WO2004082286A1

WO2004082286A1 - Pay television system, method for transmission of scrambled audiovisual programmes, decoder and chip for carrying out said method

Info

Publication number: WO2004082286A1
Application number: PCT/EP2004/050299
Authority: WO
Inventors: Jean-Luc Dauvois; Philippe Cassagne
Original assignee: Kudelski S.A.
Priority date: 2003-03-12
Filing date: 2004-03-12
Publication date: 2004-09-23

Abstract

The invention relates to a method for broadcasting a scrambled audiovisual programme to decoders (11), comprising a step for transmission of first messages (ECM) to said decoders, each comprising a control word (CW), encrypted using a operation key permitting each decoder to unscramble the received audiovisual programme during a given period, second messages (EMM) comprising operation keys according to which during the same basic period as the scrambling time for the scrambled audiovisual programme, there is transmission of at least two first messages, each containing the same control word respectively encrypted by distinct operation keys and second messages, each containing one of said operation keys and an individual or group address of at least one decoder of the at least two decoder units.

Description

TELEVISION TELEVISION SYSTEM, METHOD FOR BROADCASTING

INTERFERRED AUDIOVISUAL PROGRAMS, DECODER AND CARD A

CHIP IMPLEMENTING THIS PROCESS

TECHNICAL FIELD DESCRIPTION

The present invention relates to a pay television system, a method for broadcasting scrambled audiovisual programs, a decoder and a smart card implementing this method. The subject of the invention is a method, system, decoder and mistletoe card intended to limit, in particular in reaction to the detection of a malicious action, the fraudulent impact that this action may have, in terms of piracy, on a fleet of decoders in a pay-TV system. More precisely, the fraudulent action consists in the completely illicit disclosure of keys.

STATUS OF THE PRIOR ART

The techniques used in pay television, as described for example in the article entitled "Functional model for a conditional access

System ”(EBU Technical Revie, 1995, n ° 266, pages 64 to

77), are based on two independent mechanisms: on the one hand, interference of the video and / or audio program (s) (hereinafter “audiovisual program”), and on the other hand, a function of allocation of keys and commercial rights which are transmitted, typically as secure conditional access messages (EMM and ECM) encrypted to the descrambling unit or to the decoder, or to the card associated with it through the decoder. The scrambling can be applied to a digital bit stream defining the audiovisual program.

The audio-visual program transmitted scrambled using keys, can only be descrambled by using equivalents of these keys, called control words (CW). Note that a distinction is made in the present description by using the words “scramble / descramble” and “encrypt / decrypt” according to whether they apply to an audiovisual program or to conditional access messages, respectively. For each audiovisual program, the control word values transmitted to the decoders change periodically at a relatively high frequency, for example of the order of a second. To allow descrambling upon reception of an audiovisual program, Entitlement Control Messages (ECM) and Entitlement Management Messages (EMM) are transmitted to decoders.

These two types of ECM and EMM messages can be sent, through the decoder, to a smart card or any portable object, such as a PCMCIA card ("personal computer memory card international association" or "international association of memory card to personal computer ”), a chip key, etc., which provides functions for decrypting and storing user rights. In the present description the term "card" designates any object portable operating in relation to the decoder, typically by being housed in a decoder reader.

The ECM messages contain encrypted control words, these control words allowing the decoder to descramble an audiovisual program. ECM messages are transmitted to the card which decrypts the encrypted control words and sends these CW control words to the decoder. The card performs the operation of decrypting encrypted control words only if the user is authorized to access the current audiovisual program. For this, the card stores in a zone of its memory the rights allocated to the user concerned. Thus, when a user is associated by subscription to a smart card, access authorization is indicated by entitlement data ("entitlement data") stored in the card.

EMM messages contain information which makes it possible to update the rights allocation data of the user, for example by modifying the data stored in the card. In the case of a temporary descrambled offer and according to the prior art, a first EMM message is sent to the decoder to offer the subscriber temporarily the rights required to access a program on a given channel. In the absence of a payment transaction received by the operator's rights management system, another EMM message is sent to revoke these same rights. It should be noted that the demultiplexing between the EMM and ECM messages received is typically carried out by the decoder as a function of information coming from a table indicating the MPEG streams (identified by “Packet Identifier Data” values) conveying the respective respective types of messages. The filtering of EMM messages carrying a group address or the unique address of the decoder is also advantageously operated by the decoder.

ECM and EMM messages can include a digital signature field that ensures the integrity of the message (for example a hash code). This allows you to detect any malicious or accidental corruption of the message content.

An ECM message is issued with the scrambled program. It typically includes at least two fields. The first field includes the access parameters, which define the conditions under which access to the programs is authorized. This field allows for example parental control (An additional PIN code may be required before giving access to the scrambling program). The second field of each ECM message contains a control word, denoted CW, in encrypted form by a so-called operating or service key. This control word which changes at a relatively high frequency, typically of the order of a second, allows descrambling of an audiovisual program.

An EMM message advantageously comprises at least three fields. A first address field makes it possible to address an individual decoder or a group of decoders for it / transmit to them the information conveyed by the other EMM fields. A second field contains program access permissions for subscribers. A third field contains an encrypted operating key. The value taken by this exploitation key varies at a relatively low frequency, for example of the order of several days or of the month. According to the prior art, for a given period of time, this operating key is the same for the entire fleet of subscribers considered.

Typically according to the prior art, a given EMM message for sending an operating key contains the address of a single decoder, or of a group of decoders, and the operating key previously encrypted by a clean and unique key. to the smart card of the decoder or group of decoders under consideration. EMM messages can also be used to send a command to the decoder. The emission of EMM messages is generally the result of an action (subscription) or a failure to act (non-payment in "Pay-By-View" mode with preview of temporary scrambles) from the user to the Operator . These EMM messages are generally individual. Their content is interpreted by the decoder (or the associated card) or by a limited number of decoders who are affected by these particular rights. EMM messages are not transmitted synchronously with the audiovisual program to which they apply. They are transmitted in advance to allow access to a given program by an authorized user. Any network can be used to transmit these EMM messages to the receiver: modem, mail or broadcasting. Advantageously, by on the other hand, each ECM message is transmitted with a very slight time advance, but in a quasi-synchronous manner, compared to the portion of audiovisual program that it is intended to descramble, to take into account the time of decryption of the word control it contains in encrypted form.

To be sure that an EMM message has been received by the user, to renew a subscription for example, it is sent several times. EMM messages are thus organized cyclically according to a given period for transmission. The duration of such a period defines the maximum time to wait to obtain a right allocation for a user who has cut his decoder for a long time. The fact that according to the prior art, for a given period of time, the operating key is the same for the whole of a park of subscribers considered, while being encrypted by respective unique keys different according to the auxilliary decoders said operating key is intended, poses an obvious security problem in the event that this operating key is revealed.

The invention aims to minimize the impact that can have the discovery by a pirate of operating keys, used in audiovisual systems. According to known hacking techniques, an attacker, or hacker, having discovered an exploitation key can make it available to third parties so that they can thus decrypt ECM messages to recover the control words and thus descramble the (the programs) scrambled audiovisuals broadcast by the Operators. The hacker then makes the decrypted operating keys available to third-party users, each of these operating keys remaining “valid” for a relatively long period (of the order of several days) for decrypting the control words CW, which allow descrambling the scrambled program. This provision is made for example by using a website. Third parties can then connect to this totally illegal, so-called "pirate" website, and periodically come and read the keys required to enable descrambling of scrambled audiovisual programs in order to fraudulently program their decoders and / or subscriber cards. The invention aims to remedy a posteriori this type of problem, as soon as it is discovered that one or more operating keys are fraudulently made available to third parties.

PRESENTATION BY INVEOTI03ÏÏ

The present invention therefore proposes a method of broadcasting a scrambled audiovisual program intended for decoders comprising steps: - transmission to these decoders of first messages each containing a control word encrypted by an operating key to allow chague decoder to descramble, during a given period of time, the audiovisual program received, and second messages comprising operating keys, characterized in that during the transmission step, for the same elementary period of scrambling time of the scrambled audiovisual program, there is transmission of at least two first messages each comprising the same control word encrypted by keys respective operating keys, and second messages which each contain one of these operating keys and an address, individual or group, of at least one decoder of one of at least two sets of decoders to allow decryption, by the decoders of each set, of this same control word encrypted by these respective separate operating keys.

Thus, the impact in terms of fraud of the fraudulent disclosure of an operating key is limited to a group from the entire subscriber base.

Advantageously, each first message comprises a group address field capable of being processed by each decoder, or by the card which is associated with it, to filter the only first messages corresponding to the address thereof.

Advantageously, said method comprises steps: a) of transmission, in the event of fraudulent disclosure of one of the operating keys, in second messages in grouped addressing mode intended for the group of decoders using said operating key fraudulently disclosed, new respective operating keys intended for sub-groups of said group, b) transmission, in the event of a new fraudulent disclosure of one of the new operating keys, in second messages in grouped addressing mode intended for a sub-group of decoders using said new disclosed operating key fraudulently, new respective keys to sub-sub-groups of this sub-group, c) reiteration of step b) on each new fraudulent disclosure of a new operating key.

The invention also relates to a pay-TV system comprising an access control system and a satellite, terrestrial or cable link between this system and the decoders of at least two subscribers, characterized in that these decoders form at at least two distinct sets, and in this respect that each decoder comprises means for filtering the first messages as a function of the address of the decoder or of the card associated with it.

The invention also relates to a smart card, or a decoder, which comprises means for filtering the first messages as a function of the address of the decoder or of the card associated with it.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a pay-TV transmission system of the known art operating in the field of digital television; FIG. 2 illustrates the content of an EMM message,

FIG. 3 illustrates an exemplary embodiment of a subscriber authorization system;

FIG. 4 illustrates an address field of an EMM message in an exemplary embodiment of the invention;

FIG. 5 illustrates an ECM message in a variant of the invention.

DETAILED PRESENTATION OF PARTICULAR EMBODIMENTS

As illustrated in FIG. 1, an access control system, according to a nonlimiting embodiment, comprises a subscriber management system (SMS or “Subscriber Management System”) 9 connected to an authorization authorization system. subscriber (SAS or “Subscriber Authorization System”) 10. It is assumed, for the sole purpose of simplifying the description below, that only one audiovisual program is transmitted.

This subscriber authorization system 10 as well as a control word generator (CW) 11 are connected to an operator transmission station 12, each via an encryption circuit 13 and 14. The encryption circuit 13 encrypts each unencrypted EMM message received by a so-called unique key specific to the decoder, or to the associated card, for which the EMM message considered is intended, this typically as a function of the address conveyed by one of the fields of each EMM message. The signal applied by the subscriber authorization system 10 to an input of the encryption circuit 14 carries successive operating keys which are used by the encryption circuit 14 to encrypt the control words CW generated by the generator 11. The choice by the encryption circuit 14 of the operating key which must be used to encrypt the control words CW generated by the generator 11 depends on a group number field ECM, this field being itself defined by the encryption circuit 14 as a function of the number of operating keys available at a given time, as received from the system 10. The group number field ECM will be described in more detail in the following description.

This operator transmitting station 12 receives image signals I, sound S and possibly data D which pass successively through a multiplexer 15, a jammer 16, a modulator 17 and a transmitter 18 .

The subscriber management system 9, in an exemplary embodiment, comprises a subscriber database, which, for each subscriber, comprises in particular the name, the first name, the subscription formula chosen (which defines the programs which the subscriber can access) and the number of the smart card. This database is updated with each new subscription or each subscription termination. The subscriber authorization system 10 is responsible for generating the EMM messages. Each EMM message, in a preferred embodiment, comprises, at least one address field 20, an access rights field 21, an exploitation key field Sk 22, and an integrity verification field for example by Hash 23 function field, as shown in Figure 2.

Such an EMM message, and in particular the key Sk, is encrypted, at least partially, by a so-called unique key, which corresponds to a key of the smart card, to which the message is intended by addressing by means of the address field. . The content of such an EMM message is renewed periodically, for example every month, to change the key Sk, used to decrypt, the ECM messages. As illustrated in FIG. 3, the subscriber authorization system 10 can include:

- a key generation module 30,

an addressing module 31,

- a hash code generation module 32, - a multiplexer 33.

A COM communication signal is applied to respective inputs of the key generation 30 and addressing 31 modules. Access rights information DA is entered on the hash code generation module 32 and on the multiplexer 33.

The Hash code generation module 32 receives as input respective outputs from the key generation module 30, from the addressing module 31, and the access right information DA from the subscriber management system 9 to produce a Hash code for each EMM message. Outputs from the key generation module 30, the hash code generation module 32, and the addressing module 31 as well as the access right information DA are applied to the multiplexer 33, which produces the successive unencrypted EMM messages by unique key.

According to the invention, as soon as the fraudulent disclosure of an operating key for a given subscriber group, for example by consulting a website, is detected, a COM command is applied to respective inputs of the module key generation 30 and the addressing module 31 so that:

(a) on the one hand, the key generation module 30, which until now generated only one key for this given subscriber group, now generates or from a given subsequent time, in response to the reception of the COM command, at least two keys, and

(b) on the other hand, that instead of a single subscriber group address for this given subscriber group, at least two subscriber group addresses are generated by the addressing module 31 to send by addressing the at least two keys thus generated to these two distinct groups of subscribers. In the devices of the prior art, a control word value CW, intended to descramble an elementary period of scrambling time of a given scrambled audiovisual program, is transmitted in an ECM message by being encrypted by a single key. exploitation, itself transmitted in encrypted form in EMM messages. This key is transmitted to the decoders in different EMM messages in encrypted form with different respective unique keys. In the method of the invention, there is emission of at least two ECM messages (each intended to descramble the same elementary period of scrambling time of a scrambled audiovisual program) each comprising a same control word encrypted by keys respective operating systems. Thus, in the method of the invention, for an elementary period of scrambling time of a given scrambled audiovisual program, each given control word value CW is encrypted by at least two distinct operating keys between them before be issued in respective ECM messages. The at least two operating keys thus used for encryption of the same control word value are transmitted in respective EMM messages intended for different decoders, to allow this same word value to be obtained by decryption. control by these decoders.

In the invention, the concept of "group EMM message" is used. Such a message makes it possible to address several decoders simultaneously, by means of a single EMM message, and to transmit to each of them the operating key which they will have to use. The respective keys transmitted to the different groups of decoders can be identical or different between them. Each of the decoders of a group considered therefore has the same key, called a unique key, for decrypt the operating key received in a message

EMM in group addressing mode.

In a first embodiment of a simple illustration, we consider a set of n decoders, for example n = 4000, addressable by an address field of the EMM message, for example of N = 12 bits (2 ¹² = 4096) Bl to B12, as shown in ^'Figure 4.

The 10 bits B3 to B12 are used to address a group of

1024 (2 ¹⁰ ) decoders while bits B1 and B2 make it possible to address 2 ² = 4 distinct groups of 1024 decoders. Depending on whether bits B1 and B2 respectively take the values "00", "01", "10" and "11", four distinct groups of decoders can be addressed. Very advantageously according to the invention, one can add to the ECM messages a field "ECM group number". The ECM messages 40, as illustrated in FIG. 5, then contain:

a field 41 of access parameters, a field 42 of control mode,

- a field 43 of ECM group number.

Such a field 43 allows, typically with the smart card or the decoder, to filter the only ECM messages that the card is capable of decrypting. Indeed, this smart card, or this decoder, does not have, from EMM messages, other operating keys than the operating key K _by (assuming that there is a unique key per decoder ), which makes it possible to decrypt the control words (C j _exn encrypted by the key K_ _xn , n being an integer between 1 and 2 ^N , N being the number of bits of this field. It should be noted that only the EMM messages corresponding to the address profile of the decoder / card are effectively filtered and processed.

In a second embodiment illustrating the invention more precisely, we consider a fleet of 800,000 decoders, each defined by a 20-bit address so that they can all be addressed (2 ²⁰ = 1,048,576). The 10 least significant bits define the addresses of the decoders within a group The 10 most significant bits define the addresses of groups of decoders. A group EMM message makes it possible, for example, to simultaneously address Q = 2 ¹⁰ = 1024 decoders by means of a single EMM message, in order to transmit to each of them the operating key which they must use. 1024 group EMM messages are sent periodically to address all of the fleet's decoders.

In the devices of the known art, these 1024 group EMM messages carry the same operating key. This exploitation key is conveyed in an EMM message in an encrypted form by a so-called unique key, different from the keys used for encryption of this same exploitation key in the other 1023 EMM messages. The fraudulent disclosure of this one operating key alone can cause considerable damage.

According to the invention, as soon as the fraudulent revelation of a Kexl exploitation key is observed, this exploitation key which is fraudulently revealed Kexl is no longer used but M new keys are used, for example two keys noted Kex2 and Kex3, M being an integer typically included in 2 and N. The content of the group EMM messages sent until then periodically is modified by including in 512 EMM messages the operating key Kex2 respectively encrypted by 512 respective unique keys. The other 512 EMM messages include the operating key Kex3 respectively encrypted by 512 respective unique keys. Thus, 512 group EMM messages convey the Kex2 operating key in an encrypted manner, and 512 group EMM messages convey the Kex3 operating key in an encrypted manner.

The content of the ECM messages conveying the control words encrypted by the operating keys is therefore modified due to the modification of these operating keys used for the encryption of the control words. For this, as considered previously, account is taken of a field "ECM group number" and a sending of ECM messages is carried out by group addressing.

Group addressing in EMM messages can be done as follows. All the group addresses (most significant bits expressed on 10 bits) "0000000000" to "0111111111" make it possible to address the operating key _e χ_ to the first 512 groups of 1024 decoders while the group addresses (most significant bits) strong expressed on 10 bits) "100000000O" to "1111111111" allow to address the operating key K _e χ ₃ to 512 other groups of 1024 decoders. In the case of ECM messages, the positioning at 1 or at 0 of a single most significant first bit of the field "ECM group number" then allows the smart card or the decoder to filter the only ECM messages that the card is able to decrypt. In fact, the card only has one operating key (either the K _eX2 operating key or the _ _X3 key) from EMM messages. This key makes it possible to decrypt the control words actually encrypted by this same key or a corresponding key (for example in asymmetric cryptographic mode).

If a new fraudulent disclosure of one or other of the two operating keys K _e * is detected. or K _e χ ₃ we no longer use this exploitation key, for example K_χ_, but we quickly use M new keys, for example four keys denoted K _eX4 , K _eX5 , K_ _x6 , _ _X7 . The undisclosed key K ^ continues for its part to be used and the EMM messages with group addresses (most significant bits expressed on 10 bits) ranging from "1000000000" to "1111111111" continue to address the operating key K _eX3 to 512 groups of 1024 decoders. Likewise, ECM messages whose first most significant bit of the "ECM group number" field is set to "1" continue to convey the control words encrypted by the operating key K _eX3 to the decoders.

On the other hand, the content of EMM messages with group addresses (most significant bits expressed on 10 bits) ranging from "0000000000" to "0111111111" is modified. If we use these four new keys replacement K _< , _x , K _e χ ₅ , K_ _x6 , K _eX7 to replace the operating key K _e ^:

- All the addresses of EMM groups (most significant bits expressed on 10 bits) "0000000000" to "0001111111" make it possible to address the operating key K _eX4 to 128 subgroups of 1024 decoders.

- All the addresses of EMM groups (most significant bits expressed on 10 bits) "0010000000" to "0011111111" make it possible to address the operating key K _eX5 to 128 subgroups of 1024 decoders.

- All the addresses of EMM groups (most significant bits expressed on 10 bits) "0100000000" to "0101111111" allow the Kaxβ operating key to be addressed to 128 subgroups of 1024 decoders.

- All the addresses of EMM groups (most significant bits expressed on 10 bits) "0110000000" to "0111111111" allow the operating key K ^ to be addressed to 128 subgroups of 1024 decoders.

In the case of ECM messages, the positioning at 00, 01, 10, 11 of the only second and third most significant bits of the "ECM group number" field typically allows the smart card or the decoder to filter the only ECM messages that the card is capable of decrypting. Indeed, a given card has only one operating key from EMM messages (one of the keys K _sx4 , _exS , K_ _x _ or K_ _x7 ) allowing to decrypt the control words encrypted by one of these keys or a corresponding key (for example in cryptographic mode. asymmetrical).

At the end of this step, there are therefore 5 different operating keys conveyed in encrypted form, namely K _ex3 , Ke _X4 , K_x5, K _ex6 or Ke _X7 .

The steps described above are repeated each time that a fraudulent disclosure of one of the operating keys then existing is detected, until potentially reducing to zero the impact of the fraudulent disclosure of keys by the holder. a decoder since it will, in a final theoretical hypothesis taken to the extreme, the only one to use the exploitation key divulged fraudulently. We can even identify from the address generated by the unit 10 (FIG. 3) for this operating key, the decoder (or more precisely the associated card and therefore the subscriber) at the origin of the fraudulent disclosure of keys. The implementation of the invention may nevertheless be limited to reducing the potential impact that the fraudulent revelation of an operating key could have on a limited group of subscribers, however substantial, because in effect, the reduction to the extreme (only one decoder) of the number of decoders using the same operating key has the counterpart of considerably increasing the size of the field "ECM group number" of ECM messages, and the number of ECM messages to • transmit or broadcast . However, ECM messages are sent at very high frequency, which then results in a very significant implication on the bandwidth required. This is therefore a choice of implementation depending on:

- the bandwidth that we wish to allocate to ECM messages, and

- the level of reduction in nuance that one wishes to implement in relation to the fraudulent disclosure of operating keys.

Claims

1. Method for broadcasting a scrambled audiovisual program intended for decoders (11) comprising a step of transmitting to these decoders first messages (ECM) each containing a control word (CW) encrypted by an operating key, to allow each decoder to descramble, during a given period of time, the audiovisual program received, and second messages (EMM) comprising operating keys, characterized in this way during the transmission step, for a same elementary period of scrambling of the scrambled audiovisual program, there is emission of at least two first messages (ECM) each comprising the same control word encrypted by respective separate operating keys, and second messages (EMM) mistletoe each contain one of these operating keys as well as an address, individual or group, of at least one decoder of one of at least two sets of decoders to allow decryption ge, by the chague decoders together, of this same control word encrypted by these respective separate operating keys.

2. Method according to claim 1, in which each first message (ECM) comprises a group address field capable of being processed by each decoder, or by the card which is associated with it, to filter the only first messages (ECM) corresponding to its address.

3. Method according to claim 1 or 2, comprising steps: a) transmission, in the case of fraudulent disclosure of one of the operating keys, in second messages (EMM) in grouped addressing mode to the group of decoders using said fraudulently disclosed exploitation key, new respective exploitation keys to subgroups of said group, b) of transmission, in the case of a new fraudulent disclosure of one of the new operating keys, in second messages (EMM) in grouped addressing mode intended for a sub-group of decoders using said new operating key fraudulently disclosed, new respective keys to sub-sub-groups corresponding to this sub-group, c) reiterating step b) each time a fraudulent new disclosure of a new exploitation key is made.

4. Pay television system comprising an access control system and a link (32) between it and the decoders of at least two subscribers, characterized in that the decoders form at least two distinct sets, and in this chague decoder includes means for filtering first messages (ECM) according to the address of the decoder.

5. Chip card for processing first messages transmitted according to any one of claims 2 and 3, when the latter depends on claim 2, characterized in that it comprises means for filtering the first messages (ECM) according the address of the decoder or of said smart card.

6. Decoder for processing the first messages transmitted according to any one of claims 2 and 3 when the latter depends on claim 2, characterized in that it comprises means for filtering the first messages (ECM) according to 1 ' address of the decoder or said smart card.