KR20090045769A - Security device and method for conditional access system and set-top-box - Google Patents

Abstract

Disclosed are a security apparatus and method for a Conditional Access System (CAS) and a Set-Top-Box (STB). The security apparatus receives an entitlement control message (ECM) from an STB to obtain a control word (CW) included in the ECM and a CA using a CW to access encrypted content further received from the STB. It includes a CA descrambler for decoding.

Conditional Access System (CAS), Set-Top-Box (STB), Entitlement Control Message (ECM), Entitlement Management Message (EMM), Control Word (CW)

Description

SECURITY DEVICE AND METHOD FOR CONDITIONAL ACCESS SYSTEM AND SET-TOP-BOX

The present invention relates to a security apparatus and method for a conditional access system (CAS) and a set-top-box (STB).

CAS (Conditional Access System) is a device that allows a user's digital receiver to determine whether or not a specific broadcast program can be received.It is intended to allow only those who pay a reasonable license fee to watch the program. to be. The CAS encrypts the content so that the content can be played only in a specific receiver and a scrambling technology that mixes data such as voice and video to protect the content from unauthorized reception. It consists of encryption technology that decrypts through) and user service support function to provide various types of services to users based on this. In the past, CAS used a fixed descrambler device that stores a decryption algorithm and a secret key, but recently, a secret card is applied to a user with a smart card with unique personal information of the subscriber in consideration of billing, convenience, and stability. Delivering is generalized.

In the prior art, the encrypted content is decrypted using CW in the STB (Set-Top-Box) provided with the appropriate CAS decryption key CW (Control Word) and DRM re-encryption key CEK (Contents Encryption Key) from the smart card. The content was reproduced and re-encrypted and stored using CEK.

The present invention is a security device and method that can improve the security of the content by using a tamper resistance module (tamper resistance module) security device so that the content is always encrypted and transmitted, and STB (Set-Top-Box) ).

The present invention provides a security device, a method and an STB that can improve the security of the content by transmitting the content encrypted in the CAS (Conditional Access System) is decrypted in the security device, re-encrypted content to the player .

The present invention provides a STB that is generalized by interworking with the security device that acquires and processes a control word (CW) and a license, and the security device.

The present invention provides a security device that can increase portability by storing the license and re-encrypted content.

The security device according to an embodiment of the present invention receives an Entitlement Control Message (ECM) transmitted from a CAS and obtains an encrypted content received from a CA (Conditional Access agent) and an STB that obtains a CW included in the ECM. It includes a CA descrambler (Conditional Access descrambler) to decrypt using a CW.

According to an aspect of the invention, the ECM may further include a Contents Encryption Key (CEK) for the encrypted content, the security device to re-encrypt the decrypted content using the CEK, storage device The transmission may further include a DRM scrambler. The security device may further include a storage device in which the re-encrypted content is stored.

According to an aspect of the present invention, the security device further receives a license transmitted from a Digital Rights Management (DRM) license server to obtain a CEK included in the license and a DRM agent based on the CEK and stored in a storage device based on the CEK. The apparatus may further include the DRM descrambler that decrypts the encrypted content.

According to an aspect of the present invention, the security device further comprises an authentication unit for sharing the re-encryption key through authentication with the player and a re-encryption unit for re-encrypting the decrypted content through the re-encryption key to the player. It may include.

The STB according to an embodiment of the present invention includes a transmission unit for transmitting the encrypted content received through the network to the security device and a player for playing the content received from the security device. In this case, the security device may re-encrypt the content decrypted through CW to CEK, and the STB may further include a storage device for receiving and storing the re-encrypted content from the security device.

A security method according to an embodiment of the present invention includes receiving an ECM transmitted from a CAS, receiving an encrypted content from an STB, and decrypting the encrypted content based on a CW included in the ECM. do. In this case, the ECM may further include a CEK for the encrypted content, and the security method may further include re-encrypting the decrypted content using the CEK and transmitting the same to the storage device.

Hereinafter, various embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

1 is an example illustrating an overview of a security system including a CAS. Here, the security system 100 is an example used to describe the overall process of transmitting and playing content.

The DRM license server 101 generates a Contents Encryption Key (CEK) corresponding to the broadcasted content and transmits it to the Conditional Access System (CAS) 102. The CAS 102 transmits an Entitlement Control Message (ECM) including a Control Word (CW) and the CEK to the CA scrambler 103, and the CA scrambler 103 encrypts the content to broadcast the encrypted content. The network 104 can be transmitted to the Set-Top-Box 105 and the ECM can be sent to the security device 106.

Here, a scrambler is a general example. It prevents loss of timing information among consecutive input data and suppresses cross-modulation in a transmission path by suppressing a single frequency component generated by repeating a periodic data pattern. In order to convert the input data into a random code sequence, the receiver may reproduce the original data signal from the converted input data using a 'descrambler' having an opposite calculation function. That is, the CA scrambler 103 may be included in the CAS 102 or configured as a separate device to convert and encrypt the input data which is the content.

In addition, the CAS 102 may generate an Entitlement Management Message (EMM) and transmit it to the security device 106. The EMM is a component of the CAS 102 that is a paid subscriber management device. The EMM may refer to information that encrypts and transmits a qualification that can be received in a paid broadcasting channel for each receiver. In general, CAS 102 typically utilizes two messages, the EMM and the ECM. That is, the CAS 102 encrypts and receives a credible for each receiver such as the STB 105 using the EMM. The EMM is decrypted when it matches a unique number of the security device 106, such as a receiver integrated circuit (IC) card, so that an intermediate key can be obtained, and thus can be controlled by the receiver in a central management center. In addition, the CAS 102 encrypts the CW using the ECM and transmits the CW to the receiver.

In other words, the STB 105 receives the encrypted content and transmits the encrypted content to the security device 106, and the security device 106 decrypts the ECM with an intermediate key included in the EMM received from the CAS 102. CW can be obtained. At this time, the security device 106 may decrypt the bit flow of the content encrypted using the CW using the descrambler described above, thereby converting and receiving the content into a normal bit flow form. In addition, the security device 106 may re-encrypt the decrypted content and transmit it to the STB 105, and the player may decrypt the re-encrypted content so that the content can be safely played back.

The security system 100 described with reference to FIG. 1 is an example of a security method performed by the STB 105, the security device 106, or the security device 106 according to an embodiment of the present invention. The present invention is provided only for better understanding, and the present invention is not limited to the above embodiments, and various modifications and variations can be made by those skilled in the art to which the present invention pertains.

Hereinafter, an STB, a security device, and a method according to various embodiments of the present disclosure will be described in more detail with reference to FIGS. 2 to 4.

2 is a block diagram illustrating an internal configuration of a security device according to an embodiment of the present invention. First, the DRM license server 210 generates a CEK for the content and transmits it to the CAS 220, and the CAS 220 encrypts the content using a CA scrambler (not shown). In this case, the CAS 220 may generate an ECM including the CEK and the CW for decrypting the encrypted content, transmit the generated ECM to the security device 200, and transmit the encrypted content to the STB 230. In addition, the encrypted content may be transmitted from the STB 230 to the security device 200. As shown in FIG. 2, the security device 200 includes a CA (Conditional Access Agent) 201, a CA descrambler 202, a DRM scrambler 203, a storage device 204, a DRM agent 205, and a DRM. It may include a descrambler 206, an authentication unit 207, and a re-encryption unit 208.

The CA agent 201 receives the ECM transmitted from the CAS 220 and obtains a CW included in the ECM. In this case, the CA agent 201 may acquire the CW by decrypting the ECM using the EMM received with the ECM as described with reference to FIG. 1.

The CA descrambler 202 decrypts the encrypted content received from the STB 230 using the CW. As described above, the STB 230 receives the encrypted content through the CAS 220 or the CA scrambler, and transmits the received encrypted content to the security device 200. That is, the CA descrambler 202 may decrypt the encrypted content received from the STB 230 based on the CW acquired by the CA agent 201 and transmit the decrypted content back to the STB 230 to be played by the player. .

In this case, the security device 200 may further re-encrypt the decrypted content using the re-encryption key and transmit the same to the STB 230 to further improve stability of the content. As described above, a method of re-encrypting and transmitting the decrypted content to the STB 230 will be described in detail later through the authenticator 207 and the re-encryption unit 208.

Here, the ECM may further include a CEK for the encrypted content, and the DRM scrambler 203 may re-encrypt the decrypted content using the CEK and transmit the encrypted content to the storage device 204. In other words, the re-encrypted content is stored in the storage device 204. In this case, the storage device 204 may be included in the security device 200 as shown in FIG. 2, or may be included in another device such as the STB 230. When the storage device 204 is included in the security device 200, the license and re-encrypted content, which will be described later, may be stored together in the security device 200, thereby increasing portability. That is, in any STB in which the content is not stored, the content can be replayed only by carrying the security device 200 without re-receiving the content.

The DRM agent 205 receives a license transmitted from the DRM license server 210 to obtain a CEK included in the license. As described above, since the decrypted content has been re-encrypted by the CEK included in the ECM, the security device 200 uses the DRM agent 205 in the DRM license server 210 to reproduce the re-encrypted content. Obtain a license and obtain a CEK that the license includes.

As described above, since the security device 200 according to the embodiment of the present invention includes the AC agent 201 and the DRM agent 205 in the security device 200 instead of the STB 230, the generalization of the STB 230 may be performed. It becomes possible. In other words, since the security device 200 receives the ECM, the EMM, and the license and decrypts the content encrypted by a specific DRM, the content can be played without a specific player, thereby enabling the generalization of the STB 230. Therefore, the user can reproduce the contents in any STB only by carrying the portable security device 200.

The DRM descrambler 206 decrypts the re-encrypted content stored in the storage 204 based on the CEK. In other words, the DRM descrambler 206 decrypts the re-encrypted content based on the CEK included in the license, so that the security device 200 transmits the decrypted content to the STB 230 to reproduce the content. You can do that. At this time, the decrypted content transmitted to the STB 230 may be re-encrypted again through the re-encryption key and transmitted to the STB 230 as described above.

The authentication unit 207 shares the re-encryption key through authentication with the player, and the re-encryption unit 208 re-encrypts the decrypted content through the re-encryption key and transmits it to the player. That is, when the content decoded through the CW or CEK in the CA descrambler 202 or the DRM descrambler 206 is transmitted to the STB 230 without any action, a problem may occur in which the content is exposed in a defenseless state. Accordingly, the security apparatus 200 re-encrypts and transmits the decrypted content through the re-encryption key shared with the player using the authentication unit 207 and the re-encryption unit 208, and the player shares the shared information. By decrypting and reproducing the re-encrypted content through the re-encryption key, the decrypted content may not be exposed to the outside.

3 is a block diagram illustrating an internal configuration of an STB according to an embodiment of the present invention. Here, the STB 300 may be linked with the security device 200 described with reference to FIG. 2. In this case, the STB 300 may include a transmitter 310 and a player 320 as shown in FIG. 3.

The transmitter 310 transmits the encrypted content received through the network to the security device. In this case, the network may be a broadcast network, and the encrypted content may be encrypted in a CAS.

The player 320 plays the content received from the security device. In this case, the content may be re-encrypted and received by the re-encryption key in the security device, and the player 320 may play the content with the security device as shown in FIG. 3 to reproduce the received content. An authentication unit 321 sharing the re-encryption key through authentication, a decryption unit 322 for decrypting the re-encrypted content using the re-encryption key, and a playback unit 323 for reproducing the decrypted content. It may include.

That is, when the decrypted content is directly transmitted to the STB 300 by the security device, since the decrypted content may be exposed to the outside, the security device is shared by the player 320 and the authenticator 321. The encrypted content is re-encrypted with the re-encryption key and transmitted to the STB 300, and the player 320 decrypts the re-encrypted content using the re-encryption key in the decryption unit 322, thereby reproducing the content. In operation 323, the decoded content may be played.

Here, the player 320 may be included in the STB 300 as shown in FIG. 3, or may be configured as a separate device from the STB 300 and interlocked with the STB 300.

In addition, the STB 300 may further include a storage device (not shown). That is, the security device may re-encrypt the content decrypted through CW through CEK to transmit to the STB 300, and the STB 300 may store the re-encrypted content in the storage device. That is, in FIG. 2, the re-encrypted content is stored in the storage device 204 included in the security device 200, but the content of the re-encrypted content is too large or is intended to be used only in a specific STB. It may be stored in the storage device 300 includes.

4 is a flowchart illustrating a security method performed by a security apparatus according to an embodiment of the present invention.

In step S401, the security device receives the ECM transmitted from the CAS. In this case, the security device may receive the ECM directly through a network or through an STB. The security device may further receive an EMM transmitted from the CAS to decrypt the ECM and obtain a CW included in the ECM.

In step S402, the security device receives encrypted content from the STB. In this case, the encryption of the encrypted content may be performed by a CA scrambler included in or linked to the CAS. As such, the encrypted content may be transmitted to all corresponding STBs through a broadcast network, and the STB may transmit the encrypted content to the security device again.

In step S403, the security device decrypts the encrypted content based on the CW included in the ECM. In this case, the security device may obtain the CW by decrypting the ECM through the EMM, and may decrypt the encrypted content through the CW. The decrypted content may be immediately transmitted to the player or the STB including the player, but may be re-encrypted and transmitted to prevent the decrypted content from being exposed to the outside. This re-encryption will be described in more detail later.

Steps S401 to S403 may be steps performed by the security device to play the encrypted content broadcasted. Thereafter, step S404 may be performed by the security device to re-encrypt and store the decrypted content, and S405 and S406 may be performed by the security device to replay the stored re-encrypted content. .

In step S404, the security device re-encrypts the decrypted content using the CEK, and transmits it to the storage device. Here, the CEK may be included in the ECM and transmitted to the security device together with the ECM. In more detail, the CEK is a key generated by the DRM license server for the broadcasted content, and the CAS that receives the CEK from the DRM license server may generate and transmit the ECM including the CEK. That is, the security device may receive the ECM as in step S401, and may re-encrypt the decrypted content through the CEK included in the ECM.

In step S405, the security device receives a license transmitted from the DRM license server to obtain a CEK included in the license. That is, in order to reproduce the re-encrypted and stored content, it is necessary to decode the re-encrypted content through the CEK included in the license.

In step S406, the security device decrypts the re-encrypted content stored in the storage device based on the CEK. As such, the content decrypted based on the CEK may be directly transmitted to the player or the STB, but may be re-encrypted and transmitted.

That is, when the content decrypted by the CW or the CEK is directly transmitted to the player or the STB in step S403 or step S406, the decrypted content may be exposed to the outside, so that the decrypted content may be exposed to the outside. Decryption and transmission of the content, and decryption of the re-encrypted content in the player, so that the decrypted content can be played back.

To this end, the security device shares the re-encryption key through authentication with the player (not shown) and re-encrypts the decrypted content through the re-encryption key and transmits it to the player (not shown). It may further include.

As described above, the present invention has been described by specific embodiments such as specific components and the like, but the embodiments and drawings are provided only to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and all the things that are equivalent to or equivalent to the claims as well as the following claims will belong to the scope of the present invention. .

1 is an example illustrating an overview of a security system including a CAS.

2 is a block diagram illustrating an internal configuration of a security device according to an embodiment of the present invention.

3 is a block diagram illustrating an internal configuration of an STB according to an embodiment of the present invention.

4 is a flowchart illustrating a security method performed by a security apparatus according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

101: DRM license server

102: Conditional Access System

103: CA scrambler

105: set-top-box

106: security device

201: CA Agent

202: CA descrambler

203: DRM scrambler

204: storage device

205: DRM Agent

206: DRM descrambler

Claims (12)

A CA agent which receives an Entitlement Control Message (ECM) transmitted from a Conditional Access System (CAS) and obtains a Control Word (CW) included in the ECM; And CA descrambler that decrypts encrypted content received from a set-top-box (STB) using the CW Security device comprising a. The method of claim 1, The ECM further includes a Contents Encryption Key (CEK) for the encrypted content, A DRM scrambler for re-encrypting the decrypted content using the CEK and transmitting it to a storage device The security device further comprising. The method of claim 2, Storage device that stores the re-encrypted content The security device further comprising. The method of claim 1, A DRM agent receiving a license transmitted from a digital rights management (DRM) license server to obtain a CEK included in the license; And The DRM descrambler for decoding re-encrypted content stored in a storage device based on the CEK The security device further comprising. The method according to claim 1 or 4, An authentication unit for sharing the re-encryption key through authentication with the player; And Re-encryption unit for re-encrypting the decrypted content through the re-encryption key to transmit to the player The security device further comprising. A transmission unit for transmitting the encrypted content received through the network to the security device; And A player that plays content received from the security device STB comprising a. The method of claim 6, The content is re-encrypted and received by the re-encryption key in the security device, The player, An authentication unit for sharing the re-encryption key through authentication with the security device; A decryption unit for decrypting the re-encrypted content using the re-encryption key; And Playback unit for playing the decrypted content STB comprising a. The method of claim 6, The security device re-encrypts the content decrypted through CW with CEK, A storage device for receiving and storing the re-encrypted content from the security device STB comprising more. Receiving an ECM transmitted from the CAS; Receiving encrypted content from the STB; And Decrypting the encrypted content based on the CW included in the ECM Security method comprising a. The method of claim 9, The ECM further comprises a CEK for the encrypted content, Re-encrypting the decrypted content using the CEK and transmitting the decoded content to a storage device; The security method further comprising. The method of claim 9, Receiving a license transmitted from a DRM license server to obtain a CEK included in the license; And Decrypting the re-encrypted content stored in the storage device based on the CEK The security method further comprising. The method according to claim 9 or 11, Sharing the re-encryption key through authentication with the player; And Re-encrypting the decrypted content through the re-encryption key and transmitting it to the player The security method further comprising.

Images