time and switch whether to perform Ks encryption. Providing a conditional access device capable of
The purpose is to provide the conditional access method.

[0020]

Therefore, according to the present invention, the security module includes a scramble key encryption unit, the receiver includes an encrypted scramble key decryption unit, and the security module includes a scramble key decryption unit. In the conditional access device in which the scramble key encrypted is output, one of the receiver and the security module is provided with a key generation unit for generating a session key and a session key encryption unit for encrypting the session key, On the other side, there are provided key acquisition means for acquiring an encrypted session key, and session key decryption means for decrypting the encrypted session key. By decrypting with, the session key is shared between the receiver and the security module,
The scramble key encryption unit and the decryption unit are configured to encrypt and decrypt the scramble key using the shared session key.

Further, in a conditional access method in which a scramble key is encrypted by a security module and the encrypted scramble key is decrypted by a receiver, a session key encrypted and transmitted from one of the receiver and the security module is used. On the other hand, by decrypting, the receiver and the security module share the session key,
The encryption and the decryption of the scramble key are performed using the shared session key.

Therefore, since the session key is a common key system using a common key, a scramble key is encrypted /
The processing load at the time of decoding is light, and processing can be performed in a short time. In addition, since the session key is transmitted between the receiver and the security module after being encrypted by the public key cryptosystem or the common key cryptosystem in order to share the session key, high security can be maintained.

If the other party does not have a scramble key encryption function, it is possible to switch so as not to use the session key.

[0024]

DESCRIPTION OF THE PREFERRED EMBODIMENTS As shown in FIG. 1, a conditional access apparatus according to an embodiment of the present invention comprises a receiver 1 and a security module 40 inserted into the receiver 1.
Performs an authentication process with the security module 40 in addition to the descrambling unit 16, and performs a temporary session key (Ks
e), an authentication processing unit 19 for generating K), a Kse encryption / decryption unit 15 for encrypting or decrypting Kse, and a Ks decryption unit 18 for decrypting Ks encrypted using Kse. In addition, the security module 40
In addition to the M44, the individual information decryption unit 42, and the program information decryption unit 43, an authentication process unit 46 that performs an authentication process with the receiver 1 to generate a session key (Kse), and encrypts or decrypts Kse. Kse encryption / decryption unit 47 and Kse using Kse
and a Ks encryption unit 45 for encrypting s.

FIG. 2 shows the operation procedure of this device.

Steps 1 and 11: Authentication processing section 19 of receiver 1 and authentication processing section 46 of security module 40
Is to perform mutual authentication and confirm the other party. This mutual authentication is performed when the security module 40 is mounted on the receiver 1 or when viewing / listening of a program is selected (purchased). In the authentication, for example, a public key is given to the other party, and the result of encrypting the authentication data with the public key is transmitted. This data is decrypted with the secret key, encrypted again with the secret key, and transmitted to the other party. The other party authenticates by seeing a match between the decryption result and the authentication data. This authentication takes several seconds to perform because the public key is used. However, the authentication process is performed at a time when there is enough time, such as when the security module 40 is mounted on the receiver 1 or when a program is selected for viewing. Is performed, so that transmission of Ks does not become an obstacle. The public key transmitted at this time is also used for encrypting the session key. At the time of this authentication, the receiver 1 determines whether or not the security module 40 has a cryptographic processing function. If the security module 40 does not have a cryptographic processing function, the receiver 1 executes the security module in a conventional manner.
Obtain an unencrypted Ks from 40. Similarly, at the time of this authentication, the security module 40 determines whether or not the receiver 1 has an encryption processing function. If the receiver 1 does not have an encryption processing function, the security module 40 receives an unencrypted Ks. Output to machine 1.

If the receiver 1 and the security module 40 have an encryption function, step 12: the authentication processing unit 46 of the security module 40
Generates a session key Kse, holds it, encrypts it using the public key obtained from the receiver by the Kse encryption / decryption unit 47, and transmits it to the receiver 1. The session key Kse is a key temporarily created for a series of processes, and is generated using a random number or the like.

Step 2: The authentication processing unit 19 of the receiver 1
The encrypted session key Kse sent from the security module 40 is decrypted by the Kse encryption / decryption unit 15 using the secret key, and the decrypted Kse is output to the Ks decryption unit 18. Further, the authentication processing unit 46 of the security module 40 outputs the generated session key Kse to the Ks encryption unit 45.

Step 3: When the ECM is input, the receiver 1 separates the ECM and outputs it to the security module 40.

Step 13: The program information decoding unit 43 of the security module 40 receives the ECM. Step 14: Decodes the ECM by the EMM and extracts the Ks
Is output to the Ks encryption unit 45.

Step 15: The Ks encryption section 45 encrypts Ks with the session key Kse, and Step 16: sends the encrypted Ks to the receiver 1.

Step 4: Upon receiving the encrypted Ks, Step 5: The Ks decryption unit 18 decrypts the Ks using the session key Kse. Step 6: The descrambling unit 16 decrypts the content using the Ks. To descramble.

As described above, in this apparatus, Ks is encrypted / decrypted by the common key method using the session key Kse as the common key. Therefore, high-speed processing is possible. Further, in order to share the session key Kse between the security module 40 and the receiver 1, the security module 40 that has generated the session key transmits the Ks to the receiver 1.
e is transmitted after being encrypted. Public key encryption and common key encryption can be used for the encryption for Kse. This session key may be changed each time a series of processes is completed. In this case, unlike the case where a fixed key is used, the encrypted Ks also changes in various forms. Therefore, the session key Ks
Despite continuing to observe the Ks encrypted with e, decrypting the Ks can be a daunting task.

Here, the case where the session key Kse is generated on the security module 40 side and transmitted to the receiver 1 is shown. However, the session key Kse is generated by the authentication processing unit 19 of the receiver 1 and the Kse encryption / decryption is performed. The data may be encrypted by the decryption unit 15 and passed to the authentication processing unit 46 of the security module 40.

The authentication may be performed by holding a common key between the receiver and the security module in advance and using this common key. The session key may be encrypted using this common key.

Although the case where the one-way authentication is performed is shown here, the mutual authentication of the receiver or the security module may be performed.

In order to increase the security level,
A random number sequence of a certain byte length is encrypted together with Ks,
The encryption result of Ks may be made variable.

In order to increase the security level,
The receiver and the security module may hold a plurality of encryption algorithms, and vary the encryption algorithm for each session.

[0039]

As is apparent from the above description, the conditional access apparatus and the conditional access method of the present invention employ a common key system using a session key as a common key, so that a scramble key is encrypted / decrypted. The processing load is light, and processing can be performed in a short time. In addition, the session key is encrypted and transferred (shared) between the receiver and the security module.
Therefore, high security can be maintained.

If the other party does not have a scramble key encryption function, the system can be switched to a system that does not use a session key.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a conditional access apparatus according to the present invention;

FIG. 2 is a diagram showing a procedure of a conditional access method of the present invention,

FIG. 3 is a block diagram showing a configuration of a transmission side of a conventional conditional access system;

FIG. 4 is a block diagram showing a configuration of a conventional conditional access apparatus;

FIG. 5 is a block diagram showing a configuration of a conventional conditional access device for encrypting Ks.

[Explanation of symbols]

 1 Receiver 15 Kse encryption / decryption unit 16 Descramble unit 17 Key generation unit 18 Ks decryption unit 19 Authentication processing unit 40 Security module 42 Individual information decryption unit 43 Program information decryption unit 44 EEPROM 45 Ks encryption unit 46 Authentication processing Unit 47 Kse encryption / decryption unit 51 content generation unit 52 Ks generation unit 53 ECM generation unit 54 Kw generation unit 55 EMM generation unit 56 Km unit 57 scrambler 58 ECM encryption unit 59 EMM encryption unit 60 multiplexing unit

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Hironori Murakami 1006 Kadoma Kadoma, Kadoma City, Osaka Prefecture Inside Matsushita Electric Industrial Co., Ltd. 72) Inventor Akio Higashi 1006 Kadoma Kadoma, Osaka Pref. Matsushita Electric Industrial Co., Ltd. (72) Inventor Toru Nakahara 1006 Odakadoma Kadoma, Osaka Pref. 5th floor of Matsushita Electric Information System Nagoya Research Laboratories, 5F, Matsushita Electric Information System Nagoya R & D Co., Ltd.

Claims (12)

[Claims] The security module includes a scramble key encryption unit, the receiver includes an encrypted scramble key decryption unit, and the encrypted scramble key is output from the security module to the receiver. In the conditional access device, one of the receiver and the security module includes:
Key generating means for generating a session key and session key encrypting means for encrypting the session key, the other comprising: a key obtaining means for obtaining the encrypted session key; and Session key decryption means for decrypting a session key, by decrypting the session key encrypted and transmitted from one side to the other, so that the receiver and the security module share the session key. The conditional access apparatus, wherein the scramble key encryption unit and the decryption unit perform encryption and decryption of the scramble key using the shared session key. 2. The conditional access apparatus according to claim 1, wherein the session key encrypting means and the session key decrypting means encrypt or decrypt the session key based on a public key cryptosystem. . 3. The conditional access apparatus according to claim 1, wherein the session key encrypting means and the session key decrypting means encrypt or decrypt the session key based on a common key cryptosystem. . 4. The conditional access apparatus according to claim 1, wherein at least one of the key generation unit and the key acquisition unit has an authentication function. 5. The method according to claim 1, wherein the receiver or the security module switches between performing and not performing the scrambling key encryption processing depending on whether the other party has a scrambling key encryption function. The conditional access device according to claim 1. 6. A conditional access method for encrypting a scramble key with a security module and decrypting the encrypted scramble key with a receiver, wherein the session encrypted and transmitted from one of the receiver or the security module. The key is decrypted on the other side, whereby the receiver and the security module share the session key, and the encryption and decryption of the scramble key are performed using the shared session key. Receiving method. 7. The conditional access method according to claim 6, wherein the encryption and decryption of the session key are performed by a public key cryptosystem. 8. The conditional access method according to claim 6, wherein encryption and decryption of the session key are performed by a common key cryptosystem. 9. The method according to claim 6, wherein authentication is performed between the security module and a receiver, and thereafter, the encrypted session key is transmitted from one to the other.
The conditional access method described in 1. 10. The conditional access method according to claim 9, wherein the authentication is performed between the security module and a receiver. 11. The conditional access method according to claim 9, wherein the authentication is performed by only one of the security module and the receiver. 12. At the time of the authentication, it is determined whether or not the other party has a scrambling key encryption function. If the other party does not have the encryption processing function, the scrambling key is not encrypted. 9. The method according to claim 9, wherein:
2. The conditional access method according to claim 1.