WO2000011866A1

WO2000011866A1 - Security device for decoding compressed encrypted data

Info

Publication number: WO2000011866A1
Application number: PCT/FR1999/002016
Authority: WO
Inventors: François Grieu; Roland Moreno
Original assignee: Innovatron (Societe Anonyme)
Priority date: 1998-08-19
Filing date: 1999-08-19
Publication date: 2000-03-02
Also published as: AU5174399A

Abstract

The invention concerns a case co-operating with a safe storage unit comprising protected memory and processor. The device comprises: means for receiving compressed encrypted data; means for decrypting (r5; r3, r4) the data received; and means for delivering (r1), in a decoded form exploitable by a user, decompressed decrypted data. The safe microcircuit (M; M') incorporates the set of decrypting means (r5; r3, r4) and at least part of the decompressing means (r2), the decrypted compressed data flow (ζ) delivered by the decrypting means not being accessible from outside the safe microcircuit. The safe microcircuit can in particular belong to a card separate from the case, the link between microcircuit and case being a series-type link using at least one of the RFU contacts as per ISO 7816-2 for delivering the decrypted and partially or completely decompressed data flow.

Description

Secure device decoder of encrypted and compressed information

The present invention relates to information dissemination systems in which information is sent from a broadcaster to a user in compressed and encrypted form, and in which the user has a decoder associated with a protected electronic microcircuit, by example a microcircuit card, which constitutes the key necessary so that the decoder can restore information in clear. EP-A-0 714204 describes such a decoder capable of processing information both encrypted and compressed, which is the field concerned by the present invention.

EP-A-0 723 371 and EP-A-0 453 737, as well as Peyret P et al., Smart Cards Provide Very High Security and Flexibility in Subscribers Management, IEEE Transactions on Consumer Electronics, 1990, Vol. 36, 3, 744-752, only describe the decoding of uncompressed information.

The information broadcast by such systems can be varied, for example audio (music) or video signals (television programs), or even textual data such as agency reports or financial information.

The purpose of encryption is to reserve unencrypted access to this information to authorized persons in return for a payment such as a subscription or a payment per session. The electronic microcircuit allowing the decoder to ensure decryption is generally protected against reading its content and against copying, whether it is a microcircuit card inserted in a connector of the decoder, or a microcircuit internal to the decoder. This level of security does not however prevent the information once decoded from being able to be copied, thus allowing the authorized user to share the dissemination of the information with other unauthorized persons, that is to say without subscription to the broadcaster or without payment in return for the unencrypted return of information. There are indeed many possible attacks on existing systems tants in order to save the information in a usable form. These attacks, which are well known on encrypted television broadcasting systems, will be explained in the detailed description which follows. One of the aims of the invention is to prevent, as far as possible, that the information once decoded can be copied, or at least to ensure that this copying is accompanied by a significant degradation of the quality of information or a considerable increase in the volume of data preventing or making it difficult to record. Essentially, the invention provides for this purpose a device for decoding encrypted and compressed information, in particular video, audio or text information, of the known generic type comprising a housing cooperating with a secure microcircuit comprising a memory and a processor protected against attempts to analyze and read and copy the information stored in this microcircuit, this decoder device comprising: means for receiving input of encrypted and compressed data; means for decrypting the data thus received; means for decompressing the data thus decrypted; and means for outputting, in a decoded form exploitable by a user, decrypted and decompressed data.

According to the invention, the secure microcircuit incorporates all of the decryption means and at least part of the decompression means, the stream of decrypted and compressed data delivered by the decryption means to the decompression means not being accessible. from outside the secure microcircuit.

The secure microcircuit can be that of a microcircuit card separate from the housing, the latter comprising connection means making it possible to couple the microcircuit card therein, or else an internal microcircuit in the housing. In the case of a microcircuit card, the link between the microcircuit and the box is advantageously a serial type link, very advantageously a link such that the decrypted and partially or fully decompressed data stream is delivered by the microcircuit on at least one of the RFU contacts according to ISO 7816-2. According to other advantageous subsidiary characteristics: - the housing includes part of the decompression means, this part including circuits capable of delivering the decompressed data in response to commands issued by the secure microcircuit;

the secure microcircuit also includes part of the means for delivering the data in an exploitable decoded form, this part including in particular digital processing or filtering means;

the data received as input is in the form of packets accompanied by associated data, and the decryption means operate by implementing a first algorithm allowing the calculation of packet keys from said associated information, and a second algorithm reconstructing a stream of information decrypted from the packets and packet keys calculated by the first algorithm; - The device comprises means of payment conditioning the delivery at the output of the data in a decoded form exploitable with the verification, by the microcircuit, of the preliminary realization of a payment according to associated tariff information contained in a memory, in particular of pricing information comprising user identification information contained in a memory of the secure microcircuit;

the device comprises recording means or means of coupling to recording means, which can in particular record compressed and encrypted data; - The secure microcircuit comprises means for including a watermark in the decrypted and decompressed data stream delivered, this watermark incorporating an identifier of the secure microcircuit.

0

We will now give an example of implementation of the invention, with reference to the accompanying drawings.

FIG. 1 is an illustration, in the form of a block diagram, of the chain of transmission and reception of information, explaining the various stages of transformation of the signals. FIG. 2 represents the decoder of the user with its various associated elements.

Figure 3 shows the different standardized contact areas of a microcircuit card.

0

We will first of all expose with reference to FIG. 1 the way in which the best current systems (that is to say those providing the highest security against fraud) operate for the dissemination of encrypted information, typically encrypted television signals. We will first describe the steps implemented on the transmitter side: e1) We first produce a stream of digital signals, either directly or by digitizing analog signals, thus giving an uncompressed data stream Φ of high speed, around 10 ⁶ bps (bits per second) for audio and 10 ⁸ bps for video. e2) The stream Φ is then compressed using a compression technique with loss of information, for example of the MPEG type, to give a stream of medium bit rate φ, of the order of 10 ⁵ bps for audio and 3.10 ⁶ bps for video; this operation implements relatively advanced technical means, that is to say requiring a high computing power, to achieve a compression which does not adversely affect the sound or visual quality of the signal; e3) This compressed stream φ is then cut into packets, each representing for example 0.1 seconds of sound or image; for each packet, a numerical value forming the packet key is chosen such that the possession of the master key of a first cryptographic algorithm ALG1 is necessary to calculate this packet key. For example, an incremental index is associated with each packet and the packet key is obtained by encrypting the index with the master key by a triple-DES algorithm. e4) Each packet is then encrypted with a second ALG2 cryptographic algorithm using the packet key as a key (note that the data flow for the first ALG1 algorithm is of the order of 10 ³ bps, much lower than the data flow of the second al- gorithm ALG2, which is that φ at medium speed of the compressed data). The encrypted stream resulting from step e4 is then broadcast, accompanied by additional information necessary for the calculation of the packet keys, in this example the packet indices. It can be a one-way broadcast, of the satellite, CD-ROM or DVD-ROM type, or on demand, such as a cable broadcast, via the Internet, via the switched telephone network or ISDN.

Of course, this dissemination is accompanied by various operations for verifying the integrity of the information transmitted and possible correction of errors, which are not concerned with the present invention. It should be noted that the term "broadcasting" should not be understood in the strict technical sense (television or radio broadcasting, over the air or by wire) but that it also includes, for example, the dissemination of information by distribution of physical media such as CD-ROMs, DVDs, floppy disks, etc., the teachings of the invention applying equally to the decryption and decompression of information read on a physical medium of this nature.

We will now describe the steps implemented on the receiver side.

The receiver or decoder comprises a secure electronic microcircuit, that is to say protected against analysis and duplication of its content, and containing the master key necessary for decryption. The successively implemented steps are as follows (we will use references comprising homologous indices of the corresponding steps implemented on transmission): r3) The microcircuit receives the information necessary for the calculation of the packet keys (in the present example, packet indices) and applies the first cryptographic algorithm ALG1; it communicates the packet keys thus calculated to the rest of the decoder. r4) The decoder then decrypts the packets using the second cryptographic algorithm ALG2 and the corresponding packet key, producing a data flow φ identical to that resulting from step e2, i.e. compressed data of means debit. r2) The decoder then decompresses this data stream φ, operation which requires relatively limited means compared to those implemented in step e2, thus giving a high-speed data flow Φ 'comparable to the flow Φ resulting from step e1, but not identical due to the modifications linked to the compression / decompression process. r1) The decoder converts this data flow Φ 'in a way accessible to the human senses, for example by controlling the vibration of a speaker membrane or the luminescence of a cathode ray tube; typically this step r1 firstly comprises a digital / analog conversion.

Note that the system described here is a digital system, which allows strong compression in step e2.

The process can also be transposed to an analog system, for example for systems of older design using in step e2 an analog encoding of the PAL, SECAM or NTSC type and for e4 an analog encryption of the type permutation or rotation of lines; the operating principle is identical, although the flow resulting from step r4 is, in this case, only approximately identical to the flow φ resulting from step e2. The technique which has just been exposed has a certain number of weak points which make it vulnerable.

Even if it is supposed that the microcircuit and the first cryptographic algorithm ALG1 are effectively resistant, there remain various possible attacks when one wishes to record information in an exploitable form, namely:

1 °) The attack of the second algorithm ALG2, that is to say the reconstruction of step r4 without having the data stream resulting from step r3, for example by using redundancies in the resulting data stream normally r4; the design of the second algorithm tries to make this operation difficult, but we cannot exclude a successful attack - implying to change all the decoders which use this second algorithm ALG2. 2 °) The recording, on the one hand, of the stream of encrypted information as broadcast (at the input of r4) and, on the other hand (on a decoder equipped with the legitimate microcircuit), of the stream of packet keys, then the deco- dage by a decoder devoid of the legitimate microcircuit and receiving these two information flows. The volume of data represented by the packet keys being very low, this information can for example be made available by radio or on the Internet. 3) The recording of the stream of decrypted information resulting from step r4, followed by its subsequent exploitation in a device applying r2 and r1. This recording can be done: on a decoder equipped with the legitimate microcircuit, by recovering the information passing from the stage carrying out r4 to that carrying out r2 (the most recent decoders try to avoid this attack by grouping steps r4 and r2 in the same circuit, where the stream in question is not very accessible), by reproducing step r4 in an appropriate device, receiving on the one hand the flow of encrypted information as broadcast, on the other hand the flow of keys packet from a legitimate microcircuit, the device reproducing the decryption by the fast algorithm (this attack can be combined with the previous one). 4 °) The recording of the information flow resulting from step r2. But the speed at this stage being high, in particular for video, the fraudster will have an interest in recompressing the data, that is to say applying a step similar to e2; we can assume that the technical difficulty of the operation, as well as the resulting loss of quality (a loss all the more significant when the means used are modest) diminishes the attractiveness of the technique.

5) The recording of the signals in a form derived from r2, for example an intermediate analog form used in r1. The reduction in quality is then clear; in addition, various analog means are known which prevent making a copy of acceptable quality with a consumer video recorder.

The invention endeavors to remedy these drawbacks which make the system vulnerable to attempts by fraudsters.

It essentially consists in integrating into the safety microcircuit all of the decryption (steps r3 + r4 above) and at least most of the decompression (step r2 above), so that the φ (medium speed) flow of decrypted and compressed data as well as the flow of packet keys are not present outside the microcircuit and are therefore never accessible.

The limits of the secure microcircuit have been illustrated in FIG. 1 in dashed lines in the two variants M, where this microcircuit includes all of the decompression stages of step r2, and M ′, where it does not use only part of this step.

Under these conditions, attack n ° 1 (exposed above) is made more difficult, because the cryptographic algorithm can remain secret. In addition, if its security is compromised by a design defect and it must be replaced by another algorithm, it is possible to change the only microcircuit if it is removable, without modification of the decoder itself. An additional advantage is that it is possible to use algorithms varying according to the dissemination area, or even to develop the decompression algorithm. Finally, the decoder unit alone (that is to say without its secure microcircuit) containing no cryptographic algorithm, is not subject to any particular regulation.

The aforementioned attacks No. 2 and No. 3 are made impossible, since the intermediate data flows necessary for these attacks remain internal to the microcircuit.

The system that has just been described can be presented in a simplified form, with the two encryption algorithms ALG1 and ALG2 grouped together into one. Under these conditions, the steps on the transmitter side will be: e1) Production of digital signals (no change), e2) Compression (no change), e5) Encryption of the data flow par by a cryptographic process using a master key. On the receiver side, the decoder includes a secure electronic microcircuit which contains the master key. The steps implemented are: r5) The microcircuit receives the data flow resulting from e5 and decrypts it, reconstructing (in the absence of transmission error) the data flow φ as it was before produced step e2. r2) The same microcircuit (the fact that it is the same microcircuit, and not another decoder circuit, is an essential characteristic of the invention) decompresses this data flow φ, producing a data flow Φ ', comparable to that Φ resulting from step e1 (the differences arising from the compression / decompression process). This flow Φ 'is communicated by the microcircuit to the rest of the decoder. r1) Conversion in a form perceptible to the senses (without change). As illustrated in FIG. 2, the invention can be implemented by a box 10 ensuring the interfacing between, on the one hand, radio reception means 12 (typically an antenna or a satellite decoder), a cable network 14, a DVD-ROM drive 16, etc. and, on the other hand, a television receiver 18 or a high-fidelity channel 20. The box can include a mechanism for program selection and / or selective routing of a program on demand. This box cooperates with a secure microcircuit 22, for example the microcircuit of a removable card 24 inserted in a slot 26 of the box 10, the box 10 + microcircuit 22 assembly constituting the "decoder" mentioned above.

The selected information arrives, compressed and encrypted, from the box 10 to the microcircuit 22, and the latter - if it contains the appropriate key and possibly if other conditions are met, for example the debit of prepaid points or the remote payment of a subscription or access to a program - decrypts and decompresses it, without the deciphered and compressed form being accessible. The decompressed stream is delivered by the microcircuit 22 to the housing 10 to be applied, after the appropriate conversions to the television set 18 or the amplifier of the chain 20. This basic principle can receive several improvements. A first improvement aims to optimize the connection of the microcircuit to the housing, as well as the distribution between microcircuit and housing of the elements involved in the decompression process r2 and conversion r1.

First, to minimize the number of contacts, the connection between the microcircuit and the housing is advantageously of the serial type. For the data flows, in particular the flow Φ 'of high flow rate leaving from r2, it is possible to use the contacts "RFU"("reserved for future use") of the ISO 7816-2 standard. Figure 3 shows the arrangement of the contacts of a microcircuit card according to this standard.

It will be noted that the ground contacts GND, power supply VCC, clock CLK, reset RST and input / output I / O keep their usual functions, I / O being used for supervisory functions such as those of step r3 and / or, by multiplexing, for the slower data flows, in particular the flows entering r5.

These serial data streams are synchronized by a phase locked loop integrated into the microcircuit, synchronized with a signal entering the microcircuit such as the data entering r5 and / or CLK.

There is provided in the data code leaving the microcircuit an error detection code and an inhibition of the sound or visual restitution when the housing detects an error in this flow, this to prevent unwanted noise or images, when the microcircuit has a poor contact with the housing.

Furthermore, still in this improvement aimed at optimizing the connection of the microcircuit to the housing, the last stages of the decompression process r2 can be transferred to the housing, this in order to reduce the complexity of the microcircuit, in particular the amount of memory and the power required treatment.

In the case of audio signals, it is known that the decompression methods include in the phase preceding the digital / analog conversion the generation and the combination of various signals the characteristics of which are calculated elsewhere, for example generation and addition digital signals such as sinusoid and / or wavelet and / or noise whose frequency and / or amplitude and / or spectrum and / or envelope are configured. It can then be provided that the control (configuration) of these generators is carried out by the microcircuit, but that the generation and the combination proper are carried out in the housing, the main part of the computing power being thus transferred to this housing. In video, the decompression methods include in the final phase of generation of the decoded signal the copying of information coming from lines and frames of previous images and / or the filling of zones. We can then predict that the box will store this information and realize copies and filling, but according to parameters produced by the microcircuit.

Conversely, if there is still sufficient computing power in the microcircuit, one can integrate into it not only the decompression r2, but also the first phases of the conversion process r1, in order to increase the bit rate of the information leaving the microcircuit and making its storage more difficult, which makes it possible to fight more effectively, to a certain extent, against the above-mentioned attack No. 4. In particular, for audio, digital processing can be integrated into the microcircuit such as modification of the number of bits of the sampling and / or digital filtering, making it possible to reduce the complexity of the analog filter placed downstream of the converter digital / analog of the housing. A second improvement consists in carrying out each of the stages e5 and r5 in two respective stages e3 + e4 and r3 + r4 involving two distinct algorithms, which is justified cryptographically speaking, with the aim of carrying out the operation with a good compromise in complexity. /cost. A third improvement consists in providing an additional mechanism intended to price the use of the system. To this end, provision is made in the microcircuit for a means of conditioning the production of the decrypted information to prior payment, means operating by processing the content of a memory containing the rights of the owner of the microcircuit. This memory can be located in the microcircuit itself, or in the housing, or even at the information broadcaster.

These rights change according to the use made of the system; for example a credit zone of this memory is debited when the information is first broadcast, for example the first hearing of a piece of music, and the identifier of this piece is stored in this memory, allowing the user who wishes to listen to the same song later, do so without bitrate, or at reduced bitrate. Certain operations are inhibited when the credit falls to zero. Reloading means are also provided. If it is with the broadcaster, the memory can be subdivided into zones each corresponding to a given microcircuit, the adequate zone being Î2

selected from an identifier of the microcircuit contained in a memory thereof.

In addition to the recording in the memory of an identifier of the piece, the purchase of the rights can be materialized by the storage in the memory of the microcircuit of the key and / or of the algorithm of decryption of this piece; this measure avoids having a universal key and / or algorithm valid for all songs.

Provision will be made to the compressed and encrypted data for identification / pricing information used by the microcircuit to determine which key and / or decryption algorithm and / or which pricing is to be applied to the encrypted information flow. In a step e6 (for example after e5), this identification / pricing information is added to the data flow; and in a step r6 (for example prior to r5), this identifier is extracted and used by the microcircuit to determine which key and / or which algorithm to use in step 5, and / or which pricing to apply (for example if the rights of decryption by the microcircuit are acquired definitively, or are the subject of a payment with each use, and at what price). To protect the pricing part of this information against intentional alterations, a cryptographic method can be used, for example the addition of an electronic signature of the data including the pricing and verified by the microcircuit, or by inserting this pricing information before encryption, so that its rapid alteration makes the rest of the data unusable. A fourth improvement consists in associating a recorder with the system of the invention.

For this purpose, the box 10 can contain an information recording device (or include means for connection to such a device), allowing subsequent use without the need to convey the information by the dissemination channel.

The information can be saved in a still compressed and encrypted form; it will be deciphered and decompressed on proofreading, which will therefore require the presence of the microcircuit (this service may possibly be accompanied by a payment). Registration can also take place concomitantly with the first use. These recording devices can, for example, take the form of a semiconductor memory, a hard disk 28, a magnetic strip 30 of the DAT type, a magneto-optical disc or of the optical WORM or DVD type. -RAM, etc., if direct digital recording is desired. As a variant or in addition, the box 10 can also include digital / analog conversion means for recording and analog / digital conversion means for reading in the case of analog recording, typically on a VHS video recorder. A fifth improvement consists in providing during the decryption and decompression operations the inclusion of a "watermark" (wa- termarking) in the decrypted and decompressed data stream at output, this watermark including an identifier of the card used decryption and decompression of these data. The technique of including a "watermark" or "tattoo" is in itself known, and described for example in Fabien A et al., Information Hiding

- a Survey, Proceedings of the IEEE, 87 (7): 1062-1078, July 1999, or Boney et al., Digital Watermarks for Audio Signais, European Signal Processing Conférence, EUSIPCO '96, Trieste, Italy, September 1996, as well than in US-A-5,828,325, US-A-5,613,004, US-A-5,687,191 and US-A-5,822,360, or in presentations of Aris Techologies Musicode systems (www.musicode. com) and Audiomark from Alpha Tec Ltd. (www.alphatecltd.com). The invention however proposes to: - implement it locally in the decoder, and within the card itself,

- by incorporating an identifier of the latter,

- and to use this technique to "watermark" or "tattoo" the decoded data stream delivered to the user. In general, this technique consists of adding inaudible information to the musical message, but which can be revealed by appropriate techniques.

For an analog signal, the simplest technique combines by adding a low level identification signal coding the identification information in a very redundant manner, for example by adding a port 10 kHz sound level controller inaudible with respect to the musical message and phase modulated at 100 bits / s; the revelation is done by filtering techniques with correlation. Similar operations can be performed digitally for a digital signal. More simply, the identification message can be multiplexed with the original message and ignored during sound reproduction (but in this case the identification message can be easily removed).

Many techniques exist aimed at making the tattoo undetectable, difficult to remove or hide, and little alteration of the message. Some allow watermarking of compressed music in digital form without even decompressing it, which is well suited to the case of the invention.

Claims

1. A device for decoding encrypted and compressed information, in particular video, audio or text information, of the type comprising a box (10) cooperating with a secure microcircuit (22) comprising a memory and a processor protected against interference attempts to analyze and read and copy the information stored in this microcircuit, this decoder device comprising:

means for receiving input of encrypted and compressed data,

means for decrypting (r5; r3, r4) the data thus received,

means of decompression (r2) of the data thus decrypted, and

- output means (r1) for output, in a decoded form exploitable by a user, decrypted and decompressed data, device characterized in that the secure microcircuit incorporates all of the decryption means (r5; r3, r4) and at least part of the decompression means (r2), the stream (φ) of decrypted and compressed data delivered by the decryption means to the decompression means not being accessible from outside the secure microcircuit.

2. The device of claim 1, wherein the secure microcircuit (22) is that of a microcircuit card (24) separate from the housing, the latter comprising connection means making it possible to couple the microcircuit card there.

3. The device of one of claims 1 and 2, wherein the secure microcircuit is a microcircuit internal to the housing.

4. The device of one of claims 2 and 3, wherein the connection between the microcircuit and the housing is a serial type connection.

5. The device of claim 4, in which the stream of decrypted and partially or fully decompressed data is delivered by the microcircuit on at least one of the RFU contacts according to ISO 7816-2.

6. The device of one of claims 1 to 5, in which the housing comprises part of the decompression means (r2), this part including circuits suitable for delivering the decompressed data in response to commands issued by the secure microcircuit .

7. The device of one of claims 1 to 6, in which the secure microcircuit further includes a part of the delivery means (r1) at the output of the data in an exploitable decoded form, this part notably including processing means or digital filtering.

8. The device of one of claims 1 to 7, wherein the data received as input is in the form of packets accompanied by associated data, and the decryption means operate by implementing a first algorithm (ALG1) allowing the calculation of packet keys from said associated information, and a second algorithm (ALG2) reconstructing a stream (φ) of information decrypted from packets and packet keys calculated by the first algorithm.

9. The device of one of claims 1 to 8, comprising means of payment conditioning the output output of the data in a decoded form exploitable to the verification, by the microcircuit, of the prior realization of a payment according to 'associated tariff information contained in a memory.

10. The device of claim 9, in which the tariff information includes user identification information contained in a memory of the secure microcircuit.

11. The device of one of claims 1 to 10, comprising recording means or means for coupling to recording means (38, 30, 32).

12. The device of claim 11, wherein the data supplied to the recording means are compressed and encrypted data.

13. The device of one of claims 1 to 12, in which the secure microcircuit comprises means for including a watermark in the stream of decrypted and decompressed data delivered, this watermark incorporating an identifier of the secure microcircuit.