US20140086409A1 - Personalized whitebox descramblers - Google Patents
Personalized whitebox descramblers Download PDFInfo
- Publication number
- US20140086409A1 US20140086409A1 US14/089,452 US201314089452A US2014086409A1 US 20140086409 A1 US20140086409 A1 US 20140086409A1 US 201314089452 A US201314089452 A US 201314089452A US 2014086409 A1 US2014086409 A1 US 2014086409A1
- Authority
- US
- United States
- Prior art keywords
- descrambler
- module
- key
- block cipher
- transformed key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
- H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
- H04L9/0631—Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
- H04L9/065—Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
- H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
- H04N21/234—Processing of video elementary streams, e.g. splicing of video streams, manipulating MPEG-4 scene graphs
- H04N21/2347—Processing of video elementary streams, e.g. splicing of video streams, manipulating MPEG-4 scene graphs involving video stream encryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
- H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
- H04N21/254—Management at additional data server, e.g. shopping server, rights management server
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
- H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
- H04N21/266—Channel or content management, e.g. generation and management of keys and entitlement messages in a conditional access system, merging a VOD unicast channel into a multicast channel
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/41—Structure of client; Structure of client peripherals
- H04N21/418—External card to be used in combination with the client device, e.g. for conditional access
- H04N21/4181—External card to be used in combination with the client device, e.g. for conditional access for conditional access
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/41—Structure of client; Structure of client peripherals
- H04N21/418—External card to be used in combination with the client device, e.g. for conditional access
- H04N21/4182—External card to be used in combination with the client device, e.g. for conditional access for identification purposes, e.g. storing user identification data, preferences, personal settings or data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
- H04N21/44—Processing of video elementary streams, e.g. splicing a video clip retrieved from local storage with an incoming video stream, rendering scenes according to MPEG-4 scene graphs
- H04N21/4405—Processing of video elementary streams, e.g. splicing a video clip retrieved from local storage with an incoming video stream, rendering scenes according to MPEG-4 scene graphs involving video stream decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
- H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
- H04N21/4623—Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
- H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
- H04N21/4627—Rights management associated to the content
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/47—End-user applications
- H04N21/472—End-user interface for requesting content, additional data or services; End-user interface for interacting with content, e.g. for content reservation or setting reminders, for requesting event notification, for manipulating displayed content
- H04N21/47211—End-user interface for requesting content, additional data or services; End-user interface for interacting with content, e.g. for content reservation or setting reminders, for requesting event notification, for manipulating displayed content for requesting pay-per-view content
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N7/00—Television systems
- H04N7/16—Analogue secrecy systems; Analogue subscription systems
- H04N7/162—Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
- H04N7/163—Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing by receiver means only
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N7/00—Television systems
- H04N7/16—Analogue secrecy systems; Analogue subscription systems
- H04N7/167—Systems rendering the television signal unintelligible and subsequently intelligible
- H04N7/1675—Providing digital key or authorisation information for generation or regeneration of the scrambling sequence
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/16—Obfuscation or hiding, e.g. involving white box
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/60—Digital content management, e.g. content distribution
- H04L2209/601—Broadcast encryption
Definitions
- the present invention relates to whitebox descramblers. More specifically, the invention relates to whitebox descramblers in receivers of a conditional access system.
- an encrypted (scrambled) broadcast stream forms a ciphertext ‘C’ that is decrypted (descrambled) in a broadcast receiver to obtain a descrambled broadcast stream ‘M’.
- C ciphertext
- M descrambled broadcast stream
- multiple broadcast receivers receive the same broadcast stream and decrypt the broadcast stream with the same key (Control Word) ‘CW’.
- the value of the CW is updated regularly and is delivered to the receivers in encrypted form in an entitlement control message ‘ECM’ that can be decrypted by authorized subscribers.
- FIG. 1 a shows an example wherein ECM processing is implemented in a smartcard, which uses hardware tamper resistance techniques to provide a secured execution environment.
- Decryption of the broadcast stream C is implemented in a hardware circuit 301 of a chip in a receiver 101 for the obtainment of a descrambled broadcast stream, denoted by ‘M’.
- a secure client 201 is implemented in hardware of the smartcard for obtaining an CW from an ECM.
- Hardware tamper resistance technology secures the implementation against attacks.
- FIG. 1 b shows an alternative example, wherein ECM processing is based on software techniques.
- the software runs as a software secure client 202 in a receiver 102 and loads the keys (CWs) into a hardware descrambler 301 of the receiver 102 in encrypted form based on a key hierarchy loaded in the descrambler chip.
- FIG. 1 c shows another alternative example, wherein the both a secure client 202 and a descrambling function 302 of a receiver 103 are implemented in software.
- the software implemented receiver 103 lacks a hardware hook, such as e.g. a chipset unique key ‘CSUK’ or a chipset serial number ‘CSSN’ stored in a read-only memory of a chipset.
- CSUK chipset unique key
- CSSN chipset serial number
- FIG. 2 a shows an example of a descrambler module.
- a ciphertext C is decrypted in the descrambler module 303 with a fixed key K into a plaintext M.
- the key K is embedded or preloaded in the descrambler module 303 .
- FIG. 2 b shows an alternative descrambler module, wherein several instances of a descrambler module 304 can be made by loading values of K from an external source.
- Block ciphers operate by dividing an input ciphertext stream in fixed sized blocks. Each block is processed by repeatedly applying a relatively simple function. This approach is known as iterated block cipher. Each iteration is called a round, and the repeated function is called a round function. Typical block ciphers have 4 to 32 rounds.
- FIG. 3 shows a typical inner working of a prior art iterated block cipher 305 as may be used as the descrambling module 304 of FIG. 2 b .
- a ciphertext C is received and divided in blocks. Each block of ciphertext C is processed over ‘n’ rounds into the plaintext message ‘M’. Each round ‘r’ receives its own round key ‘RK r ’ as input, which is calculated from the original key ‘K’ in a key schedule module 501 .
- each block cipher round module 4011 , 4012 is typically implemented using a sequence of table lookup operations hiding the value of the key ‘K’ and the roundkeys ‘RK r ’.
- a fixed-key variant using a descrambling module 303 as shown in FIG. 2 a may be used in the iterated block cipher 305 .
- the key schedule module 501 as shown in FIG. 3 is then replaced by a module embedding a fixed input ‘RK r ’ to each round.
- a block cipher round module 4011 , 4012 as shown in FIG. 3 is shown in more detail in FIG. 4 .
- the block cipher round function 401 contains two modules that operate in sequence.
- a diffusion module 601 modifies an input C r-1 randomly.
- the thus obtained C′ r-1 is input to a confusion module 701 .
- the purpose of the confusion module 701 is to mix the round key RK r with the ciphertext C′ r-1 , making it mandatory to provide the relevant round key RK r to produce the output C r for the next decryption round.
- a block cipher round module may be personalized by having a unique function, in whitebox cryptography typically using a table-driven lookup implementation, that performs the confusion function.
- a table-driven lookup implementation An example of a prior art table-driven lookup implementation will be described in more detail with FIG. 7 .
- a whitebox iterated block cipher using AES encryption is known from “White-Box Cryptography and an AES Implementation” by S. Chow, P. Eisen, H. Johnson, P. C. van Oorschot, Proceedings of the 9th Annual Workshop on Selected Areas in Cryptography, August 2002.
- each block cipher round consists of four parts: SubBytes, ShiftRows, MixColumns and AddRoundKey. The first three parts correspond to the operations in the diffusion module and the AddRoundKey part is comparable to the confusion module.
- whitebox iterated block cipher implementations typically apply a random permutation to the output of lookup tables (see also FIG. 7 ), and the inverse of that permutation to the input of a next lookup table.
- FIG. 5 A simplified block cipher 306 applying a random permutation consisting of two rounds in block cipher round modules 4021 and 4022 and with a block and key size of two bits is shown in FIG. 5 .
- a block cipher round module 402 is shown in mode detail.
- each arrow represents a dataflow of two bits.
- each arrow represents a single bit data flow.
- the diffusion module 602 swaps the two bits of input C r-1 and replaces the second bit by their binary sum (XOR).
- the thus obtained C′ r-1 is input to the confusion module 702 .
- the confusion module 702 performs a binary addition (XOR) of the two input bits of C′ r-1 with the relevant bit of the round key RK r .
- FIG. 7 A simplified example of a whitebox lookup table driven implementation 307 of the simplified block cipher 306 of FIG. 5 and FIG. 6 is shown in FIG. 7 .
- stream ciphers As an alternative to using block ciphers as broadcast descrambling algorithm, stream ciphers and public key cryptosystems are known.
- FIG. 17 shows a typical inner working of a prior art stream cipher 308 as may be used as an alternative descrambling module 304 of FIG. 2 b .
- a setup module 5041 initializes the internal state of the cipher in a manner known per se. Initialization typically involves an initial vector (IV) that is loaded into a keyed internal secret state of the cipher, after which a number of cipher rounds is executed on an input key K prior to releasing an initialized key to the next module.
- a key expansion module 5042 creates an expanded key EK from the initialized key to match the size of the ciphertext C. The expanded key EK is provided to a XOR module 404 , where an input ciphertext C is descrambled using a XOR operation with the expanded key EK.
- FIG. 20 shows a typical inner working of a prior art public key cipher 309 as may be used as another alternative descrambling module 304 of FIG. 2 b .
- EK is input to a decipher module 4052 for deciphering an input ciphertext C.
- the ciphertext C may me modified in modification module 4051 into an intermediate ciphertext C 1 prior to being input to the decipher module 4052 .
- a known problem in Pay TV application is the redistribution of CW key values using broadband communication infrastructures such as the Internet.
- Hackers intercept CW values and insert the CW values into a redistribution infrastructure, e.g. using a peer-to-peer network.
- Unauthorized receivers obtain the appropriate CW key values from the redistribution infrastructure and use the thus obtained CW values to decrypt a broadcast stream. More specifically, intercepted keys are used in unauthorized whitebox descrambler modules for the decryption of a ciphertext.
- a whitebox descrambler for descrambling a ciphertext to obtain a cleartext message.
- the descrambler is configured to receive a personalized transformed key from an external preprocessing module.
- the descrambler is further configured to receive the input ciphertext.
- the descrambler is further configured to generate an output data by applying a second part of a descrambling operation to the input ciphertext using the personalized transformed key as an input to the second part of the descrambling operation.
- the descrambler is further configured to apply an inverse transformation to the personalized transformed key before generating the output data.
- the personalized transformed key comprises preprocessed data as a result of applying a first part of the descrambling operation in the external preprocessing module.
- a method for use in a whitebox descrambler for descrambling a ciphertext to obtain a cleartext message.
- the method comprises receiving a personalized transformed key from an external preprocessing module.
- the method further comprises receiving the input ciphertext.
- the method further comprises generating an output data by applying a second part of a descrambling operation to the input ciphertext using the personalized transformed key as an input to the second part of the descrambling operation.
- the method further comprises applying an inverse transformation to the personalized transformed key before generating the output data.
- the personalized transformed key comprises preprocessed data as a result of applying a first part of the descrambling operation in the external preprocessing module.
- the inverse transformation is either performed as a separate distinguishable step or integrated in the second part of the descrambling operation. If the inverse transformation is integrated in the second part of the descrambling operation, a single mathematical operation may perform both the inverse transformation and the descrambling operation.
- the preprocessed data is generated by applying the first part of the descrambling operation to a decryption key.
- this key is also known as a control word.
- claims 2 and 12 enable use of iterated block cipher based descramblers.
- intercepted keys for an authorized iterated block cipher based descrambler cannot be used in an unauthorized iterated block cipher based descrambler.
- claims 3 - 6 and claims 13 - 15 advantageously enable various alternative implementations of iterated block cipher based descramblers.
- the embodiment of claim 7 enables use of stream cipher based descramblers and public key based descramblers.
- intercepted keys for an authorized stream cipher based descrambler or an authorized public key based descrambler cannot be used in an unauthorized stream cipher based descrambler or an unauthorized public key based descrambler.
- a receiver for use in a conditional access system.
- the receiver comprises a descrambler having one or more of the above mentioned features.
- the descrambler can advantageously be integrated in a receiver, enabling the descrambler to be used in a conditional access system.
- a secure client for use in a conditional access system.
- the secure client comprises an input for receiving an encrypted control word from a head-end system via the intermediary of a receiver.
- the secure client further comprises a memory configured to store a product key.
- the secure client further comprises a decryption module configured to decrypt the encrypted control word using the product key to obtain the control word.
- the secure client further comprises a preprocessing module configured to apply a first part of a descrambling operation to the control word to obtain a modified control word and to transform the modified control word to obtain a personalized transformed control word.
- the secure client further comprises an output for providing the personalized transformed control word to the receiver.
- a method for use in a secure client of a conditional access system.
- the method comprises receiving an encrypted control word from a head-end system via the intermediary of a receiver.
- the method further comprises decrypting the encrypted control word using a product key from a memory to obtain the control word.
- the method further comprises applying a first part of a descrambling operation to the control word to obtain a modified control word.
- the method further comprises transforming the modified control word to obtain a personalized transformed control word.
- the method further comprises providing the personalized transformed control word to the receiver.
- preprocessed data is generated for use in a second part of the descrambling operation in a descrambler module of the receiver.
- the first part of the descrambling operation is typically applied to a decryption key.
- this key is known as the control word.
- a head-end system for use in a conditional access system.
- the head-end system comprises a preprocessing module configured to apply a first part of a descrambling operation to a control word to obtain a modified control word and to transform the modified control word to obtain a personalized transformed control word.
- the head-end system further comprises an output for providing the personalized transformed control word and a ciphertext to a receiver according having one or more of the above mentioned features.
- preprocessed data is generated for use in a second part of the descrambling operation in a descrambler module of the receiver.
- the first part of the descrambling operation is typically applied to a decryption key.
- this key is known as the control word.
- a computer program element is proposed.
- the computer program element is, when being executed by a processor, adapted to carry out a method for use in a whitebox descrambler having one or more of the above mentioned features.
- FIG. 1 a shows a prior art receiver and secure client
- FIG. 1 b shows another prior art receiver and secure client
- FIG. 1 c shows another prior art receiver and secure client
- FIG. 2 a shows a block diagram of a prior art descrambler
- FIG. 2 b shows another block diagram of a prior art descrambler
- FIG. 3 shows a prior art descrambler in more detail
- FIG. 4 shows a prior art block cipher round module
- FIG. 5 shows another prior art descrambler in more detail
- FIG. 6 shows another prior art block cipher round module
- FIG. 7 shows a prior art block cipher based descrambler
- FIG. 8 shows a diagram clarifying transformation functions and encryption in general terms
- FIG. 9 shows a receiver and a secure client of an exemplary embodiment of the invention.
- FIG. 10 a shows a block diagram of a descrambler of an exemplary embodiment of the invention
- FIG. 10 b shows block diagram of a descrambler of another exemplary embodiment of the invention.
- FIG. 11 shows a receiver and a secure client of another exemplary embodiment of the invention.
- FIG. 12 shows a descrambler of an exemplary embodiment of the invention
- FIG. 13 shows a block cipher round module of an exemplary embodiment of the invention
- FIG. 14 shows a whitebox iterated block cipher based descrambler of an exemplary embodiment of the invention
- FIG. 15 shows a whitebox iterated block cipher based descrambler of another exemplary embodiment of the invention.
- FIG. 16 shows a whitebox iterated block cipher based descrambler of another exemplary embodiment of the invention.
- FIG. 17 shows a prior art stream cipher based descrambler
- FIG. 18 shows a whitebox stream cipher based descrambler of an exemplary embodiment of the invention
- FIG. 19 shows a whitebox stream cipher based descrambler of another exemplary embodiment of the invention.
- FIG. 20 shows a prior art public key based descrambler
- FIG. 21 shows a whitebox public key based descrambler of an exemplary embodiment of the invention
- FIG. 22 shows a conditional access system of an exemplary embodiment of the invention
- FIG. 23 shows a method in a whitebox descrambler of an exemplary embodiment of the invention
- FIG. 24 shows a method in a whitebox descrambler of another exemplary embodiment of the invention.
- FIG. 25 shows a method in a secure client of an exemplary embodiment of the invention.
- the invention prevents intercepted keys from being used in unauthorized whitebox descrambler modules for the decryption of a ciphertext.
- a receiver with a personalized whitebox descrambler is proposed, such as e.g. shown in FIG. 9 , whereby a part of the descrambling operation of the personalized descrambler is performed in a preprocessing module external to the descrambler.
- the personalized descrambler 311 is typically implemented as an obfuscated software module in the receiver 111 .
- the personalized descrambler may be implemented in programmable hardware.
- Each receiver in a conditional access network typically has a unique personalized descrambler 311 .
- a secure client 211 is typically communicatively connected to the receiver 111 to provide descrambler specific key related data to the personalized descrambler 311 to achieve a common descrambling function.
- the secure client 211 is implemented such that a part of the descrambling operation of the personalized descrambler 311 is performed in a preprocessing module 811 of the secure client 211 .
- the secure client 211 is typically implemented in hardware of a smartcard.
- the preprocessing module 811 may be implemented as an obfuscated software module running in the secure client 211 .
- the descrambler specific key related data is provided from a head-end system to the receiver, possibly via the intermediary of a smartcard.
- the preprocessing module 811 is then a part of the head-end system.
- the personalized whitebox descrambler of the invention uses the descrambler specific preprocessed key-related data as input.
- An encryption function E using some key is defined that is configured to accept the data elements of input domain ID as an input to deliver a corresponding encrypted data element in an output domain OD.
- a decryption function D By applying a decryption function D, the original data elements of input domain ID can be obtained by applying the decryption function D to the data elements of output domain OD.
- white box In a non-secure environment (typically referred to as “white box”), an adversary is assumed to know the input and output data elements and the encryption function E, such that the key can be derived.
- Transformation function T 1 maps data elements from the input domain ID to transformed data elements of transformed input domain ID′ of a transformed data space.
- transformation function T 2 maps data elements from the output domain OD to the transformed output domain OD′.
- Transformed encryption and decryption functions E′ and D′ can now be defined between ID′ and OD′ using transformed keys.
- T 1 and T 2 are bijections.
- transformation functions T 1 , T 2 together with encryption techniques implies that, instead of inputting data elements of input domain ID to encryption function E to obtain encrypted data elements of output domain OD, transformed data elements of domain ID′ are input to transformed encryption function E′ by applying transformation function T 1 .
- Transformed encryption function E′ combines the inverse transformation functions T 1 ⁇ 1 and/or T 2 ⁇ 1 in the encryption operation to protect the confidential information, such as the key. Then transformed encrypted data elements of domain OD′ are obtained.
- T 1 and/or T 2 in a secured portion, keys for encryption functions E or decryption function D cannot be retrieved when analysing input data and output data in the transformed data space.
- T 1 , T 2 should be a non-trivial function.
- T 1 is a trivial function
- the input domains ID and ID′ are the same domain.
- T 2 is a trivial function
- the output domains are the same domain.
- White box cryptology In white box cryptology, it is assumed that this process is performed completely in a hostile environment, wherein an attacker has access to the data elements in ID, OD and the functions E and D.
- White box cryptology provides security by securing (parts of) the keys for the functions E and D.
- transformation functions T 1 and T 2 By applying transformation functions T 1 and T 2 in at least one of the smart card or a secured portion the receiver, the lookup tables L n as applied in white box cryptology cannot be resolved in the transformed space.
- the software implementations of the secure client and the descrambler use software transformations to secure software applications. Transformations are typically used in whitebox cryptography, wherein a decryption key is merged with the decryption steps of the algorithm to achieve a software program that can decrypt a ciphertext C.
- FIG. 10 a shows a whitebox implementation of FIG. 2 b , wherein a key is provided to a decryption module 3111 in a transformed format.
- the transformed key T(K) is loaded in the whitebox implementation of the decryption module 3111 .
- the decryption module 3111 transforms T(K) to obtain the key K before applying a descrambling operation with the key K.
- the implementation of the decryption module 3111 ensures that an attacker with knowledge of the decryption module 3111 and the value of T(K) cannot recover K.
- the ciphertext input C and/or the decrypted output M can be transformed as well.
- FIG. 10 b shows a personalized whitebox descrambler 3112 that uses descrambler specific key-related data T i (K) that has been preprocessed prior to being input to the whitebox descrambler 3112 .
- the index ‘i’ is used to indicate the specific descrambler 3112 .
- the preprocessed key related data T i (K) is construed such that it can be used in the corresponding personalized whitebox descrambler 3112 only.
- each receiver uses a personalized transformation T i of the key.
- the transformed key T i (K) is loaded in the whitebox implementation of the descrambler 3112 for decrypting the broadcast stream C.
- the implementation of the descrambler 3112 ensures that an attacker with knowledge of the implementation and the value of T i (K) cannot recover the key K. Moreover the attacker will not be able to generate key-related data T i (K) for another receiver (indicated by ‘j’), which receiver has a personalized whitebox descrambler using a personalized transformation T j .
- the input key K could be intercepted and redistributed to other receivers for descrambling a broadcast stream C. Because the key related data T i (K) is unique to a receiver, the key related data T 1 (K) is useless for any other receiver. Hence, intercepting the input key related data T i (K) and redistribution to other receivers is advantageously no longer is useful.
- FIG. 11 shows a more detailed example of a receiver 111 with a personalized whitebox descrambler 311 of an exemplary embodiment of the invention.
- a personalized key data T i (CW) is generated by preprocessing a CW in a secure client 211 of a smartcard.
- a preprocessing module 811 is used in the secure client 211 to preprocess the CW outside the descrambler 311 of the receiver 111 .
- a part of the descrambling operation of the personalized descrambler 311 is performed in the preprocessing module 811 .
- the preprocessing module 811 performs a transformation function before providing the personalized key data T i (CW) to the descrambler 311 .
- the CW may be preprocessed in a preprocessing module of a head-end system and transmitted to the receiver from the head-end system to the receiver, possibly via the intermediary of a smartcard.
- the receiver 111 receives an input stream ‘input’ from a broadcast network in a manner known per se.
- the input stream is typically an MPEG-2 or DVB transport stream and contains multiple TV channels (i.e. program streams) as well as encrypted information containing the keys required for descrambling a program stream.
- the key is commonly called a Control Word or CW.
- a demux/filter module 901 in the receiver 111 forwards a part of the transport stream that corresponds to a user selected program stream ‘C’, which is a ciphertext, to the descrambler 311 .
- the demux/filter module 901 further extracts to the program stream C relevant information from the encrypted information, such as Entitlement Management Messages (EMM) and Entitlement Control Messages (ECM), and sends the information to the secure client 211 .
- ECM Entitlement Management Messages
- ECM Entitlement Control Messages
- the secure client 211 receives the ECM and decrypts it in a decryption module 902 with a pre-stored P K value read from a secured key storage module 903 .
- the preprocessing module 811 processes the CW into a descrambler specific transformed form T i (CW).
- the descrambler specific CW transformation in the secure client 211 is linked to the personalized descrambler 311 in the receiver 111 using knowledge of the receiver identity ‘i’, which may be communicated from the descrambler 311 to the preprocessing module 811 .
- a part of the descrambling operation of the personalized descrambler 311 is performed in the preprocessing module 811 .
- the following exemplary embodiments show how a personalized descrambler may be secured using personalized whitebox descramblers based on block ciphers.
- the personalized descrambler is a personalized block cipher 312 . Similar to the block cipher 305 as shown in FIG. 3 , a block of ciphertext C is processed over ‘n’ rounds into a plaintext message M using block cipher round modules 4111 , 4112 . In the personalized block cipher 312 , each round ‘r’ receives its own personalized round key ‘PRK i r ’ as input, which is derived from the received personalized key data T i (K) in the key partitioning module 511 .
- FIG. 13 shows an example of a personalized block cipher round module 412 that may be used as block cipher round module 4111 , 4112 as shown in FIG. 12 .
- the block cipher round module 412 has a diffusion module 611 that operates similar to the diffusion module 601 shown in FIG. 4 .
- the Personalized Round Key ‘PRK i r ’ is input to a personalized confusion module 711 .
- the Personalized Round Key is calculated by applying a bitwise XOR with a Unique Key ‘UK i r ’ for round ‘r’ and personalized descrambler ‘i’. A repeated XOR operation with the same Unique Key in the Personalized Confusion module removes the transformation of the Personalized Round Key.
- FIG. 14 A simplified example of a whitebox lookup table driven implementation 313 of the personalized block cipher 312 of FIG. 12 is shown in FIG. 14 .
- the personalized key T i (K) has already been expanded in an external preprocessing module 811 from a two bit value to a four bit value.
- the block cipher round modules 4121 , 4122 operate in a similar manner as shown for the block cipher round modules 4031 , 4032 of FIG. 7 .
- the exemplary embodiment of the invention of FIG. 14 differs from FIG. 7 in that the personalized descrambler 313 operates on the personalized input key T i (K).
- a key partitioning module 5121 selects a two-bit personalized round key ‘PRK i r ’ from the string of personalized round keys that are contained in the transformed key.
- a personalizing module 5122 transforms each ‘PRK i r ’ using a XOR operation ⁇ with a preprogrammed Unique Key ‘UK i r ’.
- the confusion module 711 uses a lookup table to convert the value ‘10’ into ‘01’ using the first common round key value ‘11’ to select the appropriate column of the lookup table.
- the confusion module 711 uses a lookup table to convert the binary value ‘11’ into ‘10’ using the second common round key value ‘01’ to select the appropriate column of the lookup table.
- the XOR operation ⁇ as shown for the personalizing module 5122 may be integrated in the block cipher round modules 4121 , 4122 .
- the confusion module 712 is personalized by changing the column order of the lookup tables in the confusion module 712 .
- the confusion modules 712 have been personalized by a specific arrangement of order of the columns to process a personal round key ‘PRK’ into the correct output. Another receiver will have differently personalized confusion modules and will not be able to decrypt the ciphertext with the transformed key for receiver ‘i’.
- the personalized confusion module 712 uses a lookup table to convert the value ‘10’ into ‘01’ using the first personal round key value ‘10’ to select the appropriate column of the lookup table.
- the personalized confusion module 712 uses a lookup table to convert the binary value ‘11’ into ‘10’ using the second personal round key value ‘11’ to select the appropriate column of the lookup table.
- FIG. 16 An alternative embodiment of a block cipher as personalized descrambler module is shown in FIG. 16 , wherein the confusion functionality in each block cipher round function 4141 , 4142 is preprogrammed with a set of transformation tables. Each transformation table applies a data transformation, depending on the personalized round key ‘PRK i r ’ that is input to the block cipher round 4141 , 4142 .
- each bit of the personalized round key ‘PRK’ indicates whether the corresponding table should be used or not. In this way, the personalized confusion module 713 generates the correct output.
- a diffusion module 611 transforms the ciphertext into binary value ‘10’, which is input to the personalized confusion module 713 .
- the first bit of PRK i 1 equals ‘0’, which is interpreted as not to use the first transformation table.
- the second bit of PRK i 1 equals ‘1’, which is interpreted as to transform the input ‘10’ to ‘01’ in accordance with the second transformation table.
- the binary value ‘01’ is provided to the second block cipher round module 4142 , where the diffusion module 611 first transforms the data from ‘01’ into ‘11’. This data is input to the personalized confusion module 713 of the second block cipher round module 4142 .
- the first bit of PRK i 2 equals ‘1’, which is interpreted as to transform the input ‘11’ to ‘10’ in accordance with the first transformation table.
- the second bit of PRK i 2 equals ‘0’, which is interpreted as not to use the second transformation table on the result after the first transformation table.
- Different receivers with a block cipher as shown in FIG. 16 are typically preprogrammed with different personalized confusion modules, i.e. with a different set of transformation tables in the personalized confusion modules, and will therefore advantageously not be able to decrypt the input ciphertext C with an intercepted transformed input binary key ‘T i (K)’ of other receivers.
- AES block ciphers typically use a 128-bit cipher block size and a key size of 128, 192 or 256 bits in 10, 12 or 14 block cipher rounds.
- DES block ciphers typically use a 64-bit cipher block size and a 56-bit key size in 16 block cipher rounds.
- the following exemplary embodiments show how a personalized descrambler may be secured using personalized whitebox descramblers based on stream ciphers.
- FIG. 18 shows and example of a personalized whitebox stream cipher module 316 .
- Preprocessed key related data T i (K) is input to the personalized stream cipher module 316 .
- T i (K) contains a preprocessed key K that has been preprocessed by a setup function and a key expansion function in a preprocessing module 811 external to the personalized stream cipher module 316 .
- the preprocessed key K is transformed.
- T i (K) is input to a XOR module 415 for descrambling a ciphertext C. Similar to the working of the tables in the personalized confusion modules of the block cipher embodiments, the XOR tables in the XOR module are personalized to inverse the transformation.
- FIG. 19 shows an example of an alternative personalized whitebox stream cipher module 317 .
- Preprocessed key related data T i (K) is input to the personalized stream cipher module 317 .
- T i (K) contains a preprocessed key K that has been preprocessed by a setup function in a preprocessing module 811 external to the personalized stream cipher module 317 .
- the preprocessed key K is transformed.
- T i (K) is input to a key expansion module 513 to obtain a personalized expanded key PEK.
- the PEK is input to a XOR module 416 for descrambling a ciphertext C. Similar to the working of the tables in the personalized confusion modules of the block cipher embodiments, the XOR tables in the XOR module may be personalized to inverse the transformation. Alternatively the key expansion module 513 performs the inverse transformation.
- the following exemplary embodiment shows how a personalized descrambler may be secured using personalized whitebox descramblers based on a public key cipher.
- FIG. 21 shows an example of a personalized public key cipher module 318 .
- T i (K) ⁇ K ⁇ K1 ⁇
- T i K
- the obtained expanded personalized key PEK is input to a personalized decipher module 417 for deciphering an input ciphertext C.
- the ciphertext C may me modified in modification module 4051 into an intermediate ciphertext C 1 prior to being input to the personalized decipher module 417 .
- FIG. 22 shows a conditional access system 260 of an exemplary embodiment of the invention.
- a head-end system 250 transmits ECMs, EMMs and a content stream scrambled with a CW (i.e. a ciphertext) to one or more receivers 111 via a distribution network 270 .
- the ECM typically contains one or more encrypted CWs.
- the ECMs are processed by a secure device 280 that is communicatively connected to the receiver 111 .
- the receiver contains a personalized descrambler 311 , 312 , 313 , 314 , 315 , 316 , 317 or 318 .
- the secure device 280 is e.g. a smartcard and typically contains a secure client 211 as described with FIG. 11 .
- the CWs are preprocessed in a preprocessing module 811 in the head-end system 250 or alternatively in a preprocessing module 811 in the secure client 211 .
- any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments.
- One embodiment of the invention may be implemented as a program product for use with a computer system.
- the program(s) of the program product define functions of the embodiments (including the methods described herein) and can be contained on a variety of computer-readable storage media.
- Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive, ROM chips or any type of solid-state non-volatile semiconductor memory) on which information is permanently stored; and (ii) writable storage media (e.g., floppy disks within a diskette drive or hard-disk drive or any type of solid-state random-access semiconductor memory or flash memory) on which alterable information is stored.
- non-writable storage media e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive, ROM chips or any type of solid-state non-volatile semiconductor memory
- writable storage media e.g., floppy disks within a diskette drive or hard-disk drive or any type of solid-state random-access semiconductor memory or flash memory
Abstract
Description
- The present invention relates to whitebox descramblers. More specifically, the invention relates to whitebox descramblers in receivers of a conditional access system.
- In Pay TV applications an encrypted (scrambled) broadcast stream forms a ciphertext ‘C’ that is decrypted (descrambled) in a broadcast receiver to obtain a descrambled broadcast stream ‘M’. Typically, multiple broadcast receivers receive the same broadcast stream and decrypt the broadcast stream with the same key (Control Word) ‘CW’. The value of the CW is updated regularly and is delivered to the receivers in encrypted form in an entitlement control message ‘ECM’ that can be decrypted by authorized subscribers.
- ECM processing can be implemented in various manners.
FIG. 1 a shows an example wherein ECM processing is implemented in a smartcard, which uses hardware tamper resistance techniques to provide a secured execution environment. Decryption of the broadcast stream C is implemented in ahardware circuit 301 of a chip in areceiver 101 for the obtainment of a descrambled broadcast stream, denoted by ‘M’. Asecure client 201 is implemented in hardware of the smartcard for obtaining an CW from an ECM. Hardware tamper resistance technology secures the implementation against attacks. -
FIG. 1 b shows an alternative example, wherein ECM processing is based on software techniques. The software runs as a softwaresecure client 202 in areceiver 102 and loads the keys (CWs) into ahardware descrambler 301 of thereceiver 102 in encrypted form based on a key hierarchy loaded in the descrambler chip. -
FIG. 1 c shows another alternative example, wherein the both asecure client 202 and adescrambling function 302 of areceiver 103 are implemented in software. The software implementedreceiver 103 lacks a hardware hook, such as e.g. a chipset unique key ‘CSUK’ or a chipset serial number ‘CSSN’ stored in a read-only memory of a chipset. As a result, thedescrambling function 302 cannot be restricted to a particular receiver based on such hardware hook, making the software implementedreceiver 302 more vulnerable to hacking attacks. -
FIG. 2 a shows an example of a descrambler module. A ciphertext C is decrypted in thedescrambler module 303 with a fixed key K into a plaintext M. The key K is embedded or preloaded in thedescrambler module 303. -
FIG. 2 b shows an alternative descrambler module, wherein several instances of adescrambler module 304 can be made by loading values of K from an external source. - Many existing broadcast descrambling algorithms, such as DVB (digital video broadcasting), DES (data encryption standard) and AES (advanced encryption standard), are based on block ciphers. Block ciphers operate by dividing an input ciphertext stream in fixed sized blocks. Each block is processed by repeatedly applying a relatively simple function. This approach is known as iterated block cipher. Each iteration is called a round, and the repeated function is called a round function. Typical block ciphers have 4 to 32 rounds.
-
FIG. 3 shows a typical inner working of a prior art iteratedblock cipher 305 as may be used as thedescrambling module 304 ofFIG. 2 b. A ciphertext C is received and divided in blocks. Each block of ciphertext C is processed over ‘n’ rounds into the plaintext message ‘M’. Each round ‘r’ receives its own round key ‘RKr’ as input, which is calculated from the original key ‘K’ in akey schedule module 501. In whitebox cryptography, each blockcipher round module - Alternatively, a fixed-key variant using a
descrambling module 303 as shown inFIG. 2 a may be used in the iteratedblock cipher 305. Thekey schedule module 501 as shown inFIG. 3 is then replaced by a module embedding a fixed input ‘RKr’ to each round. - A block
cipher round module FIG. 3 is shown in more detail inFIG. 4 . The blockcipher round function 401 contains two modules that operate in sequence. Adiffusion module 601 modifies an input Cr-1 randomly. The thus obtained C′r-1 is input to aconfusion module 701. The purpose of theconfusion module 701 is to mix the round key RKr with the ciphertext C′r-1, making it mandatory to provide the relevant round key RKr to produce the output Cr for the next decryption round. - A block cipher round module may be personalized by having a unique function, in whitebox cryptography typically using a table-driven lookup implementation, that performs the confusion function. An example of a prior art table-driven lookup implementation will be described in more detail with
FIG. 7 . - A whitebox iterated block cipher using AES encryption is known from “White-Box Cryptography and an AES Implementation” by S. Chow, P. Eisen, H. Johnson, P. C. van Oorschot, Proceedings of the 9th Annual Workshop on Selected Areas in Cryptography, August 2002. In the whitebox implementation of AES each block cipher round consists of four parts: SubBytes, ShiftRows, MixColumns and AddRoundKey. The first three parts correspond to the operations in the diffusion module and the AddRoundKey part is comparable to the confusion module.
- To protect intermediate values that are passed from one module to the next from being interceptable, whitebox iterated block cipher implementations typically apply a random permutation to the output of lookup tables (see also
FIG. 7 ), and the inverse of that permutation to the input of a next lookup table. - A
simplified block cipher 306 applying a random permutation consisting of two rounds in blockcipher round modules 4021 and 4022 and with a block and key size of two bits is shown inFIG. 5 . InFIG. 6 a blockcipher round module 402 is shown in mode detail. InFIG. 5 each arrow represents a dataflow of two bits. InFIG. 6 each arrow represents a single bit data flow. Thediffusion module 602 swaps the two bits of input Cr-1 and replaces the second bit by their binary sum (XOR). The thus obtained C′r-1 is input to theconfusion module 702. Theconfusion module 702 performs a binary addition (XOR) of the two input bits of C′r-1 with the relevant bit of the round key RKr. With reference toFIG. 5 , thekey schedule module 502 receives a key K and generates the two round keys ‘RK1=K’ and ‘RK2=K⊕10’ where ‘10’ denotes a binary vector and ⊕ is a XOR operation. - A simplified example of a whitebox lookup table driven
implementation 307 of thesimplified block cipher 306 ofFIG. 5 andFIG. 6 is shown inFIG. 7 . In the example ofFIG. 7 , thekey schedule module 503 receives a binary key ‘K=11’ and expands the key K into two round keys: ‘RK1=11’ and ‘RK2=01’ using a table lookup. The table lookup is visualized by the predefined paths following a particular key input. Following the arrows for key input K=11, the tworound keys cipher round module 4031 uses a table lookup in thediffusion module 603 to produce the intermediary output ‘C′0=10’, which is input to theconfusion module 703. Theconfusion module 703 adds the round key RK1 resulting in the output ‘C1=01’ that is input to the second blockcipher round module 4032. In the second blockcipher round module 4032, in a similar manner thediffusion module 603 obtains ‘C′1=11’ and theconfusion module 703 obtains ‘C2=10’. The second blockcipher round module 4032 generates the cleartext message ‘M’ as the output of the block cipher decryption operation: ‘M=C2=10’. - As an alternative to using block ciphers as broadcast descrambling algorithm, stream ciphers and public key cryptosystems are known.
-
FIG. 17 shows a typical inner working of a priorart stream cipher 308 as may be used as analternative descrambling module 304 ofFIG. 2 b. Asetup module 5041 initializes the internal state of the cipher in a manner known per se. Initialization typically involves an initial vector (IV) that is loaded into a keyed internal secret state of the cipher, after which a number of cipher rounds is executed on an input key K prior to releasing an initialized key to the next module. Akey expansion module 5042 creates an expanded key EK from the initialized key to match the size of the ciphertext C. The expanded key EK is provided to aXOR module 404, where an input ciphertext C is descrambled using a XOR operation with the expanded key EK. -
FIG. 20 shows a typical inner working of a prior art publickey cipher 309 as may be used as anotheralternative descrambling module 304 ofFIG. 2 b. Anexponentiation module 505 processes an input key K, typically by applying a modular exponentiation like ‘EK=GK mod N’. The thus obtained expanded key EK is input to a deciphermodule 4052 for deciphering an input ciphertext C. As part of the deciphering of ciphertext C, the ciphertext C may me modified inmodification module 4051 into an intermediate ciphertext C1 prior to being input to the deciphermodule 4052. - A known problem in Pay TV application is the redistribution of CW key values using broadband communication infrastructures such as the Internet. Hackers intercept CW values and insert the CW values into a redistribution infrastructure, e.g. using a peer-to-peer network. Unauthorized receivers obtain the appropriate CW key values from the redistribution infrastructure and use the thus obtained CW values to decrypt a broadcast stream. More specifically, intercepted keys are used in unauthorized whitebox descrambler modules for the decryption of a ciphertext.
- It is an object of the invention to prevent intercepted keys from being used in unauthorized whitebox descrambler modules for the decryption of a ciphertext.
- According to an aspect of the invention a whitebox descrambler is proposed for descrambling a ciphertext to obtain a cleartext message. The descrambler is configured to receive a personalized transformed key from an external preprocessing module. The descrambler is further configured to receive the input ciphertext. The descrambler is further configured to generate an output data by applying a second part of a descrambling operation to the input ciphertext using the personalized transformed key as an input to the second part of the descrambling operation. The descrambler is further configured to apply an inverse transformation to the personalized transformed key before generating the output data. The personalized transformed key comprises preprocessed data as a result of applying a first part of the descrambling operation in the external preprocessing module.
- According to an aspect of the invention a method is proposed for use in a whitebox descrambler for descrambling a ciphertext to obtain a cleartext message. The method comprises receiving a personalized transformed key from an external preprocessing module. The method further comprises receiving the input ciphertext. The method further comprises generating an output data by applying a second part of a descrambling operation to the input ciphertext using the personalized transformed key as an input to the second part of the descrambling operation. The method further comprises applying an inverse transformation to the personalized transformed key before generating the output data. The personalized transformed key comprises preprocessed data as a result of applying a first part of the descrambling operation in the external preprocessing module.
- The inverse transformation is either performed as a separate distinguishable step or integrated in the second part of the descrambling operation. If the inverse transformation is integrated in the second part of the descrambling operation, a single mathematical operation may perform both the inverse transformation and the descrambling operation.
- In the external preprocessing module the preprocessed data is generated by applying the first part of the descrambling operation to a decryption key. In a conditional access system this key is also known as a control word.
- By performing the first part of the descrambling operation outside the descrambler and furthermore personalize the resulting modified key by transforming the result such that only a particular (i.e. authorized) descrambler can inverse the transformation, intercepting the personalized transformed key for redistribution to another receiver advantageously becomes useless. The other receiver would have to inverse the transformation and have knowledge of the second part of the descrambling operation as implemented in the particular authorized receiver, which is substantially impossible.
- The embodiments of
claims 2 and 12 enable use of iterated block cipher based descramblers. Advantageously, intercepted keys for an authorized iterated block cipher based descrambler cannot be used in an unauthorized iterated block cipher based descrambler. - The embodiments of claims 3-6 and claims 13-15 advantageously enable various alternative implementations of iterated block cipher based descramblers.
- The embodiment of claim 7 enables use of stream cipher based descramblers and public key based descramblers. Advantageously, intercepted keys for an authorized stream cipher based descrambler or an authorized public key based descrambler cannot be used in an unauthorized stream cipher based descrambler or an unauthorized public key based descrambler.
- According to an aspect of the invention a receiver is proposed for use in a conditional access system. The receiver comprises a descrambler having one or more of the above mentioned features.
- Thus, the descrambler can advantageously be integrated in a receiver, enabling the descrambler to be used in a conditional access system.
- According to an aspect of the invention a secure client is proposed for use in a conditional access system. The secure client comprises an input for receiving an encrypted control word from a head-end system via the intermediary of a receiver. The secure client further comprises a memory configured to store a product key. The secure client further comprises a decryption module configured to decrypt the encrypted control word using the product key to obtain the control word. The secure client further comprises a preprocessing module configured to apply a first part of a descrambling operation to the control word to obtain a modified control word and to transform the modified control word to obtain a personalized transformed control word. The secure client further comprises an output for providing the personalized transformed control word to the receiver.
- According to an aspect of the invention a method is proposed for use in a secure client of a conditional access system. The method comprises receiving an encrypted control word from a head-end system via the intermediary of a receiver. The method further comprises decrypting the encrypted control word using a product key from a memory to obtain the control word. The method further comprises applying a first part of a descrambling operation to the control word to obtain a modified control word. The method further comprises transforming the modified control word to obtain a personalized transformed control word. The method further comprises providing the personalized transformed control word to the receiver.
- In the preprocessing module preprocessed data is generated for use in a second part of the descrambling operation in a descrambler module of the receiver. The first part of the descrambling operation is typically applied to a decryption key. In a conditional access system this key is known as the control word.
- By performing the first part of the descrambling operation outside the descrambler and furthermore personalize the resulting modified key by transforming the result such that only a particular (i.e. authorized) descrambler can inverse the transformation, intercepting the personalized transformed key for redistribution to another receiver advantageously becomes useless. The other receiver would have to inverse the transformation and have knowledge of the second part of the descrambling operation as implemented in the particular authorized receiver, which is substantially impossible.
- According to an aspect of the invention a head-end system is proposed for use in a conditional access system. The head-end system comprises a preprocessing module configured to apply a first part of a descrambling operation to a control word to obtain a modified control word and to transform the modified control word to obtain a personalized transformed control word. The head-end system further comprises an output for providing the personalized transformed control word and a ciphertext to a receiver according having one or more of the above mentioned features.
- In the preprocessing module preprocessed data is generated for use in a second part of the descrambling operation in a descrambler module of the receiver. The first part of the descrambling operation is typically applied to a decryption key. In a conditional access system this key is known as the control word.
- By performing the first part of the descrambling operation outside the descrambler and furthermore personalize the resulting modified key by transforming the result such that only a particular (i.e. authorized) descrambler can inverse the transformation, intercepting the personalized transformed key for redistribution to another receiver advantageously becomes useless. The other receiver would have to inverse the transformation and have knowledge of the second part of the descrambling operation as implemented in the particular authorized receiver, which is substantially impossible.
- According to an aspect of the invention a computer program element is proposed. The computer program element is, when being executed by a processor, adapted to carry out a method for use in a whitebox descrambler having one or more of the above mentioned features.
- This advantageously enabled the descrambler to be implemented in software.
- Hereinafter, embodiments of the invention will be described in further detail. It should be appreciated, however, that these embodiments may not be construed as limiting the scope of protection for the present invention.
- Aspects of the invention will be explained in greater detail by reference to exemplary embodiments shown in the drawings, in which:
-
FIG. 1 a shows a prior art receiver and secure client; -
FIG. 1 b shows another prior art receiver and secure client; -
FIG. 1 c shows another prior art receiver and secure client; -
FIG. 2 a shows a block diagram of a prior art descrambler; -
FIG. 2 b shows another block diagram of a prior art descrambler; -
FIG. 3 shows a prior art descrambler in more detail; -
FIG. 4 shows a prior art block cipher round module; -
FIG. 5 shows another prior art descrambler in more detail; -
FIG. 6 shows another prior art block cipher round module; -
FIG. 7 shows a prior art block cipher based descrambler; -
FIG. 8 shows a diagram clarifying transformation functions and encryption in general terms; -
FIG. 9 shows a receiver and a secure client of an exemplary embodiment of the invention; -
FIG. 10 a shows a block diagram of a descrambler of an exemplary embodiment of the invention; -
FIG. 10 b shows block diagram of a descrambler of another exemplary embodiment of the invention; -
FIG. 11 shows a receiver and a secure client of another exemplary embodiment of the invention; -
FIG. 12 shows a descrambler of an exemplary embodiment of the invention; -
FIG. 13 shows a block cipher round module of an exemplary embodiment of the invention; -
FIG. 14 shows a whitebox iterated block cipher based descrambler of an exemplary embodiment of the invention; -
FIG. 15 shows a whitebox iterated block cipher based descrambler of another exemplary embodiment of the invention; -
FIG. 16 shows a whitebox iterated block cipher based descrambler of another exemplary embodiment of the invention; -
FIG. 17 shows a prior art stream cipher based descrambler; -
FIG. 18 shows a whitebox stream cipher based descrambler of an exemplary embodiment of the invention; -
FIG. 19 shows a whitebox stream cipher based descrambler of another exemplary embodiment of the invention; -
FIG. 20 shows a prior art public key based descrambler; -
FIG. 21 shows a whitebox public key based descrambler of an exemplary embodiment of the invention; -
FIG. 22 shows a conditional access system of an exemplary embodiment of the invention; -
FIG. 23 shows a method in a whitebox descrambler of an exemplary embodiment of the invention; -
FIG. 24 shows a method in a whitebox descrambler of another exemplary embodiment of the invention; and -
FIG. 25 shows a method in a secure client of an exemplary embodiment of the invention. - The invention prevents intercepted keys from being used in unauthorized whitebox descrambler modules for the decryption of a ciphertext. Hereto a receiver with a personalized whitebox descrambler is proposed, such as e.g. shown in
FIG. 9 , whereby a part of the descrambling operation of the personalized descrambler is performed in a preprocessing module external to the descrambler. - With reference to
FIG. 9 , thepersonalized descrambler 311 is typically implemented as an obfuscated software module in thereceiver 111. Alternatively, the personalized descrambler may be implemented in programmable hardware. Each receiver in a conditional access network typically has a uniquepersonalized descrambler 311. Asecure client 211 is typically communicatively connected to thereceiver 111 to provide descrambler specific key related data to thepersonalized descrambler 311 to achieve a common descrambling function. Hereto, thesecure client 211 is implemented such that a part of the descrambling operation of thepersonalized descrambler 311 is performed in apreprocessing module 811 of thesecure client 211. Thesecure client 211 is typically implemented in hardware of a smartcard. Thepreprocessing module 811 may be implemented as an obfuscated software module running in thesecure client 211. - Alternatively the descrambler specific key related data is provided from a head-end system to the receiver, possibly via the intermediary of a smartcard. The
preprocessing module 811 is then a part of the head-end system. - The personalized whitebox descrambler of the invention uses the descrambler specific preprocessed key-related data as input.
- In conditional access systems the wording ‘CW’ or ‘control word’ is a synonym of a ‘key’.
- Software obfuscation techniques make use of transformation functions to obfuscate intermediate results. The concept of transformation functions differs from encryption, which is clarified in general with reference to
FIG. 8 . - Assume, there exists an input domain ID with a plurality of data elements in a non-transformed data space. An encryption function E using some key is defined that is configured to accept the data elements of input domain ID as an input to deliver a corresponding encrypted data element in an output domain OD. By applying a decryption function D, the original data elements of input domain ID can be obtained by applying the decryption function D to the data elements of output domain OD. In a non-secure environment (typically referred to as “white box”), an adversary is assumed to know the input and output data elements and the encryption function E, such that the key can be derived.
- Additional security can be obtained in a non-secured environment by applying transformation functions to the input domain ID and output domain OD, i.e. the transformation functions are input- and output operations. Transformation function T1 maps data elements from the input domain ID to transformed data elements of transformed input domain ID′ of a transformed data space. Similarly, transformation function T2 maps data elements from the output domain OD to the transformed output domain OD′. Transformed encryption and decryption functions E′ and D′ can now be defined between ID′ and OD′ using transformed keys. T1 and T2 are bijections.
- Using transformation functions T1, T2, together with encryption techniques implies that, instead of inputting data elements of input domain ID to encryption function E to obtain encrypted data elements of output domain OD, transformed data elements of domain ID′ are input to transformed encryption function E′ by applying transformation function T1. Transformed encryption function E′ combines the inverse transformation functions T1 −1 and/or T2 −1 in the encryption operation to protect the confidential information, such as the key. Then transformed encrypted data elements of domain OD′ are obtained. By performing T1 and/or T2 in a secured portion, keys for encryption functions E or decryption function D cannot be retrieved when analysing input data and output data in the transformed data space.
- One of the transformation functions T1, T2 should be a non-trivial function. In case, T1 is a trivial function, the input domains ID and ID′ are the same domain. In case, T2 is a trivial function, the output domains are the same domain.
- In white box cryptology, it is assumed that this process is performed completely in a hostile environment, wherein an attacker has access to the data elements in ID, OD and the functions E and D. White box cryptology provides security by securing (parts of) the keys for the functions E and D. By applying transformation functions T1 and T2 in at least one of the smart card or a secured portion the receiver, the lookup tables Ln as applied in white box cryptology cannot be resolved in the transformed space.
- The software implementations of the secure client and the descrambler use software transformations to secure software applications. Transformations are typically used in whitebox cryptography, wherein a decryption key is merged with the decryption steps of the algorithm to achieve a software program that can decrypt a ciphertext C.
-
FIG. 10 a shows a whitebox implementation ofFIG. 2 b, wherein a key is provided to adecryption module 3111 in a transformed format. The transformed key T(K) is loaded in the whitebox implementation of thedecryption module 3111. Thedecryption module 3111 transforms T(K) to obtain the key K before applying a descrambling operation with the key K. The implementation of thedecryption module 3111 ensures that an attacker with knowledge of thedecryption module 3111 and the value of T(K) cannot recover K. In variants of this scheme, the ciphertext input C and/or the decrypted output M can be transformed as well. -
FIG. 10 b shows apersonalized whitebox descrambler 3112 that uses descrambler specific key-related data Ti(K) that has been preprocessed prior to being input to thewhitebox descrambler 3112. The index ‘i’ is used to indicate thespecific descrambler 3112. The preprocessed key related data Ti(K) is construed such that it can be used in the correspondingpersonalized whitebox descrambler 3112 only. Thereto, each receiver uses a personalized transformation Ti of the key. - The transformed key Ti(K) is loaded in the whitebox implementation of the
descrambler 3112 for decrypting the broadcast stream C. The implementation of thedescrambler 3112 ensures that an attacker with knowledge of the implementation and the value of Ti(K) cannot recover the key K. Moreover the attacker will not be able to generate key-related data Ti(K) for another receiver (indicated by ‘j’), which receiver has a personalized whitebox descrambler using a personalized transformation Tj. - With known descramblers, such as e.g. shown in
FIG. 5 ,FIG. 17 andFIG. 20 , the input key K could be intercepted and redistributed to other receivers for descrambling a broadcast stream C. Because the key related data Ti(K) is unique to a receiver, the key related data T1(K) is useless for any other receiver. Hence, intercepting the input key related data Ti(K) and redistribution to other receivers is advantageously no longer is useful. -
FIG. 11 shows a more detailed example of areceiver 111 with apersonalized whitebox descrambler 311 of an exemplary embodiment of the invention. In the example ofFIG. 11 a personalized key data Ti(CW) is generated by preprocessing a CW in asecure client 211 of a smartcard. More specifically, apreprocessing module 811 is used in thesecure client 211 to preprocess the CW outside thedescrambler 311 of thereceiver 111. Herewith, a part of the descrambling operation of thepersonalized descrambler 311 is performed in thepreprocessing module 811. Thepreprocessing module 811 performs a transformation function before providing the personalized key data Ti(CW) to thedescrambler 311. Alternatively the CW may be preprocessed in a preprocessing module of a head-end system and transmitted to the receiver from the head-end system to the receiver, possibly via the intermediary of a smartcard. - The
receiver 111 receives an input stream ‘input’ from a broadcast network in a manner known per se. In a conditional access system the input stream is typically an MPEG-2 or DVB transport stream and contains multiple TV channels (i.e. program streams) as well as encrypted information containing the keys required for descrambling a program stream. For the descrambling of a program stream, the key is commonly called a Control Word or CW. A demux/filter module 901 in thereceiver 111 forwards a part of the transport stream that corresponds to a user selected program stream ‘C’, which is a ciphertext, to thedescrambler 311. The demux/filter module 901 further extracts to the program stream C relevant information from the encrypted information, such as Entitlement Management Messages (EMM) and Entitlement Control Messages (ECM), and sends the information to thesecure client 211. The ECM contains the CW encrypted with a product key PK, which is shown inFIG. 11 as EPK(CW). Thesecure client 211 receives the ECM and decrypts it in adecryption module 902 with a pre-stored PK value read from a securedkey storage module 903. Thepreprocessing module 811 processes the CW into a descrambler specific transformed form Ti(CW). The descrambler specific CW transformation in thesecure client 211 is linked to thepersonalized descrambler 311 in thereceiver 111 using knowledge of the receiver identity ‘i’, which may be communicated from thedescrambler 311 to thepreprocessing module 811. A part of the descrambling operation of thepersonalized descrambler 311 is performed in thepreprocessing module 811. - Use of the transformed key Ti(CW) in the
personalized descrambler 311 needs to be secure. This means that it should be difficult to obtain the CW from the transformed key Ti(CW) and from thepersonalized descrambler 311. Moreover, it should be hard to calculate a valid transformed key for a different particularpersonalized descrambler 111. - The following exemplary embodiments show how a personalized descrambler may be secured using personalized whitebox descramblers based on block ciphers.
- In the exemplary embodiment of
FIG. 12 , the personalized descrambler is apersonalized block cipher 312. Similar to theblock cipher 305 as shown inFIG. 3 , a block of ciphertext C is processed over ‘n’ rounds into a plaintext message M using blockcipher round modules 4111,4112. In thepersonalized block cipher 312, each round ‘r’ receives its own personalized round key ‘PRKi r’ as input, which is derived from the received personalized key data Ti(K) in thekey partitioning module 511. -
FIG. 13 shows an example of a personalized block cipher round module 412 that may be used as blockcipher round module 4111,4112 as shown inFIG. 12 . The block cipher round module 412 has adiffusion module 611 that operates similar to thediffusion module 601 shown inFIG. 4 . The Personalized Round Key ‘PRKi r’ is input to apersonalized confusion module 711. The Personalized Round Key is calculated by applying a bitwise XOR with a Unique Key ‘UKi r’ for round ‘r’ and personalized descrambler ‘i’. A repeated XOR operation with the same Unique Key in the Personalized Confusion module removes the transformation of the Personalized Round Key. - A simplified example of a whitebox lookup table driven
implementation 313 of thepersonalized block cipher 312 ofFIG. 12 is shown inFIG. 14 . In the example ofFIG. 14 , a transformed binary key ‘Ti(K)=1011’ is the personalized version of a common key ‘K=11’ as shown in the prior art example ofFIG. 7 . Moreover, the personalized key Ti(K) has already been expanded in anexternal preprocessing module 811 from a two bit value to a four bit value. The blockcipher round modules cipher round modules FIG. 7 . The exemplary embodiment of the invention ofFIG. 14 differs fromFIG. 7 in that thepersonalized descrambler 313 operates on the personalized input key Ti(K). - In the example of
FIG. 14 , akey partitioning module 5121 selects a two-bit personalized round key ‘PRKi r’ from the string of personalized round keys that are contained in the transformed key. The transformed key ‘T1(K)=1011’ is a concatenation of ‘PRKi 1=10’ and ‘PRKi 2=11’. Apersonalizing module 5122 transforms each ‘PRKi r’ using a XOR operation ⊕ with a preprogrammed Unique Key ‘UKi r’. Unique keys ‘UKi 1=11’ and ‘UKi 2=01’ are used to convert the personalized round keys into common round keys that are used in the blockcipher round modules - In
FIG. 14 , ciphertext ‘C=11’ is input to the first blockcipher round module 4121.Diffusion module 611 uses a lookup table to change the input value ‘C=11’ into ‘10’. Theconfusion module 711 uses a lookup table to convert the value ‘10’ into ‘01’ using the first common round key value ‘11’ to select the appropriate column of the lookup table. Intermediary result ‘C1=01’ is input to the second blockcipher round module 4122.Diffusion module 611 uses a lookup table to change the input value ‘C1=01’ into ‘11’. Theconfusion module 711 uses a lookup table to convert the binary value ‘11’ into ‘10’ using the second common round key value ‘01’ to select the appropriate column of the lookup table. Final result ‘M=10’ is the descrambled message. - The XOR operation ⊕ as shown for the
personalizing module 5122 may be integrated in the blockcipher round modules FIG. 15 , wherein apersonalized confusion module 712 processes the ‘PRKi r’ values as they are extracted from the transformed key ‘Ti(K)=1011’. Theconfusion module 712 is personalized by changing the column order of the lookup tables in theconfusion module 712. Thekey partition module 5121 receives the transformed binary key ‘Ti(K)=1011’ and partitions it into the two personalized round keys, ‘PRKi 1=10’ and ‘PRKi 2=11’. Theconfusion modules 712 have been personalized by a specific arrangement of order of the columns to process a personal round key ‘PRK’ into the correct output. Another receiver will have differently personalized confusion modules and will not be able to decrypt the ciphertext with the transformed key for receiver ‘i’. - In
FIG. 15 , ciphertext ‘C=11’ is input to the first blockcipher round module 4131.Diffusion module 611 uses a lookup table to change the input value ‘C=11’ into ‘10’. Thepersonalized confusion module 712 uses a lookup table to convert the value ‘10’ into ‘01’ using the first personal round key value ‘10’ to select the appropriate column of the lookup table. Intermediary result ‘C1=01’ is input to the second blockcipher round module 4132.Diffusion module 611 uses a lookup table to change the input value ‘C1=01’ into ‘11’. Thepersonalized confusion module 712 uses a lookup table to convert the binary value ‘11’ into ‘10’ using the second personal round key value ‘11’ to select the appropriate column of the lookup table. Final result ‘M=10’ is the descrambled message. - An alternative embodiment of a block cipher as personalized descrambler module is shown in
FIG. 16 , wherein the confusion functionality in each blockcipher round function block cipher round FIG. 16 a transformed input binary key ‘Ti(K)=0110’ is partitioned into two personalized round keys ‘PRKi 1=01’ and ‘PRKi 2=10’ in akey partitioning module 5121. In thepersonalized confusion modules 713, each bit of the personalized round key ‘PRK’ indicates whether the corresponding table should be used or not. In this way, thepersonalized confusion module 713 generates the correct output. - In
FIG. 16 , a two-bit ciphertext ‘C=11’ is input to the first blockcipher round module 4141. Adiffusion module 611 transforms the ciphertext into binary value ‘10’, which is input to thepersonalized confusion module 713. Personalized round key ‘PRKi 1=01’ is used by thepersonalized confusion module 713 of the first blockcipher round module 4141 to determine which transformation tables are to be applied to the binary input ‘10’. The first bit of PRKi 1 equals ‘0’, which is interpreted as not to use the first transformation table. The second bit of PRKi 1 equals ‘1’, which is interpreted as to transform the input ‘10’ to ‘01’ in accordance with the second transformation table. The binary value ‘01’ is provided to the second blockcipher round module 4142, where thediffusion module 611 first transforms the data from ‘01’ into ‘11’. This data is input to thepersonalized confusion module 713 of the second blockcipher round module 4142. The first bit of PRKi 2 equals ‘1’, which is interpreted as to transform the input ‘11’ to ‘10’ in accordance with the first transformation table. The second bit of PRKi 2 equals ‘0’, which is interpreted as not to use the second transformation table on the result after the first transformation table. The output of the second blockcipher round module 4142 is the final result of thepersonalized descrambler 315, thus the descrambled message equals ‘M=10’. - Different receivers with a block cipher as shown in
FIG. 16 are typically preprogrammed with different personalized confusion modules, i.e. with a different set of transformation tables in the personalized confusion modules, and will therefore advantageously not be able to decrypt the input ciphertext C with an intercepted transformed input binary key ‘Ti(K)’ of other receivers. - It is to be understood that the invention is not limited to two-bit data operations with two block cipher rounds as shown in the various examples. For example, AES block ciphers typically use a 128-bit cipher block size and a key size of 128, 192 or 256 bits in 10, 12 or 14 block cipher rounds. For example, DES block ciphers typically use a 64-bit cipher block size and a 56-bit key size in 16 block cipher rounds.
- The following exemplary embodiments show how a personalized descrambler may be secured using personalized whitebox descramblers based on stream ciphers.
-
FIG. 18 shows and example of a personalized whiteboxstream cipher module 316. Preprocessed key related data Ti(K) is input to the personalizedstream cipher module 316. Ti(K) contains a preprocessed key K that has been preprocessed by a setup function and a key expansion function in apreprocessing module 811 external to the personalizedstream cipher module 316. Moreover, the preprocessed key K is transformed. Ti(K) is input to aXOR module 415 for descrambling a ciphertext C. Similar to the working of the tables in the personalized confusion modules of the block cipher embodiments, the XOR tables in the XOR module are personalized to inverse the transformation. -
FIG. 19 shows an example of an alternative personalized whiteboxstream cipher module 317. Preprocessed key related data Ti(K) is input to the personalizedstream cipher module 317. Ti(K) contains a preprocessed key K that has been preprocessed by a setup function in apreprocessing module 811 external to the personalizedstream cipher module 317. Moreover, the preprocessed key K is transformed. Ti(K) is input to akey expansion module 513 to obtain a personalized expanded key PEK. The PEK is input to aXOR module 416 for descrambling a ciphertext C. Similar to the working of the tables in the personalized confusion modules of the block cipher embodiments, the XOR tables in the XOR module may be personalized to inverse the transformation. Alternatively thekey expansion module 513 performs the inverse transformation. - The following exemplary embodiment shows how a personalized descrambler may be secured using personalized whitebox descramblers based on a public key cipher.
-
FIG. 21 shows an example of a personalized publickey cipher module 318. The value of the key K is hidden by setting Ti(K)={K−K1} in anexternal preprocessing module 811. Apersonalized exponentiation module 514 calculates a personalized expanded key ‘PEK=G(K+K1) mod N’ using input Ti(K). Thus a personalized version of the public key algorithm is created by varying the value of ‘K1’. The obtained expanded personalized key PEK is input to a personalized deciphermodule 417 for deciphering an input ciphertext C. As part of the deciphering of ciphertext C, the ciphertext C may me modified inmodification module 4051 into an intermediate ciphertext C1 prior to being input to the personalized deciphermodule 417. -
FIG. 22 shows aconditional access system 260 of an exemplary embodiment of the invention. A head-end system 250 transmits ECMs, EMMs and a content stream scrambled with a CW (i.e. a ciphertext) to one ormore receivers 111 via adistribution network 270. The ECM typically contains one or more encrypted CWs. The ECMs are processed by asecure device 280 that is communicatively connected to thereceiver 111. The receiver contains apersonalized descrambler secure device 280 is e.g. a smartcard and typically contains asecure client 211 as described withFIG. 11 . The CWs are preprocessed in apreprocessing module 811 in the head-end system 250 or alternatively in apreprocessing module 811 in thesecure client 211. - It is to be understood that any feature described in relation to any one embodiment may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments, or any combination of any other of the embodiments. One embodiment of the invention may be implemented as a program product for use with a computer system. The program(s) of the program product define functions of the embodiments (including the methods described herein) and can be contained on a variety of computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., read-only memory devices within a computer such as CD-ROM disks readable by a CD-ROM drive, ROM chips or any type of solid-state non-volatile semiconductor memory) on which information is permanently stored; and (ii) writable storage media (e.g., floppy disks within a diskette drive or hard-disk drive or any type of solid-state random-access semiconductor memory or flash memory) on which alterable information is stored. Moreover, the invention is not limited to the embodiments described above, which may be varied within the scope of the accompanying claims.
Claims (20)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/089,452 US20140086409A1 (en) | 2010-03-26 | 2013-11-25 | Personalized whitebox descramblers |
US15/297,945 US20170111167A1 (en) | 2010-03-26 | 2016-10-19 | Personalized whitebox descramblers |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP10157952.2 | 2010-03-26 | ||
EP10157952.2A EP2369778B1 (en) | 2010-03-26 | 2010-03-26 | Personalized whitebox descramblers |
US13/070,003 US8594330B2 (en) | 2010-03-26 | 2011-03-23 | Personalized whitebox descramblers |
US14/089,452 US20140086409A1 (en) | 2010-03-26 | 2013-11-25 | Personalized whitebox descramblers |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/070,003 Continuation US8594330B2 (en) | 2010-03-26 | 2011-03-23 | Personalized whitebox descramblers |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/297,945 Continuation US20170111167A1 (en) | 2010-03-26 | 2016-10-19 | Personalized whitebox descramblers |
Publications (1)
Publication Number | Publication Date |
---|---|
US20140086409A1 true US20140086409A1 (en) | 2014-03-27 |
Family
ID=42232651
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/070,003 Active 2031-06-11 US8594330B2 (en) | 2010-03-26 | 2011-03-23 | Personalized whitebox descramblers |
US14/089,452 Abandoned US20140086409A1 (en) | 2010-03-26 | 2013-11-25 | Personalized whitebox descramblers |
US15/297,945 Abandoned US20170111167A1 (en) | 2010-03-26 | 2016-10-19 | Personalized whitebox descramblers |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/070,003 Active 2031-06-11 US8594330B2 (en) | 2010-03-26 | 2011-03-23 | Personalized whitebox descramblers |
Family Applications After (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/297,945 Abandoned US20170111167A1 (en) | 2010-03-26 | 2016-10-19 | Personalized whitebox descramblers |
Country Status (6)
Country | Link |
---|---|
US (3) | US8594330B2 (en) |
EP (1) | EP2369778B1 (en) |
JP (1) | JP5901884B2 (en) |
KR (1) | KR20110108322A (en) |
CN (1) | CN102238430B (en) |
CA (1) | CA2735080C (en) |
Families Citing this family (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP2227014B1 (en) * | 2009-03-02 | 2019-10-02 | Irdeto B.V. | Securely providing secret data from a sender to a receiver |
EP2829010B1 (en) * | 2012-03-20 | 2020-11-04 | Irdeto B.V. | Updating key information |
GB201305734D0 (en) | 2013-03-28 | 2013-05-15 | Irdeto Bv | Enabling a content receiver to access encrypted content |
KR101527329B1 (en) * | 2014-09-12 | 2015-06-09 | 삼성에스디에스 주식회사 | Apparatus and method for data encryption |
GB201418815D0 (en) | 2014-10-22 | 2014-12-03 | Irdeto Bv | Providing access to content |
DE102014016548A1 (en) * | 2014-11-10 | 2016-05-12 | Giesecke & Devrient Gmbh | Method for testing and hardening software applications |
JP6187624B1 (en) * | 2016-03-17 | 2017-08-30 | 富士電機株式会社 | Information processing apparatus, information processing method, and program |
KR102602696B1 (en) * | 2017-10-13 | 2023-11-16 | 삼성전자주식회사 | Encryption device and decryption device, and method of operation thereof |
WO2020186125A1 (en) | 2019-03-13 | 2020-09-17 | The Research Foundation For The State University Of New York | Ultra low power core for lightweight encryption |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20100251285A1 (en) * | 2009-03-02 | 2010-09-30 | Irdeto Access B.V. | Conditional entitlement processing for obtaining a control word |
US20100299515A1 (en) * | 2007-01-11 | 2010-11-25 | Koninklijke Philips Electronics N.V. | Tracing copies of an implementation |
Family Cites Families (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP3115350B2 (en) * | 1991-06-10 | 2000-12-04 | 富士通株式会社 | Encryption method |
JPH06303230A (en) * | 1993-04-19 | 1994-10-28 | Toshiba Corp | Scramble data transmission device |
WO1997016924A1 (en) * | 1995-10-31 | 1997-05-09 | Philips Electronics N.V. | Time-shifted conditional access |
RU2000111530A (en) * | 1997-10-02 | 2002-05-27 | Каналь+Сосьетэ Аноним | METHOD AND DEVICE FOR ENCRYPTED DATA STREAM TRANSLATION |
US6697489B1 (en) * | 1999-03-30 | 2004-02-24 | Sony Corporation | Method and apparatus for securing control words |
US7860243B2 (en) * | 2003-12-22 | 2010-12-28 | Wells Fargo Bank, N.A. | Public key encryption for groups |
WO2007116390A2 (en) * | 2006-04-11 | 2007-10-18 | Nds Limited | Fingerprinting descrambling keys |
JP4909668B2 (en) * | 2006-07-24 | 2012-04-04 | Kddi株式会社 | Hybrid encryption apparatus and hybrid encryption method |
JP5355554B2 (en) * | 2007-05-22 | 2013-11-27 | イルデト・コーポレート・ビー・ヴイ | Updating encryption key data |
EP2304552B1 (en) * | 2008-05-23 | 2019-11-06 | Irdeto B.V. | System and method for generating white-box implementations of software applications |
US8121294B2 (en) * | 2008-10-21 | 2012-02-21 | Apple Inc. | System and method for a derivation function for key per page |
-
2010
- 2010-03-26 EP EP10157952.2A patent/EP2369778B1/en active Active
-
2011
- 2011-03-23 US US13/070,003 patent/US8594330B2/en active Active
- 2011-03-24 CA CA2735080A patent/CA2735080C/en active Active
- 2011-03-25 CN CN201110121436.2A patent/CN102238430B/en active Active
- 2011-03-25 JP JP2011067650A patent/JP5901884B2/en not_active Expired - Fee Related
- 2011-03-28 KR KR1020110027675A patent/KR20110108322A/en not_active Application Discontinuation
-
2013
- 2013-11-25 US US14/089,452 patent/US20140086409A1/en not_active Abandoned
-
2016
- 2016-10-19 US US15/297,945 patent/US20170111167A1/en not_active Abandoned
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20100299515A1 (en) * | 2007-01-11 | 2010-11-25 | Koninklijke Philips Electronics N.V. | Tracing copies of an implementation |
US20100251285A1 (en) * | 2009-03-02 | 2010-09-30 | Irdeto Access B.V. | Conditional entitlement processing for obtaining a control word |
Also Published As
Publication number | Publication date |
---|---|
CA2735080A1 (en) | 2011-09-26 |
KR20110108322A (en) | 2011-10-05 |
CA2735080C (en) | 2019-04-16 |
JP5901884B2 (en) | 2016-04-13 |
JP2011211708A (en) | 2011-10-20 |
CN102238430A (en) | 2011-11-09 |
US8594330B2 (en) | 2013-11-26 |
CN102238430B (en) | 2016-07-06 |
US20170111167A1 (en) | 2017-04-20 |
EP2369778A1 (en) | 2011-09-28 |
US20110235803A1 (en) | 2011-09-29 |
EP2369778B1 (en) | 2018-08-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8594330B2 (en) | Personalized whitebox descramblers | |
EP2461534A1 (en) | Control word protection | |
US20120042170A1 (en) | Device and method for establishing secure trust key | |
US9608804B2 (en) | Secure key authentication and ladder system | |
CA2737413C (en) | Simulcrypt key sharing with hashed keys | |
EP2227015B1 (en) | Conditional entitlement processing for obtaining a control word | |
KR20100092902A (en) | Securely providing a control word from a smartcard to a conditional access module | |
KR20070073622A (en) | Method of descrambling a scrambled content data object | |
JP5933705B2 (en) | Receiver software protection | |
KR20110096056A (en) | Content decryption device and encryption system using an additional key layer | |
US9219606B2 (en) | Method and device for digital data blocks encryption and decryption | |
WO2007116390A2 (en) | Fingerprinting descrambling keys | |
US9660965B2 (en) | Obtaining a control word to reveal a client device identity | |
RU2534925C2 (en) | Security method, decoding method, data medium and terminal for security method | |
KR20110097683A (en) | Disabling a cleartext control word loading mechanism in a conditional access system | |
WO2014154236A1 (en) | Obtaining or providing key data |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: IRDETO B.V., NETHERLANDS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:DOUMEN, JEROEN MATHIAS;REEL/FRAME:034418/0381 Effective date: 20100326 |
|
AS | Assignment |
Owner name: IRDETO CORPORATE B.V., NETHERLANDS Free format text: CHANGE OF NAME;ASSIGNOR:IRDETO B.V.;REEL/FRAME:034597/0626 Effective date: 20101006 |
|
AS | Assignment |
Owner name: IRDETO B.V., NETHERLANDS Free format text: MERGER;ASSIGNOR:IRDETO CORPORATE B.V.;REEL/FRAME:034512/0718 Effective date: 20140930 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |