JP4691244B2 - Limited reception device and security module of limited reception system, limited reception system, limited reception device authentication method, and encryption communication method - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a broadcasting system (conditional reception system) that requires a viewing contract. Technology for secure cryptographic communication between the conditional access device and the security module that make up the conditional access system About.
[0002]
[Prior art]
In MPEG2 SYSTEMS (ISO / IEC13818-1), which is a conventional standard conditional access method, the transmission side scrambles and transmits content such as video and audio with a scramble key Ks, and also transmits this scramble key Ks to ECM ( After being stored in Entitlement Control Messages (program information), the ECM is encrypted with the work key Kw and transmitted. Also, the work key Kw is stored in advance in EMM (Entitlement Management Messages: individual information), encrypted with the individual key Km, and transmitted.
[0003]
FIG. 1 shows the configuration on the sending side. A content generation unit 100 that generates content such as video and audio; a Ks generation unit 101 that generates Ks; a scrambler 106 that scrambles the content with Ks; an ECM generation unit 102 that generates an ECM that stores Ks; A Kw generation unit 103 that generates Kw, an ECM encryption unit 107 that encrypts ECM using Kw, an EMM generation unit 104 that generates an EMM that stores Kw, a Km generation unit 105 that generates Km, An EMM encryption unit 108 that encrypts the EMM using Km, and a multiplexing unit 109 that multiplexes the scrambled content and the encrypted ECM and EMM are provided.
[0004]
In addition to Ks, program tier information, which is program identification information, and the current time are stored in the ECM, and these are encrypted with Kw. Further, a non-cryptographic module identification flag is attached to the ECM.
In addition to Kw, the EMM stores individual tier information for identifying the viewing right of the corresponding receiving apparatus and viewing contract information, and these are encrypted with Km. Further, the EMM is assigned a non-cryptographic module identification flag and the ID of the corresponding receiving device.
[0005]
The signal multiplexed by the multiplexing unit is converted into a TS packet (Transport Stream Packet) and transmitted. On the other hand, as shown in FIG. Limited A receiver (receiver) 110 and a security module 120 such as an IC card attached to the receiver are provided, and the receiver is multiplexed with a TS filtering unit 111 that captures only selected TS packets. The security module includes a separation unit 112 that separates signals and a descrambler 113 that decrypts scrambled content. The security module also includes a Km storage unit 121 that holds Km, and an EMM that decrypts EMM using Km. The decoding part 122 and the ECM decoding part 123 which decodes ECM using Kw are comprised.
[0006]
The receiver receives an EMM addressed to itself when it is sent. The EMM is sent when the viewing contract is renewed. The EMM is separated by the separation unit 112 and output to the EMM decoding unit 122. The EMM decoding unit decodes the EMM using the Km stored in the Km storage unit 121, and the Kw and individual tier included in the EMM are decoded. Information, contract information, and the like are output to the ECM decryption unit 123. The ECM decoding unit holds these pieces of information.
[0007]
When the receiver receives the scrambled content and the ECM including the scramble key Ks, the scrambled content is separated by the separation unit 112 and sent to the descrambler 113, and the separated ECM is the ECM. It is sent to the decryption unit 123. The ECM decoding unit decodes the ECM with the held Kw, compares the current time contained therein with the validity period of the viewing contract, compares the program tier information with the individual tier information, and views the channel. Identifies rights. Only when the channel viewing right is recognized, the decrypted Ks is output to the descrambler 113 of the receiver. The descrambler of the receiver sequentially obtains Ks sent from the security module and unscrambles the content. Thus, the scrambled program can be viewed.
[0008]
However, in this case, since the Ks in an unencrypted state is passed from the security module to the receiver, the Ks is illegally acquired on the communication path, and a person who does not have a viewing contract illegally uses Ks for descrambling the content There is a fear.
In Japanese Patent Laid-Open No. 09-46672, in order to improve such points, the security module and the receiver hold a common key, and the security module encrypts Ks with the common key and sends it to the receiver. Describes a method for extracting Ks by decrypting with a common key. In this case, there is a possibility that the common key is illegally acquired when it is passed from the security module to the receiver. If this common key is acquired illegally, Ks is acquired illegally after all.
[0009]
Japanese Patent Laid-Open No. 02-195376 describes a secure key sharing method between IC cards. According to this, the second IC card generates a random number, encrypts the random number with the master key and passes it to the first IC card, and the first IC card decrypts the encrypted random number with the master key. The first IC card and the second IC card perform cryptographic communication using the shared random number as a session key. In this case, since the first IC card and the second IC card share a master key that is a global secret in advance, it is possible to share a random number safely.
[0010]
[Problems to be solved by the invention]
As is clear from the explanation so far, Limited In order to perform secure cryptographic communication between the receiving device and the security module, Limited It is important that the receiving device and the security module share the shared information safely. Share information as a global secret in advance Limited When stored in the receiving device and the security module, it is possible to share a different secure session key for each session by performing mutual authentication for each session. However, in this case, a malicious person Limited The mutual authentication data (challenge, response, etc.) communicated between the receiving device and the security module is illegally acquired and attempted to be decrypted. If the shared information is successfully calculated, the session key can be determined. As a result, scramble key Ks, viewing contract information, billing information, etc. Limited Data communicated between the receiving device and the security module is illegally acquired. In addition, since the determined shared information is common to all receiving apparatuses, damage to the conditional access system operation is very serious. As a measure for recovering the system operation, a method of distributing the storage medium in which new shared information is encrypted and distributed to all viewers and updating the shared information of the receiver and the security module can be considered. It is expected to involve costs and is unrealistic.
[0011]
Also, Limited In general, a plurality of different manufacturers are in charge of manufacturing a receiving device and a security module such as an IC card. Share information in advance Limited When stored in the receiver and security module, Limited In order to correctly perform mutual authentication in the combination of the receiving device and security modules made by all manufacturers, Conditional receiver And the security module need to share the same shared information. In this case, if the confidential information management level in one manufacturer is low and leakage of shared information occurs from within the manufacturer, Limited The influence also spreads to the receiving device and the security module, causing fatal damage to the operation of the conditional access system.
[0012]
The present invention solves these problems, Limited Even if the receiving device and the security module do not have the common shared information in advance, the shared information used for generating the session key can be safely shared. Conditional reception system conditional reception apparatus and security module, conditional reception system, Authentication method for conditional access device, and Encryption communication method The purpose is to provide.
[0013]
[Means for Solving the Problems]
In order to solve this problem, the present invention Limited Conditional reception in which the security module is installed in the receiving device system In Limited The receiving device Limited Manufacturer ID storage means for storing an ID for identifying a manufacturer that manufactures the receiving device, and one or more Limited Store receiver specific information Limited Receiving device specific information storage means, and One of the one or more conditional access device specific information The security module comprises: decryption means for decrypting information encrypted using the receiving apparatus specific information as a key; and authentication processing means for performing authentication processing with the security module using information output from the decryption means as input. Security module Uniquely identifies Security module Remember ID Security module ID storage means; Said Manufacturer ID and Security module Filtering means for filtering the receiving apparatus authentication information with reference to the ID, security module specific information storage means for storing one or more security module specific information, One of the one or more security module specific information Security module specific information as input Limited An authentication processing means for performing an authentication process with the receiving device is provided.
[0014]
Also, the receiving station authentication information is generated in the broadcasting station facility, the receiving apparatus authentication information is transmitted from the broadcasting station using a broadcast wave, and the limited receiving apparatus receives the manufacturer ID and the received receiving apparatus authentication information. Security module Filtering only the receiving device authentication information addressed to the receiving device using the ID as a search key, and generating shared information equal to the security module specific information held in advance by the security module based on the filtered receiving device authentication information, Limited The receiving device and the security module perform authentication processing using the shared information.
[0015]
The receiving device authentication information is Limited Receiving device holds Limited Information generated by encrypting unique security module specific information for each security module held by the security module using the receiving apparatus specific information as a key; and Limited A manufacturer ID identifying the manufacturer of the receiving device; Security module Identify Security module Consists of ID Be done .
[0016]
With the above, Limited Security module specific information is shared between the receiving device and the security module, and based on the shared information, Limited A session key used for encrypted communication between the receiving device and the security module is generated. Also, Limited The receiving device includes a random number generation unit, a session key storage unit, an encryption key generation unit, an encryption unit, and a decryption unit. The security module includes a session key storage unit, an encryption key generation unit, and an encryption unit. And a decoding means.
[0017]
Also, Limited The receiving device generates a random number and outputs it to the security module, and also generates an encryption key from the session key read from the session key storage unit and the random number. Further, the generated encryption key is stored in the session key storage unit as a new session key. Security module Limited An encryption key is generated from the random number input from the receiving device and the session key read from the session key storage unit, and the generated encryption key is stored as a new session key in the session key storage unit.
[0018]
With the above, Limited The receiving device and the security module share a common encryption key and perform encrypted communication.
[0019]
DETAILED DESCRIPTION OF THE INVENTION
Embodiments of the present invention will be described with reference to the drawings. In the following, Limited Receiver device as receiver, security module as IC card, Limited The receiving device unique information is described as a device key, and the security module unique information is described as an IC card unique key.
[0020]
FIG. 3 is a diagram illustrating an example of a procedure for storing a device key and an IC card unique key managed by a broadcasting station in a receiver and an IC card, respectively.
The key management center 201, which is one facility of the broadcasting station 200, has n device keys Kd unique to each receiver manufacturer. _i (1 ≦ i ≦ n) is generated. Here, i is the index number of the device key. The value of n will be described later.
[0021]
The device key value varies from receiver manufacturer to receiver manufacturer. All receivers manufactured by the same manufacturer have the same device key Kd ₁ ~ Kd _n Is stored. Each device key generated by the device key generation unit 202 is registered in the device key DB 203 in the key management center together with a manufacturer ID for identifying a receiver manufacturer, and is securely managed. For example, it is managed in a confidential information management room where entry of a third party is restricted.
[0022]
The receiver manufacturer 206 receives a device key for the manufacturer, which is delivered from the broadcasting station by a secure means, and stores the device key in a device key storage unit inside the receiver when the receiver 207 is manufactured. In device key distribution from a broadcasting station to a receiver manufacturer, for example, an encrypted device key is recorded on a recording medium such as a CD-ROM and delivered offline.
[0023]
One receiver stores n device keys. By providing the device key storage unit inside the receiver inside the LSI where it is difficult to extract data, the possibility of a device key exposure by a malicious receiver user can be reduced.
On the other hand, the key management center has m IC card unique keys KIC unique to each IC card. _j (1 ≦ j ≦ m) is generated. Here, j is the index number of the IC card unique key. The values of n and m are defined as a conditional access system specification from the viewpoint of security and the storage capacity of the receiver and the IC card. The greater the values of n and m, the higher the security level, but this requires a large storage capacity of the receiver and the IC card, which is disadvantageous in terms of cost.
[0024]
The value of the IC card unique key is different for every IC card manufactured and issued, regardless of the IC card manufacturer. Each IC card unique key generated by the IC card unique key generation unit 204 is registered in the IC card unique key DB 205 in the key management center together with a card ID for identifying the IC card, and is managed safely in the same way as a device key. . Note that the value of the IC card unique key may be different for each production lot.
[0025]
The IC card maker 208 receives the IC card unique key delivered from the broadcasting station by a secure means, and stores the IC card unique key in the IC card unique key storage unit inside the IC card when the IC card is manufactured. In general, the IC card has tamper resistance, and it is difficult to access the IC card unique key storage unit in the IC card from the outside, and the possibility that the IC card unique key is exposed from the IC card is low.
[0026]
In FIG. 3, the device key is generated on the broadcasting station side and distributed to the receiver manufacturer. However, each receiver manufacturer generates its own device key, and the key management center of the broadcasting station. It does not matter as a form of registering.
In FIG. 3, the key management center is configured as one facility in the broadcasting station, but may be configured independently of the broadcasting station.
[0027]
FIG. 4 is a diagram illustrating a method of generating receiving device authentication information. The device key and manufacturer ID are input from the device key DB 203 and the IC card unique key and card ID are input from the IC card unique key DB 205 to the receiving device authentication information generation unit 210 of the key management center 201. The encryption unit 211 has an IC card unique key KIC _j Device key Kd _i Enc (Kd _i , KIC _j ) Is generated and output. Here, Enc (X, Y) represents encrypted data obtained by encrypting data Y with key X. Further, by adding a manufacturer ID and an IC card ID to the encrypted data output by the encryption unit, the receiving device authentication information C _ij = Enc (Kd _i , KIC _j ) | MID | CID. Here, X | Y represents data obtained by combining data X and data Y. The receiver authentication information for a combination of a receiver manufactured by one receiver manufacturer and one IC card is C ₁₁ , C ₁₂ ,. . . , C _1m , C _{twenty one} , C _{twenty two} ,. . . , C _nm N × m in total are generated.
[0028]
FIG. 5 is a block diagram on the transmission side that transmits the reception device authentication information to the reception device side using broadcast waves. (C _ij , I, j) In the generation unit 130, the receiving device confirmation information C _ij And the index information i and j (C _ij , I, j). Then, in the same way as multiplexing the EMM encrypted with the individual key Km and the ECM encrypted with the work key Kw on the content scrambled with the scramble key Ks, the multiplexing unit 131 (C _ij , I, j) is multiplexed with the contents, etc., and the signal is converted into a TS packet and transmitted as a broadcast wave. (C _ij , I, j) may be stored in the ECM or EMM and transmitted as a broadcast wave.
[0029]
FIG. 6 shows that the IC card unique key is shared between the receiver and the IC card using the received receiver authentication information, and the session key is shared by performing mutual authentication using the shared IC card unique key. FIG. 6 is a block diagram for explaining a method for performing encrypted communication of a scramble key Ks.
First, in the initial processing when the IC card 400 is connected to the receiver 300, the receiver receives the manufacturer ID (MID) of the receiver stored in the manufacturer ID storage unit 304 and stores it in the manufacturer ID storage unit 402. Store the MID. Broadcast waves (TS packets) received by the receiver are transmitted to the video / audio signal, EMM, ECM, (C _ij , I, j). The receiver is responsible for all (C _ij , I, j) is transmitted from the input / output unit 301 to the IC card and received by the input / output unit 401 (C _ij , I, j) are input to the receiving device authentication information filtering unit 404. The receiving device authentication information filtering unit refers to the MID stored in the maker ID storage unit 402 and the CID stored in the card ID storage unit 403, all the (C _ij , I, j) of which both MID and CID match _ij (= Enc (Kd _i , KIC _j ) | MID | CID), a combination of i and j is extracted. MID or CID does not match (C _ij , I, j) are discarded. IC card is extracted C _ij C 'with MID and CID removed from _ij (= Enc (Kd _i , KIC _j )) And i are transmitted from the input / output unit 401 to the receiver. Further, the IC card unique key KIC corresponding to the value of j _j Is read from the IC card unique key storage unit 405.
[0030]
Receiver is IC 'card from C' _ij And i are received, first, the device key Kd corresponding to the value of i _i Is read from the device key storage unit 305. Next, in the authentication information decryption unit 306, Kd _i C 'as a key _ij IC card unique key KIC _j Get. Here, the encryption algorithm used in the authentication information decryption unit of the receiver is equal to the common key encryption algorithm used when the reception device authentication information is generated in the key management center of the broadcasting station. The encryption algorithm may be a public key encryption algorithm.
[0031]
In this way, the IC card unique key KIC can be used from the state in which the receiver and the IC card do not have pre-shared information. _j Can be shared safely.
Further, the authentication processing unit 307 of the receiver and the authentication processing unit 406 of the IC card include the shared IC card unique key KIC. _j Mutual authentication using is performed, and a session key SK is generated and shared. When the IC card receives the EMM from the receiver, the EMM decryption unit 409 outputs the work key Kw obtained by decrypting the EMM with the individual key Km stored in the Km storage unit 408 to the ECM decryption unit. When the ECM is received from the machine, the ECM decryption unit 410 decrypts the ECM using the Kw to obtain the scramble key Ks. The IC card encryption unit 407 outputs Enc (SK, Ks) obtained by encrypting Ks using the SK as an encryption key to the receiver. The decryption unit 308 of the receiver decrypts the Enc (SK, Ks) received from the IC card using the SK as a decryption key and outputs a scramble key Ks.
[0032]
As described above, since encrypted communication using the session key SK updated every time authentication processing is possible, the scramble key Ks can be transmitted from the IC card to the receiver while maintaining high security.
FIG. 7 is a diagram illustrating an example of a mutual authentication flow based on a challenge / response between the receiver and the IC card. In the following description, the receiver side processing is performed by the mutual authentication unit 310 of the receiver 300, and the IC card side processing is performed by the mutual authentication unit 413 of the IC card 400. The receiver generates a random number R1 and transmits it to the IC card. The receiver is KIC _j Encrypt R1 with the key as Enc (KIC _j , R1). When IC card receives R1, KIC _j Encrypt R1 with the key as Enc (KIC _j , R1). Further, a random number R2 is generated and Enc (KIC _j , R1) and R2 to the receiver. IC card is KIC _j Encrypt R2 using as a key, Enc (KIC _j , R2). The receiver sends an Enc (KIC _j , R1) and R2 are received, Enc (KIC already created in the receiver) _j , R1) and Enc (KIC) received from the IC card _j , R1) and confirm that the values match. Enc (KIC _j , R1) match, KIC _i Encrypt R2 received from the IC card using as the key to Enc (KIC _j , R2) is generated and transmitted to the IC card. The IC card is sent from the receiver to Enc (KIC _j , R2), Enc (KIC already created on the IC card) _j , R2) and Enc (KIC) received from the IC card _j , R2) and confirm that the values match. And the receiver and the IC card are KIC for R1 and R2, which are composed of R1 and R2, respectively. _j Is used as a key to obtain a session key SK. Here, the encryption algorithms provided in the mutual authentication units of the receiver and the IC card are the same.
[0033]
The mutual authentication flow by the challenge and response is only an example, and KIC _j May be used as shared secret information and other mutual authentication methods may be applied to share the session key SK. Further, it may be one-way authentication of a receiver or an IC card.
The session key SK is mutually authenticated and shared when the receiver power is turned on and when the IC card is inserted into the receiver. The mutual key is generated separately by the receiver and the IC card. It is important for security that the random numbers are different each time mutual authentication is performed. In other words, considering the case where the receiver authenticates the IC card, if the random number R1 generated at the above timing is a different random number each time, the same KICj used for the previous mutual authentication is used. However, Enc (KICj, R1) becomes different data, and it is impossible for an unauthorized IC card to impersonate past data used by a regular IC card for mutual authentication. It becomes possible to prevent. Similarly, when the IC card authenticates the receiver, if the random number R2 is a different random number each time, even if the same KICj as that used for the previous mutual authentication is used, Enc (KICj, R2) becomes different data, and it is impossible for an unauthorized receiver to impersonate the past data used by the authorized receiver for mutual authentication, and it is possible to prevent impersonation fraud. Become.
[0034]
As described above, as a method for preventing the same random number from being generated at the time of mutual authentication, there is use of a nonvolatile memory circuit. That is, the random number generator stores the generated state in a nonvolatile memory, and the random number to be generated next time is continuously generated from that state to prevent the generation of the same random number. Alternatively, the random number generator is configured to give initialization data and obtain a random number, store the random number generated this time, and prevent the generation of the same random number by using it as the next initialization data.
[0035]
FIG. 8 is a diagram showing a case where the IC card 400 includes the receiving device authentication information storage unit 411 in the configuration described with reference to FIG. The IC card receiving device authentication information filtering unit 404 refers to the MID stored in the manufacturer ID storage unit 402 and the CID stored in the card ID storage unit 403, and executes all (C _ij , I, j) of which MID and CID match _ij , I and j are extracted. MID or CID does not match (C _ij , I, j) are discarded. And the extracted C _ij C 'with MID and CID removed from _ij And i to the receiver and the transmitted C ′ _ij And i, j, and the extracted C _ij Is stored in the receiving device authentication information storage unit 411.
[0036]
FIG. 9 is a diagram showing a processing flow from the time when the IC card is installed in the receiver until the authentication process is reached. In the processing flow of the IC card, the flow when the receiving device authentication information storage unit is not provided is described by a solid line arrow, and the flow when the receiving device authentication information storage unit is provided is described by a broken line arrow.
In the receiver, there is no difference in processing flow between the case where the IC card is provided with the receiving device authentication information storage unit and the case where it is not provided. When the IC card is inserted, the receiver transmits the MID to the IC card (step S100). And included in the broadcast wave (C _ij , I, j) is transmitted to the IC card (step S101). Then from the IC card C ' _ij , I are input, the device key Kd from the device key storage unit _i Is read out and Kd _i C 'as a key _ij Decode and KIC _j (Step S103), the KIC _j Is used to perform authentication processing with the IC card (step S104).
[0037]
On the other hand, in the case of an IC card, the processing flow differs depending on whether the receiving device authentication information storage unit is provided or not.
First, a flow when the IC card is not provided with a receiving device authentication information storage unit will be described. The IC card receives the MID from the receiver and stores it in the manufacturer ID storage unit (step S110). And from the receiver (C _ij , I, j) is waited for (step S111). (C _ij , I, j) is input, C in which MID and CID coincide with each other. _ij Extract C ' _ij (Step S112) and C ′ _ij And i are output to the receiver (step S113). Furthermore, the KIC corresponding to the j from the IC card unique key storage unit _j Is read (step S114), and the KIC _j Is used to perform authentication processing with the receiver (step S115).
[0038]
Next, a flow when the IC card includes a receiving device authentication information storage unit will be described. When receiving the MID from the receiver, the IC card stores the MID in the manufacturer ID storage unit (step S110). Then, C ′ from the receiving device authentication information storage unit _ij , I, j, and MID are tried to be read (step S120). C ′ in the receiving device authentication information storage unit _ij , I, j, and MID are stored, and if the read is successful, it is compared with the MID received from the receiver (step S121). When MID is equal, C ′ read from the receiving device authentication information storage unit _ij And i are output to the receiver (step S113). In step S120, C ′ is stored in the receiving device authentication information storage unit. _ij , I, j, and MID are not stored, or when the comparison result of the MID is not equal in step S121, (C _ij , I, j) is input (step S111), and C ′ is filtered by the filtering process. _ij Is created (step S112). And C ' _ij , I, j, and MID are stored in the receiving device authentication information storage unit (step S122), then C ′ _ij And i are output to the receiver (step S113). After that, it is the same as the case where the receiving device authentication information storage unit is provided.
[0039]
As described above, the IC card is provided with the receiving device authentication information storage unit, and C ′ transmitted to the receiver. _ij , I, j, and MID of the receiver are stored, and if the manufacturer of the receiver is the same as the last time when the IC card is mounted after the next time, it is not necessary to wait for reception of receiving device authentication information from the receiver. The mutual authentication with the receiver can be started immediately.
[0040]
FIG. 10 is a diagram illustrating a case where the receiver 300 includes the receiving device authentication information filtering unit 309 in the configuration described with reference to FIG. The receiver authentication information filtering unit 309 of the receiver is separated by the separation unit 303 (C _ij , I, j), the MIDs do not match. _ij C with the same manufacturer ID _ij And only i and j are transmitted to the IC card. The IC card receiving device authentication information filtering unit 412 receives (C _ij , I, j) with the same CID _ij , I and j are extracted only, and the CIDs do not match _ij Is discarded.
[0041]
Thus, when the receiver also includes a receiving device authentication information filtering unit, it is transmitted to the IC card (C _ij , I, j) can be reduced, and the amount of processing in the IC card receiver authentication information filtering unit can be reduced, so that the processing load on the IC card can be reduced. Generally, a receiver has a higher processing capability than an IC card, so even if a receiver authentication information filtering unit is provided, the load is not increased significantly. In addition, there is an advantage that a manufacturer ID storage unit is unnecessary in the IC card.
[0042]
FIG. 11 is a block diagram for explaining a method of performing cryptographic communication between the receiver and the IC card.
First, processing in which the receiver transmits a command to the IC card and the receiver receives encrypted communication data from the IC card as a response will be described. For example, when the receiver receives the ECM, the receiver transmits an ECM reception command to the IC card together with the ECM, and receives the encrypted scramble key Ks as a response.
[0043]
Receiver and IC card are IC card unique key KIC _j Based on the above, mutual authentication processing is performed and the session key SK is held. The receiver stores the SK in the SK storage unit 320, and the IC card stores the SK in the SK storage unit 420. The random number generation unit 321 of the receiver generates a random number R. The command generation unit 322 generates a command to the IC card using a user operation or broadcast wave reception as a trigger. At that time, the random number R is configured as a part of the command data, and the command COM (R) is transmitted to the IC card. Here, COM (X) indicates command data including data X. In addition, the encryption key generation unit 323 of the receiver generates the encryption key SK ′ by inputting the session key SK stored in the SK storage unit and the random number R, and outputs the encryption key SK ′ to the decryption unit 308. Further, the encryption key generation unit 323 outputs the generated SK ′ to the SK storage unit 320 and updates the SK. The decryption unit 308 holds the encryption key SK ′ until a response to the command is received from the IC card. On the other hand, the command analysis unit 421 of the IC card analyzes the content of the command COM (R) received from the receiver, extracts the random number R, and outputs it to the encryption key generation unit 422. The encryption key generation unit generates an encryption key SK ′ from the session key SK stored in the SK storage unit 422 and the random number R input from the command analysis unit, and outputs the encryption key SK ′ to the encryption unit 407. Further, the encryption key generation unit 422 outputs the generated SK ′ to the SK storage unit 420 and updates the SK. Here, the encryption key generation algorithm of the encryption key generation unit 323 of the receiver and the encryption key generation unit 422 of the IC card are equal. The encryption unit 407 outputs Enc (SK ′, RES) obtained by encrypting the response data RES to the command input from the receiver using SK ′ as a key, and transmits the Enc (SK ′, RES) from the input / output unit 401 to the receiver. When the input / output unit 301 receives Enc (SK ′, RES) from the IC card as a response to the command, the receiver 308 decrypts the stored SK ′ as a key and outputs response data RES. .
[0044]
Next, processing in which the receiver transmits a command to the IC card and then transmits the encrypted communication data to the IC card will be described. For example, when it is desired to store in the IC card information that may be misused if illegally acquired, such as information related to billing for viewing a program or information related to copyright, the receiver sends a command to that effect to the IC card. Send it, and then encrypt and send that information.
[0045]
Until the encryption key generation unit 323 of the receiver and the encryption key generation unit 422 of the IC card generate SK ′, the SK ′ is stored in the SK storage units 320 and 420, respectively, and the SK is updated. This is the same as the description of the process in which the receiver receives communication data from the card. However, the encryption key generation unit 323 of the receiver outputs SK ′ to the encryption unit 324, and the encryption key generation unit 422 of the IC card outputs SK ′ to the decryption unit 423. The encryption unit 324 of the receiver outputs Enc (SK ′, DATA) obtained by encrypting the communication data DATA using SK ′ as a key, and transmits it from the input / output unit 301 to the IC card. When the input / output unit 401 receives Enc (SK ′, DATA) from the receiver, the decryption unit 423 decrypts the IC card using the held SK ′ as a key and outputs DATA.
[0046]
Thus, when a random number is generated for each command transmitted from the receiver to the IC card, the random number is transmitted together with the command to the IC card, and the encryption key SK ′ is generated using a common algorithm in the receiver and the IC card, Encryption using a key that is refreshed at each command is possible, and encryption communication with higher security can be realized as compared with encryption communication using the session key SK as an encryption key. Further, since SK is updated each time an encryption key is generated, even if the random number R becomes equal to the previously used value, SK ′ is different, and it is difficult to determine SK ′ by eavesdropping on the random number R. is there.
[0047]
It is not always necessary to generate random numbers for all commands and update the encryption key SK ′ every time. The random number may be generated at a certain command generation count or at a timing when a certain time has elapsed. When a random number is not included in the command from the receiver, the decryption unit and the encryption unit of the receiver and the IC card may perform encrypted communication using SK ′ already held. In this case, the encryption key generation process and the SK update process can be omitted in the receiver and the IC card.
[0048]
FIG. 12 is a timing chart showing, in time series, processing until the receiver holds the scramble key Ks after the authentication processing of the receiving apparatus. The broadcast station pre-certifies the authentication information C for one IC card for each receiver manufacturer. _ij N × m are held. The receiver must use its own device key Kd in advance. _i N are held. IC card is IC card unique key KIC in advance _j And m individual keys Km.
[0049]
First, the receiving device authentication phase will be described. The receiver receives the C sent from the broadcasting station. _ij Is transmitted to the IC card. IC card is C _ij Is received, the filtering process is performed and C ′ _ij Is generated and transmitted to the receiver. The receiver is C ' _ij Receive Kd _i Decode using KIC and KIC _j To get. The receiver and the IC card were able to share KIC _j Is used for mutual authentication to obtain a session key SK.
[0050]
Next, the viewing contract update phase will be described. In the viewing contract renewal phase, the IC card obtains a work key Kw necessary for decrypting the scramble key Ks from the EMM. When the receiver receives the EMM addressed to the own receiving device transmitted from the broadcasting station, the receiver transmits the EMM to the IC card. When the IC card receives the EMM, it decrypts the EMM using the individual key Km and obtains the work key Kw.
[0051]
Next, the program viewing phase will be described. In the program viewing phase, the IC card acquires the scramble key Ks necessary for descrambling the program from the ECM and transmits it to the receiver. When the receiver receives the ECM transmitted from the broadcast station, the receiver transmits the ECM to the IC card. At this time, the random number R is also transmitted to the IC card, and an encryption key SK ′ is generated from the SK and R obtained in the receiving device authentication phase. When the IC card receives the ECM, it decrypts the ECM using the work key Kw and obtains Ks. Furthermore, an encryption key SK ′ is generated from the received random number R and the SK obtained in the receiving device authentication phase, and Ks is encrypted and transmitted to the receiver. Upon receiving the received encrypted Ks, the receiver decrypts it using the generated SK ′ to obtain Ks. Thereafter, the receiver performs the same process each time it receives an ECM sent from the broadcast station, and acquires Ks. At that time, random numbers (R ′, R ″,...) Having different values are used, and the encryption key SK ′ is updated to a different one (SK ′, SK ″,...) Every time. .
[0052]
Note that once the viewing contract update phase is executed, it may not be executed until the viewing contract is updated.
The broadcast form of the broadcast wave received by the receiving apparatus described so far may be any of terrestrial broadcast, sanitary broadcast, and cable broadcast (CATV). Also, other broadcast forms may be used.
[0053]
【The invention's effect】
As is apparent from the above description, in the conditional access apparatus authentication method and the conditional access apparatus of the present invention, the IC card held in advance by sending the reception apparatus authentication information to the reception apparatus using broadcast waves. Unique key KIC _j Since the receiver can hold the shared information, the shared information can be safely shared between the receiver and the IC card without sharing the global secret in advance. By performing an authentication process using the shared information, it is possible to generate a session key SK that is updated each time the authentication process is performed. The scramble key Ks is encrypted using the SK, and the Ks can be safely transmitted to the receiver. It becomes possible to send. Further, by transmitting a random number for each command from the receiver to the IC card, the receiver and the IC card can generate and share different encryption keys SK ′ for each command from the random number and SK, The response data from the IC card to the command and the communication data from the receiving apparatus main body to the IC card are encrypted, and safe data can be transferred.
[0054]
Further, since a plurality of IC card unique keys can be held in one IC card, even if the first IC card unique key is determined from the communication data at the time of mutual authentication, it corresponds to another IC card unique key. By sending the receiving device authentication information from the broadcasting station, it is possible to prevent Ks from being obtained illegally.
Also, since the IC card unique key is different for all IC cards, even if all the values of the IC card unique key of an IC card are calculated, the influence on the conditional access system operation is slight.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration of a transmission side of a conventional conditional access system
FIG. 2 is a block diagram showing a configuration of a conventional conditional access apparatus
FIG. 3 is a diagram showing an example of a procedure for storing a device key and an IC card unique key of the present invention in a receiver and an IC card, respectively.
FIG. 4 is a block diagram illustrating a method for generating receiving device authentication information according to the present invention.
FIG. 5 is a block diagram showing a configuration of a transmission side in a conditional access system using the conditional access apparatus authentication method of the present invention.
FIG. 6 is a block diagram showing a method for performing authentication processing by the conditional access apparatus of the present invention.
FIG. 7 is a block diagram showing an example of a conventional mutual authentication method.
FIG. 8 is a block diagram illustrating a method for performing authentication processing when the conditional access apparatus of the present invention includes a receiving apparatus authentication information storage unit in an IC card.
FIG. 9 is a flowchart showing a procedure of the conditional access apparatus authentication method of the present invention.
FIG. 10 is a block diagram showing an authentication method when the conditional access apparatus of the present invention includes a receiving apparatus authentication information filtering unit in the receiving apparatus main body.
FIG. 11 is a block diagram showing a method in which the conditional access apparatus of the present invention generates a random number for each command, transmits it to the IC card, generates an encryption key, and performs encrypted communication.
FIG. 12 is a timing chart showing, in a time series, processing until the receiver holds the scramble key Ks after authentication processing of the receiving device in the conditional access system using the conditional access device authentication method of the present invention.
[Explanation of symbols]
100 content generator
101 Ks generator
102 ECM generator
103 Kw generator
104 EMM generator
105 km generator
106 Scrambler
107 ECM encryption section
108 EMM Encryption Department
109 Multiplexer
110 Receiver body
111 TS filtering section
112 Separation unit
113 Descrambler
120 Security module
121 km storage
122 EMM decoder
123 ECM decoder
130 (C _ij , I, j) generator
131 Multiplexer
200 broadcast station
201 Key management center
202 Device key generation unit
203 Device key DB
204 IC card unique key generation unit
205 IC card unique key DB
206 Receiver manufacturer
207 receiver
208 IC card manufacturers
209 IC card
210 Receiver Authentication Information Generation Unit
211 Encryption section
300 receiver
301 Input / output unit
302 TS filtering unit
303 Separation unit
304 Manufacturer ID storage unit
305 Device key storage
306 Authentication information decryption unit
307 Authentication processing unit
308 Decryption unit
309 Receiver authentication information filtering unit
310 Mutual authentication unit
320 SK storage unit
321 random number generator
322 Command generator
323 Encryption key generator
324 Encryption unit
400 IC card
401 Input / output unit
402 Manufacturer ID storage unit
403 Card ID storage unit
404 Receiver Authentication Information Filtering Unit
405 IC card unique key storage unit
406 Authentication processing unit
407 Encryption section
408 km storage
409 EMM decoder
410 ECM decoder
411 Receiver authentication information storage unit
412 Receiver Authentication Information Filtering Unit
413 Mutual authentication unit
420 SK storage unit
421 Command analyzer
422 Encryption key generation unit
423 Decryption unit

Claims (27)

The conditional reception device that receives the broadcast signal and outputs it to the security module, and the security module that processes the data input from the conditional reception device and outputs the processed data to the conditional reception device A conditional access system for a conditional access system including:
Input / output means for performing data input / output with the security module;
Limited reception device specific information storage means for storing one or more limited reception device specific information;
Decryption means for decrypting encrypted information input from the security module via the input / output means using one of the one or more conditional access apparatus specific information as a key;
A conditional reception apparatus comprising: authentication processing means for performing authentication processing with the security module by using information output from the decryption means as input, and outputting a shared value with the security module. Manufacturer ID storage means for storing a manufacturer ID for identifying a manufacturer of the limited receiving device;
The conditional access apparatus according to claim 1, further comprising: filtering means for filtering reception apparatus authentication information included in a received broadcast wave with reference to the manufacturer ID. The conditional reception device that receives the broadcast signal and outputs it to the security module, and the security module that processes the data input from the conditional reception device and outputs the processed data to the conditional reception device A conditional access system security module including
Input / output means for performing data input / output with the conditional access device;
Security module ID storage means for storing a security module ID for uniquely identifying the security module;
Filtering means for filtering receiving device authentication information inputted from the limited receiving device via the input / output means with reference to the security module ID;
Security module specific information storage means for storing one or more security module specific information;
Authentication processing means for performing authentication processing with the conditional access device by inputting one security module specific information among the one or more security module specific information and outputting a shared value with the conditional access device. Security module characterized by   The security module according to claim 3, wherein the security module is an IC card, and the security module ID is a card ID. Further comprising a manufacturer ID storage means for storing a manufacturer ID for identifying the manufacturer of the conditional access device, input from the conditional access device via the input / output means,
The filtering means filters the receiving device authentication information input from the conditional access device through the input / output means with reference to the manufacturer ID and the card ID. Security module.   The security module according to any one of claims 3 to 5, further comprising a receiving device authentication information storage unit that stores the receiving device authentication information output by the filtering unit. The conditional reception device that receives the broadcast signal and outputs it to the security module, and the security module that processes the data input from the conditional reception device and outputs the processed data to the conditional reception device A conditional access system including
The conditional access device includes first input / output means for performing data input / output with the security module;
Manufacturer ID storage means for storing a manufacturer ID for identifying a manufacturer of the limited receiving device;
Limited reception device specific information storage means for storing one or more limited reception device specific information;
Decryption means for decrypting encrypted information input from the security module via the first input / output means, using one of the one or more conditional access apparatus specific information as a key. When,
Authentication processing means for performing authentication processing with the security module using the information output by the decryption means as input, and outputting a shared value with the security module;
The security module includes second input / output means for performing data input / output with the conditional access device;
Security module ID storage means for storing a security module ID for uniquely identifying the security module;
Manufacturer ID storage means for storing a manufacturer ID for identifying the manufacturer of the limited reception apparatus, which is input from the limited reception apparatus via the second input / output means;
Filtering means for filtering receiving device authentication information inputted from the limited receiving device via the second input / output means with reference to the manufacturer ID and the security module ID;
Security module specific information storage means for storing one or more security module specific information;
Authentication processing means for performing authentication processing with the conditional access device by inputting one security module specific information among the one or more security module specific information and outputting a shared value with the conditional access device. A conditional access system characterized by this.   The conditional access system according to claim 7, wherein the security module further includes a receiving device authentication information storage unit that stores the receiving device authentication information output by the filtering unit. The conditional reception device that receives the broadcast signal and outputs it to the security module, and the security module that processes the data input from the conditional reception device and outputs the processed data to the conditional reception device A conditional access system including
The conditional access device includes first input / output means for performing data input / output with the security module;
Manufacturer ID storage means for storing a manufacturer ID for identifying a manufacturer of the limited receiving device;
Filtering means for filtering reception device authentication information included in the received broadcast wave with reference to the manufacturer ID;
Limited reception device specific information storage means for storing one or more limited reception device specific information;
Decryption means for decrypting encrypted information input from the security module via the first input / output means, using one of the one or more conditional access apparatus specific information as a key. When,
Authentication processing means for performing authentication processing with the security module using the information output by the decryption means as input, and outputting a shared value with the security module;
The security module includes second input / output means for performing data input / output with the conditional access device;
Security module ID storage means for storing a security module ID for uniquely identifying the security module;
Filtering means for filtering receiving device authentication information input from the limited receiving device via the second input / output means with reference to the security module ID;
Security module specific information storage means for storing one or more security module specific information;
Authentication processing means for performing authentication processing with the conditional access device by inputting one security module specific information among the one or more security module specific information and outputting a shared value with the conditional access device. A conditional access system characterized by this.   The conditional access system according to claim 9, wherein the security module further includes a receiving device authentication information storage unit that stores the receiving device authentication information output by the filtering unit. An authentication method for a conditional access device equipped with a security module,
The conditional access device is
Separating receiving device authentication information included in the received broadcast wave;
A filtering process step for extracting only receiving device authentication information addressed to the receiving device;
Generating shared information equal to security module specific information held in advance by a security module based on the receiving device authentication information;
The conditional access device and the security module are:
A method of authenticating a conditional access device, comprising the step of performing an authentication process using the security module specific information shared by the conditional access device and the security module. The receiving device authentication information is a security module specific information unique to each security module held by one or more of the security modules, using any one of the limited receiving device specific information held by the limited receiving device as a key. Information generated by encrypting any one of the above, a manufacturer ID that identifies the manufacturer of the conditional access device, and a security module ID that identifies the security module,
Claims characterized in that it is transmitted using broadcast waves from broadcasting station equipment in combination with index information for specifying limited reception device specific information and security module specific information used for generating reception device authentication information. 11. The conditional access apparatus authentication method according to 11.   12. The filtering process according to claim 11, wherein the filtering apparatus selects receiving apparatus authentication information in which the manufacturer ID and the security module ID stored in the security module match as receiving apparatus authentication information addressed to the own receiving apparatus. The conditional access apparatus authentication method according to claim 12.   12. The shared information generated by the conditional access device is restored by decrypting information included in the reception device authentication information using the conditional access device specific information as a key. The conditional access apparatus authentication method according to claim 13.   The filtering process selects the receiving device authentication information that matches the manufacturer ID stored in the limited receiving device in the limited receiving device, and the security module stores the security module ID stored in the security module. 15. The limited receiving apparatus authentication method according to claim 11, wherein receiving apparatus authentication information addressed to the receiving apparatus is extracted by selecting matching receiving apparatus authentication information.   The said security module has a step which memorize | stores the manufacturer ID input from the said conditional access apparatus after the said security module is mounted | worn with the said conditional access apparatus, The any one of Claims 11-14 characterized by the above-mentioned. The conditional access apparatus authentication method according to one item.   In the security module, the filtering process selects receiving device authentication information addressed to the own receiving device by selecting receiving device authentication information in which the stored manufacturer ID matches the security module ID stored in the security module. The conditional access apparatus authentication method according to claim 16, wherein the conditional access apparatus authentication method is extracted. The security module has a step of storing receiving device authentication information extracted by filtering processing,
If the manufacturer ID input from the conditional access device after the security module is attached to the conditional access device is equal to the manufacturer ID included in the stored reception device authentication information, the stored reception device Outputting authentication information to the conditional access device;
The limited reception according to any one of claims 15 to 17, wherein the limited reception device generates the shared information based on the reception device authentication information passed from the security module. Device authentication method. Storage means for storing a shared value with the security module output by the authentication processing means;
Random number generation means for outputting a random number;
An encryption key generating means for outputting an encryption key by inputting the stored shared value and the random number;
The decryption means for decrypting information input from the security module via the input / output means using the encryption key is further provided. The method according to any one of claims 1 and 2, The limited receiving apparatus described.   The conditional access apparatus according to claim 19, further comprising an encryption unit that encrypts information to be output to the security module using the encryption key. Storage means for storing a shared value with the conditional access device output by the authentication processing means;
An encryption key generating means for outputting an encryption key by inputting the stored shared value and a random number input from the conditional access device via the input / output means;
The security module according to claim 3, further comprising: an encryption unit that encrypts information to be output to the conditional access device using the encryption key.   The security module according to claim 21, further comprising decryption means for decrypting information input from the conditional access apparatus via the input / output means using the encryption key. The conditional reception device that receives the broadcast signal and outputs it to the security module, and the security module that processes the data input from the conditional reception device and outputs the processed data to the conditional reception device A conditional access system including
The conditional access device includes first input / output means for performing data input / output with the security module;
Manufacturer ID storage means for storing a manufacturer ID for identifying a manufacturer of the limited receiving device;
Limited reception device specific information storage means for storing one or more limited reception device specific information;
Decryption means for decrypting encrypted information input from the security module via the first input / output means, using one of the one or more conditional access apparatus specific information as a key. When,
Authentication processing means for performing authentication processing with the security module using information output by the decryption means as input, and outputting a shared value with the security module;
Storage means for storing a shared value with the security module output by the authentication processing means;
Random number generation means for outputting a random number;
An encryption key generating means for outputting an encryption key by inputting the stored shared value and the random number;
Decrypting means for decrypting information input from the security module via the first input / output means using the encryption key;
The security module includes second input / output means for performing data input / output with the conditional access device;
Security module ID storage means for storing a security module ID for uniquely identifying the security module;
Manufacturer ID storage means for storing a manufacturer ID for identifying the manufacturer of the limited reception apparatus, which is input from the limited reception apparatus via the second input / output means;
Filtering means for filtering receiving device authentication information inputted from the limited receiving device via the second input / output means with reference to the manufacturer ID and the security module ID;
Security module specific information storage means for storing one or more security module specific information;
Authentication processing means for performing authentication processing with the conditional access device by inputting one security module specific information among the one or more security module specific information and outputting a shared value with the conditional access device;
Storage means for storing a shared value with the conditional access device output by the authentication processing means;
An encryption key generating means for outputting an encryption key by inputting the stored shared value and a random number input from the conditional access device via the second input / output means;
A conditional access system comprising: encryption means for encrypting information to be output to the conditional access device using the encryption key. The conditional access apparatus further includes an encryption unit that encrypts information to be output to the security module using the encryption key,
24. The security module according to claim 23, further comprising decryption means for decrypting information input from the conditional access apparatus via the second input / output means using the encryption key. Conditional access system. An encryption communication method between a conditional access device on which a security module is mounted and the security module,
The conditional access device stores a shared value generated by an authentication process with the security module;
Generating a random number;
Outputting the random number to the security module;
Generating a cryptographic key using a shared value with the stored security module and the random number;
The security module storing a shared value generated by an authentication process with the conditional access device;
Generating an encryption key using a shared value with the stored limited reception device and a random number input from the limited reception device;
Storing the encryption key as a shared value with the conditional access device,
The cipher communication method, wherein the conditional access device and the security module perform cipher communication using an encryption key generated by each. The conditional access apparatus further includes a step of storing the generated encryption key as a new shared value with the security module,
26. The encryption communication method according to claim 25 , further comprising the step of storing the generated encryption key as a new shared value with the conditional access device. As a trigger command transmission from the conditional device to the security module, the conditional access apparatus and generates the random number, the encryption communication method according to any one of claims 25 and claim 26 .

Images