KR20110040183A - Cas system and cas method for iptv - Google Patents

Abstract

PURPOSE: A CAS(Conditional Access System) for an IPTV is provided to improve a security level and a data transmission efficiency by creating an intrinsic authentication key and decoding the key. CONSTITUTION: A CAS system comprises an access restricting server(100) and a terminal of a broadcasting receiver(300). The access restricting server creates an intrinsic authentication key with a public key of the terminal, and creates a ciphering authentication key with the intrinsic authentication key. An EMM(Entitlement Management Message) encryption key and an ECM(Entitlement Control Message) encryption key for ciphering a user management message are generated. The terminal of a broadcasting receiver acquires the intrinsic authentication key as a personal intrinsic key and extracts the user management message with the intrinsic authentication key and display the received user management message.

Description

Restriction system and reception restriction method of digital broadcasting receiver {CAS SYSTEM AND CAS METHOD FOR IPTV}

The present invention is to further improve the security of the digital broadcast receiver, and more specifically, to the public key through a unique authentication key generated by a public key included in a certificate distributed in a digital broadcast receiver capable of interactive services. The present invention relates to a reception restriction system and a reception restriction method of a digital broadcast receiver, which enables the user management message EMM and ECM to be extracted only to a terminal having a corresponding private key.

In order to view the paid services of a general digital broadcasting receiver, a reception restriction system is inserted into a terminal, and for an authorized terminal, a cable broadcaster may request an emergency alert system (EAS), an interactive program guide, or an impulse pay per view (IPPV). , Video on demand, and interactive services.

Recently, as the interactive service is enabled, data broadcasting service is available, and as a result, various services such as home shopping, home banking, mail transmission, interactive advertisement, and online game are expected to expand further.

Therefore, broadcasters are required to make an effort to further improve the security of the limited reception system that guarantees fraud prevention of purchase behavior.

In the conventional conditional access system, the entitlement management message (EMM: Entitlement Management Message: EMM) that manages the subscriber's entitlement, and the entitlement control message (ECM: Entitlement Control Message: ECM) for controlling the subscriber's entitlement ) Is generated and transmitted to the subscriber's terminal. The EMM and ECM transmitted to the subscriber terminal are interpreted while passing through a filter for distinguishing between the EMM and ECM of the CA.

Specifically, the operation of the message should be able to obtain the CW (Control Word, hereinafter referred to as CW) included in the message scrambled data.

Therefore, the conditional access system broadcasts an ECM encrypted with CW for each channel, and transmits an EMM capable of unlocking the key of the CW encrypted channel to the subscriber terminal. The encryption key management structure in this regard is as shown in FIG.

Such a normal reception restriction system pre-inserts and distributes a CID (CAS Initial Delivery) key to the smart card of the terminal, and the reception restriction server encrypts key keys and functions for encrypting the ECM and EMM through the CID key of the smart card. The terminal to which the smart card having the corresponding CID key is attached is decoded to extract the EMM and ECM information. That is, the security between the CAS server and the terminal generating and transmitting the EMM and the ECM based on the CID key recorded in the smart card could be maintained.

However, when there is no physical security device such as a smart card, there is a problem in that the security for the digital broadcast receiver that provides the paid additional service.

The present invention has been made in view of the above circumstances, and an object of the present invention is to generate a unique authentication key by generating a unique authentication key with a public key of each terminal stored in advance and encrypting the generated unique authentication key with a public key. And encrypting a main key and an operation function with the unique authentication key to generate an encryption operation key, and encrypting a user management message including viewing qualification information (EMM) and viewing restriction information (ECM) based on the main key and the operation function. To generate a EMM encryption key and ECM encryption key, based on the generated EMM encryption key and ECM encryption key, it provides a reception restriction server that encrypts the user management message EMM and ECM and sequentially delivers them to the terminal. To provide a system for limiting the reception of digital broadcasting receivers that can further improve the security between the two. .

In addition, the present invention was created in view of the above circumstances, and another object of the present invention is to generate a unique authentication key with a public key of each terminal stored in advance, encrypting a unique authentication key generated with a public key, and encrypting a unique authentication. Generates a key and sends it to the terminal, generates a cryptographic operation key by encrypting the main key and the calculation function with the unique authentication key, and based on the main key and the calculation function, viewing qualification information (EMM) and viewing restriction information (ECM) After generating an EMM encryption key and ECM encryption key for encrypting a user management message, the user management message EMM and ECM are encrypted and transmitted to the device based on the generated EMM encryption key and ECM encryption key. Key key and operation by decrypting unique authentication key with private key and decrypting cipher key with obtained unique authentication key Acquires a function and extracts the password user management message EMM and ECM through the obtained main key and operation function to generate a control word for the viewing permission channel, and processes the received data with the generated control word and displays it on the screen. It is an object of the present invention to provide a reception restriction method of a digital broadcast receiver that can further improve the security between the terminal and the reception restriction server and further improve the paid additional service quality thereof.

A reception restriction system of a digital broadcast receiver according to a first aspect of the present invention for achieving the above object includes a reception restriction server for generating and transmitting a unique authentication key encrypted with a public key included in a certificate, and a unique reception restriction server. After acquiring the unique authentication key as the private key corresponding to the public key, distinguishing and extracting the user management message provided from the reception restriction server with the obtained unique authentication key and processing the received data based on the extracted user management message. And a broadcast receiving terminal for displaying, wherein the reception restriction server generates a unique authentication key with a public key of a pre-stored terminal, encrypts the generated unique authentication key with a public key, and generates a password unique authentication key for transmission to the terminal. Generate a cryptographic operation key by encrypting a main key and an operation function with the unique authentication key. And generate and generate an EMM encryption key and an ECM encryption key for encrypting a user management message including transmission qualification information (EMM) and viewing restriction information (ECM), respectively, based on the main key and a calculation function. And encrypting the user management messages EMM and ECM based on the EMM encryption key and the ECM encryption key, respectively, to generate an encrypted user management message and to transmit the generated encrypted user management message to the terminal.

Further, the terminal decrypts the received encryption unique authentication key of the reception restriction server into a private key corresponding to a previously stored public key to obtain a unique authentication key, and decrypts the encryption operation key with the obtained unique authentication key to generate a main key and an operation. Acquiring a function and generating an EMM decryption key and an ECM decryption key for decrypting the cryptographic user management message using the obtained primary key and arithmetic function, and user management based on the generated EMM decryption key and ECM decryption key. Extracting the message EMM and ECM, respectively, generating a control word for the view-licensed channel based on the obtained user management message EMM and ECM, and descrambles the data received through the selected channel based on the generated control word; It is characterized by being provided to decode and display.

The reception restriction server of the digital broadcasting receiver according to the second aspect of the present invention encrypts the generated unique authentication key with the public key after generating the unique authentication key with the public key included in the certificate distributed to the broadcast receiving terminal. A cryptographic unique authentication key generation module for generating an authentication key; An encryption operation key generation module for generating an encryption operation key by encrypting a main key and an operation function with the generated unique authentication key; And a cryptographic user management message generation module for generating a cryptographic user management message EMM and an ECM and transmitting the encrypted user management message based on a main key and an operation function of the cryptographic operation key generation module to the terminal.

Preferably, the cryptographic user management message generation module generates an EMM encryption key and an ECM encryption key for encrypting an EMM and an ECM based on a primary key and an operation function of the cryptographic operation key generation module, and generates the generated EMM encryption. And encrypting the EMM and the ECM based on the key and the ECM encryption key to generate the encrypted user management message EMM and the ECM.

The terminal of the digital broadcast receiver according to the third aspect of the present invention extracts the encrypted user management message EMM and ECM received from the terminal of the private key having the public key through the encryption unique authentication key of the reception restriction server. A security device for generating a control word for a view-permitted channel on the basis of the user management message EMM and ECM, and a data processing module for descrambling and decoding data supplied from the outside with the generated control word and displaying the decoded data on a screen. Characterized in that it comprises a,

Preferably, the security device is to decrypt the cryptographic unique authentication key with a private key corresponding to a pre-stored public key to generate a unique authentication key and to decrypt the cryptographic operation key with the generated private key to generate a main key and an operation function. Generates an EMM decryption key and an ECM decryption key for decrypting the user management message EMM and ECM encrypted with the generated primary key and arithmetic function, and based on the generated EMM decryption key and ECM decryption key. And extracting a management message EMM and an ECM, respectively, and generating a control word for a viewing permission channel based on the extracted user management message EMM and ECM.

In addition, the security device, a unique authentication key extraction module for obtaining a unique authentication key by decrypting the received encryption unique authentication key with a pre-stored public key, cryptographic operation based on the unique authentication key obtained from the unique authentication key extraction module An operation key acquisition module for distinguishing and extracting a main key and an operation function by decrypting a key, and a user management message extraction module for extracting a cryptographic user management message based on the operation function extracted from the operation key acquisition module;

The user management message extracting module generates an EMM description key and an ECM description key based on the arithmetic function extracted by the operation key obtaining module, and generates the user management message EMM and ECM using the generated EMM description key and ECM description key, respectively. And generate a control word for a view-licensed channel based on the extracted user management messages EMM and ECM.

In a method of limiting reception of a digital broadcast receiver according to a fourth aspect of the present invention, a unique authentication key for generating a unique password by encrypting and generating a unique authentication key with a public key of a certificate having a public key and a private key distributed to a terminal Key generation step; And extracting a unique authentication key by decrypting a cryptographic unique authentication key received at the terminal with a private key corresponding to the public key, and further comprising: obtaining a user management message with the unique authentication key; An encryption operation key generation step of generating an encryption operation key by encrypting a primary key and an operation function for encryption; And an operation key obtaining step of extracting a main key and an operation function by decrypting in the encryption operation key generation step with a unique authentication key obtained from the terminal, wherein the method comprises: in the encryption operation key generation step at the reception restriction server. Generating an encrypted user management message by encrypting the user management messages EMM and ECM with the generated primary key and arithmetic function, respectively, and transmitting the encrypted user management message to the terminal; And a user management message obtaining step of extracting a user management message EMM and an ECM by decrypting a cryptographic user management message on the basis of a primary key and an operation function of the operation key obtaining step. A data processing step of generating a control word for a channel that is permitted to be watched by the user management message EMM and ECM extracted in the management message acquisition step, and descrambles and processes the data received through the channel that is permitted by the generated control word. Include.

In the generating of the encrypted user management message, the EMM encrypt key and the ECM encrypt key are respectively generated by the main key and the calculation function to encrypt the user management message EMM and ECM, and the generated EMM encrypt key and And encrypting the user management message EMM and ECM with an ECM encrypt key to generate an encrypted user management message and transmit the encrypted user management message to the terminal.

The acquiring the user management message may generate and generate an EMM decryption key and an ECM decryption key for decrypting and encrypting the encrypted user management message using the primary key and the operation function obtained in the operation key obtaining step. Distinguish and extract the encrypted user management message EMM and ECM with the encrypted EMM decryption key and the ECM decryption key, and generate a control word for a channel licensed with the extracted user management message EMM and ECM. It features.

Accordingly, according to the system and method for receiving restriction of a digital broadcasting receiver according to the present invention, a unique authentication key is generated using a public key of each terminal stored in advance, and a generated unique authentication key is encrypted with a public key to generate a unique password and generate the unique authentication key. EMM encryption key for encrypting main key and arithmetic function with a key to generate a cryptographic arithmetic key and encrypting a user management message including viewing qualification information (EMM) and viewing restriction information (ECM) based on the main key and arithmetic function And an ECM encryption key, and encrypts the user management message EMM and ECM based on the generated EMM encryption key and ECM encryption key to generate a password user management message EMM and ECM and delivers it to the terminal. Obtained by encrypting with key and decrypting cryptographic operation key with the obtained unique authentication key. After extracting the number, decrypt the user management message EMM and ECM with the extracted main key and operation function, extract the user management message EMM and ECM, and descramble and view the data received through the authorized channel through the extracted user management message. As a result, the security of the digital broadcasting receiver can be further improved, and the efficiency and safety of data transmission can be further improved.

Hereinafter, an apparatus and method for limiting reception of a digital broadcast receiver according to an exemplary embodiment of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 2 is a diagram illustrating a reception limiting apparatus according to an exemplary embodiment of the present invention, FIG. 3 is a diagram illustrating a configuration of a reception limiting server shown in FIG. 2, and FIG. 4 is a view of the terminal of FIG. 2. Fig. Shows the configuration in detail. FIG. 5 is a diagram for describing a reception restriction process through data communication between a terminal and a reception restriction system illustrated in FIG. 1.

As shown in FIG. 2, the reception restriction system according to the present invention includes a reception restriction server 100 and a broadcast reception terminal 300.

Here, the reception restriction server 100 generates a unique authentication key with a public key of each terminal 300 stored in advance, encrypts the generated unique authentication key with a public key, generates a password unique authentication key, and transmits the generated unique authentication key to the terminal. Subsequently, an encryption key is generated by encrypting a main key and an operation function with the unique authentication key, and the cryptographic operation key is generated and transmitted to the terminal 300. Also, based on the main key and the operation function, viewing qualification information (EMM) and viewing restriction information are provided. Generates an encrypted user management message by encrypting EMM and ECM, respectively, based on the generated EMM encryption key and ECM encryption key generated by generating an EMM encryption key and an ECM encryption key for encrypting a user managed message including an ECM. Is provided to deliver to the terminal 300.

Preferably, the reception restriction server 100, as shown in Figure 3, after generating the unique authentication key with the public key of the terminal by encrypting the generated unique authentication key with the public key unique to generate a unique password authentication key An authentication key generation module 110, a cryptographic operation key generation module 103 for generating a cryptographic operation key by encrypting a main key and an operation function with the generated cryptographic unique authentication key, and a key of the cryptographic operation key generation module 130. And a cryptographic user management message generation module 150 for encrypting the user management message EMM and ECM based on the key and arithmetic function to generate a cryptographic user management message EMM and ECM.

Here, the encrypted user management message generation module 105 includes a user including viewing qualification information (EMM) and viewing restriction information (ECM) based on the main key and the calculation function encrypted from the encryption calculation key generation module 13. EMM encryption key and ECM encryption key for encrypting the management message, respectively, is generated to encrypt the EMM and ECM based on the generated EMM encryption key and ECM encryption key.

Meanwhile, as illustrated in FIG. 4, the terminal 300 extracts the encrypted user management message from the terminal of the private key having the public key through a unique password authentication key received from the reception restriction server 100. And a control word for a viewing permission channel based on the user management message EMM and ECM obtained by the security device 310 and the digital broadcast data scrambled with the generated control word. And a data processing module 330 which decodes and decodes and displays the result.

Herein, the security device 310 generates a unique authentication key by decrypting the cryptographic unique authentication key with a private key corresponding to a previously stored public key, and generates a main key and an operation function by decrypting a cryptographic operation key with the generated private key. The EMM decryption key and the ECM decryption key for decrypting the user management message EMM and ECM encrypted with the generated main key and the calculation function are generated, and the user management message is generated based on the generated EMM decryption key and ECM decryption key. EMM and ECM are provided to extract respectively.

Preferably, the security device 310 is obtained by a unique authentication key acquisition module 311, the unique authentication key acquisition module 311 to obtain a unique authentication key by decrypting the received encryption unique authentication key with a previously stored public key. An operation key acquisition module 313 for distinguishing and extracting a primary key and an operation function by decrypting the encryption operation key based on the unique authentication key, and an encryption user management message based on the operation function extracted from the operation key acquisition module. And extracting the user management message extraction module 315.

Here, the user management message extraction module 315 generates an EMM description key and an ECM description key based on the main key and the calculation function extracted by the operation key acquisition module 313, respectively, and generates the generated EMM description key and ECM. A user management message EMM and an ECM are extracted with a description key, respectively, and a control word for a viewing permission channel is generated based on the extracted user management message EMM and ECM.

An operation process of the reception limiting apparatus of the digital broadcast receiver will be described with reference to FIG. 5.

First, the reception restriction server 100 generates a unique authentication key based on a public key of a certificate including a private key and a public key as a terminal distributed through step 501, and encrypts the generated unique authentication key with a public key. After generating a unique password authentication key and transmits the generated unique password authentication terminal to the terminal (300).

The terminal 300 decrypts the cryptographic unique authentication key received through step 505 to a private key corresponding to the public key to obtain a unique authentication key.

Subsequently, the reception restriction server 100 generates an encryption operation key for encrypting the main key and an operation function based on the unique authentication key generated in step 507 and transmits the generated encryption operation key to the terminal.

In this case, the terminal 300 decrypts the received encryption operation key with the unique authentication key to obtain a main key and an operation function (step 509).

In step 511 of the reception restriction server 100, an EMM encryption key and an ECM encryption key for encrypting a user management message EMM and an ECM are generated based on the primary key and an operation function, and then step 513 is performed. The user management message EMM and ECM are encrypted using the generated EMM encryption key and ECM encryption key to generate a cipher user management message EMM and ECM.

The cryptographic user management messages EMM and ECM are transmitted to the terminal 300 through step 515.

In step 517 of the terminal 300, an EMM decryption key and an ECM description key are generated as a primary key and an operation function to decrypt the received cryptographic user management message EMM and ECM. The user management message EMM and ECM are extracted by decrypting the encrypted user management message EMM and ECM with the generated EMM decryption key and ECM description key.

The terminal 300 generates and transmits a control word for data reception on the channel authorized by the user management message EMM and ECM extracted in step 521 to the data processing module 330.

The data processing module 330 processes to decode and display the data received from the authorized channel through step 523 based on the control word and then to decode and display the data.

Generate a unique authentication key with the public key of each terminal stored in advance in the reception restriction server, encrypt the generated unique authentication key with the public key, generate a password unique authentication key and transmit it to the terminal, and encrypt the main key and the calculation function with the unique authentication key. EMM encryption key and ECM encryption key for generating a cryptographic operation key and transmitting it to the terminal and encrypting a user management message including the viewing qualification information (EMM) and the viewing restriction information (ECM) based on the main key and the calculation function. Based on the generated EMM encryption key and ECM encryption key, encrypt the user management message EMM and ECM to generate a password user management message EMM and ECM to pass to the terminal and encrypt the unique authentication key with a private key in the terminal Decrypt the cryptographic operation key with the obtained unique authentication key and add the main key and operation function. After decrypting the user management message EMM and ECM with the extracted key and operation function, the user management message EMM and ECM are extracted, and the data received through the authorized channel is descrambled and viewed through the extracted user management message. By preventing illegal viewing of unlicensed channels, it is possible to further improve the quality of the paid supplementary service, so that the digital broadcasting receiver is not only commercially available or commercially viable, but also can be clearly implemented in practice.

1 is a diagram illustrating an encryption key management structure of a general digital broadcasting receiver.

2 is a block diagram illustrating a reception limiting apparatus of a digital broadcast receiver according to an exemplary embodiment of the present invention.

FIG. 3 is a diagram showing the configuration of the reception restriction server shown in FIG. 2.

4 is a diagram illustrating a configuration of a terminal illustrated in FIG. 2.

5 is a diagram illustrating a reception restriction process of a digital broadcast receiver according to another embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: restriction server

110: password unique authentication key generation module

130: cryptographic operation key generation module

150: password user management message generation module

300: terminal

310: security device

311: unique authentication key acquisition module

313: operation key acquisition module

315: user management message extraction module

330 data processing module

Claims (13)

EMM for generating a unique authentication key with the public key of the terminal, encrypting the generated unique authentication key with the public key to generate a unique password for encryption, and encrypting a user management message based on the main key and the calculation function generated with the unique authentication key. A reception restriction server that generates an encryption key and an ECM encryption key, and encrypts the user management message based on the generated EMM encryption key and the ECM encryption key, and delivers the encrypted user management message; After acquiring a unique authentication key using the unique authentication key of the reception restriction server as a private key corresponding to the public key, distinguishing and extracting a user management message provided from the reception restriction server with the obtained unique authentication key and based on the extracted user management message And a broadcast reception terminal for processing and displaying data received by the digital broadcast receiver. A cryptographic unique authentication key generation module for generating a cryptographic unique authentication key by encrypting the generated unique authentication key with a public key after generating the unique authentication key with a public key included in a certificate distributed to a broadcast receiving terminal; An encryption operation key generation module for generating an encryption operation key by encrypting a main key and an operation function with the generated unique authentication key; And And a cryptographic user management message generation module for generating a cryptographic user management message by encrypting the user management messages EMM and ECM based on the primary key and an operation function of the cryptographic operation key generation module and transmitting the encrypted user management message to the terminal. Restriction server for broadcast receivers. The method of claim 2, wherein the password user management message generation module, Generate an EMM encryption key and an ECM encryption key for encrypting the EMM and the ECM, respectively, based on the primary key and the calculation function of the cryptographic operation key generation module; And the EMM and the ECM are encrypted based on the generated EMM encryption key and the ECM encryption key to generate a cipher user management message EMM and ECM. After extracting the encrypted user management message EMM and ECM received from the terminal of the private key having the public key through the password-specific authentication key of the reception restriction server, the user is allowed to view the channel based on the obtained user management message EMM and ECM. A security device for generating control words for, And a data processing module for descrambling and decoding data supplied from the outside with the generated control word and displaying the decoded data on a screen. The method of claim 4, wherein the security device, Decode the cryptographic unique authentication key into a private key corresponding to a previously stored public key to generate a unique authentication key, and decrypt a cryptographic operation key with the generated private key to generate a primary key and an operation function. EMM decryption key and ECM decryption key for decrypting encrypted user management message EMM and ECM are generated, and user management message EMM and ECM are extracted and extracted based on generated EMM decryption key and ECM decryption key, respectively. And generating a control word for a view-permitted channel based on the user management messages EMM and ECM. The method of claim 4, wherein the security device, A unique authentication key acquisition module for decoding the received cryptographic unique authentication key into a previously stored public key to obtain a unique authentication key; An operation key acquisition module for distinguishing and extracting a main key and an operation function by decrypting an encryption operation key based on the unique authentication key obtained by the unique authentication key extraction module; And And a user management message extraction module for extracting an encrypted user management message based on the operation function extracted by the operation key obtaining module. The method of claim 6, wherein the user management message extraction module, Generate an EMM description key and an ECM description key based on the operation function extracted from the operation key acquisition module; The user-managed messages EMM and ECM are extracted with the generated EMM description key and ECM description key, respectively. And generating a control word for a view-licensed channel based on the extracted user management messages EMM and ECM. Generating a unique authentication key using a public key of a certificate having a public key and a private key distributed to the terminal in a reception restriction server to generate a cryptographic unique authentication key and transmitting the encrypted unique authentication key to the terminal; And And acquiring a unique authentication key by decrypting a cryptographic unique authentication key received at the terminal into a private key corresponding to the public key to extract a unique authentication key. The method according to claim 8, wherein the method, A cryptographic operation key generation step of generating a cryptographic operation key by encrypting a main key and an arithmetic function for encrypting a user management message with a unique authentication key at the reception restriction server; And And an operation key acquisition step of extracting a primary key and an operation function by decrypting in the encryption operation key generation step with the unique authentication key obtained by the terminal. The method according to claim 9, wherein the method, A cipher that generates a cipher user management message by encrypting a user management message EMM and an ECM with a primary key and an arithmetic function generated in the cipher operation key generation step at the reception restriction server, and transmits the generated cipher user management message to the terminal. Generating a user management message; And And a user management message obtaining step of extracting a user management message EMM and an ECM by decrypting an encrypted user management message based on a main key and an operation function of the operation key obtaining step. Limitation method. The method according to claim 10, wherein the method, Data processing for descrambling, processing and displaying data received through the channel permitted by the control word generated by generating the control word for the channel permitted to be viewed by the user management message EMM and ECM extracted in the user management message obtaining step. Receiving method of a digital broadcast receiver comprising the step of. The method of claim 11, wherein generating the password user management message, Generate an EMM encrypt key and an ECM encrypt key using the primary key and an operation function to encrypt the user management message EMM and ECM, And encrypting the user management messages EMM and ECM with the generated EMM encrypt key and ECM encrypt key to generate an encrypted user management message and transmit the encrypted user management message to the terminal. The method of claim 11, wherein the obtaining of the user management message comprises: Generating an EMM decryption key and an ECM decryption key for decrypting the encrypted user management message using the primary key and an operation function obtained in the operation key obtaining step, respectively Distinguish and extract the encrypted user management message EMM and ECM with the generated EMM decryption key and ECM decryption key, And generating a control word for a channel that is allowed to view through the extracted user management messages EMM and ECM.

Images