WO2006040482A2

WO2006040482A2 - Device and method for receiving scrambled data, and descrambling unit, data transmission system and adapted transmitter for said device

Info

Publication number: WO2006040482A2
Application number: PCT/FR2005/002541
Authority: WO
Inventors: Jean-Pierre Vigarie
Original assignee: Viaccess
Priority date: 2004-10-14
Filing date: 2005-10-13
Publication date: 2006-04-20
Also published as: FR2876858A1; WO2006040482A3; FR2876858B1

Abstract

The invention concerns a device for receiving scrambled data comprising a security processor adapted to transmit only one first part of the control word (CWc) to a descrambling unit, said first part of the control word being insufficient by itself to descramble the scrambled data. The descrambling unit comprises an assembly module (68) capable of completing the first part of the control word transmitted by the security processor to construct a complete control word sufficient for descrambling the scrambled data.

Description

DEVICE AND METHOD FOR RECEIVING RUBBER INFORMATION, AND UNLOCKING UNIT, INFORMATION TRANSMISSION SYSTEM AND TRANSMITTER ADAPTED FOR THIS

DEVICE

The present invention relates to a device and method for receiving scrambled information, and a descrambling unit, an information transmission system and a transmitter adapted for this device. Known reception devices include:

a descrambling unit capable of descrambling the scrambled information with the aid of a control word, and

a security processor able to decipher the control word to be used for descrambling the information, and to transmit the decrypted control word to the descrambling unit.

Such devices are used in particular for the reception of pay television programs. In such a use, the security processor is, for example, in the form of a smart card.

To illegally descramble information, it is possible to intercept the control word decrypted by the security processor at the moment when this decrypted control word is transmitted from the security processor to the descrambling unit. The control word thus intercepted can then be used to illegally descramble the scrambled information.

To remedy this drawback, solutions have already been proposed. For example, the patent application EP 1 078 524 proposes to encrypt the control words transmitted from the security processor to the descrambling unit.

The aim of the invention is to propose an alternative solution to that proposed in the patent application EP 1 078 524. The invention therefore relates to a device for receiving scrambled information in which: the security processor is adapted to transmit only a first portion of the control word to the descrambling unit, this first part of the control word being insufficient by itself to descramble the scrambled information, and the descrambling unit includes an assembly module able to complete the first part of the control word transmitted by the security processor to build a complete control word sufficient to descramble the scrambled information .

In the above receiving device, since the control word transmitted from the security processor to the descrambling unit is incomplete, the hacking techniques of intercepting the control word transmitted from the security processor to the descrambling unit are defeated. Indeed, the intercepted control word is not enough on its own to descramble the scrambled information.

Embodiments of this device may include one or more of the following features:

a filter adapted to prevent the transmission to the security processor of sufficient information alone to reconstruct the complete control word, the filter is adapted to transmit to the security processor a cryptogram of the first part of the control word executed at the using a first encryption key used only for this security processor or for a small group of security processors among all the security processors that can be used in a scrambled information transmission system, a decryption module capable of decrypting a cryptogram of a second part of the control word, this second part of the control word being insufficient on its own for descrambling the scrambled information, and the assembly module is suitable for completing the first part of the control word; part of the control word with the second part of the control word decrypted by the decryption module to build the complete control word, - the cryptogram of the second part is realized using a second encryption key used only for this descrambling unit or for a small group of descrambling units among all the descrambling units that can be used in a scrambled information reception system,

the assembly module is able to complete the first part of the control word transmitted by the security processor by implementing an assembly algorithm, the assembly algorithm being a function of an algorithm identifier of assembly and / or a parameter of the assembly algorithm, this algorithm identifier and / or this parameter varying according to the control word.

The invention also relates to a descrambling unit adapted to be implemented in the receiving device described above.

The invention also relates to a transmitter adapted to operate with the receiving device described above. This emitter comprises a separation module capable of splitting the control word into at least a first and a second part, and the emitter is able to transmit the first part to the security processor of the receiving device and the second part to descrambling unit of the receiving device, each part of the control word being insufficient to she alone to descramble the tangled information.

The embodiments of this transmitter may include one or more of the following features: a module capable of encrypting the first part of the control word with a first key known only to the security processor or a small group of security processors among the set of security processors that can be used in a scrambled information transmission system and capable of encrypting the second part of the control word with a second known key of the descrambling unit only or of a restricted group of units descrambling of all the descrambling units usable in the transmission system, before transmitting each part of the encrypted control word.

the transmitter is able to broadcast coded in the form of a TLV structure (Type Length Value) the first and second parts of the control word as well as all the parameters necessary for their use by the reception device. the separation module is able to complete each part of the control word by bits or bytes of additional information so that the number of bits or bytes of each part is equal to the number of bits or bytes of the complete control word;

the separation module is able to modify the bits or bytes of additional information for each control word or for each limited group of control words among all the control words used.

Finally, the invention also relates to a scrambled information transmission system comprising the reception device described above and a method of receiving information. The invention will be better understood on reading the description which follows, given solely by way of example and with reference to the drawings, in which: FIG. 1 is a schematic illustration of the architecture of a control system; transmission of scrambled information,

FIG. 2 is a schematic illustration of the structure of an ECM (Entitlement Control Message) frame used in the system of FIG. 1, and

FIG. 3 is a flowchart of a scrambled information transmission method.

FIG. 1 represents a scrambled information transmission system, designated by the general reference 2, and more specifically a pay television transmission system. The system 2 comprises a transmitter 4 able to broadcast scrambled information and a large number of devices for receiving scrambled information. To simplify the illustration, only a receiving device 6 is shown in FIG.

In the context of a pay-TV system, the scrambled information corresponds to programs such as, for example, audiovisual television programs or multimedia services. The transmitter 4 comprises a scrambler 10 equipped with an input 12 to receive the information in clear, that is to say not scrambled, and an output 14 for the same information once they have been scrambled. The scrambler 10 also has an input 16 for receiving the control words used to scramble the information.

The scrambler 10 executes a scrambling algorithm, such as, for example, the Common Scrambling Algorithm (CSA) specified in Europe by DVB (Digital Video Broadcasting) or the 3-DES (Triple Data Encryption Standard) algorithm referenced in the American standards of the ATSC (Advanced Television Systems Committee). The control words transmitted on the input 16 are generated by a generator 20 of control words CW.

The control word CW is also transmitted to an input 24 of a separate separation module 26 for splitting the control word CW into at least two parts, each of these parts being insufficient on its own to enable the descrambling of the information. More precisely, here, the module 26 is able to split into two parts denoted respectively CW _C and CW _t , the control word CW. For this purpose, the separation module 26 executes a parameterized separation algorithm. In this embodiment, the module 26 is able to calculate a value of the parameter or to choose the value of the parameter from a list 28 of possible values stored in a memory 30 associated with the module 26. Here, the separation algorithm uses a number of bytes or bits of the CW control word to form CW _C and the remaining bytes or bits to form CW _t . The bytes or bits of the CW control word used to form respectively CW _C and CW _t are specified by a mask M. Moreover, for CW _C and CW _{t to} have as many bytes or bits as the control word CW , CW _C and CW _t are supplemented by bits or bits randomly selected for each control word CW or for a limited number of control words. The value of the mask constitutes the parameter of this separation algorithm whose possible values are recorded in the list 28. The choice of the value of the mask must eliminate configurations making the process insecure. As an illustration of a separation of the two - part control word based on byte sharing, for a control word CW whose length is eight bytes, possible values Mi, M ₂ and M ₃ for the mask are: Mi = ttccttcc M ₂ = tttccctc M ₃ = cccttttc where "t" indicates the position of a selected byte to build CW _t and "c" indicates the position of a byte used to build CW ₀ . The following value M ₄ of the mask, for example, is to be forbidden:

M ₄ = cccccccc because it renders the process ineffective, the control word being in fact provided entirely by the security processor. The following M ₅ value of the mask, for example, should be avoided:

M ₅ = ccccccct because it suffices two hundred and fifty six attempts to find the control word from the part returned by the security processor.

Under these conditions, if the control word CW is formed by eight bytes ABCDEFGH, and the mask Mi is used, the values of CW _C and CW _t are as follows: CW ₀ = xxCDxxGH CW _t = ABxxEFxx where x is a byte chosen randomly and the letters ABCDEFGH represent the bytes of the CW control word. This example is directly transposable in case of separation of the control word based on the bit sharing.

The transmitter 4 also comprises a module 32 for encryption of CW _C and CW _t . More specifically, the encryption module 32 is able to encrypt CW _C using an encryption key K _c and CW _t using an encryption key K _t The keys K _c and K _t are chosen, respectively, from lists of keys 34 and 36 stored in a memory 38 associated with the module 32. Each list 34, 36 associates with each key an identifier of this key. Outputs of the module 32 are connected to a module 40 for the construction of an ECM (Entitlement Control Message) for transmitting thereto cryptograms CW * _C and CW * _t respectively corresponding to the parts CW _C and CW _t as well as the identifiers keys K _c and K _t used.

An output of the module 26 is also connected to the module 40 to transmit to the latter the value of the parameter used by the separation agorithm.

This module 40 is capable of constructing an ECM such as that represented in FIG.

The ECM of FIG. 2 comprises a first ECM_SOID field _C used to identify the cryptographic context applied to the cryptogram CW _C. This field makes it possible to specify the key system implemented in the cryptography applied to CW _C. It therefore includes in particular the identifier of the value of the key K _c used to encrypt CW _C.

The field ACCESS_CRITERIA _C is used to list a set of conditions of access to the scrambled information, intended for a security processor.

The field CW * _C includes the cryptogram CW * _C. The field ECM_SOID _t is used to identify the cryptographic context applied to the cryptogram CW * _t - This field notably comprises the identifier of the value of the key K _t used to encrypt CW _t .

The field ACCESS__CRITERIA _t is used to list a second set of scrambled information access conditions for a receiver. The CW_MODE field contains information necessary for the choice or the configuration of an assembly algorithm which will be described below. Here, this field contains the value of the parameter used by the separation algorithm.

The field CW * _t includes the cryptogram CW * _t .

The field ECM_REDUND is a field allowing to verify the accuracy of the transmission of one or more of the preceding fields, this field contains here a cryptographic redundancy of the message ECM concerning in particular the fields ACCESS_CRITERIA _C and CW * _C.

Finally, the MISC field corresponds to free bytes intended to contain optional data.

A preferred implementation of the above functional fields is the combination of these fields in a known TLV (Type Length Value) type structure. These fields can be in an order dependent on

1 implementation selected.

The access conditions used to fill the fields ACCESS_CRITERIA _C and ACCESS_CRITERIA _t are, for example, stored in a memory 42 associated with the module 40.

Finally, the transmitter 2 comprises a module 50 for associating the scrambled information with the corresponding ECMs, so as to synchronize the broadcast of the scrambled information and the ECMs.

The device 6 comprises a receiver 60 able to receive the scrambled information and the corresponding ECMs, and a security processor 62. The receiver 60 includes a descrambling unit 61 in addition to the conventional elements for receiving the broadcast information. This unit comprises a filtering module 64 able to transmit only the ECM SOID fields _o , ACCESS CRITERIA _C , CW * _C and ECM_REDUND to processor 62. The filter 64 is also able to transmit the fields ECM_SOID _t , ACCESS_CRITERIA _t , CW * _t to a decryption module 66 and the CW_MODE field to a module 68 assembly. Here, the modules 66 and 68 are part of the unit 61.

The decryption module 66 is able to decrypt the cryptogram CW * _t - For this purpose, it is associated with a memory 72 containing a list 74 of keys K _t and access titles specific to the receiver. The list of keys K _t 74 is, for example, identical to the list 36.

Here, the key K _t is only common to a small group of receivers among the set of receivers of the system 2 so as to differentiate this group of receivers from another group of receivers of the system 2.

The assembly module 68 is able to complete the CW part _C of the control word transmitted to it by the processor 62 in order to construct a complete control word that can be used to descramble scrambled information. More precisely, the module 68 is able to assemble the part CW _t decrypted by the module 66 with the part CW _C deciphered by the processor 62. For this purpose, the module 68 implements a parameterized assembly algorithm corresponding to the separation algorithm implemented by the transmitter 4. The assembly algorithm is, for example, recorded in a memory 75 .associated with the module 68.

The receiver also comprises a descrambler 76 able to descramble the scrambled information transmitted by the transmitter 4 by means of the control word reassembled by the assembly module 68.

The security processor 62 includes a decryption module 80 capable of decrypting the cryptogram CW * _C transmitted by the filter 64. For this purpose, it is associated with a secure memory 82 in which is recorded a list 84 K _c keys and their identifiers. For example, the list 84 is identical to the list 34. The scrambled information access titles specific to the processor 62 are also recorded in this memory 82. Typically, the security processor 62 is in the form of a card. chip adapted to be inserted into the receiver 60, so as to communicate with the different elements of this receiver.

Here, the key K _c is only common to a small group of security processors among all the security processors of the system 2 so as to discriminate this group of security processors from another group of security processors.

The device 6 is connected to a television set 90 to display the descrambled information.

The operation of the system 2 will now be described with reference to the method of FIG.

On the transmitter side, during a step 100, the generator 20 generates the control word CW and transmits it to the scrambler 10 as well as to the separation module 26.

The scrambler 10 scrambles, during a step 102, the information received in clear on the input 12 with the control word CW, and generates on its output 14 the corresponding scrambled information. In parallel, during a step 104, the module 26 splits the CW control word into two parts CW ₀ and. CW _t - For this purpose, during this step 104, the module 26 first chooses a value for the mask in the list 28, then, then executes the separation algorithm parameterized with the chosen mask value. Preferably the mask value is changed for each ECM.

Then, the module 32 digitizes, in a step 106, the CW part _C using the key K _c to construct the cryptogram CW * _C - The key K _c is chosen from the list 34. In parallel with step 106, the module 32 digitizes, during a step 108, the part CWt with the key K _t to construct the cryptogram CW * _t - The die Kt is chosen from the list 36. Once the cryptograms CW * _C and CW * _t constructed, the module 40 builds, during a step 110, the ECM described with reference to FIG. 2. For this purpose, the module 40 uses the value of the mask used by the module 24, the identifiers of the keys K _c and Kt used to encrypt the parts CW _C and CW _t , the cryptograms CW * _C and CW * _{t as} well as the access conditions specific to the receiver 60 and the processor 62 recorded in the memory 42.

Once the ECM is constructed and the information scrambled, the ECM is associated with the information scrambled in a step 112, by the module 50 to be broadcast by the transmitter synchronously to all the receiving devices .

When receiving the broadcast information, the receiver receives, during a step 120 the information. The filter 64, during a step 122, transmits to the processor 62 only the fields necessary to obtain the first part CW _C of the control word, that is to say, here the fields ECM_SOID _C , ACCESS_CRITERIA _C , CW * _C and ECM_REDUND. Thus, the processor 62 never has all the information useful for descrambling. This enhances the security of the device 6.

As soon as this information is received, the processor 62 verifies, during a step 124, the cryptographic redundancy of the fields received using the ECM_REDUND field. In the case where the cryptographic redundancy is correct, during a step 126, the processor 62 checks whether the access conditions contained in the field ACCESS_CRITERIA _C correspond to the access titles pre-stored in the memory 82. If yes, then in a step 128, the decryption module 80 decrypts the cryptogram CW * _C. For this, in step 128, the module 80 uses the key K _c corresponding to the identifier of the key contained in the ECM_SOID _C field. The decryption of the cryptogram CW * _C makes it possible to obtain the part CW _C of the control word. The processor 62 transmits, during a step 130, this portion CW _C to the assembly module 68.

If in step 124, the cryptographic redundancy is judged to be incorrect or if in step 126 the access conditions contained in the field ACCESS_CRITERIA _C do not correspond to the access titles prerecorded in the memory 82, then the processor 62 proceeds to a step 132 of sending an error message to the receiver 6. In parallel with the steps 122 to 132, the filter 64 transmits, during a step 140, only the fields necessary for the decryption module 66 and the assembly module. Here, the fields ECM_SOID _t , ACCESS_CRITERIA _t and CW * _t are transmitted to the decryption module 66 and the CW MODE field to the assembly module 68. Thus, the module 66 does not have all the information necessary for descrambling. This enhances the security of the device 6.

Then, during a step 142, the decryption module 66 verifies that the access conditions contained in the ACCESS__CRITERIA field _t correspond to the pre-recorded access titles in the memory 72. If so, it proceeds, when a step 144 for decrypting the cryptogram CW * _t to reconstruct the CW part _t of the control word. The CW part _t is then transmitted to the assembly module 68.

If the assembly module 68 has received the error message sent in step 132, or if the conditions of access contained in the field ACCESS_CRITERIA _t do do not correspond to the access tickets pre-stored in the memory 72 during the step 142, the assembly module is inhibited during a step 145. In this case no complete control word is constructed and the descrambler 76 n performs no descrambling of the scrambled information received.

On the other hand, if the processor 62 has decrypted the cryptogram CW * _C and the module 66 has deciphered the cryptogram CW * _t? then the module 68 assembled, at a step 146 the portions CW _C and CW _t so as to build a complete control word. More precisely, during step 146, the module 68 uses the assembly algorithm contained in the memory 75 parameterized using the value contained in the CW_MODE field. At the end of step 146, the complete control word is transmitted to the descrambler 76 which, in a step 148, descrambles the scrambled information using the control word CW constructed by the module 68. The transmission of the word Control of the module 68 to the descrambler 76 is preferably secure.

Then, the descrambled information is transmitted in the clear to the television set 90 for display thereof in a step 150.

In the system and method described above, the CW portion _C of the control word is transmitted in clear from the processor 62 to the receiver 60 to descramble the received scrambled information. However, the interception of this part CW _C is not enough on its own to allow an illegal descrambling of the scrambled information.

The fact of using a parameterized separation algorithm increases the complexity of the system 2 and therefore increases its security vis-à-vis hacking attempts. Using a common K _c key to a small group of security processors and a K _t key common to a small group of receivers makes it possible to create a match between this small group of security processors and this narrow group of receivers. Therefore, the security processors in which the key K _c is registered can only be used in receivers in which the key K _t is registered.

Here, the number of bytes or bits of information of parts CW _C and CW _t is equal to the number of bytes or bits of information of the control word. Therefore, the implementation of the system and method described herein is transparent to the security processor. It is therefore not necessary to modify the security processor. Bits or bytes complement random bits or bytes of the control word in every part CW and CW _C _t. This makes it difficult for an unauthorized person to identify bits or bytes of the CW _C or CW _t portion used to construct the control word, bits or bytes that are unnecessary for this task.

Many other embodiments of the system 2 are possible. For example, the decryption module 66 is either in software form or in hard-wired form. The wired form is, for example, carried out using a secure chip and a secure key memory. The chip is known as the "Chip-set". The wired version has a better level of security.

The receiver 2 has been described in the particular case where the descrambling unit 61 is integral with the receiver. Alternatively, the unit 61 is not integral with the receiver but implemented in a removable external module connected to the receiver via a connection socket so as to be mechanically coupled / uncoupled from the terminal. In the case of an external module, the key K _t is not common to a group of receivers but to a group of descrambling units only.

In system 2, the control word CW is only divided into two equal parts CW _C and CW _t . Alternatively, either the CW part _C or the CW part _t has more bytes of the CW control word than the other. In a variant also, the control word CW is divided into more than two parts, one of these parts being intended for the receiver, while the other parts are each intended for a respective security processor. This variant applies in particular to a receiver equipped with several security processors similar to the processor 62.

The format of the ECM has been described with regard to FIG. 2 in the particular case where it comprises a single cryptogram CW * _C corresponding to the encrypted part CW _C and a single cryptogram CW * _t corresponding to the encrypted part CW _t . Alternatively, several cryptograms CW * _C and / or CW * _t are contained in a single ECM. Also as a variant, the cryptogram CW * _C corresponds to the cryptogram obtained by encrypting several successive CW _C parts in time and / or the cryptogram CW * _t corresponds to the cryptogram obtained by encrypting several CW parts _t successive in time. It is also possible to create an ECM to carry only the CW * _C cryptogram (s) and another ECM to carry only the CW * _t cryptogram (s).

In a variant, the fields ECM_SOID _C and ECM_SOID _t are grouped together to form a single field ECM_SOID containing the information necessary for the decryption of the cryptograms CW * _C and CW * _t .

Preferably, the parameter used by the assembly algorithm is encrypted during transmission and then decrypted during reception, for example, by the module 66, before being transmitted to the assembly module 68.

As a variant, the separation and assembly algorithms are each replaced by a list of different separation and assembly algorithms each associated with an identifier. During transmission, the module 24 uses one of the separation algorithms and the identifier of the assembly algorithm to be used is transmitted to the reception device using, for example, the CW_MODE field of the ECM. Upon receipt, the module 68 selects the assembly algorithm to be used using the received identifier. This embodiment increases the complexity of the system 2 and therefore its security. It is also possible to combine the embodiment of FIG. 1 with the above variant. In this case, several parametric separation algorithms are usable by the transmitter and several parametric assembly algorithms are usable by the receiver. The CW-MODE field includes both an identifier of the assembly algorithm to use as well as the value of the parameter to be used.

Finally, in a simplified embodiment, the transmitter uses only one unparametric separation algorithm and the receiver uses only one unparametric assembly algorithm. In this last variant, the CW_MODE field of the ECM message is deleted.

In the embodiment of ^"Figure 1, the parameter value is contained in the CW_MODE field. In a variant, the CW_MODE field contains only a pointer to a value of the prerecorded parameter in a memory of the receiver 60. In a simplified variant, the ECM does not include an ACCESS_CRITERIAt field and the memory 74 does not include prerecorded access titles. In this variant, step 142 of the method is deleted and steps 140 and 144 are directly linked.

Another way of enhancing the security of the messages arriving at the receiving device is to extend the scope of the cryptographic redundancy ECM_REDUND to all or some of the parameters relating to the descrambling unit. These parameters are then provided to the processor 62 to verify the integrity and authenticity of all of these data.

Here, the keys K _c and K _t have been described as being respectively common to a group of security processors and to a group of receivers or descrambling units. In a variant, the keys K _c and K _t are unique for each security processor and each receiver or each descrambling unit. Conversely, in another variant, the keys K _c and K _t are common to all the security processors and to all the receivers or descrambling units of the system 2.

Finally, the key K _c can be chosen equal to the key K _t . Such a choice makes it possible to simplify the management of the keys in the transmitter.

Claims

1. Device for receiving scrambled information, this device comprising: - a descrambling unit (61) capable of descrambling the scrambled information by means of a control word,

a security processor (62) capable of decrypting at least part of the control word to be used for descrambling the information, and transmitting the decrypted control word to the descrambling unit, characterized in that the security processor is adapted to transmit only a first portion of the control word (CW _C ) to the descrambling unit, this first part of the control word being insufficient on its own for descrambling the scrambled information, and in that the descrambling unit comprises an assembly module (68) adapted to complete the first part of the control word transmitted by the security processor to construct a complete control word sufficient to descramble the scrambled information.

2. Device according to claim 1, characterized in that it comprises a filter (64) adapted to prevent transmission to the security processor of sufficient information alone to reconstruct the complete control word.

3. Device according to claim 2, characterized in that the filter is adapted to transmit to the security processor a cryptogram (CW * _C ) of the first part of the control word made with a first key (K _c ) encryption used only for this security processor or for a small group of security processors among all the security processors usable in a scrambled information transmission system.

4. Device according to any one of the preceding claims, characterized in that the descrambling unit comprises a deciphering module (66) adapted to decrypt a cryptogram (CW * _t ) of a second part of the control word, this second part of the control word being insufficient on its own for descrambling the scrambled information, and in that the assembly module (68) is able to complete the first part (CW _C ) of the control word with the second part (CW _t ) the control word decrypted by the decryption module to build the complete control word.

5. Device according to claim 4, characterized in that the cryptogram (CW * t) of the second part is made using a second key (K _t ) of encryption used only for this descrambling unit or for a a restricted group of descrambling units among all the descrambling units that can be used in a scrambled information reception system.

6. Device according to any one of the preceding claims, characterized in that the assembly module (68) is able to complete the first part (CW _C ) of the control word transmitted by the security processor by implementing a assembly algorithm, the assembly algorithm being a function of an assembly algorithm identifier and / or a parameter of the assembly algorithm, this algorithm identifier and / or this parameter varying in function of the control word.

7. Descrambling information unit adapted to be implemented in a receiving device according to any one of claims 1 to 6, characterized in that the unit comprises the assembly module (68) able to complete the first part (CW _C ) the control word transmitted by the security processor, to construct a complete control word that can be used to descramble the scrambled information.

8. Unit according to claim 7, characterized in that it comprises the filter (64) adapted to prevent transmission to the security processor of sufficient information alone to reconstruct the complete control word.

9. Unit according to any one of claims 7 to 8, characterized in that it comprises the decryption module (66) for decrypting a cryptogram

(CW * _t ) of a second part of the control word, and in that the assembly module is able to complete the first part (CW _C ) of the control word with the second part of the control word decrypted by the decryption module to build the complete control word.

10. Transmitter adapted to operate with a receiving device according to any one of claims 1 to 6, characterized in that the transmitter comprises a separation module (26) adapted to split into at least one first (CW _C ) and a second (CWt) parts control word, and the transmitter is able to transmit the first part to the security processor of the receiving device and the second part to the descrambling unit of the receiving device, each of the parts of the control word being insufficient on its own to descramble the scrambled information.

11. Transmitter according to claim 10, characterized in that it comprises a module (32) adapted to encrypt the first part of the control word with a first known key only the security processor or a small group of security processors among all the security processors that can be used in a scrambled information transmission system, and that is suitable for encrypting the second part of the control word with a second known key of the descrambling unit only or a restricted group of descrambling units among the set of descrambling units that can be used in the transmission system, before transmitting each parts of the encrypted control word.

12. Transmitter according to any one of claims 10 to 11, characterized in that the transmitter is able to broadcast in the form of a TLV structure (Type Length Value) the first and second parts of the control word encoded as well as all the parameters necessary for their use by the receiving device.

13. Transmitter according to any one of the preceding claims, characterized in that the separation module is able to complete each part of the control word by bits or bytes of additional information so that the number of bits or bytes of each part is equal to the number of bits or bytes of the complete control word.

Transmitter according to Claim 13, characterized in that the separation module is able to modify the bits or bytes of additional information for each control word or for each limited group of control words among the set of control words. used.

A scrambled information transmission system, the system comprising:

a transmitter (4) able to broadcast scrambled information by means of a control word, and at least one reception device (6) able to descramble the scrambled information broadcast, characterized in that the reception device is according to any one of claims 1 to 6.

16. Method for receiving scrambled information _r this method comprising: a step (148) of descrambling the scrambled information by a descrambling unit using a control word,

a step of decryption by a security processor of at least part of the control word to be used for descrambling the information, and

a step (130) of transmission by the security processor of the decrypted control word to the descrambling unit, characterized in that during the transmission step, the security processor transmits only a first portion of the control word (CW _C ) to the descrambling unit, this first part of the control word being insufficient on its own for descrambling the scrambled information, and in that the method comprises a step (146) of assembly in the descrambling unit , comprising completing the first portion of the control word transmitted by the security processor to construct a complete control word sufficient to descramble the scrambled information.

17. The method of claim 16, characterized in that a filter (64) prevents (in 122) the transmission to the security processor of sufficient information alone to build the complete control word.

18. The method of claim 17, characterized in that the filter transmits to the security processor a cryptogram (CW * _C ) of the first part of the control word made using a first key (K _c ) encryption used only for this security processor or for a small group of security processors among all security processors usable in a scrambled information transmission system.

19. Method according to any one of claims 16 to 18, characterized in that a decryption module decrypts (144) a cryptogram (CW * _t ) of a second part of the control word, this second part of the word control system alone to descramble the scrambled information, and in that during the assembly step, the first part (CW _C ) of the control word is completed with the second part (CW _t ) of the word of Decrypted control to build the complete control word.

20. The method of claim 19, characterized in that the cryptogram (CW * _t ) of the second part of the control word is produced using a second key (K _t ) of encryption used only for this unit of descrambling or for a small group of descrambling unit among the set of descrambling units usable in a scrambled information reception system. ^•

21. Method according to any one of claims 16 to 20, characterized in that during the assembly step, the first part (CW _C ) of the control word transmitted by the security processor is completed by implementing an assembly algorithm, the assembly algorithm being a function of an assembly algorithm identifier and / or a parameter of the assembly algorithm, this algorithm identifier and / or this variant parameter depending on the control word.

22. Device according to any one of claims 1 to 6, characterized in that the scrambled information is audiovisual programs.