KR100950457B1 - Method of implementing sac protocol for unidirectional mobile device - Google Patents

Abstract

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a digital data broadcasting system, and more particularly, to a service method of a reception restriction system of digital data broadcasting. According to the present invention, a method for implementing a SAC protocol of a CA system including a CAS server and a CAS client, the method comprising: receiving an ECM including an encrypted TEK, decrypting the encrypted TEK, and decrypting the encrypted TEK. Encrypting the TEK in a KMS application mounted on the UICC using a shared session key generated using a public key paired with a private key of the descrambler, and converting the TEK encrypted using the shared session key to the descrambler. And transmitting the public key, wherein the public key is one of public keys of all communicable descramblers stored when the KMS application is mounted on a UICC.

Restriction system, SAC, EMM, ECM, public key, private key, storage, self-generation

Description

How to implement a secure authentication channel protocol for one-way mobile devices {METHOD OF IMPLEMENTING SAC PROTOCOL FOR UNIDIRECTIONAL MOBILE DEVICE}

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a digital data broadcasting system, and more particularly, to a service method of a reception restriction system of digital data broadcasting.

As digitalization of broadcasting has recently progressed, digital data broadcasting services such as digital video broadcasting (DVB) and digital audio broadcasting (Digital Audio Broadcasting) have been in the spotlight. A key technology in digital data broadcasting service is a conditional access system (CAS). CAS is a system that allows only authorized subscribers to use a broadcast service, and means a series of processes that allow each digital broadcast receiver to determine whether or not reception is possible.

The CAS consists of a sender (CAS server) that encrypts and transmits a signal, and a receiver (CAS client) that receives and decrypts the encrypted signal. The CAS server transmits an encryption key necessary for the subscriber who wants to watch the broadcast to the CAS client subscriber through an EMM / ECM message. The EMM / ECM message transmitted from the CAS server is processed by the KDA (Key Management System Device Agent) package of the CAS client, and the broadcast can be viewed by decrypting the encrypted broadcast.

The reason why only subscribers who have the right to view the broadcast is able to watch the broadcast is to deliver the specific EMM only to the subscriber who has purchased the right to watch the broadcast, and these EMMs contain the keys necessary for decryption of the broadcast. The key for encrypting broadcast data is a traffic encryption key (TEK), which is encrypted and transmitted to the ECM.

KMS (Key Management System) applications that operate at the terminal end usually operate in a device such as a universal integrated circuit card (UICC). KMS receives EMM and ECM and performs final authority check and extracts the final TEK. A descrambler for decoding broadcast data operates outside the UICC and receives a TEK, which is a key for decoding a broadcast, from the UICC to decode the broadcast so that the user can view the broadcast. Typically, the descrambler and UICC together with KDA are called KDA packages.

TEK is a very important key as the final broadcast decryption key, which is extracted from the UICC and delivered to the descrambler. In this case, if TEK is transmitted in communication with the descrambler, the risk of eavesdropping and interception is prevented and the descrambler is sent to the outside. You are exposed to risks such as potential exposure. The Secure Authentication Channel (SAC) protocol is defined for secure TEK transfer between UICC and descrambler.

SAC is a protocol for solving the security problems that occur between devices in mobile terminals by communicating only between descramblers authenticated by KMS applications in UICC and encrypting TEK. The basic method is a half-certified Diffie-Hellman (Half-Certified Diffie-Hellman) asymmetric key exchange mechanism that exchanges the session key between two devices and encrypts it with the exchanged key when passing the TEK. The descrambler must have a semi-authenticated Diffie Hellman private key and the KMS application in the UICC must have the descrambler's public key. In addition, the descrambler has a unique ID for each application (manufacturer) and has a different public and private key pair for each application. In the related art, a corresponding ID and a public key information should be registered in a broadcast server by the descrambler manufacturer. When the KMS application in UICC starts SAC to communicate with the descrambler, if there is no public key corresponding to the descrambler ID, the server must request it and obtain it. Because it is not restricted by the terminal due to the characteristics of the UICC, that is, the UICC can be plugged into any other terminal at any time to communicate with a descrambler developed by various manufacturers, thereby enhancing security by having a CAS server / client communicate with a descrambler certified by the CAS. To do this.

In the prior art as described above, when the KMS application in the UICC does not have a public key corresponding to the descrambler ID of the current terminal, it should be received by requesting the broadcast server. At this time, if the terminal has a bidirectional channel to communicate with the broadcast server, it can be easily received using the protocol promised in advance with the server. However, the terminal does not have a bidirectional channel has the following problems.

First, the public key must be received by other means, such as a telephone or the web, in addition to the terminal. Since you cannot communicate directly with the server using a terminal, you will need to use other means, such as calling a call center or using a web portal. This causes difficulties for subscribers, and there is a difficulty in adding additional equipment and personnel even from a server operator's point of view.

Second, it should be aware that the public key for the descrambler does not exist and contact the broadcast server to request it and wait until it is delivered through the broadcast network.

Third, in the case of a message for a one-way terminal, the terminal cannot confirm receipt of the message to the server side, and therefore, the server side must periodically send the message periodically for a certain period of time. If you send messages for different types of descramblers and multiple subscribers, the load on the broadcasting network is greatly increased.

It is an object of the present invention to provide a method for implementing an improved SAC protocol for a unidirectional mobile terminal.

According to an aspect of the present invention, in the SAC protocol implementation method of the reception restriction system including a CAS server and a CAS client, receiving an ECM including an encrypted TEK, decrypting the encrypted TEK, Encrypting the decrypted TEK in a KMS application mounted in a UICC using a public key paired with a descrambler's private key, and transmitting the TEK encrypted using the public key to a descrambler; The public key is provided with a method for implementing a SAC protocol, which is one of public keys of all communicable descramblers stored when the KMS application is mounted on a UICC.

According to another aspect of the present invention, in the SAC protocol implementation method of the CA system including a CAS server and a CAS client, receiving an ECM including an encrypted TEK, decrypting the encrypted TEK, There is provided a SAC protocol implementation method comprising generating a public key paired with a descrambler's private key, and delivering a TEK encrypted using the public key to the descrambler.

Generating the public key may use the descrambler ID.

The SAC protocol implementation method may further include delivering an additional SEED value, and generating the public key may further use the additional SEED value.

The SAC protocol implementation method may further include receiving a list of communicable descrambler IDs.

According to the configuration of the present invention can achieve all the objects of the present invention described above. Specifically, SAC can be effectively implemented in a unidirectional mobile terminal because all IDs and public keys of all descramblers that can communicate with the UICC are stored, or the public keys are derived by using the descrambler IDs and additional SEED values. In other words, when a KMS application in UICC starts a SAC with a descrambler, the unidirectional terminal communicates with the descrambler itself without requesting the public key for the descrambler ID, so that the user can watch the broadcast at any time. The cost for delivery can be reduced.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 1, the reception restriction system 10 includes a CAS server 20, a CAS client 30, and a descrambler issuing system 100. The CAS server 20 includes a KMS 22 and a scrambler 24. KMS 22 sends an encrypted ECM 50 containing TEK to KDA 34 of CAS client 30. The scrambler 24 encrypts the broadcast data using the TEK and transmits the encrypted broadcast data 60 to the descrambler 38 of the CAS client 30.

The CAS client 30 is installed in a mobile terminal having a unidirectional channel and has a KDA package 32. The KDA package 32 includes a KDA 34, a UICC 36, and a descrambler 38. The KDA 34 receives the ECM 50 from the KMS 22 of the CAS server 10 and sends it to the UICC 36. The UICC 36 stores KMS applications, IDs of all descramblers that can communicate, and public keys. If a new descrambler manufacturer is created and wants to register it with the broadcasting server, the UICC of existing subscribers needs to be updated. However, it is most efficient if no new descrambler manufacturers are created. The descrambler 38 has an ID and a private key, and receives the TEK securely from the UICC 60 through the SAC.

The descrambler issuing system 100 generates a public key and a private key corresponding to a descrambler ID and manages them in a broadcast server provider, and delivers the private key to a descrambler manufacturer so that the KMS application can be safely stored in the descrambler application. When loaded into the server, it stores the public key and ID for all descramblers.

2 illustrates a step-by-step method for implementing SAC using the system of FIG. 2, receiving the ECM (S10), decrypting the ECM (S20), encrypting the TEK (S30), transmitting the encrypted TEK (S40), and encryption And decrypting the obtained TEK (S50). In step S10 of receiving the ECM, the UICC (36 in FIG. 1) receives the encrypted ECM from the KDA (34 in FIG. 1). In the step of decrypting the ECM (S20), the TEK is obtained by decrypting the ECM encrypted through the KMS application. In step S30 of encrypting the TEK, the TEK is encrypted using a shared session key generated using the public key stored in the UICC 36 in pairs with the private key of the descrambler 38. In step S40 of transmitting the encrypted TEK, the encrypted TEK is transmitted to the descrambler 38 in the UICC 36. In the step S50 of decrypting the encrypted TEK, the descrambler 38 decrypts the encrypted TEK received using the shared session key generated between the UICCs 36.

Referring to Fig. 3, the reception restriction system 10a includes a KMS 22a, a scrambler 24a, and a key generation module 26a. KMS 22a delivers a descrambler ID list 60a that is capable of communicating with encrypted ECM 50a including TEK to KDA 34a of CAS client 30a. The scrambler 24a encrypts the broadcast data using the TEK and transmits the encrypted broadcast data to the descrambler 38a of the CAS client. The key generation module 26a generates a private key and a public key pair with unique generation rules using the descrambler ID and the additional SEED value. Only the descrambler ID can be used to generate a key pair. Although the descrambler ID is unique, its size is not large enough to generate a public key and a private key, or an additional key SEED value is used for security purposes. In this case, an additional SEED value is also transmitted along with the communicable descrambler ID list 60a. The additional SEED value may be different for each descrambler ID or all the same. Otherwise, add a SEED value when sending a message notifying that additional communicable descramblers are registered on the server. The private key is stored in the descrambler 38a of the CAS client 30a.

The CAS client 30a has a KDA package 32a. The KDA package 32a includes a KDA 34a, a UICC 36a, and a descrambler 38a. The KDA 34a receives the ECM 50a and the communicable descrambler ID list 60a and the additional SEED from the CAS server 20a and delivers them to the UICC 36a. Of these pieces of information, all descrambled ID lists 60a that can be communicated must be delivered first, and if additional SEED values are used, they must also be sent together. When joining, it sends both the list of authorized descrambler IDs and the SEED value, and if added, sends the added ID list to the network for a certain period of time. If this is added, there may be load of broadcasting network, but ID is much smaller than public key, so it is much more efficient than delivering one by one upon request.

The UICC 36a includes a key generation module 39a with a KMS application. SAC is implemented through KMS applications. The key generation module 39a generates a public key using the descrambler ID provided from the descrambler 38a and the additional SEED value transmitted through the KDA. The generated public key is paired with the private key stored in the descrambler. It is stored in order not to generate a new one later.

4 illustrates a step-by-step method for implementing SAC using the system of FIG. 4, receiving an ECM (S100), decoding an ECM (S200), receiving an additional SEED value (S300), generating a public key (S400), and TEK Encrypting (S500), transferring the encrypted TEK (S600), and decrypting the encrypted TEK (S700). In step S100 of receiving an ECM, the UICC (36a of FIG. 3) receives an encrypted ECM from KDA (34a of FIG. 1). In the step of decrypting the ECM (S200), the ECM encrypted through the KMS application is decrypted. In step S300 of receiving an additional SEED value, the UICC (36a of FIG. 3) receives an additional SEED value transmitted from KDA (34a of FIG. 1) to generate a public key. In the step of generating the public key (S400), the key generation module (39a of FIG. 3) uses the CAS server (FIG. 3) by using the descrambler ID of the descrambler (38a of FIG. 3) and the additional SEED value. The public key is generated in the same manner as in the key generation module (26a in FIG. 3) of 20a of 3). In the step of encrypting the TEK (S500), the TEK is encrypted using the public session generated by the key generation module (36a of FIG. 3) and the shared session key generated using the private key of the descrambler (38a of FIG. 3). do. In step S600 of transmitting the encrypted TEK, the encrypted TEK is transferred to the descrambler 38a of FIG. 3 in the UICC (36a of FIG. 3). In step S700 of decrypting the encrypted TEK, the descrambler (38a of FIG. 3) receives the encrypted TEK received using the shared session key generated using the private key and the public key of the UICC (36a of FIG. 3). Will be decrypted.

Although the present invention has been described with reference to the above embodiments, the present invention is not limited thereto. It will be apparent to those skilled in the art that modifications and variations may be made without departing from the spirit and scope of the invention, and that such modifications and variations are also contemplated by the present invention.

1 is a block diagram schematically showing the structure of a reception restriction system according to an embodiment of the present invention.

FIG. 2 is a flowchart illustrating a method of implementing a SAC protocol using the system of FIG.

Figure 3 is a block diagram schematically showing the structure of a reception restriction system according to another embodiment of the present invention.

4 is a flowchart illustrating a step-by-step method of implementing a SAC protocol using the system of FIG.

Claims (5)

When the KMS (Key Management System) application is mounted on a Universal Integrated Circuit Card (UICC), the KDA (Key) of a unidirectional mobile terminal equipped with a UICC that stores IDs and public keys for all descramblers received from the descrambler issuing system. Receiving, at a Management System Device Agent), an encrypted Entitlement Control Message (ECM) from a Conditional Access System (CAS) server; Obtaining a Traffic Encryption Key (TEK) by decrypting the encrypted ECM in the UICC that has received the encrypted ECM through the KDA; Encrypting the TEK by using a public key corresponding to an ID of a descrambler mounted on the unidirectional mobile terminal by a KMS application mounted on the UICC; Passing the encrypted TEK to the descrambler; And decrypting the encrypted TEK using the private key in the descrambler. Receiving an encrypted Entitlement Control Message (ECM) and a list of descrambler IDs for descramblers that can communicate with additional SEED values from a Conditional Access System (CAS) server in a Key Management System Device Agent (KDA) of a unidirectional mobile terminal. Wow; Obtaining a Traffic Encryption Key (TEK) by decrypting the encrypted ECM in the Universal Integrated Circuit Card (UICC) receiving the encrypted ECM through the KDA; Generating a public key using the descrambler ID and the additional SEED value when there is an ID of the descrambler mounted in the unidirectional mobile terminal in the descrambler ID list in the key generation module mounted in the UICC; Wow; Encrypting the TEK by using a KMS application mounted on the UICC using the public key; Passing the encrypted TEK to the descrambler; And decrypting the encrypted TEK using the private key in the descrambler. 3. The method according to claim 2, wherein the additional SEED value and the descrambler ID list are delivered before the encrypted ECM. The method of claim 2, wherein the key generation module mounted in the UICC stores the public key generated using the additional SEED value and the ID of the descrambler. The method of claim 2, wherein the private key used to decrypt the encrypted TEK is generated and delivered with a public key using an additional SEED value and a descrambler ID in a key generation module mounted on the CAS server. SAC protocol implementation method for unidirectional mobile terminals.

Images