KR20090058400A - Downloadable contents security system and downloadable contents security method - Google Patents

Abstract

A downloadable contents security system and a downloadable contents security method are provided to avoid dependence of a system. Contents are downloaded. An image about the contents is encoded. An electronic sign is performed about the encoded contents. The contents are uploaded in a contents headend download server.

Description

Downloadable Contents Security System and Downloadable Contents Security Method}

Embodiments relate to a downloadable content security system.

Existing reception restriction system was burdened by service provider due to specific system dependence and high construction and operation cost, and it did not consider PVR (Personal Video Recorder) service and Home Network service. .

The embodiment solves the problems of CableCard, for example, price increase, sole vendor, technical problem, etc., and is suitable for the next generation broadcasting communication environment of home network, CAS (Conditional Access System), DRM (Digital Rights Management: To provide a downloadable content security system with an integrated environment for digital rights management).

The downloadable content security system according to the embodiment is characterized in that the content can be downloaded openly from the content headend to the content host.

In addition, the downloadable content security method according to the embodiment is characterized in that the content can be downloaded openly from the content headend to the content host.

According to the downloadable content security system according to the embodiment, the dependency of the system can be avoided.

Further, according to the embodiment, bidirectional data processing is possible, and download history management of the user is possible.

In addition, the cost of the cable card hardware (Cable Card HW) of the reception restriction system in the prior art is about $ 30 per STB (Set Top Box), etc., the effect of cost reduction by the software (SW) method according to the embodiment There is.

In addition, according to the embodiment there is an advantage that the upgrade is easy.

In addition, the embodiment can be applied to an IPTV system in addition to the digital cable broadcasting system.

Hereinafter, a downloadable content security system according to an embodiment will be described in detail with reference to the accompanying drawings.

(Example)

1 is a block diagram of a downloadable content security system according to an embodiment.

The downloadable contents security system according to the embodiment includes a downloadable contents server system (200) and a content host serving in conjunction with a server convergence (MSO) 100. (Host) 300 may be included.

The headend (see FIG. 2) in the embodiment may be a concept including a server convergence server system (MSO) 100 and a downloadable content server system 200.

In an embodiment, the downloadable content server system 200 may be a downloadable CAS (DCAS) server system 200, but is not limited thereto.

In addition, in an embodiment, the content host 300 may be the DCAS host 300, but is not limited thereto.

In an embodiment, the content host 300 should flexibly interwork with not only the DCAS server system 200 but also a reception restriction system of SOs.

In an embodiment, the DCAS server system 200 includes an Authentication Proxy Server (AP), a DCA Provisioning Server (DPS), a Local Key Server (LKS), a Personalization Server (PS), and an O & M (O & M) system that operates and manages them. It may include.

2 is a detailed view of a headend in the downloadable content security system according to an embodiment. Hereinafter, the AP, DPS, LKS, PS, MSO Manager, etc. of the headend will be described in detail in the embodiments.

First, in the embodiment, the AP (Authentication Proxy Server) directly communicates with the DCAS Host 300, PS, DPS, LKS, and Trusted Authorities, and serves as a proxy for transmitting and receiving messages (Secure Micro) (FIG. 2). /) Perform authentication for PS.

Next, in the embodiment, the Local Key Server (LKS) performs authentication processing for the SM, AP, and PS, and performs key management for image encryption processing.

Next, the Personalization Server (PS) performs a function of providing a CAS, DRM, or Authorized Service Domain (ASD) image to the SM, and processes encryption and digital signature on the image to be downloaded.

Next, the Downloadable Provisioning System (DPS) manages host information and image information registered through the MSO Manager and manages an image distribution policy. In addition, based on the registered policy, the image distribution information is generated and distributed to the AP, and the host determines the image details to download.

Next, in an embodiment, the MSO Manager is an application that the administrator manages host information and image information in association with the DPS, and manages a policy for image distribution. Images and policies registered through MSO Manager are distributed by DPS.

Next, in the embodiment, the DCAS System Manager is a system that configures the configuration of the DCAS Server, monitors the processing status of the DCAS service, and reports it to the administrator. The system monitors the operation of the system and allows the administrator to take action according to the error that occurs. It may include a reporting function.

Hereinafter, a detailed function of the DCAS host 300 will be described with reference to FIG. 1.

In an embodiment, the DCAS host 300 may include an embedded STB (eSTB) and a secure micro (SM).

First, in an embodiment, an embedded STB may include a DCAS Manager (not shown). DCAS Manager is DCAS Host Software that manages all DCAS functions in DCAS Host 300. It plays a role of routing, filtering, and queuing all DCAS messages to and from SM.

Next, in the embodiment, the SM may include a DCAS Manager (not shown), a DCAS Monitor (not shown), an SM bootloader (not shown), a secure download (not shown), a DRM client (not shown), and the like. have.

First, DCAS Monitor monitors DCAS Messages while the CAS client is running on Secure Micro, and routes DCAS Messages to the DCAS Manager or SM Bootloader.

Next, SM bootloader is one of the logical firmware of SM (Secure Micro) to boot SM and load SM Client into Secure RAM.

Next, Secure Download performs the process of verifying the downloaded image, separates the signature, and decrypts the encrypted image and loads it into Secure RAM.

Next, the DRM client issues a Local License based on the DRM message, and checks the validity of the license of the corresponding content to enable PVR and re-play of the content. For example, the DRM Client receives the DRM message from the DCAS Monitor and stores it, and issues a Local License for the content during PVR. In addition, the DRM client checks and determines the validity of the license at the time of PLAY based on information such as the number of license usage and the period of license usage, and generates and manages an encryption key according to an encryption algorithm.

(First embodiment)

3 is a flowchart of downloading content images in the downloadable content security system according to the first embodiment.

For example, FIG. 3 is a process of loading an image to a download server in order to download the image from the PS to the DCAS Host.

In the first embodiment, downloading content in an open manner may include downloading the content, encrypting an image of the content, performing an electronic signature on the encrypted content, and uploading the content to a download server of the content headend. It may include.

Specifically, the PS searches for and downloads original CAS, DRM, and ASD images registered in the file system. After that, a secret key is generated to encrypt the downloaded image.

After that, the image is encrypted with the generated secret key. Thereafter, digital signature is performed on the image encrypted with the PS's private key.

Thereafter, the electronically signed image is uploaded to the download server. The secret key is encrypted with the SM Public Key and transmitted to the DCAS Host.

In addition, in the first embodiment, the downloaded content includes two or more of CAS, DRM, and ASD (Authorized Service Domain), generates an integrated image for the downloaded content, encrypts the integrated image, and encrypts the encrypted content. The digital signature may be performed on the integrated image, and then uploaded to the download server of the content headend.

(2nd Example)

4 is a flowchart for storing a content image in a storage in the downloadable content security system according to the second embodiment.

For example, FIG. 4 is a procedure for loading an image into Secure Storage after downloading the image to the DCAS Host.

In the second embodiment, downloading the content in an open manner may include performing designing for the sender to verify the downloaded content, decoding the downloaded content image, and decoding the decrypted content image. Storing in the secure storage of the content host.

Specifically, the integrity of the image downloaded from Secure Micro of DCAS Host is verified. Subsequently, designing is performed to check the sender with the public key of the PS. Thereafter, the image decryption key is extracted with the SM's private key, and the image decryption is performed with the decryption key.

After saving the image to Secure Flash, check the update field. After that, reboot by executing System Init.

After that, copy the image from the backup area of Secure Flash to the image area and delete the existing image. The image can then be loaded into Secure Storage, for example Secure Ram.

(Third Embodiment)

5 is a structure of a content image file in the downloadable content security system according to the third embodiment.

According to a third embodiment, in the step of downloading the content in an open manner, an integrated image may be downloaded when the content image is first downloaded.

The content image file to be downloaded in the third embodiment may include an image header including information on the downloaded image and image data which is the content of the image. In addition, the downloaded content image file may further include Signature data required for verification request.

Specifically, the download content image basically includes one SM Client image (CAS or DRM or ASD), but in the case of the first SM Client download, two or more images among CAS, DRM, and ASD are converted into one download image. Can be created and sent. Therefore, the download image header can include information about the image. For example, packed_image_num is the number of SM Client images included in the download image, total_image_length is the total size of the SM Client image, and Reserved is additional information. This information may be included in the image header.

In addition, in the third embodiment, when the content is not downloaded in the open format, only the image that needs to be updated may be downloaded and downloaded.

(Example 4)

6 is a conceptual diagram of content image file caching in the downloadable content security system according to the fourth embodiment.

In the fourth embodiment, the step of downloading content in an open manner may include caching the image file generated at the first request for image download and the key used for encryption, and reusing the cached image and key when requesting the download of the same file. It is characterized by improving the speed and request processing capacity per hour.

Specifically, when the content host requests image download information from the content host during the initial image download, the AP responds with the image download information. The AP requests image encryption / personalization from the PS, and the image file is sent to the download server. Store the key in LKS. The image file is then downloaded to the content host.

Subsequently, when an image download request is added, the response speed and request per hour are obtained by retrieving the cached image storage location by retrieving the cached image storage location by obtaining the key information from the LKS for the image file generated at the initial request. The treatment capacity can be improved.

(Example 5)

7 is a conceptual diagram of a personalized update scheme in the downloadable content security system according to the fifth embodiment.

In the fifth embodiment, the step of downloading content in an open manner may deliver personalized update information that delivers update request information for a specific content host in an environment in which the same update information (SI) is broadcast to a plurality of content hosts. It is characterized by.

Specifically, delivering personalized update information is broadcast periodically by adding personalized update information along with common update information at the content headend.

Thereafter, the content host receiving the update information determines whether to update by filtering personalized update information and then compares common update information.

Thereafter, the personalized update information may be requested to the DCAS head-end.

In the fifth embodiment, the download command can be designated by designating a specific host or a specific group. For example, you can increase operational flexibility, such as changing to B CAS and downloading it to a host running A CAS.

(Example 1)

8 is a first application example of the downloadable content security system according to the embodiment. The first application is for initial image download.

Specifically, SO 'A' provides CAS service of Company A. A new CAS system is introduced to provide CAS services using the DCAS system.

When the new subscriber connects the DCAS STB to the DCAS System, the initial image can be downloaded and loaded into the DCAS STB to start the service.

(2nd application example)

9 is a second application example of the downloadable content security system according to the embodiment. The second application is for image upgrade.

Specifically, the operator of SO 'A' upgrades and registers the CAS image version of Company B through MSO Manager. Upgrade information is downloaded from STB by sending SI information from DCAS System.

That is, when the operator of SO 'A' upgrades and registers the CAS image version of Company B through MSO Manager, the upgraded image is downloaded to the DCAS STB, and the existing image is deleted from the STB.

(Third application example)

10 is a third application example of the downloadable content security system according to the embodiment. The third application example is an example of SO change.

Specifically, if the subscriber using the DCAS STB moves from SO 'I' to SO 'A', and the SO 'A' is providing CAS service of Company B using the DCAS System, if the subscriber uses the DCAS STB, CAS image of company B is downloaded when connected to DCAS System.

That is, when the customer tries to use the DCAS STB used in the SO 'I' at the SO 'A', the customer can download the CAS of the B company to receive the SO 'A' service and install it.

The present invention is not limited to the described embodiments and drawings, and various other embodiments are possible within the scope of the claims.

1 is a block diagram of a downloadable content security system according to an embodiment.

2 is a detailed view of a headend in a downloadable content security system according to an embodiment.

3 is a flowchart for downloading a content image in the downloadable content security system according to the first embodiment.

FIG. 4 is a flow chart of storing content images in storage in a downloadable content security system according to a second embodiment. FIG.

5 is a structure of a content image file in the downloadable content security system according to the third embodiment;

Fig. 6 is a conceptual diagram of caching content image file structure in the downloadable content security system according to the fourth embodiment.

7 is a conceptual diagram of a personalized update scheme in the downloadable content security system according to the fifth embodiment.

8 is a first application of a downloadable content security system according to an embodiment;

9 is a second application example of the downloadable content security system according to the embodiment;

10 is a third application example of the downloadable content security system according to the embodiment;

Claims (8)

Downloadable content security system, characterized in that the content can be downloaded openly from the content headend to the content host. According to claim 1, The downloaded content is, Downloadable content security system, characterized in that uploaded to the download server of the content headend through image encryption and digital signature. The method of claim 2, The content includes two or more of CAS, DRM, and Authorized Service Domain (ASD), The downloaded content is, Downloadable content security system, characterized in that the integrated image encryption and electronic signature through the creation of the integrated image for the content is uploaded to the download server. The method according to claim 2 or 3, The downloaded content, Downloadable content security system, characterized in that stored in the secure storage (Secure Storage) of the content host through designing and decrypting. Downloadable content security method characterized in that the content can be downloaded openly from the content headend to the content host. The method of claim 5, Downloading the content openly, Downloading the content; Image encryption for the content; Performing an electronic signature on the encrypted content; And Uploading to the download server of the content headend. The method of claim 5, The downloaded content includes two or more of CAS, DRM, ASD, Downloading the content openly, Downloading the content; Generating an integrated image of the downloaded contents; Encrypting the integrated image; Performing an electronic signature on the encrypted integrated image; And Uploading to the download server of the content headend. The method according to claim 6 or 7, Downloading the content openly, Performing designing for identifying a sender with respect to the downloaded content; Decoding the downloaded content image; And And storing the decrypted content image in a secure storage of the content host.

Images