WO2007076652A1 - Procede d'autorisation utilisateur pour systeme d'acces conditionnel a la television numerique - Google Patents

Procede d'autorisation utilisateur pour systeme d'acces conditionnel a la television numerique Download PDF

Info

Publication number
WO2007076652A1
WO2007076652A1 PCT/CN2006/001379 CN2006001379W WO2007076652A1 WO 2007076652 A1 WO2007076652 A1 WO 2007076652A1 CN 2006001379 W CN2006001379 W CN 2006001379W WO 2007076652 A1 WO2007076652 A1 WO 2007076652A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
authorization
address
users
group
Prior art date
Application number
PCT/CN2006/001379
Other languages
English (en)
French (fr)
Inventor
Haibo Jia
Zheng Liu
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Publication of WO2007076652A1 publication Critical patent/WO2007076652A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/16—Analogue secrecy systems; Analogue subscription systems
    • H04N7/167—Systems rendering the television signal unintelligible and subsequently intelligible
    • H04N7/1675—Providing digital key or authorisation information for generation or regeneration of the scrambling sequence
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/258—Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data
    • H04N21/25808—Management of client data
    • H04N21/25816—Management of client data involving client authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/258—Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data
    • H04N21/25866—Management of end-user data
    • H04N21/25875—Management of end-user data involving end-user authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
    • H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
    • H04N21/4627—Rights management associated to the content
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/63—Control signaling related to video distribution between client, server and network components; Network processes for video distribution between server and clients or between remote clients, e.g. transmitting basic layer and enhancement layers over different transmission paths, setting up a peer-to-peer communication via Internet between remote STB's; Communication protocols; Addressing
    • H04N21/633—Control signals issued by server directed to the network components or client
    • H04N21/6332—Control signals issued by server directed to the network components or client directed to client
    • H04N21/6334—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key

Definitions

  • the present invention relates to the field of multimedia communication technologies, and in particular to a method for authorizing a user in a digital television conditional access system.
  • NVOD Near Video On Demand
  • the Condition Access System is the core technology guarantee for digital TV encryption control. It provides the necessary technical means for the operation of digital TV.
  • the system can perform digital TV broadcasting services according to time, channel and program according to different situations. Management controls that enable authorized users to legitimately use a particular service, which is not available to unauthorized users.
  • CAS can realize the authorization management and reception control of various digital TV broadcasting services.
  • unauthorised users cannot descramble the scrambled program, and thus cannot watch the program.
  • the CAS packages a number of channels into products. After the package is ordered, if the user orders the product, the CAS needs to send a message to authorize the user.
  • the authorization message generally passes the Entitlement Management Message (EMM) in the CAS.
  • EMM Entitlement Management Message
  • STB set-top box
  • GK group key
  • SKS SKS in the authorization message, where SK' is encrypted by using the GK to encrypt the service key (SK) with an encryption algorithm.
  • the ciphertext form of SK after receiving the EMM message, the STB decrypts the SK' using the saved multicast key GK to obtain the SK, and then uses the SK to decrypt the Entitlement Control Message (ECM) message to obtain the control word (CW). Finally, you can use the CW descrambled program stream to see the program.
  • ECM Entitlement Control Message
  • the broadcasting network is mainly a one-way network.
  • Authorized messages can only be broadcast to the user through one-way mode. If the current system has 1 million users, the system needs 1 million cards corresponding to the 1 million users.
  • CAS is the user of the card) EMM message, ie 1 million The card corresponds to 1 million messages.
  • the index of the amount of EMM information data broadcasted will continue to increase, and since the user may not be powered on when the EMM message is sent, the CAS cannot confirm that the user has received the message. This data can only be continuously circulated for a long period of time.
  • the EMM header and each sub-information are multiplexed into the transport stream and then expanded to a fixed length of 188 bytes.
  • a typical cable TV station it is necessary to support 1 million users and 64 sets of programs. Assuming that CAS packs 64 channels into 10 products, the system needs to separate 1 million cards for the 1 million users.
  • the data transmitted on the digital TV broadcast network includes video streams, audio streams and other system data streams.
  • the EMM occupies a large bandwidth in the CAS, the actual bandwidth occupied by the program is reduced, and because of the scrambler or multiplexer The processing power is limited, so the bandwidth of the EMM data stream on the front-end device cannot be allocated very much.
  • the present invention provides a method of authorizing a user in a digital television conditional access system to overcome the shortcomings of the prior art in which the bandwidth occupied by the EMM is too large in the CAS-to-user authorization process.
  • a method of authorizing a user in a digital television conditional access system includes the following steps:
  • conditional receiving system sends the authorization information message to the set top box in a multicast authorization manner
  • the set-top box parses the received authorization information message to obtain authorization information of the user, and authorizes the user connected to the set-top box through the authorization information.
  • step (a) is further implemented by the following steps:
  • conditional receiving system packages the channel to generate a product identification
  • the conditional receiving system assembles the authorization data, the product identifier, and the multicast address into an authorization information message; (a4) The conditional receiving system sends the authorization information message to the top of the user through the transmission network.
  • the authorization information message is an authorization management information message.
  • the user grouping policy is to divide users whose card addresses are consecutive into one group, and each group has a fixed number of users.
  • the number of users fixed in each group is 1024.
  • the common address attribute of the user card is that the same address bits determined by the portion of the user card address have the same value.
  • the multicast address is any one of the same group of user cards.
  • the authorization data is a bit table data, the bits of different positions in the bit table data correspond to different user card addresses, and consecutive bits correspond to consecutive user card addresses;
  • the value is the identifier of the product corresponding to the user corresponding to the card address.
  • bit corresponding to the address of each user card is 1 bit.
  • the set top box receives the authorization information message by using the following method:
  • the user When the user's card address matches the common address attribute in the authorization information packet, the user belongs to the same group of users and receives the authorization information message.
  • the CAS sends the EMM message to the STB by means of multicast authorization, and authorizes the user who subscribes the product, thereby solving the current authorization mode mainly by unicast mode, CAS.
  • the number of packets sent during authorization is too large, which causes the bandwidth occupied by EMM to be large.
  • the invention effectively saves the bandwidth requirement of the authorization message and reduces the rotation period.
  • FIG. 1 is a flow chart of a main implementation principle of an authorization method in a digital television CAS according to the present invention
  • FIG. 2 is a structural diagram of an EMM message frame in the first embodiment
  • FIG. 3 is a structural diagram of an EMM message frame in the second embodiment
  • FIG. 4 is a structural diagram of an EMM message frame in the third embodiment.
  • the CAS packages the channel into a product, and sends an authorization information message to the STB by means of multicast authorization, and authorizes the user who subscribes the product.
  • first set the multicast address according to each card has a unique card address, set a group of cards with a common address attribute into the same group;
  • the product is licensed (the product is the program package, which is the basic unit for authorizing the card, which is a combination of several channels)
  • the CAS assembles the authorization data, product identification and multicast address into authorization information messages, and groups them through the transmission network.
  • the authorization information packet is sent to the user's STB.
  • the authorization information packet is parsed to obtain the user.
  • the order information of the product is authorized to be processed by the user who connects the STB through the order information.
  • FIG. 1 is a flowchart of a main implementation principle of an authorization method in a digital television CAS according to the present invention.
  • the authorization information packet specifically refers to an authorization management information EMM message, and the main implementation process is as follows: Step 110: C AS packages the channel , generating product identification;
  • Step 120 Set, according to the grouping policy of the user, a group of users whose card addresses have the common address attribute into the same group;
  • the user's grouping policy refers to grouping the users whose card addresses are consecutive into one group, wherein each group has a fixed number of users, and the user card having a common address attribute means that the same address bits determined by the part of the user card address have the same Value.
  • Step 130 The CAS assembles the authorization data, the product identifier, and the multicast address of the same group of user cards into an authorized EMM packet, and modulates the packet into the transmission network.
  • the multicast address is obtained according to the common address attribute of the group in step 120. Any user card address in the group can be used as a multicast address, because the multicast address in the authorized EMM message only identifies the common address attribute.
  • the address bits are valid, and the user cards in a group have the same common address attribute;
  • the authorization data is a bit table data, and the bits in different positions in the bit table data correspond to different user card addresses in the group having the common address attribute, and the consecutive bits correspond to consecutive user card addresses; and the value of the bits in the bit table data It is also the identifier of the product corresponding to the user corresponding to the card address.
  • Step 140 The STB that belongs to the specified user group in the EMM packet receives the EMM packet.
  • the STB performs authentication according to the common address attribute of the group. If the card address of the user meets the common address attribute in the EMM message, and the user belongs to the same group of users, the EMM message is received; otherwise, the user cannot receive the message.
  • the EMM authorization message If the card address of the user meets the common address attribute in the EMM message, and the user belongs to the same group of users, the EMM message is received; otherwise, the user cannot receive the message.
  • Step 150 The STB of the user parses the EMM packet, obtains authorization information for the user, and obtains an order for the user to subscribe to the product.
  • the authorized receiving time depends on the multicast algorithm of the CAS, that is, the number of users that can be authorized by one multicast authorization message.
  • the following takes the grouping of 1024 users as an example to illustrate the process in which the conditional receiving system sends an EMM packet to authorize the user who subscribes the product through multicast authorization. The specific steps are as follows:
  • Step 210 The CAS packages the channel into a product; in this example, the product 1 includes CCTV1, CCTV2, ... CCTV8, and the product 2 includes Phoenix Satellite TV, and the product 3 includes ising
  • Step 220 Divide 1024 users having a common address attribute and consecutive card addresses into a group; in this example, the card address 0x884800010000, 6 bytes, and the first 38 bits of 48 bits are grouped.
  • the common address attribute, the card address is 0x884800010000, 0x884800010001, 0x884800010002..., 0x8848000103FF, the 1024 users are divided into one group;
  • Step 230 Assembling the authorization data, the product identifier, and the multicast address into the authorized EMM message into the transmission network.
  • the assembled EMM message is as shown in FIG. 2, where the parameters related to the present invention are There are 6 bytes of "multicast address", 2 bytes of "product identification”, 16 bytes of "SK"', 128 bytes of "authorization data", the specific settings are as follows:
  • Product Identification 0x0001, which means Product 1, which includes eight TV channels such as CCTV1, CCTV2...CCTV8;
  • SK is the SK in the form of cipher text.
  • the set-top box uses the saved multicast key GK to decrypt SK' to get SK:
  • Authorization data A 1024-bit bit table data, each bit represents a card address (user), and also indicates the user's purchase of the product ID, the value can be set to 0 and 1, specifically, 0 means no purchase, 1 means already purchased. In this example, as shown in Figure 2, it means that 0x884800010001 and 0x884800010003 are authorized, and no other users are authorized.
  • Step 240 The STB that belongs to the specified user group in the authorized message receives the EMM message; the STB performs authentication according to the common address attribute of the group, that is, according to the common address attribute of the first 38 bits of the card address 0x884800010000, Only users who meet the common address attribute can receive the EMM message, for example, 0x884800010001 can receive 0x884800010000, and 0x888800010000 cannot receive 0x884800010000.
  • Step 250 The user parses the EMM packet to obtain an order for the user to subscribe to the product. According to the EMM packet structure described in step 230, the user parses the authorization data. If the bit corresponding to the card address of the user is 1, the user can receive the authorization. If the corresponding bit is 0, the user cannot receive the authorization. This authorization also removes the authorization of the product that already exists.
  • Second Embodiment - On the basis of the first embodiment, we can implement multicast authorization by means of more users or fewer users in each group. For example, in the second embodiment, we use 512 groups per group. Grouping of users. For example, the authorization of the product 2 is used to describe the process in which the CAS sends an EMM message to the user who subscribes the product through multicast authorization. The specific steps are as follows:
  • Step 310 The CAS packages the channel into a product; in this example, the product 1 includes CCTV1, CCTV2, ... CCTV8, and the product 2 includes Phoenix Satellite TV, and the product 3 includes ising
  • Step 320 Divide 512 users having a common address attribute and consecutive card addresses into a group; in this example, the card address 0x884800010000, 6 bytes, and the first 39 bits of 48 bits are used as the common address attribute of the group. , the card address is 0x884800010000, 0x884800010001, 0x884800010002..., 0x8848000101FF, these 512 users are divided into one group;
  • step 330 the authorization data, the product identifier, and the multicast address are assembled into an authorized EMM message and modulated into the transmission network.
  • the assembled EMM message is as shown in FIG. 3, and the parameters related to the present invention are 6 bytes of "multicast address", 2 bytes of "product identification”, 16 bytes “SK"', 64 bytes of "authorization data", the specific settings are as follows:
  • Multicast Address 0x884800010000
  • Product Identification 0x0002, which means Product 2, which includes the Phoenix TV channel;
  • SK is the SK in the form of cipher text. After receiving the message, the set-top box uses the saved multicast key GK to decrypt SK' to get SK:
  • Authorization data A 512-bit bit table data, each bit represents a card address (user), and also indicates the user's purchase of the product ID, the value can be set to 0 and 1, specifically, 0 means no purchase, 1 indicates that it has been purchased. In this example, as shown in Figure 3, it indicates that 0x884800010001 and 0x884800010003 are authorized, and no other users are authorized;
  • Step 340 The STB that belongs to the specified user group in the authorized message receives the EMM message; the STB performs authentication according to the common address attribute of the group, that is, according to the common address attribute of the first 39 bits of the card address 0x884800010000, Only users who meet the common address attribute can receive the EMM message, for example, 0x884800010001 can receive 0x884800010000, and 0x888800010000 cannot receive 0x884800010000.
  • Step 350 The user parses the EMM packet to obtain an order for the user to subscribe to the product. According to the EMM packet structure described in step 330, the user parses the authorization message. If the bit corresponding to the card address of the user is 1, the user can receive the authorization. If the corresponding bit is 0, the user cannot receive the authorization. This authorization also removes the authorization of the product that already exists.
  • the "authorization data" in the EMM message uses lbit to represent a user.
  • the EMM message represents a user with 2 bits, and each group of 512 users is used to authorize the product 2, and the CAS sends the EMM message by means of multicast authorization to authorize the user of the ordered product, and implements
  • the steps in the first embodiment and the second embodiment are basically the same, and only the specific frame format of the EMM message is different.
  • Figure 4 shows the "authorization data" in the EMM message.
  • the 2bit represents the frame format of a user.
  • the 11 and 00 respectively indicate whether the user has authorization.
  • Figure 4 indicates that 0x884800010001 and 0x884800010003 are authorized, and other users are not authorized.
  • each group of 1024 and 512 users is implemented, but in principle, the number of each group of users can be In the case of packet fragmentation, more users per group (for example, a group of 2048 users, etc.) can be implemented, or only partial bytes can be used to implement a group of fewer users per group (for example: 10 A group of users, etc.).
  • lbit can be used to represent a user or 2bit to represent a user, or a combination of multiple bits can be used to represent a user.
  • Transmission networks in the method of the present invention include, but are not limited to, satellite transmission networks, terrestrial wireless transmission networks, wired transmission networks, and IP networks.
  • the CAS sends the EMM packet to the STB through the multicast authorization mode, and authorizes the user who subscribes the product, which effectively saves the bandwidth requirement of the authorization message and reduces the rotation period.

Landscapes

  • Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Multimedia (AREA)
  • Signal Processing (AREA)
  • Computer Graphics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

一种在数字电视条件接收系统中对用户授权的方法 技术领域
本发明涉及多媒体通讯技术领域， 具体指一种在数字电视条件接收系统 中对用户授权的方法。
背景技术
数字电视由于其优质的画面和多样的服务方式正逐渐替代模拟电视走入 平常百姓家庭。 各种付费节目， 比如准视频点播 (Near Video On Demand, NVOD)等， 都有相应的收费方式， 要保证这些增值业务的开展， 必须对信息 进行加密， 只允许经过授权的用户收看特定节目， 从而维护收视者的合法权 益， 保证运营者的利益。
条件接收系统 (Condition Access System, CAS)是数字电视加密控制的核 心技术保证， 为数字电视的运营提供了必要的技术手段， 该系统可以按不同 情况对数字电视广播业务按时间、 频道和节目进行管理控制，使拥有授权的用 户合法地使用某一项业务， 而未经授权的用户不能使用这一业务。
CAS能实现各项数字电视广播业务授权管理和接收控制， 在用户端， 未 经授权的用户不能对加扰节目进行解扰， 因而无法收看节目。
CAS对若干个频道进行打包成产品， 打包后如果用户定购该产品， 则需 要 CAS下发报文对该用户进行授权， 该授权报文在 CAS中一般通过授权管 理信息（Entitlement Management Message, EMM)报文下发到机顶盒（STB)。 由于用户在开卡时已经获知各种卡相关的参数， 其中包括组密钥 （GK)， 授 权报文中的 SKS 其中 SK'就是使用 GK对服务密钥 （SK)用加密算法进行 加密后的 SK的密文形式； STB在接收到 EMM报文后使用保存的组播密钥 GK解密 SK'得到 SK ， 再用 SK解密授权控制信息 （Entitlement Control Message, ECM)报文获得控制字 （CW)， 最终使用 CW解扰节目流即可看 到节目。
目前广电网络主要是单向网络， 授权报文通常只能通过单向方式广播到 用户端， 如果当前系统有 100万个用户， 那么系统需要对该 100万个用户对 应的 100万张卡（对 CAS来说卡就是用户）分别下发 EMM报文， 即 100万 张卡对应 100 万个报文。 这种方法中随着用户量和节目数的增加， 广播的 EMM信息数据量的指数会不断增加，并且由于在下发 EMM报文时用户有可 能没有开机， CAS无法确认用户已经收到报文， 只能在一个较长的时间内不 停地循环下发这些数据。
在一般的 CAS中， EMM信息头和每个子信息复用到传输流中之后都扩 成定长 188个字节。 考虑到一般的有线电视台的应用， 需要支持 100万个用 户和 64套节目， 假设 CAS对 64个频道进行打包成 10个产品， 那么系统需 要对该 100万个用户对应的 100万张卡分别下发 10个 EMM授权报文，需要 1Μχ10χ188Β = 1880ΜΒ的信息量， 按照分配 50Kbps的带宽计算， 轮播一遍 的时间为 （1880x1000x8) kb/(50kbps)=300， 800秒。 数字电视广播网上传输 的数据包括视频流、 音频流和其它系统数据流， 如果在 CAS中 EMM占据很 大带宽的话， 节目占用的实际带宽就会降低， 而且， 因为加扰器或复用器的 处理能力有限， 所以在前端设备上 EMM数据流的带宽无法分配很大。
综上， 如何有效减少在 CAS对用户授权过程中 EMM所占据的带宽， 是 目前业界极需解决的问题。
发明内容
本发明提供一种在数字电视条件接收系统中对用户授权的方法， 以克服 现有技术的在 CAS对用户授权过程中 EMM所占据的带宽过大的缺点。
本发明的目的是通过如下技术方案实现的：
一种在数字电视条件接收系统中对用户授权的方法， 包括下述步骤：
(a)条件接收系统以组播授权的方式发送授权信息报文到机顶盒；
(b)机顶盒对接收到的授权信息报文进行解析，得到用户的授权信息，通 过该授权信息对连接所述机顶盒的用户进行授权处理。
进一步地， 所述的步骤（a)进一步是通过下述步骤实现的：
(al)条件接收系统对频道进行打包， 生成产品标识；
(a2)根据用户的分组策略， 将一组卡具有共同地址属性的用户设置到同 一个组内；
(a3)条件接收系统将授权数据、 产品标识和组播地址组装成授权信息报 文； (a4)条件接收系统通过传输网络将所述授权信息报文发送到用户的机顶 进一步地， 所述授权信息报文是授权管理信息报文。
再进一步地， 所述的用户分组策略是将卡地址连续的用户分为一组， 其 中每个组内设置有固定的用户数。
更进一步地， 所述每个组内固定的用户数是 1024。
再进一步地， 所述的用户卡的共同地址属性是用户卡地址中部分确定的 相同地址位具有相同的值。
再进一步地， 所述的组播地址是同一组用户卡中任意一卡地址。
再进一步地， 所述的授权数据为一个位表数据， 所述的位表数据中不同 位置的位对应不同的用户卡地址， 且连续的位与连续的用户卡地址对应； 所 述的位的数值为该卡地址对应的用户是否定购产品的标识。
更进一步地， 在所述的位图数据中， 与每个用户卡的地址对应的位是 1 位。
进一步地， 所述步骤 (b)中， 机顶盒接收授权信息报文是通过下述方法实 现的：
当用户的卡地址与所述的授权信息报文中的共同地址属性相符时， 该用 户属于同组用户， 接收所述的授权信息报文。
从以上技术方案可以看出，本发明的授权方法中 CAS通过组播授权的方 式发送 EMM报文到 STB， 对定购该产品的用户进行授权， 从而解决了目前 授权方式主要为单播方式， CAS在授权时发送的报文数量过大， 导致 EMM 所占据的带宽大的缺点。
本发明有效地节省了授权消息对带宽的要求， 缩小了轮播周期。 以 100 万用户 10个产品为例， 100万用户分成 1000个组 （每组 1024个用户）， 每 个组再有 10个产品的授权， 则共有 10000个报文， 每个传输流报文长度为 188字节，按照分配 50Kbsp的带宽计算，轮播一遍的时间为 (10000个报文 xl88 字节每报文 x8bits) /(50xl024 bsp) = 293.75秒， 从而得到轮播一次约 300秒， 这和现有技术中轮播一次需要 300， 800秒相比具有明显的优势。
附图说明 图 1为本发明数字电视 CAS中授权方法的主要实现原理流程图； 图 2为第一实施例中 EMM报文帧结构图；
图 3为第二实施例中 EMM报文帧结构图；
图 4为第三实施例中 EMM报文帧结构图。
具体实施方式
本发明的核心思想为： 首先， CAS将频道进行打包成产品， 并通过组播 授权的方式发送授权信息报文到 STB， 对定购该产品的用户进行授权。 在下 发报文对定购产品的用户授权时， 先设置组播地址， 根据每张卡都有一个唯 一的卡地址， 将一组具有共同地址属性的卡设置到同一个组内； 当对某个产 品授权时 （产品即节目包， 是对卡进行授权的基本单位， 为若干个频道的组 合)， CAS将授权数据、产品标识和组播地址组装成授权信息报文，并通过传 输网络以组播授权的方式将该授权信息报文发送到用户的 STB; 当隶属于授 权信息报文中指定用户组的 STB接收到该授权信息报文后， 对该授权信息报 文进行解析， 得到该用户对该产品的定购信息， 通过该定购信息对连接所述 STB的用户进行授权处理。
图 1所示为本发明数字电视 CAS中授权方法的主要实现原理流程图，其 中的授权信息报文具体指授权管理信息 EMM报文， 其主要实现过程如下： 步骤 110: C AS对频道进行打包， 生成产品标识；
步骤 120: 根据用户的分组策略， 将一组卡地址具有共同地址属性的用 户设置到同一个组内；
其中： 用户的分组策略是指将卡地址连续的用户分为一组， 其中每组内 设定固定的用户数， 用户卡具有共同地址属性是指用户卡地址中部分确定的 相同地址位具有相同的值。
步骤 130: CAS将同一组用户卡的授权数据、 产品标识和组播地址组装 成授权 EMM报文， 并将该报文调制到传输网络中；
组播地址是根据步骤 120所述组的共同地址属性得到的， 该组中的任何 一个用户卡地址都能作为组播地址， 因为在授权 EMM报文中组播地址也只 有标识共同地址属性的地址位是有效的， 而一个组中的用户卡是具有相同的 共同地址属性的； 授权数据为一个位表数据， 位表数据中不同位置的位对应具有共同地址 属性的组中不同的用户卡地址， 连续的位与连续的用户卡地址对应； 同时位 表数据中的位的数值也是该卡地址对应的用户是否定购产品的标识。
步骤 140: 隶属于 EMM报文中指定用户组的 STB接收该 EMM报文；
STB 根据该组的共同地址属性进行鉴权， 如果用户的卡地址符合所述 EMM报文中的共同地址属性，该用户属于同组用户，则接收所述 EMM报文; 否则， 该用户不能接收所述 EMM授权报文。
步骤 150: 用户的 STB对该 EMM报文进行解析， 获得对该用户的授权 信息， 并得到该用户对该产品的定购情况。
为使本发明的目的、 技术方案、 及优点更加清楚明白， 以下参照附图并 举实施例， 对本发明进一步详细说明。
第一实施例：
在用户数量、 平均产品定购数量、 预留带宽全相同的情况下， 授权接收 时间就取决于 CAS的组播算法， 即一个组播授权报文所能授权的用户数量。 下面以每组 1024个用户的分组为例，说明条件接收系统通过组播授权的方式 发送 EMM报文对定购该产品的用户进行授权的过程， 具体步骤如下：
步骤 210: CAS对频道进行打包成产品； 在本例中产品 1包括 CCTV1、 CCTV2...CCTV8, 产品 2包括凤凰卫视， 产品 3包括 ......；
步骤 220:将具有共同地址属性、且卡地址连续的 1024个用户分为一组; 在本例中将卡地址 0x884800010000， 6个字节共 48个位 (bit)的前 38个 bit 作为分组的共同地址属性， 则卡地址为 0x884800010000， 0x884800010001 , 0x884800010002... , 0x8848000103FF这 1024个用户分成一个组；
' 步骤 230:将授权数据、产品标识和组播地址组装成授权 EMM报文调制 到传输网络中； 在本例中， 所组装的 EMM报文如图 2所示， 其中和本发明 相关的参数有 6个字节的"组播地址"， 2个字节的"产品标识"， 16个字节的 "SK"'， 128个字节的"授权数据"， 具体设置如下：
"组播地址，，： 0x884800010000；
"产品标识"： 0x0001 , 表示产品 1， 其包括 CCTV1、 CCTV2...CCTV8 等八个电视频道； "SK"': 就是以密文形式存在的 SK, 机顶盒在接收到该报文后使用保存 的组播密钥 GK解密 SK'得到 SK:
"授权数据"： 一个 1024bit的位表数据， 每一个 bit表示一个卡地址（用 户）， 同时也表示该用户对产品 ID的购买情况， 其值可以设置 0和 1， 具体， 0 表示没有购买， 1 表示已经购买。 在本例中如图 2 所示， 表示对 0x884800010001和 0x884800010003进行授权， 其它用户都没有授权；
步骤 240:隶属于授权报文中指定用户组的 STB接收该 EMM报文； STB 根据该组的共同地址属性进行鉴权， 即根据卡地址 0x884800010000的前 38 个 bit的共同地址属性进行鉴权，只有符合该共同地址属性的用户才能接收该 EMM报文， 例如 0x884800010001 才能收到 0x884800010000 的报文， 而 0x888800010000不能接收 0x884800010000的报文；
步骤 250:用户对该 EMM报文进行解析，得到该用户对该产品的定购情 况。 根据步骤 230所述的 EMM报文结构， 用户对该授权数据进行解析， 如 果该用户的卡地址对应的 bit为 1表示该用户可以接收该授权， 如果对应的 bit为 0， 则表示用户不能接收该授权， 同时清除已经存在的该产品的授权。
第二实施例- 在第一实施例的基础上， 我们可以采用每组里更多用户或更少用户的方 式来实现组播授权， 例如， 在第二实施例中我们釆用每组 512个用户的分组。 我们以对产品 2进行授权为例， 说明 CAS通过组播授权的方式发送 EMM报 文对定购该产品的用户进行授权的过程， 具体步骤如下：
步骤 310: CAS对频道进行打包成产品； 在本例中产品 1包括 CCTV1、 CCTV2...CCTV8, 产品 2包括凤凰卫视， 产品 3包括 ......；
步骤 320: 将具有共同地址属性、 且卡地址连续的 512个用户分为一组; 在本例中将卡地址 0x884800010000， 6个字节共 48个 bit的前 39个 bit作为 分组的共同地址属性， 卡地址为 0x884800010000， 0x884800010001 , 0x884800010002... , 0x8848000101FF这 512个用户分成一个组；
步骤 330:将授权数据、产品标识和组播地址组装成授权 EMM报文调制 到传输网络中； 在本例中， 所组装的 EMM报文如图 3所示， 其中和本发明 相关的参数有 6个字节的"组播地址"， 2个字节的"产品标识"， 16个字节的 "SK"'， 64个字节的"授权数据"， 具体设置如下：
"组播地址"： 0x884800010000；
"产品标识"： 0x0002, 表示产品 2， 其包括凤凰卫视电视频道；
"SK"': 就是以密文形式存在的 SK， 机顶盒在接收到该报文后使用保存 的组播密钥 GK解密 SK'得到 SK:
"授权数据"：一个 512bit的位表数据，每一个 bit表示一个卡地址（用户）， 同时也表示该用户对产品 ID的购买情况， 其值可以设置 0和 1， 具体， 0表 示没有购买， 1表示已经购买。在本例中如图 3所示，表示对 0x884800010001 和 0x884800010003进行授权， 其它用户都没有授权；
步骤 340:隶属于授权报文中指定用户组的 STB接收该 EMM报文； STB 根据该组的共同地址属性进行鉴权， 即根据卡地址 0x884800010000的前 39 个 bit的共同地址属性进行鉴权，只有符合该共同地址属性的用户才能接收该 EMM报文， 例如 0x884800010001 才能收到 0x884800010000 的报文， 而 0x888800010000不能接收 0x884800010000的报文；
步骤 350:用户对该 EMM报文进行解析，得到该用户对该产品的定购情 况。 根据步骤 330所述的 EMM报文结构， 用户对该授权消息进行解析， 如 果该用户的卡地址对应的 bit为 1表示该用户可以接收该授权， 如果对应的 bit为 0， 则表示用户不能接收该授权， 同时清除已经存在的该产品的授权。
第三实施例：
在实施例一和实施例二中， EMM报文中 "授权数据"中采用 lbit代表一个 用户， 在此基础上， 我们也可以采用多个 bit的组合来代表一个用户， 例如， 在第三实施例中 EMM报文中以 2bit代表一个用户， 采用每组 512个用户的 分组， 对产品 2进行授权， CAS通过组播授权的方式发送 EMM报文对定购 产品的用户进行授权的步骤， 和实施例一和实施例二中的步骤基本相同， 仅 是在 EMM报文的具体帧格式上有所不同。 图 4为 EMM报文中 "授权数据" 釆用 2bit代表一个用户的帧格式， 其中， 分别以 11和 00代表用户是否有授 权， 图 4表示对 0x884800010001和 0x884800010003进行授权， 其它用户都 没有授权。
本发明中以每组 1024和 512个用户来实现，但原理上每组用户的数量可 以变化， 在报文分片的情况下可以实现每组更多用户 （例如： 2048个用户一 组等）， 也可以只使用部分字节， 实现每组比较少的用户分组 （例如： 10个 用户一组等）。
本发明中 EMM报文的 "授权数据"中可以采用 lbit代表一个用户或 2bit 代表一个用户， 也可以采用多个 bit的组合来代表一个用户。
本发明的方法中传输网络包括但不限于卫星传输网络、 地面无线传输网 络、 有线传输网络和 IP网络。
从上述实施例中可以看出， CAS通过组播授权的方式发送 EMM报文到 STB， 对定购该产品的用户进行授权， 有效的节省了授权消息对带宽的要求， 也缩小了轮播周期。
最后应说明的是： 以上实施例仅用以说明本发明而并非限制本发明所描 述的技术方案； 因此， 尽管本说明书参照上述的各个实施例对本发明已进行 了详细的说明， 但是， 本领域的普通技术人员应当理解， 仍然可以对本发明 进行修改或者等同替换； 而一切不脱离本发明的精神和范围的技术方案及其 改进， 其均应涵盖在本发明的权利要求范围当中。

Claims

权利 要 求 书
1.一种在数字电视条件接收系统中对用户授权的方法， 包括下述步骤-
(a)条件接收系统以组播授权的方式发送授权信息报文到机顶盒；
(b)机顶盒对接收到的授权信息报文进行解析，得到用户的授权信息，通 过该授权信息对连接所述机顶盒的用户进行授权处理。
2.如权利要求 1所述的方法， 其特征在于， 所述的步骤（a)进一步是通 过下述步骤实现的：
(al)条件接收系统对频道进行打包， 生成产品标识；
(a2)根据用户的分组策略， 将一组卡具有共同地址属性的用户设置到同 一个组内；
(a3)条件接收系统将授权数据、 产品标识和组播地址组装成授权信息报 文；
(a4)条件接收系统通过传输网络将所述授权信息报文发送到用户的机顶
3.如权利要求 1或 2所述的方法， 其特征在于， 所述授权信息报文是授 权管理信息报文。
4.如权利要求 2所述的方法， 其特征在于， 所述的用户分组策略是将卡 地址连续的用户分为一组， 其中每个组内设置有固定的用户数。
5.根据权利要求 4所述的方法， 其特征在于， 所述每个组内固定的用户 数是 1024。
6.如权利要求 2所述的方法， 其特征在于， 所述的用户卡的共同地址属 性是用户卡地址中部分确定的相同地址位具有相同的值。
7.如权利要求 2所述的方法， 其特征在于， 所述的组播地址是同一组用 户卡中任意一卡地址。
8.如权利要求 2所述的方法， 其特征在于， 所述的授权数据为一个位表 数据， 所述的位表数据中不同位置的位对应不同的用户卡地址， 且连续的位 与连续的用户卡地址对应； 所述的位的数值为该卡地址对应的用户是否定购 产品的标识。
9. 如权利要求 8所述的方法， 其特征在于， 在所述的位图数据中， 与每 个用户卡的地址对应的位是 1位。
10. 如权利要求 1所述的方法， 其特征在于， 所述步骤 (b)中， 机顶盒接 收授权信息报文是通过下述方法实现的：
当用户的卡地址与所述的授权信息报文中的共同地址属性相符时， 该用 户属于同组用户， 接收所述的授权信息报文。
PCT/CN2006/001379 2005-12-31 2006-06-19 Procede d'autorisation utilisateur pour systeme d'acces conditionnel a la television numerique WO2007076652A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200510121536.X 2005-12-31
CNB200510121536XA CN100525434C (zh) 2005-12-31 2005-12-31 一种在数字电视条件接收系统中对用户授权的方法

Publications (1)

Publication Number Publication Date
WO2007076652A1 true WO2007076652A1 (fr) 2007-07-12

Family

ID=37298416

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2006/001379 WO2007076652A1 (fr) 2005-12-31 2006-06-19 Procede d'autorisation utilisateur pour systeme d'acces conditionnel a la television numerique
PCT/CN2006/003646 WO2007076694A1 (fr) 2005-12-31 2006-12-28 Procede et systeme d'autorisation pour abonne, systeme de commande d'autorisation et dispositif terminal associe

Family Applications After (1)

Application Number Title Priority Date Filing Date
PCT/CN2006/003646 WO2007076694A1 (fr) 2005-12-31 2006-12-28 Procede et systeme d'autorisation pour abonne, systeme de commande d'autorisation et dispositif terminal associe

Country Status (4)

Country Link
US (1) US20080059993A1 (zh)
EP (1) EP1853000A4 (zh)
CN (2) CN100525434C (zh)
WO (2) WO2007076652A1 (zh)

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008103864A (ja) * 2006-10-18 2008-05-01 Nec Corp Ｉｐマルチキャストサービスシステム、スイッチ装置及びそれらに用いるグループ選択送信方法
US20090165074A1 (en) * 2007-12-21 2009-06-25 General Instrument Corporation Multi-Address Message Addressing
US8407486B2 (en) * 2008-03-12 2013-03-26 International Business Machines Corporation Sending and releasing pending messages
EP2124439A1 (fr) 2008-05-21 2009-11-25 Nagravision S.A. Méthode d'allocation et de gestion d'abbonements de réception de produits télédiffusés
CN101594294B (zh) * 2008-05-29 2011-12-21 北京视博数字电视科技有限公司 发送授权信息的方法及其条件接收系统前端
US20100210239A1 (en) * 2009-02-17 2010-08-19 Jeyhan Karaoguz Service mobility via a femtocell infrastructure
US8381260B2 (en) * 2009-07-08 2013-02-19 Echostar Technologies L.L.C. Separate addressing of a media content receiver and an installed removable circuit device
EP2566157A1 (en) 2011-09-02 2013-03-06 Nagravision S.A. Method to optimize reception of entitlement management messages in a Pay-TV system
EP2747443B1 (en) 2012-12-20 2019-06-26 Nagravision S.A. Method to enforce processing of management messages by a security module
US9961384B2 (en) 2012-12-20 2018-05-01 Nagravision S.A. Method and a security module configured to enforce processing of management messages
US10652673B2 (en) * 2013-05-15 2020-05-12 Gn Hearing A/S Hearing instrument with an authentication protocol
CN104363040B (zh) * 2014-09-26 2018-09-11 航天数字传媒有限公司 卫星授权搜索的方法及装置
CN105263133A (zh) * 2015-09-14 2016-01-20 惠州Tcl移动通信有限公司 一种虚拟sim卡实现方法及系统
US10291965B2 (en) * 2016-03-11 2019-05-14 DISH Technologies L.L.C. Television receiver authorization over internet protocol network

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1444826A (zh) * 2000-06-02 2003-09-24 通用仪器公司 用以传送加密访问控制信息的系统
DE10244079A1 (de) * 2002-09-06 2004-04-01 Deutsche Telekom Ag Verfahren zum Bereitstellen eines verschlüsselten IP-basierenden Gruppen-Dienstes
US6862684B1 (en) * 2000-07-28 2005-03-01 Sun Microsystems, Inc. Method and apparatus for securely providing billable multicast data

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0200310B1 (en) * 1985-05-01 1993-08-11 General Instrument Corporation Direct broadcast satellite signal transmission system
HU229694B1 (en) * 1997-03-21 2014-05-28 Nagra France Sas Conditional access system
ATE232670T1 (de) * 1997-03-21 2003-02-15 Canal Plus Technologies Chipkarte und empfänger für den empfang von verschlüsselten rundfunksignalen
ID23380A (id) * 1997-03-21 2000-04-20 Canal & Siciete Anonyme Metode dan aparatus untuk mencegah akses yang curang dalam sistem akses bersyarat
US6295361B1 (en) * 1998-06-30 2001-09-25 Sun Microsystems, Inc. Method and apparatus for multicast indication of group key change
EP1067720A1 (en) * 1999-07-05 2001-01-10 CANAL+ Société Anonyme Method and apparatus for transmitting and receiving messages, in particular in broadcast transmissions
US20020002706A1 (en) * 2000-05-26 2002-01-03 Sprunk Eric J. Authentication and authorization epochs
DE10037630B4 (de) * 2000-08-02 2008-02-07 Deutsche Telekom Ag Verfahren zur Adressierung von Endgeräten
TW548983B (en) * 2000-10-26 2003-08-21 Gen Instrument Corp Initial viewing period for scalable authorization of streaming multimedia content
CN1164107C (zh) * 2000-12-18 2004-08-25 北京永新同方信息工程有限公司 一种基于分组算法的数字电视有条件接收系统
US7995603B2 (en) * 2001-05-22 2011-08-09 Nds Limited Secure digital content delivery system and method over a broadcast network
EP1343316A1 (de) * 2002-03-04 2003-09-10 Beta Research GmbH Verfahren und Vorrichtung zum Adressieren von Mitteilungen eines Anbieters digitaler Dienste
US20040151315A1 (en) * 2002-11-06 2004-08-05 Kim Hee Jean Streaming media security system and method
EP1427208A1 (en) * 2002-12-02 2004-06-09 Canal + Technologies Messaging over mobile phone network for digital multimedia network
US20040181811A1 (en) * 2003-03-13 2004-09-16 Rakib Selim Shlomo Thin DOCSIS in-band management for interactive HFC service delivery
US7266198B2 (en) * 2004-11-17 2007-09-04 General Instrument Corporation System and method for providing authorized access to digital content

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1444826A (zh) * 2000-06-02 2003-09-24 通用仪器公司 用以传送加密访问控制信息的系统
US6862684B1 (en) * 2000-07-28 2005-03-01 Sun Microsystems, Inc. Method and apparatus for securely providing billable multicast data
DE10244079A1 (de) * 2002-09-06 2004-04-01 Deutsche Telekom Ag Verfahren zum Bereitstellen eines verschlüsselten IP-basierenden Gruppen-Dienstes

Also Published As

Publication number Publication date
US20080059993A1 (en) 2008-03-06
CN1859559A (zh) 2006-11-08
WO2007076694A1 (fr) 2007-07-12
CN101156350A (zh) 2008-04-02
EP1853000A4 (en) 2008-07-02
CN100525434C (zh) 2009-08-05
EP1853000A1 (en) 2007-11-07

Similar Documents

Publication Publication Date Title
WO2007076652A1 (fr) Procede d'autorisation utilisateur pour systeme d'acces conditionnel a la television numerique
US7383561B2 (en) Conditional access system
US8385545B2 (en) Secure content key distribution using multiple distinct methods
AU2006200338B2 (en) Method of controlling communication between a head-end system and a plurality of client systems
US20080137850A1 (en) Method and system for a generic key packet for mpeg-2 transport scrambling
US20110093883A1 (en) System, protection method and server for implementing the virtual channel service
JP2004187306A (ja) デジタルデータを再送信する端末及び方法を具備する端末及びデータ配信システム
US8693692B2 (en) Direct delivery of content descrambling keys using chip-unique code
AU2007200006A1 (en) Method of descrambling a scrambled content data object
WO2008046323A1 (fr) Procédé, système et appareil pour la protection de service de télévision pour téléphone mobile
EP2373019A1 (en) Secure descrambling of an audio / video data stream
JP2012520649A (ja) 受信機への制御語（ｃｏｎｔｒｏｌｗｏｒｄ）の提供
CN101087402A (zh) 基于ip流的数字电视加密授权系统和方法
CA2396821A1 (en) Conditional access and security for video on-demand systems
US20060233368A1 (en) Method for conditional access in a DMTS/DOCSIS enabled set top box environment
US9100677B2 (en) Server, client device, method for generating a transport stream thereof and processing the transport stream thereof
JP2000124893A (ja) 暗号／復号アルゴリズムの変換方法、暗号通信システムにおける送信装置および受信装置
WO2006024234A1 (en) Method ano apparatus for protecting broadband video and audio broadcast content
JP2012512589A (ja) 放送されたテレビジョン信号の処理方法、システム、および装置
JP5162931B2 (ja) コンテンツ配信方法、中継ノード、データ通信プログラム、および該プログラムを記録した記録媒体
EP1048157B1 (en) Method for transferring data from a head-end to a number of receivers
JP4970012B2 (ja) デジタル放送配信方法及びデジタル放送受信装置
CN103634624A (zh) 基于ip网络的数字电视直播方法及系统
CN102761778B (zh) 一种基于双向终端的数据加解密系统及方法
JP2008136108A (ja) デジタル放送配信方式およびその送受信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application
NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 06752987

Country of ref document: EP

Kind code of ref document: A1