JP5098292B2 - Content decryption key extraction method and content reception device - Google Patents

Description

  The present invention relates to a receiver for digital broadcasting, and more particularly to conditional access processing used for viewing control for determining the right to receive pay broadcasting or for descrambling for copy protection.

The viewing control function of a digital broadcast receiver is a function that performs broadcast service reception permission control on the receiver side in order to provide a pay broadcast service to a legitimate contractor.
The main processing of the viewing control function includes contract reception processing for receiving information on contract maintenance and contract renewal, reception determination processing for determining program rights based on the contract, and determining whether or not to receive, encrypted from the broadcasting station There is a decryption process for extracting contract information from contract information received.

  Note that the viewing control function of the digital broadcast receiver may be damaged if a malicious user performs unauthorized alteration of the viewing control function, such as illegally receiving a pay broadcast service. Need to be defended against.

  For this reason, as a method of providing a viewing control function that makes it difficult to tamper with, the entire viewing control function is stored in a secret storage area, and an IC card that is executed by the secret calculation processing unit is inserted into the receiver. Is common. For example, in the standard “Access Control Method for Digital Broadcasting” (ARIB-STD-B25) established by the Radio Industries Association, the functions that an IC card must have to realize the viewing control function and the communication between the receiver and the IC card Is stipulated.

  While the above method is general, there is a demand for realizing a viewing control function by software in order to extend a paid service in digital broadcasting. For example, the service was initially only a monthly contract, but it can be expanded to a service that allows contracts on a program-by-program basis, or pay-per-view (when a viewer gives a purchase instruction directly to a receiver, a program can be purchased immediately, and later If you want to expand after the start of business, it is necessary to update the viewing control function.

  In response to such a request, for example, Patent Document 1 discloses a method for realizing a viewing control function by software. In Patent Document 1, a conditional reception system receives encrypted content and an associated secret content key from a content provider in an encrypted form. The security module decrypts the secret content key, and decrypts the content with the decrypted secret content key.

  However, processing such as contract reception processing and reception determination processing for realizing the viewing control function is stored as software in a storage area outside the security module and processed by an external CPU. With this configuration, software including contract reception processing and reception determination processing can be updated at the time of service expansion using means such as downloading.

Japanese Patent Laid-Open No. 2004-289847

  However, in the conventional method of converting the viewing control function to software, the software stored in the external storage area can be falsified. In addition, when software is executed by a non-confidential CPU, the calculation result can be analyzed during the execution of the calculation, or the calculation result can be rewritten during the execution of the program in some cases. For this reason, it is possible for a malicious user to make a contract with only a minimum number of channels, for example, and to illegally view all channels by tampering with the software reception determination processing unit.

  Conversely, since the decryption processing unit for decrypting the cipher is stored in the security module, the decryption processing unit cannot be updated by software update.

  In order to solve the above problems, the content receiving apparatus of the present invention stores encryption processing software in a rewritable storage area, stores a master key Km for encryption / decryption in a rewritable secret storage area, Is configured to read the decryption processing software and the key from the storage area and the confidential storage area and perform the decryption process.

  In addition to the above, the content receiving apparatus of the present invention stores contract reception processing software in the storage area, stores a key in the secret storage area, and the processor receives contract reception processing from the storage area and the secret storage area. The software and the master key Km are read, and the processor receives the encrypted contract information and work key Kw from the outside, performs decryption processing and contract reception processing, and extracts the extracted contract information and work key Kw as the secret It has a configuration for storing in a storage area.

  In addition to the above, the conditional access processor of the present invention stores reception determination processing software in the storage area, stores the contract information and the work key Kw in the secret storage area, and the processor conceals the storage area. Receiving determination processing software, contract information and work key Kw are read from the storage area, and the processor receives the encrypted program right information and scramble key Ks from the outside, and performs decryption processing and reception determination processing to extract The scramble key Ks thus passed is passed to the descrambling process, and the descrambling determination process has a configuration for performing a descrambling process on data input from the outside.

  In addition to the above, the conditional access processor of the present invention attaches a hash value to processing software stored in the storage area in advance and stores hash value determination processing software in the secret storage area. Reads the processing software and hash value from the storage area, reads the hash value determination processing software stored in the confidential storage area, performs processing, and detects unauthorized rewriting of the processing software read from the storage area Have

  According to the present invention, it is possible to provide a more suitable broadcast receiver that prevents unauthorized viewing of a digital broadcast.

  Embodiments of the present invention will be described below with reference to the drawings.

  FIG. 1 is a diagram showing the flow of data. The limited reception processor of the digital broadcast receiver is installed at the user's home and performs contract determination and viewing control. FIG. 1 shows an example of a digital broadcasting system configuration using a conditional access processor. The features of the present invention are mainly performed by a conditional access processor. A block diagram of the conditional access processor is shown in FIGS. The limited reception processor may be a device installed in the digital broadcast receiver, or may cause a part of the digital broadcast receiver to function as the limited reception processor, that is, the digital broadcast receiver main body. Good.

  The digital broadcasting station 202 broadcasts a signal defined by, for example, the MPEG2-System ISO standard 13818-1. This broadcasting station may be any of terrestrial digital broadcasting, satellite digital broadcasting, and digital cable broadcasting. The digital broadcast signal includes ECM, EMM, and scrambled content.

  An EMM (Entity Management Message) is a signal including contract information for each viewer and a work key Kw for decrypting the ECM encryption. An ECM (Entitlement Control Message) is a signal including program information, information such as a descrambling key Ks, and information for controlling reception / rejection as program information. Note that the EMM and ECM are encrypted together with Kw / Ks and transmitted from the digital broadcast station.

  The digital broadcast receiver 201 performs viewing control, MPEG decoding, and the like and outputs video when an instruction is given from the user by channel selection or the like. The digital broadcast receiver 201 may be provided as an integral unit with the television, or may be provided as an independent set-top box.

  When the operation processing unit 231 receives the channel designation instruction 212 from the user, the digital broadcast receiver 201 notifies the channel display management unit 232 of the channel designation 213. The channel display management unit 232 specifies the demodulation instruction 214 for extracting the MPEG signal of the specified channel to the demodulation unit 233.

  The demodulation unit 233 extracts a transport stream signal (TS) 216 including a designated channel from the digital broadcast signal 211 received from the outside by the reception unit. Note that TS includes encrypted content, ECM, and EMM. The EMM may be included in the TS when the digital broadcast station wants to change the contract for each viewer, and may not be always included in the TS. The EMM includes a contract for each viewer, and after the contract information is stored in the secret storage area 105, unless the EMM information is newly received, the stored EMM The invention will be carried out.

  The contract management unit 236 notifies the separation unit 234 of the separation instruction 219 of the EMM 111 for the conditional access processor. When the separation unit 234 extracts the EMM 111, the separation unit 234 passes the EMM 111 to the contract management unit 236. Upon receiving the EMM 111, the contract management unit 236 passes the EMM 111 to the conditional access processor 101. When receiving the EMM 111, the conditional access processor 101 performs EMM decryption processing and contract reception processing, and stores the contract information and Kw in a secret storage area inside the conditional access processor.

  The channel display management unit 232 notifies the separation unit 234 of an ECM separation instruction 215. When the separation unit 23 extracts the ECM 112 of the display target channel, the separation unit 23 passes the ECM 112 to the display management unit 232.

  When the channel display management unit 232 receives the ECM 112, it passes the ECM 112 to the conditional access processor 101. When the conditional access processor 101 receives the ECM 112, it uses the work key Kw and the contract information to perform an ECM decryption process and a reception determination process. When the program reception right is confirmed, the transport stream signal 217 received from the separation unit 234 is received. The scrambled video data is descrambled using a scramble key Ks, and a decoded transport stream signal 218 is output.

  The channel display management unit 232 notifies the decoder unit 235 of the video output instruction 220 of the designated channel. The decoder unit 235 decodes an image using the decoded transport stream signal 218, and outputs a video output 221 to an external device.

  Next, FIG. 2 and FIG. 3 are processors inside the digital broadcast receiver, and the decoding process software stored in the non-confidential storage area is used to perform the EMM and ECM decoding processes to obtain Ks. It is a block diagram of the conditional access processor which extracts and implements a descrambling process.

  First, FIG. 2 will be described. The limited reception processor 101 includes a secret CPU unit 104 and a secret storage area 105 which are secret areas 102 and a non-secret memory area 106 which is a non-secret area 103. The secret storage area and the secret CPU are realized by a technology equivalent to a tamper-resistant IC card or SD memory.

  In the non-secret storage area 106, decryption processing software 113 obtained by converting a public encryption algorithm such as DES or AES into software is stored in advance. The secret storage area 105 stores in advance a master key Km116 for EMM decryption unique to the conditional access processor.

  When receiving the EMM 111 from the outside, the secret CPU unit 104 of the conditional access processor 101 reads the decryption processing software 113 from the non-secret memory area 106 and reads the master key Km 116 for decrypting the EMM 111 from the secret memory area 105. Subsequently, the secret CPU unit 104 executes a decryption process 131 to decrypt the EMM 111 with the master key Km 116, extract the work key Kw 118, and store it in the secret storage area 105.

  When receiving the ECM 112 from the outside, the secret CPU unit 104 of the conditional access processor 101 reads the decryption processing software 113 from the non-secret storage area 106 and reads the work key Kw 118 from the secret storage area 105. Subsequently, the concealment CPU unit 104 executes the decryption process 131 to decrypt the ECM 112 with the work key Kw118, extracts the descramble scramble key Ks122, and passes it to the descramble process 134 in the dedicated computation area 107. A descrambling process 134 using a public encryption algorithm such as MULTI2 or DES descrambles the MPEG transport stream packet using the scramble key Ks122.

  The secret CPU unit may be an example in which the decryption processing software 113 is read in advance regardless of whether the EMM 111 or the ECM 112 is received from the outside. Further, the software for executing the decoding process of the EMM 111 and the software for executing the decoding process of the ECM 112 may be different.

  By decrypting the EMM with Km stored in the secret storage area, the EMM can be decrypted only by a legitimate digital broadcast receiver. Then, Kw is extracted from the decrypted EMM, stored in the secret storage area, and the ECM is decrypted with the Kw, so that the decryption key Ks for descrambling the content can be decrypted with respect to an authorized contractor. Moreover, since EMM can be transmitted from a digital broadcasting station at any time, it is possible to cope with the case where the digital broadcasting station wants to change the contract. Since the decryption processing software is stored in the non-secret storage area, the decryption processing software can be modified. The modified decoding processing software can also be downloaded from a digital broadcasting station or the like via a network.

  In the drawing, the dedicated calculation area for descrambling the content is in the secret area, but the dedicated calculation area may be in the non-secret area. The same applies to FIG. When there is a dedicated calculation area in the secret area, there is an advantage that Ks cannot be extracted.

  Next, FIG. 3 will be described. In FIG. 3, hash values are assigned to the decryption processing software, the contract reception processing software, and the reception determination processing software, respectively, and whether or not each software has been tampered with by performing the hash value determination processing in the secret CPU unit. Can be checked. If the broadcasting station or the like wants to modify each software, store the software in the non-confidential storage area for the reason that it can be modified and because the software capacity is large, it does not fit in the confidential storage area However, in this way, each software can be modified by a malicious user. Therefore, a hash value is attached to the software and a hash value determination process is performed. When it is determined that the software has not been tampered with, the EMM or ECM is decrypted.

  The processing of the conditional access processor shown in FIG. 3 performs contract reception processing and program reception determination processing in addition to the decryption processing of the conditional access processor shown in FIG. It is difficult to execute illegally rewritten software by calculating whether or not the hash value stored in the non-secret storage area with the software in advance is determined by the secret CPU. This is a conditional access processor characterized by the above system.

  First, data retention will be described. In the non-confidential storage area 106, a decryption processing software 113 obtained by softwareizing a public encryption algorithm such as DES and AES, and a hash value obtained as a result of performing a hash calculation process on the decryption processing software 113 in advance externally 142, contract reception processing software 114 that performs contract reception processing for determining detailed contract conditions, hash value 143 that is a result of performing hash calculation processing on contract reception processing software 114 in advance, Stores reception determination processing software 115 that performs reception determination processing in accordance with detailed contract conditions and whether or not to allow viewing and hash value 144 that is a result of performing hash calculation processing on reception determination processing software 115 in advance. Keep it.

  In the secret storage area 105, a master key Km116 for EMM decryption unique to the conditional access processor and hash calculation processing software 123 for calculating a hash value of software are stored in advance. As described above, since the hash calculation processing software is stored in the secret storage area, the hash calculation processing software is not falsified or decrypted. Therefore, when the decryption processing software is falsified, it is compared with the hash value. Can be detected.

  The limited reception processor 101 includes a secret CPU unit 104 and a secret storage area 105 which are secret areas 102 and a non-secret memory area 106 which is a non-secret area 103.

  In the non-confidential storage area 106, a decryption processing software 113 obtained by softwareizing a public encryption algorithm such as DES and AES, and a hash value obtained as a result of performing a hash calculation process on the decryption processing software 113 in advance externally 142, contract reception processing software 114 that performs contract reception processing for determining detailed contract conditions, hash value 143 that is a result of performing hash calculation processing on contract reception processing software 114 in advance, Stores reception determination processing software 115 that performs reception determination processing in accordance with detailed contract conditions and whether or not to allow viewing and hash value 144 that is a result of performing hash calculation processing on reception determination processing software 115 in advance. Keep it. The secret storage area 105 stores in advance a master key Km116 for EMM decryption unique to the conditional access processor and hash calculation processing software for calculating a hash value of the software. The external signals EMM111 and ECM112 are both signals defined by MPEG2-Systems ISO standard 13818-1. The EMM 111 is a signal that is encrypted using the contract information 119 and the work key Kw118 as data and the master key Km116 as a key. The ECM 112 is encrypted using the program right information and the scramble key Ks121 as data and the work key Kw118 as a key. Signal.

  The secret CPU unit 104 of the conditional access processor 101 reads the decryption processing software 113 and the hash value 142 from the non-confidential storage area 106 and reads the hash value determination processing software 123 from the secret storage area 105. The hash value determination process 135 first calculates a hash value for the decryption processing software 113, and then compares the obtained calculation result with the hash value 142 so that there is no falsification of the decryption processing software 113. Judge that. Further, the contract reception processing software 114 and the hash value 143 are read from the non-secret storage area 106, and the hash value determination processing software 123 is read from the secret storage area 105. The hash value determination processing 135 first calculates a hash value for the contract reception processing software 114, and then compares the obtained calculation result with the hash value 143 so that the contract reception processing software 114 is falsified. Judge that there is no. Further, the reception determination processing software 115 and the hash value 144 are read from the non-secret storage area 106 and the hash value determination processing software 123 is read from the secret storage area 105. The hash value determination processing 135 first calculates a hash value for the reception determination processing software 115, and then compares the obtained calculation result with the hash value 144 to determine whether the reception determination processing software 115 matches. Judge that there is no.

  Next, when the secret CPU unit 104 receives the EMM 111 from the outside, the secret CPU unit 104 reads the master key Km116 from the secret storage area 105, executes the decryption process 131 that has been determined by the hash value determination process 135, and uses the master key Km116 for the EMM111. Decryption is performed to extract the contract information and the work key Kw120. Subsequently, the secret CPU unit 104 executes the contract reception process 132 that has been determined by the hash value determination process 135 to confirm the normality of the contract information, extracts the contract information 119 and the work key Kw118, and stores them in the secret storage area. Store.

  Next, when the secret CPU unit 104 receives the ECM 112 from the outside, the secret CPU unit 104 reads the work key Kw118 from the secret storage area 105, executes the decryption process 131 that has been determined by the hash value determination process 135, and uses the ECM112 as the work key Kw118. Decryption is performed to extract program right information and scramble key Ks121. Subsequently, the concealment CPU unit 104 executes the reception determination process 133 that has been determined by the hash value determination process 135 to determine whether or not to view, retrieves the scramble key Ks122, and scrambles the descramble process 134 in the dedicated calculation area 107. Give the key. The descrambling process 134 using a public encryption algorithm such as ULTI2 or DES descrambles the MPEG transport stream packet using the scramble key Ks122.

  FIG. 4 is an example of a processing flow at the time of EMM reception. When the secret CPU unit 104 of the conditional access processor 101 receives the EMM 111 from the outside, it starts an EMM reception process. Next, the hash value determination processing software 123 is read from the secret storage area 105.

  Next, the decryption processing software 113 and the hash value 142 are read from the non-secret storage area 106. Next, in the hash value determination process, the hash value calculation for the decryption processing software 113 is performed, the comparison result is compared with the hash value 142, and it is determined that the decryption processing software 113 is not falsified.

  Next, the master key Km116 is read from the secret storage area 105, decryption processing is executed, the EMM 111 is decrypted with the master key Km116, and the contract information and the work key Kw120 are extracted. Next, the contract reception processing software 114 and the hash value 143 are read from the non-secret storage area 106.

  Next, the hash value determination process calculates the hash value for the contract reception processing software 114, compares the calculation result with the hash value 143, and determines that the contract reception processing software 114 is not falsified. To do. Next, the contract reception process is executed to confirm the normality of the contract information, and the contract information 119 and the work key Kw 118 are extracted and stored in the secret storage area 106.

  FIG. 5 is an example of a processing flow at the time of ECM reception. When the secret CPU unit 104 of the conditional access processor 101 receives the ECM 112 from the outside, it starts the ECM reception process.

  Next, the hash value determination processing software 123 is read from the secret storage area 105. Next, the decryption processing software 113 and the hash value 142 are read from the non-secret storage area 106. Next, in the hash value determination process, the hash value calculation for the decryption processing software 113 is performed, the comparison result is compared with the hash value 142, and it is determined that the decryption processing software 113 is not falsified. Next, the master key Kw118 is read from the secret storage area 105, decryption processing is executed, the ECM 111 is decrypted with the work key Kw118, and the program right information 121 is extracted.

  Next, the reception determination processing software 115 and the hash value 144 are read from the non-secret storage area 106. Next, the hash value determination process calculates a hash value for the reception determination processing software 115, compares the calculation result with the hash value 144, and determines that the reception determination processing software 115 is not falsified. To do. Next, the reception determination process is executed to determine whether or not the program can be received, the scramble key Ks is extracted, and the scramble key Ks is passed to the descrambling process 122 in the dedicated calculation area 134.

  FIG. 6 is a code example of the reception determination software 115. In FIG. 8, the actual program code is described in an advanced language format for explanation. The secret CPU unit 104 executes processing in accordance with the code of the reception determination software 115.

  In this code example, the secret CPU unit 104 performs the following processing in order. First, receive the ECM using the function “receive” to acquire ECM data, then execute the function “decrypt” to decrypt the ECM using the work key Kw of the secret storage area as an argument, and temporarily store the decryption result in the secret storage area “Temporary” To do. Next, the contract information in the secret storage area is compared with the decryption result to determine whether or not reception is possible.

  FIG. 7 shows an example of the data structure stored in the secret storage area 105. FIG. 9 holds the master key Km 116, the contract information 119, and the work key Kw 118 in the secret storage area 105.

  FIG. 8 shows an example of the data structure conforming to the MPEG standard and ARIB standard as the data structure of EMM111. The header part 261 describes PID, table type, and the like. The receiver ID 262 is an ID for identifying an individual of the conditional access processor 101. The auxiliary information 263 is information related to the pay broadcaster, the key generation, and the like. The contract information 112 and the work key Kw118 are encrypted using the master key Km116. 264 is the encryption range. The contract information 112 is an example including a contract term 265, a list of contracted channels 266 and 267, and a prepaid amount 268. The footer unit 269 includes a CRC check value and stuffing.

  FIG. 9 shows an example of the data structure based on the MPEG standard and the ARIB standard as the data structure of the ECM112. The header part 271 describes PID, table type, and the like. The scramble key Ks122 and the program right information 121 are encrypted using the work key Kw118. 272 is an encryption range. The program right information 121 includes a determination type 273 for identifying free broadcast, pay broadcast, PPV broadcast, etc., current date and time 274 at the time of program broadcast, recording control 275 for specifying whether recording is possible, receiving channel number for determining whether there is a contract It is an example including. The footer unit 277 is a CRC check value, stuffing, or the like.

  FIG. 10 is an example including information different from FIG. 9 as the program right information 121 as the data structure of the ECM 112. The program right information 121 includes a program fee 278 in addition to the determination type 273, the current date and time 274, and the recording control 275. In the reception determination process, when the prepay charge amount 268 is larger than the program fee 278 in the contract information stored in the confidential storage area, the data for determining the reception is possible after reducing the prepay charge amount by the program fee It is an example of a structure.

  According to the present invention, it is possible to detect unauthorized tampering of software that could not be avoided in the conventional software control of the viewing control function, and to prevent execution of unauthorized tampering software.

  In addition, since the present invention can provide a mechanism that makes it difficult to tamper with software, it is not necessary to rely on non-rewritable providing means such as an IC card for a portion that performs cryptographic operations, and the software is not concealed. It can be stored in the storage area.

  By installing the limited reception processor of the present invention having the above-described effects in a digital broadcast receiver, all viewing control functions that operate in the digital broadcast receiver can be made into software. The software that is the viewing control function can be repeatedly expanded using the.

  For this reason, a digital broadcast receiver equipped with the limited reception processor of the present invention is capable of expanding the service by making preparations on the broadcasting station side even if only a simple monthly viewing function is installed at the time of shipment. In addition, by updating the receiving side software together, various viewing control functions such as pay-per-view, paid program preview for a certain period, video on demand, trick play reception, etc. can be performed without replacing the receiving side device. It can be realized.

Configuration diagram of a digital broadcasting system using a conditional access processor Example 1 of configuration diagram of conditional access processor Example 2 of configuration diagram of conditional access processor Processing flow when receiving EMM Processing flow when receiving ECM Program code example for reception judgment software Data structure of the secret storage area EMM data structure ECM data structure 1 ECM data structure 2

Explanation of symbols

101 conditional access processor
102 Secret area
103 Non-confidential area
104 Concealment CPU
105 Secret storage area
106 Storage area
107 Dedicated computation area

Claims (1)

In a content decryption key extraction method for decrypting the received content in a receiving device connected to a center device for transmitting content via a transmission path and receiving encrypted content from the center device,
Decryption processing software that performs decryption processing of encrypted information in the non-confidential storage area and a hash value of the decryption processing software are stored, and the secret storage area is an EMM decryption key indicating contract information for each viewer Stores certain Km and hash value judgment processing software,
Encrypted content, ECM encrypted including Ks that is a decryption key for decrypting the encrypted content, and EMM encrypted including Kw that is a decryption key for decrypting the ECM are received In case,
When the EMM and / or the ECM is received by the secret CPU unit, the hash value determination processing software is read from the secret storage area,
The hash value determination processing software calculates a hash value of the decryption processing software and compares the calculated hash value with a stored hash value to determine whether the decryption processing software has been tampered with. And
When it is determined that it has not been tampered with, the EMM is decrypted with the Km and the decryption processing software,
Extracting the Kw from the EMM;
Store the extracted Kw in the secret storage area,
The content decryption key extraction method, wherein the secret CPU unit decrypts the ECM with the Kw and the decryption processing software and extracts the Ks.

Images