WO2007076694A1 - Procede et systeme d'autorisation pour abonne, systeme de commande d'autorisation et dispositif terminal associe - Google Patents

Procede et systeme d'autorisation pour abonne, systeme de commande d'autorisation et dispositif terminal associe Download PDF

Info

Publication number
WO2007076694A1
WO2007076694A1 PCT/CN2006/003646 CN2006003646W WO2007076694A1 WO 2007076694 A1 WO2007076694 A1 WO 2007076694A1 CN 2006003646 W CN2006003646 W CN 2006003646W WO 2007076694 A1 WO2007076694 A1 WO 2007076694A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization
user
message
group
address
Prior art date
Application number
PCT/CN2006/003646
Other languages
English (en)
French (fr)
Inventor
Haibo Jia
Zheng Liu
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to CNA2006800116891A priority Critical patent/CN101156350A/zh
Priority to EP06840682A priority patent/EP1853000A4/en
Publication of WO2007076694A1 publication Critical patent/WO2007076694A1/zh
Priority to US11/847,590 priority patent/US20080059993A1/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N7/00—Television systems
    • H04N7/16—Analogue secrecy systems; Analogue subscription systems
    • H04N7/167—Systems rendering the television signal unintelligible and subsequently intelligible
    • H04N7/1675—Providing digital key or authorisation information for generation or regeneration of the scrambling sequence
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/258—Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data
    • H04N21/25808—Management of client data
    • H04N21/25816—Management of client data involving client authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
    • H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
    • H04N21/258—Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data
    • H04N21/25866—Management of end-user data
    • H04N21/25875—Management of end-user data involving end-user authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
    • H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
    • H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
    • H04N21/4627—Rights management associated to the content
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
    • H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
    • H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client 
    • H04N21/63—Control signaling related to video distribution between client, server and network components; Network processes for video distribution between server and clients or between remote clients, e.g. transmitting basic layer and enhancement layers over different transmission paths, setting up a peer-to-peer communication via Internet between remote STB's; Communication protocols; Addressing
    • H04N21/633—Control signals issued by server directed to the network components or client
    • H04N21/6332—Control signals issued by server directed to the network components or client directed to client
    • H04N21/6334—Control signals issued by server directed to the network components or client directed to client for authorisation, e.g. by transmitting a key

Definitions

  • the present invention relates to the field of multimedia communication technologies, and in particular, to a system and method for authorizing a user who receives multimedia content, and an authorization control system and terminal device thereof. Background of the invention
  • NVOD video-on-demand
  • CAS Condition Access System
  • conditional access system is the core technical guarantee for the reception control of digital TV (satellite, terrestrial, cable), IPTV, mobile TV, mobile TV, other broadcast or multicast media services.
  • digital TV wireless, terrestrial, cable
  • IPTV IPTV
  • mobile TV mobile TV
  • mobile TV other broadcast or multicast media services.
  • the system can time digital multimedia services according to different situations. Channels and programs are managed and controlled.
  • Conditional access refers to a technical means that allows only authorized users to use a certain service, and unauthorized users cannot use the service.
  • the conditional access system can realize the authorization management and reception control of various digital television broadcasting services.
  • unauthorized users cannot descramble the scrambled program, and thus cannot watch the section ⁇ .
  • conditional access system In digital TV (satellite, terrestrial, cable), IPTV, mobile TV, mobile TV, In other broadcast or multicast media services, the conditional access system packages a number of channels into products. If the user orders the product after packaging, the conditional receiving system needs to send a message to authorize the user. Management information is generally authorized by the conditional access system.
  • EMM 4 Entitlement Management Message 4 is sent to the terminal device. Since the current broadcast network is mainly a one-way network, the authorized message can only be broadcast to the user through one-way mode. That is, if the current system has 1 million users, the system needs 1 million copies corresponding to the 1 million users.
  • the card (for the CAS, the card is the user) respectively issued the EMM authorization ⁇ ⁇ ⁇ text, that is, 1 million cards corresponding to 1 million ⁇ 3 ⁇ 4 text.
  • the index of the amount of EMM information data broadcasted will continue to increase, and since the user may not be powered on when the EMM message is sent, the CAS cannot confirm that the user has received the message. This data can only be continuously circulated for a long period of time.
  • the EMM header and each sub-information are multiplexed into the transport stream and then expanded to a fixed length of 188 bytes.
  • it needs to support 1 million users and 64 sets of programs. Assuming that CAS packs 64 channels into 10 products, the system needs to separate 1 million cards for the 1 million users.
  • the data transmitted on the digital TV broadcast network includes video streams, audio streams and other system data streams.
  • the EMM occupies a large bandwidth in the CAS, the actual bandwidth occupied by the program is reduced, and because of the scrambler or multiplexer The processing power is limited, so the bandwidth of the EMM data stream on the front-end device cannot be allocated very much.
  • the present invention provides a user authorization method, the method comprising the following steps:
  • the authentication is performed according to the multicast address, and the authorization information packet is received, and the authorization information is parsed to obtain the authorization data of the user, and the authorization data is used for authorization processing.
  • the invention also provides a user authorization system, comprising:
  • An authorization control system configured to group users, set a multicast address according to a common address attribute of the group, encapsulate an authorization information message, and send the authorization information message through the transmission network; and the terminal device is configured to use the multicast address according to the And performing the authorization, and receiving the authorization information packet, and parsing the authorization information packet to obtain authorization data of the terminal device, and performing authorization processing according to the authorization data.
  • the invention also provides an authorization control system, comprising:
  • a user grouping multicast unit configured to group users according to a grouping policy of the user, and set a multicast address according to a common address attribute of the group;
  • a message encapsulating unit configured to assemble the multicast address, the authorization data, and the product identifier into 4 authorized information messages
  • a message sending unit configured to send the authorization information message.
  • the invention also provides a terminal device, comprising:
  • An authentication processing unit configured to perform authentication according to a common address attribute
  • the message parsing unit is configured to parse the authorization information packet after the common address attribute is authenticated, obtain authorization data, and perform authorization processing according to the authorization data.
  • the present invention is sent by means of grouping users by group.
  • the EMM packet is sent to the terminal device to authorize the user who subscribes the product, thereby solving the current privilege mode, and the solution provided by the present invention can effectively save the bandwidth requirement of the authorization message.
  • FIG. 1 is a flowchart of a main implementation principle of a user authorization method according to first to fourth embodiments of the present invention
  • 2A is a schematic structural diagram of a digital television user authorization system applied to the first, second, and third embodiments of the present invention
  • 2B is a schematic structural diagram of an authorization control system in a digital television system to which the first, second, and third embodiments of the present invention are applied;
  • 2C is a schematic structural diagram of a terminal device in a digital television system to which the first, second, and third embodiments of the present invention are applied;
  • 2D is a structural diagram of an EMM message frame in the first embodiment
  • 2E is a structural diagram of an EMM message frame in the second embodiment
  • 2F is a structural diagram of an EMM message frame in the third embodiment
  • FIG. 3A is a schematic structural diagram of a user authorization system for a mobile phone television system according to a fourth embodiment of the present invention.
  • 3B is a schematic structural diagram of an authorization control system in a mobile phone television system according to a fourth embodiment of the present invention.
  • 3C is a schematic structural diagram of a terminal device in a mobile phone television system according to a fourth embodiment of the present invention.
  • FIG. 3D is a flowchart of a user authorization method according to a fourth embodiment of the present invention. Mode for carrying out the invention
  • the user authorization method provided by the following embodiments of the present invention includes the following processing steps: First, the authorization control system packages the channel into a product, and the authorization control system sends the authorization information message to the terminal device by means of the group multicast authorization mode, and the The user of the product is authorized.
  • the authorization control system When sending a message to the user who ordered the product, first set the multicast address, according to each card Have a unique card address, set a group of cards with common address attributes into the same group; when authorizing a product (product is the program package, is the basic unit for authorizing the card, for several channels)
  • the authorization control system assembles the authorization data, the product identifier, and the multicast address into an authorization information message, and sends the authorization information message to the user's terminal device in a multicast authorization manner through the transmission network;
  • the terminal device of the specified user group parses the authorization information packet, and obtains the subscription information of the product for the user, and uses the information to authorize the user connected to the terminal device. .
  • FIG. 1 is a flowchart of the main implementation principle of the user authorization method provided by the first to fourth embodiments of the present invention, where the authorization information packet specifically refers to the authorization management information.
  • Step 110 The authorization control system packages the channel to generate a product identifier.
  • Step 120 According to the grouping policy of the user, set a group of users with common address attributes into the same group;
  • User's grouping strategy Users are naturally grouped according to their card addresses, without additional processing, that is, they are continuously grouped according to the user card address, and each group has a fixed number of users. The user needs to issue various card-related parameters when opening the card, including the group key (GK), and the SK' in the authorization message, where SK' is to use Gk to encrypt the service key (SK) with an encryption algorithm.
  • GK group key
  • SK' is to use Gk to encrypt the service key (SK) with an encryption algorithm.
  • the terminal device decrypts the SK' using the saved multicast key GK to obtain the SK, and then decrypts the ECM message with the SK to obtain the control word (CW), and finally uses the CW descrambling.
  • the program stream can see the program;
  • Step 130 The authorization control system assembles the authorization data, the product identifier, and the multicast address into an authorized EMM packet to be modulated into the transmission network.
  • the multicast address is obtained according to the common address attribute of the group in step 120; the authorization data indicates both the card address of each user and the order of the user for the product.
  • Step 140 The terminal device that belongs to the specified user group in the authorized message receives the EMM authorization message.
  • the terminal device performs authentication according to the common address attribute of the group, that is, if the card address of the user meets the common address attribute in the EMM authorization message, that is, the user belongs to the same group of users, the EMM authorization message is received; otherwise, The user cannot receive the EMM authorization message.
  • Step 150 The terminal device of the user parses the EMM authorization packet, obtains authorization information for the user, and obtains an order for the user to subscribe to the product.
  • the user authorization system includes an authorization control system and a terminal device.
  • the authorization control system transmits the authorization information message to the terminal device in a packet multicast manner through the transmission network.
  • the terminal device performs the identification according to the multicast address.
  • the digital rights management system acts as a terminal device, ie, the set top box 2.
  • the digital television system transmission network uses a digital television network such as a satellite transmission network, a digital terrestrial broadcasting network, a wired transmission network, or an IP network.
  • the authorization control system can implement packet grouping for users, reduce bandwidth requirements, and save the turnaround time of issuing authorization information messages.
  • FIG. 2B is a schematic structural diagram of an authorization control system, that is, a digital television condition receiving system 1 according to an embodiment of the present invention.
  • the digital television condition receiving system includes:
  • the user packet multicast unit 11 is configured to group users according to a grouping policy of the user, and set a multicast address according to a common address attribute of the group; in this example, the card address is 0x884800010000, 6 bytes are 48 bits in total. 38 bits as a common ground for grouping Address attribute, grouping strategy is divided into groups according to the user card address, wherein each group has a fixed number of users 0x884800010000, 0x884800010001, 0x884800010002..., 0x8848000103FF, which divides 1024 users into one group;
  • the packet encapsulating unit 12 is configured to assemble the multicast address, the authorization data, and the product identifier into an authorization information packet, and the specific format is as shown in FIG. 2D.
  • group broadcast address ,: 0x884800010000
  • Product identification 0x0001, indicating product 1, which includes eight TV channels such as CCTV1, CCTV2...CCTV8;
  • Authorization data Each bit represents a card address (user), and also indicates the user's purchase of the product ID. The value can be set to 0 and 1. Specifically, 0 means no purchase, 1 means purchase.
  • the message sending unit 13 is configured to send an authorization information message.
  • the digital television condition acceptance system of the user packet multicasting unit and the message encapsulating unit is added, and the EMM message can be sent to the terminal device by means of grouping the user packet, and the user who subscribes the product is authorized to solve the current authorization.
  • the mode is mainly unicast. With the multicast address and authorization data, the user group can be authorized, thereby reducing the rotation period for the user authorization.
  • the terminal device provided by the embodiment of the present invention that is, the structure of the set top box, the set top box 2 includes:
  • the authentication processing unit 21 is configured to perform authentication according to a common address attribute; that is, according to the card address
  • the message parsing unit 22 is configured to parse the authorization information packet after the authentication process is passed. Obtaining authorization information for the authorized user, and performing authorization processing according to the authorization data: performing authorization processing on the set top box through the common address attribute, if the card corresponding to the set top box of the user has a bit corresponding to 1 indicating that the user can receive the authorization If the corresponding bit is 0, it means that the user cannot receive the authorization and clear the authorization of the existing product.
  • the set-top box of the authentication processing unit and the message parsing unit is added, and the set-top box of the grouping user can be authenticated according to the multicasting address, and the authorized set-top box can receive the authorization information packet for authorization processing.
  • the set-top box shown in FIG. 2C is connected to the ordinary television set to form a terminal device having an audio-visual playback function, and the message parsing unit parses the license to receive the authorization, and uses the SK to decrypt the ECM message to obtain the control word, and finally uses the CW.
  • the program stream is descrambled, and the ordinary TV set can play and receive digital multimedia content.
  • the digital television system is introduced, and the digital television conditional receiving system is improved by adding a user packet multicast unit and a message encapsulating unit based on the prior art, thereby A new method for authorizing a user is implemented.
  • a common multicast address is assigned to users of the same group, and a value of 1 bit of the authorization data is used to represent the user card address and the product order status. Save bandwidth.
  • a group of users can be set to 512, the card address 0x884800010000, the first 39 bits of the 6-byte total 48 bits are used as the common address attribute of the group, and the grouping policy is continuous according to the user card address.
  • each group has a fixed number of users 0x884800010000, 0x884800010001, 0x884800010002..., 0x8848000101FF These 512 users are divided into one group; the same can be used to represent a user with two bits in the EMM message.
  • the digital television copyright management system can also be utilized as a user authorization control system in a digital television system, that is, a user group multicast unit and a message encapsulation unit are also added in the digital television copyright management system, having the same as described in FIG. 2B.
  • a user group multicast unit and a message encapsulation unit are also added in the digital television copyright management system, having the same as described in FIG. 2B.
  • first, second, and third embodiments are based on the user authorization system in the digital television system described in the above embodiments, realizing a user authorization method in the digital television system.
  • the authorized receiving time depends on the multicast algorithm of the CAS, that is, the number of users that can be authorized by one multicast authorization message.
  • the following takes the grouping of 1024 users as an example to illustrate the process in which the conditional receiving system sends an EMM packet to authorize the user who subscribes the product through multicast authorization. The specific steps are as follows:
  • Step 2210 The digital television conditional receiving system packages the channel into a product; in this example, the product 1 includes CCTV1, CCTV2, ... CCTV8, and the product 2 includes Phoenix Satellite TV, and the product 3 includes...
  • Step 2220 Set a group of users with common address attributes into the same group according to the grouping policy of the user; in this example, the card address 0x884800010000, the first 38 bits of 6 bytes totaling 48 bits are grouped.
  • the common address attribute, the grouping policy is continuously divided into groups according to the user card address, wherein each group has a fixed number of users 0x884800010000, 0x884800010001, 0x884800010002..., 0x8848000103FF, and the 1024 users are divided into one group;
  • Step 230 Assembling the authorization data, the product identifier, and the multicast address into an authorized EMM message to be modulated into the transmission network.
  • the assembled EMM message is as shown in FIG. 2, and the parameters related to the present invention are 6 bytes of "broadcast address,,, 4 bytes of "product identification”, 16 bytes of "SK”, 128 bytes of "authorization data,, the specific settings are as follows:
  • Product identification 0x0001, indicating product 1, which includes eight TV channels such as CCTV1, CCTV2...CCTV8;
  • SK is the SK in the form of cipher text.
  • the set-top box uses the saved multicast key GK to decrypt SK' to get SK:
  • Authorization data Each bit represents a card address (user), and also indicates the user's purchase of the product ID. The value can be set to 0 and 1, specifically, 0 means no purchase, 1 means purchase. In this example, as shown in FIG. 2D, it indicates that 0x884800010001 and 0x8 84 800010003 are authorized, and other users are not authorized; through step 220 and step 230, multicasting of users is implemented, and one user in the prior art is solved.
  • This unicast method of text implements a packet multicast mode of a group of users and one message;
  • Step 2250 The user parses the EMM authorization packet to obtain an order for the user to order the product. According to the EMM packet structure described in step S230, the user parses the authorization data. If the bit corresponding to the card address of the user is 1, the user can receive the authorization. If the corresponding bit is 0, the user cannot receive the authorization. This authorization also removes the authorization of the product that already exists.
  • packet grouping authorization information packets are sent to the set top box to which the user belongs, which effectively saves bandwidth requirements and reduces the carousel period.
  • 10 products of 1 million users 1 million users are divided into 1000 groups (1024 users per group). Each group has 10 products for authorization.
  • There are 10000 packets in total, and the length of each transport stream packet. 188 bytes, calculated according to the bandwidth allocated 50Kbsp, the time of the carousel is (10000 messages xl 88 bytes per message x8bits) 7 (50x1024 bsp) 293.75 seconds, thus getting the round Broadcasting for about 300 seconds is a significant advantage over the prior art in which it takes 300,800 seconds to spin once.
  • Step 2310 The conditional receiving system packages the channel into a product; in this example, the product 1 includes CCTV1, CCTV2...CCTV8, the product 2 includes Phoenix Satellite TV, and the product 3 includes...
  • Step 2320 According to the user's grouping strategy, a group The user with the common address attribute is set to the same group; in this example, the card address 0x884800010000, the first 39 bits of 6 bytes totaling 48 bits are used as the common address attribute of the packet, and the grouping policy is continuous according to the user card address. Divided into a group, each of which has a fixed number of users 0x884800010000, 0x884800010001, 0x884800010002..., 0x8848000101FF, these 512 users are divided into one group;
  • Step 2330 Assembling the authorization data, the product identifier, and the multicast address into an authorized EMM message modulated into the transmission network.
  • the assembled EMM is shown in FIG. 2E, where the present invention is related.
  • the parameter has 6 bytes of "broadcast address", 4 bytes of "product identification”, 16 bytes of "SK,”, 64 bytes of "authorization data,, the specific settings are as follows:
  • Product identification 0x0002, indicates product 2, which includes Phoenix TV channel;
  • SK is SK in cipher text, the set-top box uses the saved multicast key GK to decrypt SK after receiving the message. , get SK:
  • Authorization data Each bit represents a card address (user), and also indicates that the use
  • the value of the purchase of the product ID by the user can be set to 0 and 1, specifically, 0 means no purchase, 1 means purchase.
  • 0 means no purchase
  • 1 means purchase.
  • FIG. 2E it indicates that 0x884800010001 and 0x884800010003 are authorized, and other users are not authorized; and the user group multicast is implemented through steps 320 and 330, which solves one message of a user in the prior art.
  • Single-cast mode which achieves a group multicast mode of a group of users;
  • Step 2340 The STB that belongs to the specified user group in the authorized message receives the EMM authorization message; the set top box performs authentication according to the common address attribute of the group, that is, the first 39 bits of the common address attribute of the card address 0x884800010000 is used for authentication. Only users who meet the common address attribute can receive the EMM message, for example, 0x884800010001 can receive 4 ⁇ of 0x884800010000, and 0x888800010000 cannot receive 0x884800010000 message;
  • Step 2350 The user parses the EMM authorization packet to obtain an order for the user to order the product. According to the EMM packet structure described in step S330, the user parses the authorization message. If the bit corresponding to the card address of the user is 1, the user can receive the authorization. If the corresponding bit is 0, the user cannot receive the message. This authorization also removes the authorization of the product that already exists.
  • the "authorization data" in the EMM message uses one bit to represent a user.
  • the EMM message represents two users with two bits, and each group of 512 users is used to authorize the product 2.
  • the digital eDonkey conditional receiving system sends the EMM message to the user who subscribes the product by means of the multicast authorization.
  • the steps of performing the authorization are basically the same as those in the first embodiment and the second embodiment, and only differ in the specific frame format of the EMM message.
  • Figure 2F shows the authorization data in the EMM message.
  • the two bits represent the frame format of a user, where 11 and 00 respectively represent whether the user has authorization. 2F means to authorize 0x884800010001 and 0x884800010003, and no other users have authorization.
  • the second and third embodiments also save bandwidth and reduce the turn cycle.
  • the first, second and third embodiments described above mainly describe a method of authorizing a user in a digital television system.
  • the digital television system includes a satellite television system, a terrestrial television system, and a cable television system;
  • the above-mentioned authorization control system for grouping and multicasting users is operated by a conditional receiving system in a digital television system, wherein the user is a user of the set top box, that is, A user who ordered a digital TV.
  • the transmission network in the method of this embodiment includes, but is not limited to, a satellite transmission network, a digital terrestrial broadcast network, a wired transmission network, or an IP network.
  • the system for authorizing the user is the same as that of FIG. 2A described above, except that the authorization control system is operated by the mobile phone television conditional access system or the digital rights management system; It is a mobile communication network.
  • the authorized object is a mobile TV user such as a PDA or a 3G mobile phone, that is, the user's mobile phone or PDA virtual card address or mobile phone number, SIM card serial number, IMSI number common address attribute is authenticated, in this example Define the virtual card address implementation. For example, you can refer to the 6-byte virtual address defined in the digital TV.
  • the card address is 0x884800010000, and the first 38 bits of the 6-byte total 48 bits are used as the common address attribute of the packet.
  • the grouping policy is based on the user card.
  • the addresses are continuously divided into groups, each of which has a fixed number of users 0x884800010000, 0x884800010001, 0x884800010002..., 0x8848000103FF.
  • the 1024 users are divided into one group; the optional scheme can use the mobile phone number, the serial number of the SIM card, IMSI (International Mobile Subscriber Identity) can be used to uniquely identify the number of a mobile terminal.
  • IMSI International Mobile Subscriber Identity
  • any combination of users such as 13888888880, 13888888881, 1388888888..., 13888888889, etc., use the first 8 digits 13888888000 as the group number, and the last three digits (1000 users) as the intra-group address;
  • the strategy is divided into groups according to the user card address.
  • the authorization control system can implement packet grouping for users, reduce bandwidth requirements, and save the turnaround time of issuing authorization information messages.
  • FIG. 3B the structure diagram of the embodiment of the mobile phone television conditional access system or the digital rights management system of the present invention increases the user packet multicasting unit and the message encapsulating unit, and its structure and function are the same as those described in FIG. 2B of the above embodiment.
  • the mobile TV condition acceptance system of the user packet multicasting unit and the message encapsulating unit is added, and the EMM message can be sent to the terminal device by means of the grouping of the user group, and the user who subscribes the product is authorized to solve the current authorization mode.
  • Mainly for unicast With the multicast address and the authorization data, the user group can be authorized, thereby reducing the rotation period for authorizing the user.
  • FIG. 3C is a schematic structural diagram of an embodiment of a terminal device such as a mobile phone or a PDA in the mobile phone power system of the present invention; the authentication processing unit and the message parsing unit, the structure and function thereof, and the foregoing embodiment FIG. 2C The description is the same and will not be described here.
  • the mobile phone or the PDA has an audio and video playback unit, the message parsing unit parses the license, receives the authorization, uses SK to decrypt the ECM message to obtain the control word, and finally uses the CW descrambled program stream to play and receive the digital multimedia content.
  • the mobile phone or PDA with the authentication processing unit and the message parsing unit is added, and the mobile phone or PDA of the group user can be authenticated according to the multicast address, and the authorization information message can be received by the authenticated mobile phone or PDA. , for authorization processing.
  • the fourth embodiment describes a method of authorizing a user in a mobile phone system.
  • Step 3410 The mobile TV conditional receiving system packages the channel into a product; in this example, the product 1 includes CCTV1, CCTV2...CCTV8, and the product 2 includes Phoenix Satellite TV, and the product 3 includes...
  • Step 3420 # User's grouping policy, setting a group of users with common address attributes into the same group; in this example, defining a virtual card address implementation, for example, referring to a 6-byte virtual address defined in digital television, the card Address 0x884800010000, 6 bytes of the first 38 bits of 48 bits as the common address attribute of the packet, the grouping strategy is according to the user card
  • the addresses are continuously divided into groups, each of which has a fixed number of users 0x884800010000, 0x884800010001, 0x884800010002..., 0x8848000103FF.
  • the 1024 users are divided into one group; the optional scheme can use the mobile phone number, the serial number of the SIM card,
  • the IMSI full name is International Mobile Subscriber Identification Number
  • any combination of users such as 13888888880, 13888888881, 1388888888..., 13888888889, etc., use the first 8 digits 13888888000 as the group number, and the last three digits (1000 users) as the intra-group address;
  • Step 3430 Assembling the authorization data, the product identifier, and the multicast address into an authorized EMM message modulation into the transmission network.
  • the parameter has a 6-byte "multicast address,,, a 4-byte "product identification”, and a 16-byte "SK,,,, 64-byte "authorization data”.
  • the specific settings are as follows:
  • Product identification,,: 0x0002 indicates product 2, which includes the Phoenix TV channel;
  • SK is the SK in the form of cipher text, the mobile phone or PDA uses the saved multicast key after receiving the message.
  • GK decrypts SK and gets SK:
  • Authorization data Each bit represents a card address (user), and also indicates the user's purchase of the product ID. The value can be set to 0 and 1. Specifically, 0 means no purchase, 1 means purchase. In this example, as shown in FIG. 2D, it indicates that 0x884800010001 and 0x884800010003 are authorized, and other users are not authorized; through step 3420 and step 3430, packet multicasting to users is implemented, which solves one message of a user in the prior art. Unicast mode, which achieves a group multicast mode of a group of users;
  • Step 3440 The mobile phone or the PDA belonging to the specified user group in the authorized message receives the EMM authorization message; the mobile phone or the PDA performs authentication according to the common address attribute of the group, that is, the card address 0x884800010000, a total of 48 bytes of 6 bytes The first 38 bits of the bit are used as points The common address attribute of the group is authenticated. Only the user who meets the common address attribute can receive the EMM message, for example, 0x884800010001 can receive the message of 0x884800010000, and 0x888800010000 cannot receive the message of 0x884800010000.
  • Step 3450 The user parses the EMM authorization message to obtain the user's order for the product. According to the EMM packet structure described in step S330, the user parses the authorization message. If the bit corresponding to the card address of the user is 1, the user can receive the authorization. If the corresponding bit is 0, the user cannot receive the message. This authorization also removes the authorization of the product that already exists.
  • a group of 512 users can also be selected.
  • the specific processing steps are the same as those in the second embodiment.
  • the processing steps of the embodiment in which two bits represent one user are the same as the third embodiment.
  • the authorization for the user in the mobile television system of the fourth embodiment is the same as the authorization for the user in the digital television system of the first to third embodiments, the only difference being the multicast address, that is, in the mobile television system, the virtual card address is defined. Or use the mobile phone number, SIM card serial number, IMSI, etc. to uniquely identify the number of a mobile terminal as a common address attribute.
  • the system for authorizing the user is the same as that shown in FIG. 2A or 3A.
  • the authorization control system is operated by the IPTV conditional access system or the digital rights management system;
  • the authorized object is an IPTV user such as a networked computer.
  • Every networked computer There is only one smart card, that is, the common address attribute of the smart card address is authenticated.
  • the smart card address 0x884800010000, the first 39 bits of the 6-byte total 48 bits are grouped as the common address attribute of the group.
  • the policies are successively grouped according to the user card address; the system connection relationship is the same as the above embodiment.
  • the transport network can be an IP network.
  • the authorized object may also be a user who views the program by using an IP set-top box and a television set, that is, the common address attribute of the IP set-top box card address is authenticated.
  • the authorization control system can implement packet grouping for users, reduce bandwidth requirements, and save the turnaround time of issuing authorization information messages.
  • the user packet grouping unit and the message encapsulating unit are added, and the structure and function thereof are the same as those described in FIG. 2B or 3B of the above embodiment, and details are not described herein again.
  • the IPTV condition acceptance system of the user packet multicasting unit and the encapsulation unit is added, and the EMM message is sent to the terminal device by means of the grouping of the user group, and the user who subscribes the product is authorized to solve the current authorization.
  • the mode is mainly unicast. With the multicast address and the authorization data, the user group can be authorized, thereby reducing the rotation period for authorizing the user.
  • the terminal device such as a networked computer or an IP set-top box, has an authentication processing unit and a message parsing unit, and its structure and function are the same as those described in FIG. 2C or 3C of the foregoing embodiment, and details are not described herein again.
  • the networked computer has an audio and video playback unit. After the message parsing unit parses, it receives the authorization, and uses SK to decrypt the ECM message to obtain the control word. Finally, the CW descrambles the program stream, that is, the digital multimedia content can be played and received.
  • the IP set-top box is connected to the ordinary television set to form a terminal device having an audio-visual playback function, and the message parsing unit parses the license to receive the authorization, and uses the SK to decrypt the ECM message to obtain the control word, and finally uses the CW to descramble the program stream.
  • the TV can play and receive digital multimedia content.
  • the networked computer or the IP set-top box of the authentication processing unit and the message parsing unit is added, and the networked computer or the IP set-top box of the group user can be authenticated according to the multicast address, and can be received through the authenticated networked computer or the IP set-top box.
  • the packet grouping authorization processing procedure for the user is the same as that of the first embodiment, the second embodiment, and the third embodiment, and the only difference is that the authorization control system for performing packet grouping authorization on the user is
  • the IPTV conditional access system or the IPTV digital rights management system, in the IPTV system that is, the common address attribute of the smart card of the networked computer or the IP set top box card address is authenticated, in this example, the smart card or the IP set top box card address is grouped together. Address attribute (specifically the same as in the digital TV system).
  • the packet multicasting of the user is also implemented, which solves the unicast mode of one message of one user in the prior art, and achieves a packet multicast mode of one group of users, which reduces the occupied bandwidth and reduces the bandwidth. Take turns.
  • the system for authorizing the user is the same as that shown in Fig. 2A or 3A above, except that the authorization control system is operated by the mobile television conditional access system or the digital rights management system.
  • Authorized objects are mobile TV users such as car mobile TV or other dedicated terminals with video and audio playback functions and receiving multimedia program streams, such as improved MP4 players, such as virtual card addresses for devices such as MP3, MP4, etc.
  • the MP4 can be used as a networked terminal in the mobile TV system, in correspondence with its device identification (such as the body serial number, etc.) or directly using the device identification.
  • the authorization control system the system authenticates the virtual card common address attribute of the in-vehicle mobile TV.
  • the card address 0x884800010000 the first 39 bits of 6 bytes totaling 48 bits are used as the common address of the group.
  • grouping strategy is divided into groups according to the user card address, wherein each group has a fixed number of users 0x884800010.000, 0x884800010001, 0x884800010002..., 0x8848000101FF, the 512 users are divided into one group;
  • the transmission network can be a satellite transmission network or a digital terrestrial broadcast network or a mobile communication network.
  • the authorization control system can implement packet grouping for users, reduce bandwidth requirements, and save the turnaround time of issuing authorization information messages.
  • the mobile TV condition acceptance system that adds the user packet multicast unit and the message encapsulation unit can implement the method of transmitting the EMM message to the terminal device by means of grouping the user group, authorizing the user who subscribes the product, and solving the current authorization.
  • the mode is mainly unicast. With the multicast address and the authorization data, the user group can be authorized, thereby reducing the rotation period for authorizing the user.
  • a terminal device such as an in-vehicle mobile television device or other dedicated terminal having an audio-visual playback function and receiving a multimedia program stream, such as a modified MP4 player, having an authentication processing unit and a message parsing unit, the structure and function thereof, and the above embodiment
  • a multimedia program stream such as a modified MP4 player
  • the description of 2C or 3C is the same and will not be described here.
  • the car mobile TV device or the improved MP4 player has an audio and video playback unit, and the message parsing unit parses the license to receive the authorization, and uses the SK to decrypt the ECM message to obtain the control word, and finally uses the CW to descramble the program stream, and then the broadcast is received.
  • Digital multimedia content Digital multimedia content.
  • the in-vehicle mobile television device or the improved MP4 player with the authentication processing unit and the message parsing unit is added, and the grouped mobile TV device or the improved MP4 player can be authenticated according to the multicast address.
  • the authenticated in-vehicle mobile television device or the improved MP4 player can receive the authorization information message for authorization processing.
  • the packet grouping authorization processing procedure for the user is the same as that of the first embodiment, the second embodiment, and the third embodiment, and the only difference is the authorization control of the group multicast authorization for the user.
  • the system is a mobile TV conditional access system or a mobile TV digital rights management system, in a mobile television system, that is, a virtual television set or other dedicated terminal having an audio-visual playback function and receiving a multimedia program stream, such as an improved MP4 player.
  • the common address attribute of the card address is authenticated.
  • the virtual card address is used as the common address attribute of the packet (specifically, it is consistent with the digital television system:).
  • the same is also achieved for user group multicast, which solves a message in the prior art of a user.
  • the unicast method achieves a group multicasting method of a group of users, which reduces the occupied bandwidth and reduces the rotation period.
  • the user is authorized to perform group packet broadcast, and the authorized terminal device can watch live broadcast or remote on-demand programs from the multimedia server, and can also view the locally stored multimedia. Program stream.
  • Embodiments of the present invention provide a user authorization method capable of reducing bandwidth and reducing the turn cycle.
  • each group of 1024 and 512 users is implemented, but in principle, the number of each group of users can be changed. In the case of packet fragmentation, more users per group can be implemented, or only partial bytes can be used. Groups of fewer users per group (for example, a group of 2048 users, even a group of 10 users, etc.);
  • authorization data uses one bit to represent one user or two bits to represent one user, and a combination of multiple bits may be used to represent one user.
  • the above user authorization method is also applied to other broadcast or multicast media services, and the packet grouping authorization processing procedure for the user is the same as the first embodiment, the second embodiment, and the third embodiment.
  • the system of other broadcast or multicast media services only needs to add a user packet multicast unit and a message encapsulation unit, and the terminal device has an authentication processing unit and a message parsing unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Multimedia (AREA)
  • Signal Processing (AREA)
  • Computer Graphics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

用户授权方法和系统、 及其授权控制系统和终端设备 技术领域
本发明涉及多媒体通讯技术领域， 尤其是一种对接收多媒体内容的 用户进行授权的系统及方法， 及其应用的授权控制系统和终端设备。 发明背景
数字化视音频业务由于其优质的画面和多样的服务方式正逐渐替代 模拟电视走入平常百姓家。 各种付费节目， 比如准视频点播 (NVOD)等， 都要有相应的收费方式， 要保证这些增值业务的开展， 必须对信息进行 加密， 只允许经过授权的用户收看特定节目， 从而保证运营者的利益。 因此， 在这些增值业务的开展过程中， 出现了数字版权管理系统和条件 接收系统 (Condition Access System, CAS), 数字版权管理系统的原理是： 使用技术手段， 对数字产品在分发、 传输和使用等各个环节进行控制， 使得数字产品只能被授权使用的人， 按照授权的方式， 在授权使用的期 限内使用。
条件接收系统是数字电视（卫星， 地面， 有线）、 IPTV、 移动电视、 手机电视、 其他广播或组播的媒体业务接收控制的核心技术保障， 该系 统可以按不同情况对数字多媒体业务按时间、 频道和节目进行管理控 制。条件接收是指一种技术手段，它只允许被授权的用户使用某一业务， 未被授权的用户不能使用这一业务。
条件接收系统能实现各项数字电视广播业务授权管理和接收控制， 在用户端， 未经授权的用户不能对加扰节目进行解扰, 因而无法收看节 ^ 。
在数字电视（卫星， 地面， 有线）、 IPTV、 移动电视、 手机电视、 其他广播或组播的媒体业务中， 条件接收系统对若干个频道进行打包成 产品， 打包后如果用户定购该产品， 则需要条件接收系统下发报文对该 用户进行授权， 该授权报文在条件接收系统中一般通过授权管理信息
( Entitlement Management Message, EMM ) 4艮文下发到终端设备。 由于 目前广电网络主要是单向网络， 所以该授权报文只能通过单向方式广播 到用户端， 即如果当前系统有 100万个用户， 那么系统需要对该 100万 个用户对应的 100万张卡（对 CAS来说卡就是用户）分别下发 EMM授 权^ ^艮文， 即 100万张卡对应 100万个^ ¾文。 这种方法中随着用户量和节 目数的增加， 广播的 EMM信息数据量的指数会不断增加， 并且由于在 下发 EMM报文时用户有可能没有开机， CAS无法确认用户已经收到报 文， 只能在一个较长的时间内不停地循环下发这些数据。
在一般的条件接收系统中， EMM信息头和每个子信息复用到传输 流中之后都扩成定长 188个字节。 考虑到一般的有线电视台的应用， 需 要支持 100万个用户和 64套节目， 假设 CAS对 64个频道进行打包成 10个产品,那么系统需要对该 100万个用户对应的 100万张卡分别下发 10个 EMM授权报文， 需要 1Μχ10χ188Β = 1880MB的信息量， 按照分 配 50Kbps 的带宽计算， 轮播一遍的时间为 （ 1880x 1000x8 ) kb/(50kbps)=300, 800 秒。 数字电视广播网上传输的数据包括视频流、 音频流和其它系统数据流， 如果在 CAS中 EMM占据很大带宽的话， 节 目占用的实际带宽就会降低， 而且， 因为加扰器或复用器的处理能力有 限， 所以在前端设备上 EMM数据流的带宽无法分配很大。
在数字版权管理系统中， 同样适用上述技术对每个用户发送授权报 文。 因此， 如何有效減少在对用户授权过程中 EMM所占据的带宽， 是 目前业界极需解决的问题。 发明内容
本发明提供了一种用户授权方法， 该方法包括以下步骤：
通过传输网络以分组群播方式， 发送授权信息报文；
才艮据群播地址进行鉴权， 接收所述授权信息报文， 并对所述 4吏权信 息报文进行解析，得到用户的授权数据，通过该授权数据进行授权处理。
本发明还提供了一种用户授权系统， 包括：
授权控制系统， 用于对用户进行分组， 根据组的共同地址属性设置 群播地址， 封装授权信息报文并将授权信息报文， 通过传输网络发送； 终端设备， 用于根据所述群播地址进行婆权， 接收所述授权信息报 文； 并对所述授权信息报文进行解析， 得到所述终端设备的授权数据， 根据所述授权数据进行授权处理。
本发明还提供了一种授权控制系统， 包括：
用户分组群播单元， 用于根据用户的分组策略， 对用户进行分组， 根据组的共同地址属性设置群播地址；
报文封装单元， 用于将所述群播地址、 授权数据和产品标识組装成 4受权信息艮文；
报文发送单元， 用于发送所述授权信息报文。
本发明还提供了一种终端设备， 包括：
鉴权处理单元， 用于根据共同地址属性进行鉴权；
报文解析单元， 在所述共同地址属性通过鉴权后， 用于对授权信息 报文进行解析， 获得授权数据， 根据所述授权数据进行授权处理。
从以上技术方案可以看出， 本发明通过对用户分组群播的方式发送
EMM报文到终端设备， 对定购该产品的用户进行授权， 从而解决了目 前授权方式主要为单播方式， 以及本发明提供的方案可以有效地节省 了授权消息对带宽的要求。 附图简要说明
图 1为本发明第一至第四实施例提供的一种用户授权方法的主要实 现原理流程图；
图 2A为本发明第一、 第二和第三实施例所应用的数字电视用户授 权系统的结构示意图；
图 2B为本发明第一、 第二和第三实施例所应用的数字电视系统中 授权控制系统的结构示意图；
图 2C为本发明第一、 第二和第三实施例所应用的数字电视系统中 终端设备的结构示意图；
图 2D为第一实施例中 EMM报文帧结构图；
图 2E为第二实施例中 EMM报文帧结构图；
图 2F为第三实施例中 EMM报文帧结构图；
图 3A为本发明第四实施例所应用的手机电视系统用户授权系统的 结构示意图；
图 3B为本发明第四实施例所应用的手机电视系统中授权控制系统 的结构示意图；
图 3C为本发明第四实施例所应用的手机电视系统中终端设备的结 构示意图；
图 3D为本发明第四实施例用户授权方法的流程图。 实施本发明的方式
本发明以下实施例提供的用户授权方法， 包括以下处理步骤： 首先， 授权控制系统对频道进行打包成产品， 授权控制系统通过分组群播的授 权方式发送授权信息报文到终端设备， 对定购该产品的用户进行授权。 在下发报文对定购产品的用户授权时， 先设置群播地址， 根据每张卡都 有一个唯一的卡地址， 将一组具有共同地址属性的卡设置到同一个组 内； 当对某个产品授权时（产品即节目包，是对卡进行授权的基本单位， 为若干个频道的组合）， 授权控制系统将授权数据、 产品标识和群播地 址组装成授权信息报文， 通过传输网络以群播授权的方式发送所述授权 信息报文到用户的终端设备； 当隶属于授权报文中指定用户組的终端设 备接收到该授权信息报文后， 对该授权信息报文进行解析， 得到该用户 对该产品的定购信息， 通过该信息对连接所述终端设备的用户进行授权 处理。
请参阅图 1 , 该图是本发明第一至第四实施例提供的用户授权方法 的主要实现原理流程图， 其中的授权信息报文具体指授权管理信息
EMM 4艮文， 其主要实现过程如下：
步骤 110: 授权控制系统对频道进行打包， 生成产品标识； 步骤 120: 才艮据用户的分组策略， 将一组具有共同地址属性的用户 设置到同一个组内；
用户的分组策略： 用户按照其卡地址天然分到一组，无需额外处理， 即是按照用户卡地址连续分为一组， 其中每个组内有固定的用户数。 用 户在开卡时需要下发各种卡相关的参数， 其中包括組密钥 （GK ), 授权 报文中的 SK' , 其中 SK'就是使用 Gk对服务密钥 （SK )用加密算法进 行加密后的 SK的密文形式; 终端设备在接收到该报文后使用保存的组 播密钥 GK解密 SK'得到 SK ,再用 SK解密 ECM报文获得控制字( CW )， 最终使用 CW解扰节目流即可看到节目；
步骤 130: 授权控制系统将授权数据、 产品标识和群播地址组装成 授权 EMM报文调制到传输网络中；
群播地址是根据步骤 120所述组的共同地址属性得到； 授权数据既 表示每个用户的卡地址， 同时也表示该用户对产品的定购情况。 步骤 140: 隶属于授权报文中指定用户组的终端设备接收该 EMM 授权报文；
终端设备根据该组的共同地址属性进行鉴权， 即如果用户的卡地址 符合所述 EMM授权报文中的共同地址属性， 即该用户属于同组用户， 则接收所述 EMM授权报文； 否则， 该用户不能接收所述 EMM授权报 文。
步骤 150: 用户的终端设备对该 EMM授权报文进行解析， 获得对 该用户的授权信息, 并得到该用户对该产品的定购情况。
为使本发明的目的、 技术方案、 及优点更加清楚明白， 以下参照附 图并举实施例, 对本发明进一步详细说明。
本发明以下实施例显示了一种数字电视系统中用户授权系统。 如图 2A所示， 用户授权系统， 包括授权控制系统和终端设备， 授权控制系 统将授权信息报文， 通过传输网络以分组群播方式发送给终端设备; 终 端设备根据所述群播地址进行鉴权， 接收所述授权信息报文； 并对该授 权信息报文进行解析， 得到用户的授权数据， 根据该授权数据进行授权 处理; 在本实施例中授权控制系统为数字电视条件接收系统 1或者数字 版权管理系统充当， 终端设备即机顶盒 2。 在数字电视系统传输网络采 用数字电视网如卫星传输网絡、 数字地面广播网络、 有线传输网络或 IP 网络。 利用这种授权控制系统能够实现对用户的分组群播， 减少带宽要 求， 节省下发授权信息报文的轮番时间。
如图 2B所示， 为本发明实施例提供的授权控制系统， 即数字电视 条件接收系统 1的结构示意图， 该数字电视条件接收系统包括：
用户分组群播单元 11，用于根据用户的分组策略，对用户进行分组， 根据组的共同地址属性设置群播地址； 在本例中将卡地址 0x884800010000, 6个字节共 48个 bit的前 38个 bit作为分組的共同地 址属性， 分组策略是按照用户卡地址连续分为一组， 其中每个组内有固 定的用户数 0x884800010000 , 0x884800010001 , 0x884800010002... , 0x8848000103FF这 1024个用户分成一个组；
报文封装单元 12, 用于将群播地址、授权数据和产品标识组装成授 权信息报文， 具体格式如图 2D所示；
其中， "群播地址，，： 0x884800010000;
"产品标识"： 0x0001 ,表示产品 1 ,其包括 CCTV1、 CCTV2...CCTV8 等八个电视频道；
"授权数据"： 每一个 bit表示一个卡地址（用户）， 同时也表示该用 户对产品 ID的购买情况，其值可以设置 0和 1 ,具体， 0表示没有购买， 1表示已经购买。
报文发送单元 13 , 用于发送授权信息报文。
上述增加了用户分组群播单元和报文封装单元的数字电视条件接 受系统， 能够实现通过对用户分组群播的方式发送 EMM报文到终端设 备，对定购该产品的用户进行授权，解决目前授权方式主要为单播方式。 利用群播地址和授权数据 , 能够对用户分组进行授权， 由此能够缩小对 用户授权的轮播周期。
如图 2C所示的本发明实施例提供的终端设备， 即机顶盒的结构示 意图， 机顶盒 2包括：
鉴权处理单元 21 , 用于根据共同地址属性进行鉴权； 即根据卡地址
0x884800010000的前 38个 bit的共同地址属性进行鉴权，只有符合该共 同地址属性的机顸盒才能接收该 EMM报文，例如 0x884800010001才能 收到 0x884800010000 的 艮文， 而 0x888800010000 不能接收 0x884800010000的^ =艮文；
报文解析单元 22,鉴权处理通过后，用于对授权信息报文进行解析， 获得对授权用户的授权信息， 根据该授权数据进行授权处理： 对通过共 同地址属性婆权的机顶盒进行授权处理， 如果该用户所用的机顶盒的卡 地址对应的 bit为 1表示该用户可以接收该授权， 如果对应的 bit位 0, 则表示用户不能接收该授权， 同时清除已经存在的该产品的授权。
增加了鉴权处理单元和报文解析单元的机顶盒， 能够实现根据群播 地址， 进行对分组用户的机顶盒进行鉴权， 通过鉴权的机顶盒能够接收 所述授权信息报文， 进行授权处理。
在图 2C所示的机顶盒， 与所述普通电视机相连接， 组成具有视音 频播放功能的终端设备， 报文解析单元解析后接收该授权， 用 SK解密 ECM报文获得控制字， 最终使用 CW解扰节目流， 普通电视机即可播 放接收到数字多媒体内容。
在图 2B 实施例中, 介绍了数字电视系统中， 对数字电视条件接收 系统通过在现有技术基础上增加用户分组群播单元和报文封装单元， 使 得数字电视条件接收系统得到了改进, 从而实现了一种新的对用户授权 的方法， 通过对用户进行分组划分， 对同一组的用户分配一个共同群播 地址，同时利用授权数据 1比特的值来表示用户卡地址和产品订购状态， 能够节省所占带宽。 同样在本实施例中可以将一组用户设定为 512个， 将卡地址 0x884800010000, 6个字节共 48个 bit的前 39个 bit作为分组 的共同地址属性， 分组策略是按照用户卡地址连续分为一组， 其中每个 组 内 有 固 定 的 用 户 数 0x884800010000 , 0x884800010001 , 0x884800010002... , 0x8848000101FF这 512个用户分成一个組； 同样可 以用 EMM报文中以两个 bit代表一个用户。
在数字电视系统中也可利用数字电视版权管理系统作为用户授权控 制系统， 即在数字电视版权管理系统中同样也增加有用户分組群播单元 和报文封装单元， 具有与图 2B 中所描述的相同的功能和结构， 在此不 再赘述。
以下第一、 第二、 第三实施例是基于上述实施例所描述的数字电视 系统中用户授权系统， 实现了数字电视系统中用户授权方法。
第一实施例：
在用户数量、 平均产品定购数量、 预留带宽全相同的情况下， 授权 接收时间就取决于 CAS的组播算法，即一个组播授权报文所能授权的用 户数量。 下面以每组 1024个用户的分组为例， 说明条件接收系统通过 组播授权的方式发送 EMM报文对定购该产品的用户进行授权的过程， 具体步骤如下：
步骤 2210: 数字电视条件接收系统对频道进行打包成产品； 在本例 中产品 1包括 CCTV1、 CCTV2...CCTV8, 产品 2包括凤凰卫视， 产品 3包括…
步驟 2220: 根据用户的分组策略， 将一组具有共同地址属性的用户 设置到同一个组内； 在本例中将卡地址 0x884800010000, 6个字节共 48 个 bit的前 38个 bit作为分组的共同地址属性， 分组策略是按照用户卡 地址连续分为一组， 其中每个组内有固定的用户数 0x884800010000, 0x884800010001 , 0x884800010002... , 0x8848000103FF这 1024个用户 分成一个组；
步骤 230: 将授权数据、 产品标识和群播地址组装成授权 EMM报 文调制到传输网络中； 在本例中， 所组装的 EMM报文如图 2所示， 其 中和本发明相关的参数有 6 个字节的"群播地址，，， 4 个字节的"产品标 识"， 16个字节的" SK"，， 128个字节的"授权数据，，， 具体设置如下：
"群播地址"： 0x884800010000;
"产品标识"： 0x0001 ,表示产品 1 ,其包括 CCTV1、 CCTV2...CCTV8 等八个电视频道； "SK'，，： 就是以密文形式存在的 SK， 机顶盒在接收到该报文后使用 保存的组播密钥 GK解密 SK'得到 SK:
"授权数据"： 每一个 bit表示一个卡地址（用户）， 同时也表示该用 户对产品 ID的购买情况， 其值可以设置 0和 1 , 具体， 0表示没有购买， 1 表示已经购买。 在本例中如图 2D所示， 表示对 0x884800010001 和 0x884800010003进行授权， 其它用户都没有授权； 通过步骤 220和步骤 230 实现了对用户分组组播， 解决了现有技术中一个用户一个报文这种 单播方式， 实现了一组用户一个报文这种分组群播方式；
步骤 2240:隶属于授权报文中指定用户组的 STB接收该 EMM授权 报文； 机顶盒 居该组的共同地址属性进行鉴权， 即根据卡地址 0x884800010000的前 38个 bit的共同地址属性进行鉴权，只有符合该共 同地址属性的的用户才能接收该 EMM报文，例如 0x884800010001才能 收到 0x884800010000 的 ^ =艮文， 而 0x888800010000 不能接收 0x884800010000的才艮文；
步骤 2250: 用户对该 EMM授权报文进行解析， 得到该用户对该产 品的定购情况。根据步骤 S230所述的 EMM报文结构，用户对该授权数 据进行解析， 如果该用户的卡地址对应的 bit为 1表示该用户可以接收 该授权， 如果对应的 bit位 0, 则表示用户不能接收该授权， 同时清除已 经存在的该产品的授权。
通过第一实施例所述的方法， 实现对用户所属的机顶盒进行分组群 播授权信息报文，有效地节省了对带宽的要求，缩小了轮播周期。以 100 万用户 10个产品为例， 100万用户分成 1000个组（每组 1024个用户）， 每个组再有 10个产品的授权， 则共有 10000个报文， 每个传输流报文 长度为 188字节，按照分配 50Kbsp的带宽计算，轮播一遍的时间为（10000 个报文 xl 88字节每报文 x8bits ) 7(50x1024 bsp) = 293.75秒， 从而得到轮 播一次约 300秒， 这和现有技术中轮播一次需要 300, 800秒相比具有 明显的优势。
第二实施例：
在第一实施例的基础上， 我们可以采用每组里更多用户或更少用户 的方式来实现分组群播授权， 例如， 在第二实施例中我们采用每組 512 个用户的分组。 我们以对产品 2进行授权为例， 说明条件接收系统通过 分组群播授权的方式发送 EMM报文对定购该产品的用户进行授权的过 程， 具体步驟如下：
步骤 2310: 条件接收系统对频道进行打包成产品； 在本例中产品 1 包括 CCTV1、 CCTV2...CCTV8, 产品 2包括凤凰卫视， 产品 3包括… 步骤 2320: 据用户的分組策略， 将一组具有共同地址属性的用户 设置到同一个组内； 在本例中将卡地址 0x884800010000, 6个字节共 48 个 bit的前 39个 bit作为分组的共同地址属性， 分组策略是按照用户卡 地址连续分为一组， 其中每个组内有固定的用户数 0x884800010000, 0x884800010001 , 0x884800010002... , 0x8848000101FF这 512个用户分 成一个组；
步骤 2330: 将授权数据、 产品标识和群播地址组装成授权 EMM报 文调制到传输网络中； 在本例中， 所组装的 EMM ·!艮文如图 2E所示， 其中和本发明相关的参数有 6个字节的"群播地址"， 4个字节的"产品标 识"， 16个字节的" SK，"， 64个字节的"授权数据，，， 具体设置如下：
"群播地址"： 0x884800010000;
"产品标识"： 0x0002, 表示产品 2, 其包括凤凰卫视电视频道； "SK"': 就是以密文形式存在的 SK， 机顶盒在接收到该报文后使用 保存的组播密钥 GK解密 SK，得到 SK:
"授权数据，，： 每一个 bit表示一个卡地址（用户）， 同时也表示该用 户对产品 ID的购买情况，其值可以设置 0和 1，具体， 0表示没有购买， 1 表示已经购买。 在本例中如图 2E所示， 表示对 0x884800010001 和 0x884800010003进行授权， 其它用户都没有授权； 通过步骤 320和步驟 330 实现了对用户分组组播， 解决了现有技术中一个用户一个报文这种. 单播方式， 达到了一组用户一个报文这种分组群播方式；
步骤 2340:隶属于授权报文中指定用户组的 STB接收该 EMM授权 报文； 机顶盒根据该组的共同地址属性进行鉴权， 即根据卡地址 0x884800010000的前 39个 bit的共同地址属性进行鉴权，只有符合该共 同地址属性的的用户才能接收该 EMM报文，例如 0x884800010001才能 收到 0x884800010000 的 4艮文， 而 0x888800010000 不能接收 0x884800010000的报文；
步骤 2350: 用户对该 EMM授权报文进行解析, 得到该用户对该产 品的定购情况。根据步骤 S330所述的 EMM报文结构，用户对该授权消 息进行解析， 如果该用户的卡地址对应的 bit为 1表示该用户可以接收 该授权， 如果对应的 bit位 0, 则表示用户不能接收该授权， 同时清除已 经存在的该产品的授权。
第三实施例：
在实施例一和实施例二中， EMM报文中 "授权数据"采用一个 bit代 表一个用户， 在此基础上， 我们也可以采用多个 bit的組合来代表一个 用户， 例如， 在第三实施例中 EMM报文中以两个 bit代表一个用户， 采 用每组 512个用户的分组， 对产品 2进行授权， 数字电枧条件接收系统 通过群播授权的方式发送 EMM报文对定购产品的用户进行授权的步 骤， 和实施例一和实施例二中的步骤基本相同， 仅是在 EMM报文的具 体帧格式上有所不同。 图 2F为 EMM报文中 "授权数据，，采用两个 bit代 表一个用户的帧格式， 其中， 分别以 11和 00代表用户是否有授权， 图 2F表示对 0x884800010001和 0x884800010003进行授权，其它用户都没 有授权。 同样， 第二和第三实施例也节省了带宽和缩小了轮番周期。
上述第一、 第二和第三实施例主要描述了数字电视系统中对用户授 权的方法。 其中， 数字电视系统包括卫星电视系统、 地面电视系统， 有 线电视系统； 上述对用户进行分组群播授权的授权控制系统是由数字电 视系统中的条件接收系统担当， 其中用户是机顶盒的用户， 即定购了数 字电视的用户。 本实施例的方法中传输网络包括但不限于卫星传输网 络、 数字地面广播网络、 有线传输网络或 IP网絡。
如图 3A所示， 在手机电视系统中， 对用户进行授权处理的系统， 与上述图 2A相同， 唯一不同在于， 授权控制系统是由手机电视条件接 收系统或者数字版权管理系统担当； 传输网络可以是移动通信网络。 授 权的对象是手机电视用户如 PDA或者 3G手机等的用户，即对用户的手 机或者 PDA虚拟卡地址或者手机号、 SIM卡的序列号， IMSI号的共同 地址属性进行鉴权， 在本例中定义虚拟卡地址实现, 例如可以参考数字 电视中定义 6个字节虚拟地址， 卡地址 0x884800010000, 6个字节共 48 个 bit的前 38个 bit作为分组的共同地址属性， 分組策略是按照用户卡 地址连续分为一组， 其中每个组内有固定的用户数 0x884800010000， 0x884800010001 , 0x884800010002... , 0x8848000103FF这 1024个用户 分成一个组； 可选的方案可以使用手机号、 SIM卡的序列号， IMSI (国 际移动用户识别码）等可以唯一标识一个手机终端的号码均可。 在使用 手机号码分组的情况可以任意组合， 例如 13888888880, 13888888881， 1388888888... , 13888888889等一系列用户， 使用前 8位 13888888000 作为组号， 后三位（ 1000个用户）作为组内地址； 分组策略是按照用户 卡地址连续分为一组。 利用这种授权控制系统能够实现对用户的分组群 播， 减少带宽要求， 节省下发授权信息报文的轮番时间。 如 3B所示， 本发明手机电视条件接收系统或者数字版权管理系统 实施例的结构示意图增加用户分组群播单元和报文封装单元， 其结构和 功能， 与上述实施例图 2B描述相同， 在此不再赘述。 上述增加了用户 分组群播单元和报文封装单元的手机电视条件接受系统， 能够通过对用 户分组群播的方式发送 EMM报文到终端设备， 对定购该产品的用户进 行授权，解决目前授权方式主要为单播方式。利用群播地址和授权数据， 能够对用户分组进行授权， 由此能够缩小对用户授权的轮播周期。
如图 3C所示， 为本发明手机电枧系统中手机或者 PDA此类终端设 备实施例的结构示意图； 其具有鉴权处理单元和报文解析单元， 其结构 和功能， 与上述实施例图 2C描述相同， 在此不再赘述。 同时， 手机或 者 PDA具有视音频播放单元， 报文解析单元解析后接收该授权， 用 SK 解密 ECM报文获得控制字， 最终使用 CW解扰节目流， 即可播放接收 到数字多媒体内容。 同样， 增加了鉴权处理单元和报文解析单元的手机 或者 PDA, 能够根据群播地址， 对分组用户的手机或者 PDA进行鉴权， 通过鉴权的手机或者 PDA能够接收所述授权信息报文， 进行授权处理。
基于上述实施例所描述的手机系统中用户授权系统， 第四实施例描 述了在手机系统中对用户授权的方法。
第四实施例： 如图 3D所示， 具体步骤如下：
步骤 3410: 手机电视条件接收系统对频道进行打包成产品； 在本例 中产品 1 包括 CCTV1、 CCTV2...CCTV8, 产品 2包括凤凰卫视， 产品 3包括…
步驟 3420: # 用户的分组策略， 将一组具有共同地址属性的用户 设置到同一个组内； 在本例中定义虚拟卡地址实现， 例如可以参考数字 电视中定义 6个字节虚拟地址， 卡地址 0x884800010000, 6个字节共 48 个 bit的前 38个 bit作为分组的共同地址属性， 分組策略是按照用户卡 地址连续分为一组， 其中每个组内有固定的用户数 0x884800010000, 0x884800010001 , 0x884800010002... , 0x8848000103FF这 1024个用户 分成一个组； 可选的方案可以使用手机号、 SIM卡的序列号， IMSI (全 称是 International Mobile Subscriber Identification Number国际移动用户 识别码）等可以唯一标识一个手机终端的号码均可。 在使用手机号码分 组的情况可以任意组合， 例如 13888888880 , 13888888881 , 1388888888... , 13888888889等一系列用户， 使用前 8位 13888888000 作为组号， 后三位（ 1000个用户）作为组内地址；
步骤 3430: 将授权数据、 产品标识和群播地址组装成授权 EMM报 文调制到传输网络中； 在本例中， 所组装的 EMM ^=艮文如图 3所示， 其 中和本发明相关的参数有 6 个字节的"群播地址，，， 4 个字节的"产品标 识"， 16个字节的" SK，，，， 64个字节的"授权数据"， 具体设置如下：
"群播地址"： 0x884800010000;
"产品标识，，： 0x0002, 表示产品 2, 其包括凤凰卫视电视频道； "SK"':就是以密文形式存在的 SK,手机或 PDA在接收到该报文后 使用保存的组播密钥 GK解密 SK，得到 SK:
"授权数据"： 每一个 bit表示一个卡地址（用户）， 同时也表示该用 户对产品 ID的购买情况，其值可以设置 0和 1 ,具体， 0表示没有购买， 1 表示已经购买。 在本例中如图 2D所示， 表示对 0x884800010001 和 0x884800010003进行授权， 其它用户都没有授权； 通过步骤 3420和步 骤 3430 实现了对用户分组组播， 解决了现有技术中一个用户一个报文 这种单播方式， 达到了一组用户一个报文这种分组群播方式；
步骤 3440: 隶属于授权报文中指定用户组的手机或者 PDA接收该 EMM授权报文； 手机或者 PDA根据该组的共同地址属性进行鉴权， 即 居卡地址 0x884800010000, 6个字节共 48个 bit的前 38个 bit作为分 组的共同地址属性进行鉴权， 只有符合该共同地址属性的的用户才能接 收该 EMM报文， 例如 0x884800010001才能收到 0x884800010000的报 文， 而 0x888800010000不能接收 0x884800010000的 艮文；
步骤 3450: 用户对该 EMM授权报文进行解析， 得到该用户对该产 品的定购情况。根据步骤 S330所述的 EMM报文结构，用户对该授权消 息进行解析， 如果该用户的卡地址对应的 bit为 1表示该用户可以接收 该授权， 如果对应的 bit位 0， 则表示用户不能接收该授权， 同时清除已 经存在的该产品的授权。
这种方法下，手机电视系统中，通过对用户所属的手机或者 PDA进 行分组群播授权信息报文， 有效地节省了对带宽的要求， 缩小了轮播周 期。以 100万用户 10个产品为例， 100万用户分成 1000个组（每组 1024 个用户）， 每个组再有 10个产品的授权， 则共有 10000个 4艮文， 每个传 输流报文长度为 188字节， 按照分配 50Kbsp的带宽计算， 轮播一遍的 时间为（10000个报文 188字节每报文 813^ )/(50 l024 bsp) = 293.75秒， 从而得到轮播一次约 300秒， 这和现有技术中轮播一次需要 300, 800 秒相比具有明显的优势。
手机电视系统中也可以选择一组用户为 512个， 具体处理步骤与第 二实施例相同， 两个 bit代表一个用户的实施例处理步骤同第三实施例。 在第四实施例手机电视系统中对用户的授权与第一至第三实施例数字 电视系统中对用户的授权相同， 唯一不同在于群播地址， 即在手机电视 系统中， 定义虛拟卡地址， 或者使用手机号、 SIM 卡的序列号, IMSI 等可以唯一标识一个手机终端的号码作为共同地址属性。
IPTV系统中 ,对用户进行授权处理的系统与图 2A或 3 A所示相同， 唯一不同在于, 授权控制系统是由 IPTV条件接收系统或者数字版权管 理系统担当； 授权的对象是 IPTV用户如联网计算机， 每个联网计算机 上有唯一一张智能卡， 即对智能卡地址的共同地址属性进行鉴权， 在本 例中将智能卡地址 0x884800010000, 6个字节共 48个 bit的前 39个 bit 作为分組的共同地址属性， 分組策略是按照用户卡地址连续分为一组； 该系统连接关系与上述实施例相同。传输网络可以 IP网络。授权的对象 也可以是通过使用 IP机顶盒和电视机收看节目的用户， 即对 IP机顶盒 卡地址的共同地址属性进行鉴权。 利用这种授权控制系统能够实现对用 户的分组群播， 减少带宽要求， 节省下发授权信息报文的轮番时间。
同样在该 IPTV条件接收系统或者数字版权管理系统中， 增加用户 分组群播单元和报文封装单元， 其结构和功能， 与上述实施例图 2B或 3B描述相同，在此不再赘述。上述增加了用户分組群播单元和 ^艮文封装 单元的 IPTV条件接受系统， 能够实现通过对用户分组群播的方式发送 EMM报文到终端设备， 对定购该产品的用户进行授权， 解决目前授权 方式主要为单播方式。 利用群播地址和授权数据， 能够对用户分组进行 授权， 由此能够缩小对用户授权的轮播周期。
终端设备如联网计算机或者 IP机顶盒，具有鉴权处理单元和报文解 析单元， 其结构和功能， 与上述实施例图 2C或 3C描述相同， 在此不再 赘述。 联网计算机具有视音频播放单元 , 报文解析单元解析后接收该授 权， 用 SK解密 ECM报文获得控制字， 最终使用 CW解扰节目流， 即 可播放接收到数字多媒体内容。 IP机顶盒与所述普通电视机相连接， 组 成具有视音频播放功能的终端设备， 报文解析单元解析后接收该授权， 用 SK解密 ECM报文获得控制字， 最终使用 CW解扰节目流， 普通电 视机即可播放接收到数字多媒体内容。
同样，增加了鉴权处理单元和报文解析单元的联网计算机或者 IP机 顶盒， 能够根据群播地址，对分組用户的联网计算机或者 IP机顶盒进行 鉴权， 通过鉴权的联网计算机或者 IP机顶盒能够接收所述授权信息报 文， 进行授权处理。
基于上述 IPTV中用户授权系统， 对用户的分组群播授权处理流程 同第一实施例、 第二实施例和第三实施例相同， 唯一不同的就是对用户 进行分组群播授权的授权控制系统是 IPTV条件接收系统或 IPTV数字版 权管理系统、 在 IPTV系统中， 即对联网计算机的智能卡或者 IP机顶盒 卡地址的共同地址属性进行鉴权，在本例中将智能卡或 IP机顶盒卡地址 作为分组的共同地址属性（具体选取同数字电视系统中相一致）。 同样 也实现了对用户分组组播， 解决了现有技术中一个用户一个报文这种单 播方式， 达到了一組用户一个报文这种分组群播方式， 减少了所占带宽 以及缩小了轮番周期。
移动电视系统中，对用户进行授权处理的系统与上述图 2A或 3A所 示相同， 唯一不同在于， 授权控制系统是由移动电视条件接收系统或者 数字版权管理系统担当。 授权的对象是移动电视用户如车载移动电视或 者其他具有视音频播放功能和接收多媒体节目流的专用终端如改进的 MP4播放器等， 如对 MP3, MP4等设备定义虚拟卡地址,该虚拟卡地址 可以与其设备标识 (例如机身序列号等）存在对应关系， 或直接使用设 备标识均可，该 MP4作为移动电视系统中的联网终端。在授权控制系统 中， 系统对对车载移动电视机的虚拟卡共同地址属性进行鉴权， 在本例 中将卡地址 0x884800010000, 6个字节共 48个 bit的前 39个 bit作为分 组的共同地址属性， 分组策略是按照用户卡地址连续分为一组， 其中每 个组内有 固定的用 户 数 0x884800010.000 , 0x884800010001， 0x884800010002... , 0x8848000101FF这 512个用户分成一个组； 该系统 连接关系与上述实施例相同。 传输网络可以是卫星传输网络或数字地面 广播网络或者移动通信网络。 利用这种授权控制系统能够实现对用户的 分組群播， 减少带宽要求， 节省下发授权信息报文的轮番时间。 同样在该移动电视条件接收系统或者数字版权管理系统中， 增加用 户分组群播单元和报文封装单元， 其结构和功能， 与上述实施例图 2B 或 3B描述相同， 在此不再赘述。 上述增加了用户分组群播单元和报文 封装单元的移动电视条件接受系统， 能够实现通过对用户分组群播的方 式发送 EMM报文到终端设备， 对定购该产品的用户进行授权， 解决目 前授权方式主要为单播方式。 利用群播地址和授权数据， 能够对用户分 组进行授权， 由此能够缩小对用户授权的轮播周期。
终端设备如车载移动电视设备或者其他具有视音频播放功能和接收 多媒体节目流的专用终端如改进的 MP4播放器，具有鉴权处理单元和报 文解析单元， 其结构和功能， 与上述实施例图 2C或 3C描述相同， 在此 不再赘述。车载移动电视设备或者改进的 MP4播放器，具有视音频播放 单元，报文解析单元解析后接收该授权,用 SK解密 ECM报文获得控制 字， 最终使用 CW解扰节目流， 即可播放接收到数字多媒体内容。
同样， 增加了鉴权处理单元和报文解析单元的车载移动电视设备或 者改进的 MP4播放器， 能够根据群播地址，对分组用户的车载移动电视 设备或者改进的 MP4播放器进行鉴权，通过鉴权的车载移动电视设备或 者改进的 MP4播放器能够接收所述授权信息报文， 进行授权处理。
基于上述移动电视系统中用户授权系统 , 对用户的分组群播授权处 理流程同第一实施例、 第二实施例和第三实施例相同， 唯一不同的就是 对用户进行分组群播授权的授权控制系统是移动电视条件接收系统或 移动电视数字版权管理系统、 在移动电视系统中， 即对车载电视机或者 其他具有视音频播放功能和接收多媒体节目流的专用终端如改进的 MP4播放器等的虚拟卡地址的共同地址属性进行鉴权，在本例中将虚拟 卡地址作为分组的共同地址属性（具体选取同数字电视系统中相一致：)。 同样也实现了对用户分组组播， 解决了现有技术中一个用户一个报文这 种单播方式， 达到了一组用户一个报文这种分组群播方式， 减少了所占 带宽以及缩小了轮番周期。
利用本发明实施例提供的用户授权方法，对用户进行分组群播授权， 获得授权的终端设备， 就能够收看实时直播或者远端点播的来自多媒体 服务器的节目， 也能够收看在本地存储的多媒节目流。 本发明实施例提 供了一种能够减少带宽， 缩小轮番周期的用户授权方法。
本发明中以每组 1024和 512个用户来实现，但原理上每组用户的数 量可以变化， 在报文分片的情况下可以实现每组更多用户， 也可以只使 用部分字节， 实现每组比较少的用户分组（例如 2048个用户一组， 甚 至 10个用户一組等）；
本发明中 EMM报文中 "授权数据"采用一个 bit代表一个用户或两个 bit代表一个用户， 也可以采用多个 bit的组合来代表一个用户。
上述用户授权方法同样也应用于其他广播或组播的媒体业务， 对用 户的分组群播授权处理流程同第一实施例、 第二实施例和第三实施例相 同。 其他广播或组播的媒体业务的系统只需要增加用户分组群播单元和 报文封装单元， 以及终端设备中具有鉴权处理单元和报文解析单元。
以上所述仅为本发明的较佳实施例而已， 并不用以限制本发明， 凡 在本发明的精神和原则之内， 所作的任何修改、 等同替换、 改进等， 均 应包含在本发明的保护范围之内。

Claims

权利要求书
1、 一种用户授权方法， 其特征在于， 包括：
通过传输网络以分组群播方式， 发送授权信息报文；
根据群播地址进行鉴权， 接收所述授权信息报文， 并对所迷授权信 息报文进行解析， 得到用户的授权数据， 通过所述授权数据进行授权处 理。
2、根据权利要求 1所述的方法，其特征在于，所述分组群播方式为： 对频道进行打包， 生成产品标识；
根据用户的分组策略， 将一组具有共同地址属性的用户设置到同一 个組内；
将授权数据、 产品标识和群播地址组装成授权信息报文。
3、根据权利要求 1或 1所述的方法，其特征在于， 所述授权信息报 文是授权管理信息报文。
4、根据权利要求 2或 3所述的方法， 其特征在于， 所述用户的分组 策略是按照用户卡地址连续分为一组， 其中每个组内有固定的用户数。
5、根据权利要求 4所述的方法， 其特征在于， 所述每个组内固定的 用户数是 1024个或 512个。
6、根据权利要求 2所述的方法， 其特征在于， 所述群播地址是根据 所述组的共同地址属性得到。
7、根据权利要求 1或 2所述的方法， 其特征在于， 所述授权数据表 示用户的卡地址， 同时也表示该用户对产品定购情况。
8、根据权利要求 1或 2所述的方法，其特征在于，所述授权数据 采 用一个 bit代表一个用户或两个 bit代表一个用户或采用多个 bit的组合 来代表一个用户。
9、根据权利要求 1所述的方法， 其特征在于， 所述传输网络包括卫 星传输网络、 数字地面广播网络、 移动通信网络、 有线传输网络或 IP 网络。
10、 根据权利要求 1所述的方法， 其特征在于， 所述根据群播地址 进行鉴权， 接收所述授权信息报文具体指： 判断用户的卡地址是否符合 群播地址， 如果用户的卡地址符合所述授权信息报文中的共同地址属 性， 即该用户鉴权通过， 属于同组用户， 则接收所述授权信息报文； 否 则， 该用户不能接收所述授权信息报文。
11、 根据权利要求 8所述的方法， 其特征在于，
当所述授权数据采用一个 bit代表一个用户时， 所述对该授权信息 报文进行解析得到用户的授权数据， 通过该授权数据对用户进行授权处 理进一步包括： 用户对所接收报文结构进行解析， 如果该授权数据对应 的 bit值为 1时， 表示该用户可以接收该授权; 如果该授权数据对应的 bit值为 0时，表示用户不能接收该授权， 并清除已经存在的该产品的授 权；
当所述授权数据采用两个 bit代表一个用户时， 所述对该授权信息 报文进行解析进一步包括： 用户对所接收报文结构进行解析， 如果该授 权数据对应的 bit值为 11时， 表示该用户可以接收该授权; 如果该授权 数据对应的 bit值为 00时， 表示用户不能接收该授权， 并清除已经存在 的该产品的授权。
12、 一种用户授权系统， 其特征在于， 包括：
授权控制系统， 用于对用户进行分组， 根据组的共同地址属性设置 群播地址， 封装授权信息报文并将授权信息报文， 通过传输网絡发送； 终端设备， 用于根据所述群播地址进行鉴权， 接收所述授权信息报 文； 并对所述授权信息报文进行解析， 得到所述终端设备的授权数据， 根据所述授权数据进行授权处理。
13、根据权利要求 12所述的用户授权系统， 其特征在于， 所述传输 网络包括卫星传输网络、 数字地面广播网络、 有线传输网络、 移动通信 网络或 IP网络。
14、 一种授权控制系统， 其特征在于， 包括：
用户分组群播单元， 用于根据用户的分组策略， 对用户进行分组， 根据组的共同地址属性设置群播地址；
报文封装单元， 用于将所述群播地址、 授权数据和产品标识组装成 授权信息报文；
报文发送单元， 用于发送所述授权信息报文。
15、根据权利要求 14所述的授权控制系统，采用数字电视条件接收 系统、 IPTV条件接收系统、 移动电视条件接收系统或手机电视条件接 收系统。
16、根据权利要求 14所述的授权控制系统，采用数字电视数字版权 管理系统、 IPTV数字版权管理系统、 移动电视数字版权管理系统或手 机电视数字版权管理系统。
17、 一种终端设备, 其特征在于， 包括:
鉴权处理单元， 用于根据共同地址属性进行鉴权；
报文解析单元， 在所述共同地址属性通过鉴权后， 用于对授权信息 报文进行解析， 获得授权数据， 根据所述授权数据进行授权处理。
18、 根据权利要求 17所述的终端设备， 其特征在于， 还包括： 视 音频播放单元， 在报文解析单元解析获得控制字， 解扰数字多媒体节目 流后， 用于将所述数字多媒体节目流进行播放。
19、 居权利要求 17所述的终端设备， 采用机顶盒、 手机、 MP3 播放器、 MP4播放器、 PDA或计算机。
PCT/CN2006/003646 2005-12-31 2006-12-28 Procede et systeme d'autorisation pour abonne, systeme de commande d'autorisation et dispositif terminal associe WO2007076694A1 (fr)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CNA2006800116891A CN101156350A (zh) 2005-12-31 2006-12-28 用户授权方法和系统、及其授权控制系统和终端设备
EP06840682A EP1853000A4 (en) 2005-12-31 2006-12-28 PARTICIPANT AUTHORIZATION PROCESS AND SYSTEM, AUTHORIZATION CONTROL SYSTEM AND ASSOCIATED TERMINAL DEVICE.
US11/847,590 US20080059993A1 (en) 2005-12-31 2007-08-30 Method and system for transmitting and receiving authorization message

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200510121536.X 2005-12-31
CNB200510121536XA CN100525434C (zh) 2005-12-31 2005-12-31 一种在数字电视条件接收系统中对用户授权的方法

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US11/847,590 Continuation US20080059993A1 (en) 2005-12-31 2007-08-30 Method and system for transmitting and receiving authorization message

Publications (1)

Publication Number Publication Date
WO2007076694A1 true WO2007076694A1 (fr) 2007-07-12

Family

ID=37298416

Family Applications (2)

Application Number Title Priority Date Filing Date
PCT/CN2006/001379 WO2007076652A1 (fr) 2005-12-31 2006-06-19 Procede d'autorisation utilisateur pour systeme d'acces conditionnel a la television numerique
PCT/CN2006/003646 WO2007076694A1 (fr) 2005-12-31 2006-12-28 Procede et systeme d'autorisation pour abonne, systeme de commande d'autorisation et dispositif terminal associe

Family Applications Before (1)

Application Number Title Priority Date Filing Date
PCT/CN2006/001379 WO2007076652A1 (fr) 2005-12-31 2006-06-19 Procede d'autorisation utilisateur pour systeme d'acces conditionnel a la television numerique

Country Status (4)

Country Link
US (1) US20080059993A1 (zh)
EP (1) EP1853000A4 (zh)
CN (2) CN100525434C (zh)
WO (2) WO2007076652A1 (zh)

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008103864A (ja) * 2006-10-18 2008-05-01 Nec Corp Ｉｐマルチキャストサービスシステム、スイッチ装置及びそれらに用いるグループ選択送信方法
US20090165074A1 (en) * 2007-12-21 2009-06-25 General Instrument Corporation Multi-Address Message Addressing
US8407486B2 (en) * 2008-03-12 2013-03-26 International Business Machines Corporation Sending and releasing pending messages
EP2124439A1 (fr) 2008-05-21 2009-11-25 Nagravision S.A. Méthode d'allocation et de gestion d'abbonements de réception de produits télédiffusés
CN101594294B (zh) * 2008-05-29 2011-12-21 北京视博数字电视科技有限公司 发送授权信息的方法及其条件接收系统前端
US20100210239A1 (en) * 2009-02-17 2010-08-19 Jeyhan Karaoguz Service mobility via a femtocell infrastructure
US8381260B2 (en) * 2009-07-08 2013-02-19 Echostar Technologies L.L.C. Separate addressing of a media content receiver and an installed removable circuit device
EP2566157A1 (en) 2011-09-02 2013-03-06 Nagravision S.A. Method to optimize reception of entitlement management messages in a Pay-TV system
EP2747443B1 (en) 2012-12-20 2019-06-26 Nagravision S.A. Method to enforce processing of management messages by a security module
US9961384B2 (en) 2012-12-20 2018-05-01 Nagravision S.A. Method and a security module configured to enforce processing of management messages
US10652673B2 (en) * 2013-05-15 2020-05-12 Gn Hearing A/S Hearing instrument with an authentication protocol
CN104363040B (zh) * 2014-09-26 2018-09-11 航天数字传媒有限公司 卫星授权搜索的方法及装置
CN105263133A (zh) * 2015-09-14 2016-01-20 惠州Tcl移动通信有限公司 一种虚拟sim卡实现方法及系统
US10291965B2 (en) * 2016-03-11 2019-05-14 DISH Technologies L.L.C. Television receiver authorization over internet protocol network

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1360438A (zh) * 2000-12-18 2002-07-24 清华同方股份有限公司 一种基于分组算法的数字电视有条件接收系统
CN1372731A (zh) * 1999-07-05 2002-10-02 卡纳尔股份有限公司 广播和接收消息
EP1343316A1 (de) * 2002-03-04 2003-09-10 Beta Research GmbH Verfahren und Vorrichtung zum Adressieren von Mitteilungen eines Anbieters digitaler Dienste

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP0200310B1 (en) * 1985-05-01 1993-08-11 General Instrument Corporation Direct broadcast satellite signal transmission system
HU229694B1 (en) * 1997-03-21 2014-05-28 Nagra France Sas Conditional access system
ATE232670T1 (de) * 1997-03-21 2003-02-15 Canal Plus Technologies Chipkarte und empfänger für den empfang von verschlüsselten rundfunksignalen
ID23380A (id) * 1997-03-21 2000-04-20 Canal & Siciete Anonyme Metode dan aparatus untuk mencegah akses yang curang dalam sistem akses bersyarat
US6295361B1 (en) * 1998-06-30 2001-09-25 Sun Microsystems, Inc. Method and apparatus for multicast indication of group key change
US20020002706A1 (en) * 2000-05-26 2002-01-03 Sprunk Eric J. Authentication and authorization epochs
US6898285B1 (en) * 2000-06-02 2005-05-24 General Instrument Corporation System to deliver encrypted access control information to support interoperability between digital information processing/control equipment
US6862684B1 (en) * 2000-07-28 2005-03-01 Sun Microsystems, Inc. Method and apparatus for securely providing billable multicast data
DE10037630B4 (de) * 2000-08-02 2008-02-07 Deutsche Telekom Ag Verfahren zur Adressierung von Endgeräten
TW548983B (en) * 2000-10-26 2003-08-21 Gen Instrument Corp Initial viewing period for scalable authorization of streaming multimedia content
US7995603B2 (en) * 2001-05-22 2011-08-09 Nds Limited Secure digital content delivery system and method over a broadcast network
DE10244079A1 (de) * 2002-09-06 2004-04-01 Deutsche Telekom Ag Verfahren zum Bereitstellen eines verschlüsselten IP-basierenden Gruppen-Dienstes
US20040151315A1 (en) * 2002-11-06 2004-08-05 Kim Hee Jean Streaming media security system and method
EP1427208A1 (en) * 2002-12-02 2004-06-09 Canal + Technologies Messaging over mobile phone network for digital multimedia network
US20040181811A1 (en) * 2003-03-13 2004-09-16 Rakib Selim Shlomo Thin DOCSIS in-band management for interactive HFC service delivery
US7266198B2 (en) * 2004-11-17 2007-09-04 General Instrument Corporation System and method for providing authorized access to digital content

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1372731A (zh) * 1999-07-05 2002-10-02 卡纳尔股份有限公司 广播和接收消息
CN1360438A (zh) * 2000-12-18 2002-07-24 清华同方股份有限公司 一种基于分组算法的数字电视有条件接收系统
EP1343316A1 (de) * 2002-03-04 2003-09-10 Beta Research GmbH Verfahren und Vorrichtung zum Adressieren von Mitteilungen eines Anbieters digitaler Dienste

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP1853000A4 *

Also Published As

Publication number Publication date
US20080059993A1 (en) 2008-03-06
CN1859559A (zh) 2006-11-08
WO2007076652A1 (fr) 2007-07-12
CN101156350A (zh) 2008-04-02
EP1853000A4 (en) 2008-07-02
CN100525434C (zh) 2009-08-05
EP1853000A1 (en) 2007-11-07

Similar Documents

Publication Publication Date Title
WO2007076694A1 (fr) Procede et systeme d'autorisation pour abonne, systeme de commande d'autorisation et dispositif terminal associe
RU2339077C1 (ru) Способ функционирования системы условного доступа для применения в компьютерных сетях и система для его осуществления
JP4870078B2 (ja) 低階層キーマネージメントシステムおよび方法
CN102577421B (zh) 用于使用社交tv服务识别的内容的数字版权管理保护
US7383561B2 (en) Conditional access system
TWI243613B (en) System and apparatus for supplying audiovisual information to a subscriber terminal
KR101244312B1 (ko) 헤드-엔드 시스템 및 복수의 클라이언트 시스템들 간의통신을 제어하는 방법
US20110093883A1 (en) System, protection method and server for implementing the virtual channel service
WO2008046323A1 (fr) Procédé, système et appareil pour la protection de service de télévision pour téléphone mobile
JP2006523423A (ja) 条件付きアクセスパーソナルビデオレコーダー
JP2002535926A (ja) ディジタル伝送システムにおけるアドレス割り当て
US8693692B2 (en) Direct delivery of content descrambling keys using chip-unique code
EP2373019A1 (en) Secure descrambling of an audio / video data stream
JP4520148B2 (ja) データ交換ネットワークにおけるスクランブルされたデジタルデータのためのアクセスコントロールを伴う送信方法およびシステム
WO2001015448A1 (en) System and method for securing on-demand delivery of pre-encrypted content using ecm suppression
CA2396821A1 (en) Conditional access and security for video on-demand systems
WO2009017367A2 (en) Method and system for storage and playback of broadcasting contents, rights issuer applied to the same
KR20130050925A (ko) 디지털 데이터 흐름의 보안 브로드캐스팅 방법 및 시스템
US20060233368A1 (en) Method for conditional access in a DMTS/DOCSIS enabled set top box environment
KR20120014662A (ko) Ｉｐｔｖ의 콘텐트를 포터블 디바이스로 제공하고 포터블 디바이스에서 이를 재생하는 방법 및 장치
CN103634624A (zh) 基于ip网络的数字电视直播方法及系统
CN101521570A (zh) 一种实现iptv组播业务媒体安全的方法、系统及设备
Yang et al. The Simplified and Secure Conditional Access for Interactive TV service in Converged Network
Kim et al. Protection of MPEG-2 multicast streaming in IP-TV
KR101383378B1 (ko) 다운로드 수신제한 시스템을 이용한 모바일 ｉｐｔｖ 서비스 시스템 및 그 방법

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 2006840682

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 11847590

Country of ref document: US

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 200680011689.1

Country of ref document: CN

WWP Wipo information: published in national office

Ref document number: 2006840682

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 11847590

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE