WO2008086714A1

WO2008086714A1 - A method and system for realizing safety of cipher key in multi-network fusion mobile multi-media broadcasting system

Info

Publication number: WO2008086714A1
Application number: PCT/CN2007/003922
Authority: WO
Inventors: Zunyou Ke; Qinghua Yao; Zhichun Mu
Original assignee: Zte Corporation
Priority date: 2006-12-30
Filing date: 2007-12-29
Publication date: 2008-07-24
Also published as: CN101009553A

Abstract

A method and system for realizing safety of cipher key in multi-network fusion mobile multi-media broadcasting system are disclosed. The method comprises (a) broadcasting system generating, storing and updating the program stream cipher key; each mobile communication system network generating, storing and updating the operation key; and each mobile communication system network separately sending the operation cipher and the mark to user terminal; (b) broadcasting system network sending the program stream to each mobile communication system network; each mobile communication system network encrypting the program stream cipher key and returning the encrypted and controlled information; (c) the broadcasting system network using the corresponding program stream which is encrypted and coded by the program stream cipher key and broadcasting and sending the multiplexed program stream and encrypted program stream cipher key information; (d) user terminal receiving the corresponding program stream and the encrypted and controlled information; searching the corresponding operation cipher key mark; using the operation cipher key as the parameter; deciphering the encrypted program stream cipher key; and deciphering the program stream data by the obtained program stream cipher key.

Description

Method and system for realizing key security of multi-network convergence mobile multimedia broadcasting system

Technical field

The present invention relates to mobile network communications and mobile multimedia broadcast technologies. More particularly, it relates to a method and system for providing key security for a user terminal in the case of a mobile multimedia broadcast system network and a plurality of mobile communication system networks. Background technique

As the demand for mobile communication continues to grow, a large number of multimedia services have emerged with the development of the times. Among them, some applications require multiple users to receive the same media data at the same time, such as video on demand, TV broadcast, etc., such as mobile TV services.

Simple mobile multimedia broadcasting system The MMB network realizes services such as mobile multimedia broadcasting or mobile TV (DMB, DAB, DVB and other frequency-addressed broadcasting network systems, which are uniformly displayed by MMB), and faces some congenital defects. Due to the unidirectionality of its transmission, that is, only the downlink channel, it brings inconvenience to interactive services, system billing flexibility and system security, so that some mature mobile network technologies cannot be applied to the field.

In order to achieve interaction, billing and security, the MMB system has to rotate the interactive, billing and security content in an unpredictable situation. For large-scale commercial systems, the amount of data is very large, especially the billing information. Great impact on system overhead, resulting in a large systemic burden. Compared with the immersive mobile communication system network, the broadcast system network has to bear the great cost to achieve the same function. Even if it is realized, the scope of business and flexibility of use are greatly reduced. These have already gained mature carrier-grade applications in the mobile communication system network.

However, the wireless network of the broadcast network is highly efficient and the data capacity is much larger than that of the mobile network. Provides better bearer for large-scale multimedia transmission. To this end, the need for MMB to integrate with mobile networks (GSM, CDMA or 3G, etc.) has been proposed.

Both 3GPP and 3GPP2 propose corresponding multimedia broadcast/multicast services. The so-called broadcast/multicast service refers to: One-to-many unidirectional bearer service, and data is sent by one source entity to multiple receiving entities. These businesses bring point-to-multipoint ideas to mobile communication systems, which can be used in mobile networks. A point-to-multipoint service in which a data source sends data to multiple users is provided to achieve network resource sharing and improve network resource utilization.

Each program stream in the business guide is divided into several sections of program content according to the time period, referred to as the program. Every program needs to be secured. At present, the security of multimedia broadcast/multicast services in 3GPP mobile communication systems is implemented through a three-layer key system: Layer 1: User key, a key shared between a single multimedia broadcast/multicast service user terminal and a data source MU ; Layer 2: Service Key, the key MSK shared by all multimedia broadcast/multicast service user terminals and data sources; Layer 3: Program Stream Key, all multimedia broadcast/multicast service user terminals shared with data sources Multicast transmission data encryption key MTK „

MUK is used to securely send MSKs to service users. MSK is used to secure MTK to service users, and MTK is a true multicast transmission data encryption key. In order to ensure the security of the multimedia broadcast/multicast service, MSK and MTK need to be updated frequently to prevent legitimate users from leaking MSK or MTK to illegal users, so as to reduce the impact of illegal users' access to multicast communication content on service security. Protecting only the user terminals that have signed the service can legally enjoy the service. For users who do not have a contracted user, or who are retired after signing a contract, they are considered as illegal users.

After the broadcast/multicast server updates the service key, it sends a new key valid message to the user terminal, indicating that the new service key is valid; after receiving the message, the user terminal may send a request to the broadcast/multicast server. Key message, requesting a new service key; after receiving the request key message, the broadcast/multicast server sends a corresponding new service key to the user terminal that initiated the request; the user terminal successfully receives the new service After the key, the business key is saved and used later.

In the 3GPP2 mobile communication system, there is also a layered key corresponding to 3GPP. Specifically, the first layer: user key TK; the second layer: business key BAK; the third layer: program stream key SK.

In the converged network, the program stream is sent from the broadcast network (for example, radio and television broadcasting network), that is, the program service stream is transmitted by the broadcast channel of the radio and television network; the program content is encrypted by the radio and television mobile TV system; and is completed by the mobile operator's mobile communication system network. User authentication and service charging; the mobile operator's mobile communication system network is used as an interactive channel to transmit service keys and implement business ordering, business interaction, and the like.

However, 3GPP2 uses different encryption methods than 3GPP. And generally both A key management system with an unrelated broadcast/multicast service platform that exists in an independent network system. How does the broadcast system network integrate key management of service platforms of different mobile communication system networks?

Therefore, in the case of a mobile multimedia broadcast system network and a plurality of mobile communication system networks, the broadcast system network integrates the service platforms of different mobile communication system networks, and a key security method needs to be provided for the mobile user terminals to achieve the third level. Key update and key security. Summary of the invention

The technical problem to be solved by the present invention is to provide a method for realizing key security of a multi-network convergence mobile multimedia broadcasting system, so that the mobile multimedia broadcasting system can integrate multiple or multiple mobile communication system network service platforms with different key management functions. Provide key security for mobile user terminals.

In order to solve the above problems, the present invention provides a method for realizing key security of a multi-network convergence mobile multimedia broadcasting system, which is applied to a system in which a broadcast system network and a plurality of mobile communication system networks are integrated, and the broadcast system network has a scrambler. The mobile communication system network has a service platform, and the method includes the following steps:

(a) The scrambler of the broadcast system network generates, stores, and updates the program stream key according to the set rule, and the service platform of each mobile communication system network generates, stores, and updates the service key according to the set rule, and the service key corresponds to Unique service key identifier, each mobile communication system network separately distributes the service key and its identifier to the user terminal that subscribes to the corresponding service;

(b) The scrambler of the broadcast system network sends the program stream key to the service platform of each mobile communication system network, and each service platform encrypts the program stream key with the corresponding service key as a parameter, and returns the encrypted control information. The scrambler includes an encrypted program stream key, a service key identifier, and an identification parameter of the mobile communication system network, and the scrambler stores the received encryption control information;

(c) the scrambler of the broadcast system network encrypts the encoded corresponding program stream by using the program stream key, and outputs the program stream and the encrypted program stream key information together, multiplexes and broadcasts, and the encrypted program stream is densely streamed. The key information includes each program stream identifier and its encryption control in each mobile communication system network; (d) after the user terminal selects the program, receives the corresponding program stream and its encryption control information, finds the corresponding service key identifier according to the identifier of the network of the mobile communication system, and determines the local service key to be used, with the service key For the parameters, the encrypted program stream key is decrypted, and the program stream data is decrypted using the obtained program stream key.

Further, the method for implementing the key security of the multi-network convergence mobile multimedia broadcast system may also have the following features. In the step (a), the user terminal generates a user key and reports the service platform during the authentication, and the service platform presses The same rule generates a user key for the user who subscribes to the service, and verifies whether the user key of the user terminal is consistent with the user key, and if so, encrypts the service key with the user key as a parameter, and then encrypts the service. The key and its identifier are sent to the user terminal for storage; in step (d), after determining the service key to be used, the user terminal first finds the stored encrypted service key, and takes the local user key as a parameter. The service key is decrypted, and the encrypted program stream key is decrypted with the service key.

Further, the foregoing method for implementing key security of a multi-network convergence mobile multimedia broadcast system may further have the following features: Step (b) is further divided into the following steps: (bl) The scrambler of the broadcast system network passes the configured management rules according to the configuration rules. An interface with a service platform of a plurality of mobile communication system networks, to which a program stream key encryption request is transmitted, carrying a session identifier, a program stream identifier, a program stream key identifier, and a program stream key data; (b2) each mobile communication system After receiving the encryption request, the service platform of the network finds the corresponding service key according to the program stream identifier matching, uses the service key as a parameter, encrypts the control word data, and generates the encryption control information of the program stream; (1⁄2) each mobile The communication system network service platform sends the program stream key encryption response message to the scrambler, uses the same session identifier and program stream identifier as the request, and carries the generated encryption control information, including the encrypted program stream key and the service secret. Key identification and identification parameters of the mobile communication system network; (b4) service platform storage Encrypted control information for the program stream returned by the mobile communication system network.

Further, the foregoing method for implementing key security of a multi-network convergence mobile multimedia broadcast system may further have the following features: Step (d) is further divided into the following steps: (dl) a client that initiates a mobile multimedia broadcast system on the terminal, the client The terminal program starts to work; (d2) if the client needs to obtain the electronic service guide, the client interacts with the service platform to obtain the electronic service guide data and displays it, and if not, directly displays; (d3) the user displays according to the client Electronic business guide, choose to watch a valid TV program, if the program needs to be ordered, then interact with the business platform to complete the industry (d4) the terminal according to the current service selected by the user, demultiplexing and receiving the corresponding encrypted program stream according to the service identifier, and receiving the encrypted program stream key information; (d5) the terminal from the encrypted program stream key information Obtaining encryption control information of multiple networks, and selecting encryption control information using the network of the mobile communication system according to the identification parameter of the network of the mobile communication system stored by the terminal;

(d6) the terminal determines whether the terminal has stored a corresponding valid service key according to the service key identifier in the encryption control information, and if not, initiates a service key request to the mobile communication system network service platform, and acquires the terminal. After the user key is encrypted, the service key of the program stream, if yes, performs the next step;

(d7) The terminal decrypts the encrypted service key by using the local user key, and decrypts the encrypted program stream key in the encryption control information by using the obtained service key and the corresponding decryption algorithm, and then uses the obtained program stream. The key decrypts the program stream data.

Further, the foregoing method for implementing key security of a multi-network convergence mobile multimedia broadcast system may further have the following feature: the terminal acquires Ks from the service platform during the initialization process, generates a user key, and obtains a mobile communication to which the user key belongs. Identification parameters of the system network, when the user authenticates, the terminal authentication request carries the user key index and the key generated by itself, and the mobile communication system network service platform finds or generates Ks based on the authentication multi-group obtained by the HLR, and then The user key is generated according to the Ks, and the service platform verifies the user key of the same user reported by the local and the terminal, and if the same, the user key is used as a parameter, and the service of the service subscribed to by the user is performed by using a predetermined encryption algorithm. The key is encrypted, otherwise, the error code is returned to the terminal.

Further, the method for implementing the key security of the multi-network convergence mobile multimedia broadcast system may further have the following features: the parameters in the program stream key encryption request message further include one or a combination of the following: Start sequence number, indicating the program stream key data used for the transfer is used to encrypt the program stream's encryption cycle start sequence number; the absolute time at which the encryption cycle starts; the number of cycles of the encryption duration length, indicating that the program stream key is about to be used for encryption The number of consecutive encryption cycles of the program stream; and the mobile communication system network code for identifying different mobile communication system networks; and/or the parameters in the program stream key encryption response message further include an encryption cycle start sequence number.

Further, the foregoing method for implementing key security of a multi-network convergence mobile multimedia broadcasting system may further have the following features: the identification parameter of the mobile communication system network is a mobile communication system network service platform coding, and represents a specific mobile communication system network service platform. , including mobile communication system network coding, multimedia service platform coding and service key system coding; mobile communication system network coding It is the identifier of the mobile communication system network, which uniquely distinguishes the mobile communication system network; the multimedia service platform code uniquely identifies the mobile communication system network service platform; the service key system code is used to distinguish the service key's service key encryption and decryption program stream key Algorithm.

Further, the method for implementing the key security of the multi-network convergence mobile multimedia broadcast system may also have the following features. In addition to the service key and the service key identifier, the information distributed by the service platform to the terminal in the step (a) includes The program stream key valid sequence number interval; the program stream key obtained by the terminal decryption in step (d) is a time period sequence number, and the terminal first verifies whether the sequence number is within the effective sequence number range of the program stream key, and if so, Then the key is valid; and then the valid program stream key is used to decrypt the program data stream.

Further, the foregoing method for implementing key security of a multi-network convergence mobile multimedia broadcast system may further have the following features. In step (a), the service key has uniqueness of the local network key identifier, and has respective validity periods, and an expiration date. Management is used to guide key updates and validation. A system for realizing key security of a multi-network convergence mobile multimedia broadcasting system, comprising a mobile communication system network, a user terminal, and a broadcast system network, wherein

a mobile communication system network for implementing a mobile multimedia broadcast service platform function, and a mobile network bearer function, interacting with a user terminal, generating, storing, or updating a user key to complete generation, storage, update, and distribution of a service key; and broadcasting The system network interacts to complete the encryption of the program stream key by the service key;

The user terminal is configured to acquire a user key, receive a program stream of the broadcast system network, and encrypt control information, and decrypt the corresponding program stream, and interact with the network of the corresponding type and location of the mobile communication system to complete the authentication of the user key. Store or update the business key;

a broadcast system network for generating, storing, and updating a program stream key, transmitting the program stream key to each mobile communication system network, and storing the received encryption control information; and encrypting the encoded correspondence using the program stream key The program stream is multiplexed with the program stream and the encrypted program stream key information and broadcasted.

Further, the foregoing system for implementing key security of a multi-network convergence mobile multimedia broadcast system may further have the following features: The user terminal further includes the following modules: an initialization module, used in the initial The user key and the home mobile communication system network service platform code are obtained during the process; the user key is used to encrypt the service key and the decrypted service key, and the user key of each user is different; the user authentication module, Used to interact with the mobile communication system network to complete the authentication process of the terminal, and carry the user key index and the self-generated key on the terminal authentication request for network side verification of the mobile communication system; the service key management unit is configured to receive The mobile communication system network service platform stores the current service key, the service key identifier and the program stream key effective sequence number interval distributed by the user who has subscribed the service, and stores or updates; the program stream receiving module is configured to be used according to the current program. The program stream identifier receives the corresponding program stream, including receiving the encrypted program stream key information; and the program stream decryption module selects and uses the program stream encryption control information corresponding to the network from the program stream according to the mobile network service platform code to obtain the corresponding service key. Identification, according to the identification, choose to use the encryption stored on the terminal The service key is decrypted by using the local user key as a parameter to obtain the service key, and then the encrypted service stream key is decrypted by the service key, and the key validity is verified according to the effective serial number interval of the program stream key, and then used. The resulting valid program stream key decrypts the program data stream.

Further, the system for realizing the key security of the multi-network convergence mobile multimedia broadcast system may also have the following characteristics: the service key management unit, if the service is not used, does not store a valid service key locally, and initiates an active request from the corresponding The mobile communication system network obtains the service key of the service; the different mobile communication system network service platform and its terminal self-contained system, the terminal only receives the service key distributed by the contracted mobile communication system network service platform, and has been the corresponding user Key encryption.

Further, the foregoing system for implementing key security of a multi-network convergence mobile multimedia broadcast system may further have the following features: The service platform of the mobile communication system network further includes the following modules: a service center, a key management module, where: a service center, providing The service interface of the user terminal, and the business logic control of the service platform, scheduling and using functional modules in the service platform or other service platforms, including distributing service keys; and a key management module for generating, storing, or updating user keys, The service key is generated according to the valid user key, and the encryption of the program stream key by the service key is completed.

Further, the system for implementing the key security of the multi-network convergence mobile multimedia broadcast system may further have the following features: the key management module further includes: a user key management unit, a service key management unit, a service key distribution unit, and a program a stream key encryption unit, where: a user key management unit, configured to generate a user key, and store or update; when the terminal is initialized from the service platform The Ks is generated, and the user key is generated. When the service platform receives the authentication request including the user key index and the terminal generated key, the service platform finds or generates the Ks according to the index, and then the user of the same user reported by the service platform to the terminal. The key is verified, if the same, the message is notified to the service key management unit, otherwise, the error code is returned to the terminal; the service key management unit is used after the service configuration, if received by the user key management unit. If the user key confirms the information, the user key may be used as a parameter, the service key is encrypted by using a predetermined encryption algorithm, the corresponding service key is generated and stored, and the corresponding relationship with the service key identifier is established, and the service is dense. The key is associated with the program stream identifier by the service identifier, the service key has the uniqueness of the local network key identifier, and has a respective validity period; the service key distribution unit is configured to distribute the service key through the service center, and the service platform is based on the user Subscription relationship, sending the service key encrypted by the user's user key to the user who has subscribed to the service; The active push mode is dominant, or when the terminal receives the request for obtaining the service key, the corresponding service key is found, and is encrypted by the user key and sent to the terminal; the program stream key encryption unit refers to the service platform receiving the broadcast system network. The program stream key sent by the scrambler is encrypted by the corresponding service key, and the encrypted program stream key, the program stream key identifier and other encryption parameters are encapsulated into a program stream key message according to the specified data format, and returned to the program stream key message. Scrambler.

Further, the system for implementing the key security of the multi-network convergence mobile multimedia broadcast system may also have the following features. The broadcast system network includes: a program source coding module, configured to compress and encode each originally accessed audio and video content, and output the same to a scrambler for generating, storing, and updating a program stream key, transmitting the program stream key to each mobile communication system network, and storing the received encryption control information; The key control word encrypts the encoded program stream, and outputs the program stream and the encryption control information to the multiplexing system; the multiplexing system is configured to use the plurality of encrypted program streams and the plurality of mobile communication system networks The encryption control information is multiplexed and output through the broadcast system network.

Further, the foregoing system for implementing key security of a multi-network convergence mobile multimedia broadcast system may further have the following features, the scrambler further includes a program key management module and an encryption machine, wherein the program key management module is used for the program The control key of the stream key, the encrypted control word, the encryption period, and the encryption duration are managed, and the control word is continuously generated, stored, and updated; the program stream key is sent to the service platform through an interface with a plurality of mobile communication system network service platforms. An encryption request carrying a session identifier, a program stream identifier, a program stream key identifier, and program stream key data; and obtained from the service platform The program stream encrypts the control information and stores, including the encrypted program stream key, the service key identifier, and the identification parameter of the mobile communication system network; • obtaining the start and end time information of the corresponding program through an interface with the content broadcast control system , the alignment starts a new encryption cycle, and the program stream key is used as the encrypted encryption cycle range as a basis for synchronizing the program stream key with the service platform; the encryption machine encrypts the encoded code using the encrypted program stream key The program stream multiplexes the encrypted control information of the plurality of networks into the output data stream and outputs the same to the multiplexing system.

Compared with the prior art, in the case where the mobile multimedia broadcast system network is integrated with multiple or multiple mobile communication system network service platforms, a key security method is designed and proposed. The mobile multimedia broadcast system network can integrate multiple or multiple mobile communication system network service platforms with different key management functions, and a program stream of the mobile multimedia broadcast system can simultaneously serve the mobile communication system network service platform, which greatly saves Frequency resources and reduced complexity of the fusion system.

BRIEF abstract

1 is a schematic diagram of a network of a broadcast system and a plurality of mobile communication system networks in an embodiment. 2 is a schematic diagram of a network convergence of a broadcast system network and a mobile communication system in an embodiment. FIG. 3 is a schematic diagram of a service flow of a mobile user terminal in an embodiment.

4 is a sequence diagram of a program stream key encryption process in the embodiment.

Preferred embodiment of the invention

The specific implementation of the present invention will now be described with reference to the accompanying drawings.

1 is a structural diagram of a network convergence of a mobile multimedia broadcast system network and various mobile communication systems, including multiple or multiple mobile communication system networks (MNs) 101, 104, a plurality of user terminals (UEs) 102, 103, and mobile multimedia. The Broadcasting System Network (BN) 105 takes the radio and television mobile multimedia broadcasting system as an example. The mobile communication system networks MN 101 and 104 are used to implement mobile multimedia broadcast service platform functions, as well as mobile network bearer functions. Interact with user terminals to complete business discovery, ordering/returning Subscription, service guide service and management, service information configuration, audit management, authentication, key generation and distribution, billing and statistics, etc.; interact with the broadcast system network 105 to complete encryption of the program key for the service key, program Synchronization of content information, etc.

The user terminals UE 102, 103 include the functions of the mobile phone device and the card, and do not distinguish whether the machine card is integrated or separated. The program stream for receiving the broadcast system network 105 is encrypted, and interacts with the mobile communication system networks 101, 104 of respective types and locations, and further includes the following main modules:

An initialization module, configured to obtain a ks generated user key from the service platform during the initialization process, and obtain a home mobile communication system network service platform code (MNSP_Code); the user key is used to encrypt the service key and decrypt the business secret Key, each user's user key is different.

a user authentication module, configured to interact with the mobile communication system network to complete the authentication process of the terminal, and carry the user key index (user name) and the generated key (password) on the terminal authentication request for the network side of the mobile communication system verification.

a service key management unit, configured to receive a current service key, a service key identifier, and a program stream key valid sequence number interval distributed by the mobile communication system network service platform for the user who has subscribed the service, and store or update; When the service is used, the local service does not store a valid service key, and then initiates an active request to obtain the service key of the service from the corresponding mobile communication system network. Different mobile communication system network service platforms and their terminals are self-contained, and the terminal only receives information such as service keys distributed by the contracted mobile communication system network service platform, and has been encrypted by the corresponding user key.

And a program stream receiving module, configured to receive, according to a Stream_ID of the current program, a corresponding program stream, including information that can receive the encrypted program stream key.

The program stream decryption module selects and uses the program stream encryption control information corresponding to the network from the program stream according to the MNSP_Code, obtains a corresponding service key identifier SK_ID, and selects the encrypted service key stored on the terminal according to the identifier. Decrypting the parameter with the local user key to obtain the service key, and then decrypting the encrypted program stream key (CW) with the service key, verifying the validity of the key, and obtaining a valid program stream key for decryption. Program data stream. The program stream key ID value is a time period sequence number, and if the sequence number is within the program stream key valid sequence number interval range, the key is valid. In addition, the terminal further includes a client providing a mobile multimedia broadcast service application; a service discovery module, configured to acquire and display information of an electronic program guide (ESG); a service ordering and unsubscribing module; a program selection module, configured for the user to select The program to be watched, and the Stream_ID of the current program is obtained according to the program information; and a plurality of function modules for demultiplexing, decoding the program stream, multimedia presentation, authentication, and billing.

The Broadcast System Network (BN) 105 is mainly used for program stream encoding, encryption, multiplexing, and broadcasting, and the BN and MN have a content information synchronization interface and a program stream encryption interface.

2 is a schematic diagram of a network of a broadcast system and a network of one of the mobile communication systems, illustrating a more detailed description of the service platform function modules of the mobile communication system network and the functional modules of the broadcast system network.

a user terminal 201, an application client having a mobile multimedia broadcast system;

The mobile network 202, that is, the PDSN network element of the CDMA lx or CDMA2000 type network, or the GSM/GPRS or WCDMA type network GGSN network element, provides an important functional system of the packet domain core network that interfaces with the service platform;

The WAP gateway system 203 is a proxy for the HTTP interaction between the mobile user terminal and the service platform in the service network. Not a mandatory device, especially for CDMAlx or CDMA2000 type networks;

The service platform of the mobile communication system network further includes the following modules: a service center 204, a key management module 205, an ESG service module 206, and a service management module 207, wherein:

The service center 204 provides a service interface with the user terminal, and implements business logic control of the service platform, and schedules and uses functional modules in the service platform or other service platforms to implement, for example, order/unsubscribe services, distribute service keys, and service billing. Other functions;

The key management module 205 is configured to support a management function of the user key, the service key, and the program stream key, and further includes: a user key management unit, a service key management unit, a service key distribution unit, and a program stream key. The encryption unit, where: the user key management unit is configured to find or generate Ks based on the authentication tuple obtained from the HLR, and then generate a user key according to the Ks, and store or update. Business platform When receiving the authentication request of the terminal including the user key index and the terminal generation key, the user key of the same user reported by the terminal is verified, and if the same, the message is notified to the service key management unit, otherwise, an error is returned. The code is given to the terminal.

a service key management unit, configured to: after receiving the user key confirmation information sent by the user key management unit, configure the user key as a parameter, and encrypt the service key by using a predetermined encryption algorithm to generate And storing the corresponding encrypted service key, and establishing a one-to-one correspondence with the service key identifier, the service key is associated with the program stream identifier by the service identifier, and the service key has the uniqueness of the local network key identifier, and Have their own validity period. The module also manages validity periods to guide key updates and validity verification. For monthly-type businesses, the business key is updated periodically every month.

The service key distribution unit is configured to distribute the service key through the service center, and the service platform should be able to send the service key and the service key encrypted by the user key of the user to the user who has subscribed the service according to the subscription relationship of the user. The identifier and its program stream key valid sequence number interval. The network active push mode is mainly used, and when the terminal obtains the service key request, the corresponding service key is found, and the user key is encrypted and the service key identifier and the program stream key valid serial number interval are obtained. Send it to the terminal together.

The program stream key encryption unit means that the service platform can receive the program stream key sent by the broadcast system network scrambler, and after encrypting with the corresponding service key, encrypt the encrypted program stream key, the program stream key identifier and other encryption. The parameters are encapsulated into program stream key messages in the specified data format and returned to the scrambler.

Each mobile communication system network MN's service platform has an irrelevant broadcast/multicast service platform key management system according to its own needs, and even uses different encryption methods.

The ESG service module 206 has an interface with a broadcast system network, receives service information sent by the radio and television mobile TV system, provides a channel and content information function submitted by the administrator, and generates a service guide; according to the user request, through the mobile communication system network Send the generated service guide to the user terminal;

The service management module 207 processes the subscription or unsubscribe request of the user, stores and maintains the user subscription relationship, and manages the information management function of the service provided by the network of the broadcast system, provides the function of administrator approval, configures the service, and configures the service. After completion, notify the business key management unit Corresponding to the business key;

Other network elements 213, such as BOSS and other systems, for GSM/GPRS or WCDMA type networks, as well as BSF, HLR/HSS and other systems.

The broadcast system network includes -.

The multiplexing system 208 is configured to multiplex the plurality of encrypted program streams and the encryption control information of the plurality of mobile communication system networks, and output the network through the broadcast system;

The scrambler further includes:

The program key management module 210 is configured to manage the control word (CW) of the program stream key, the encrypted CW, the encryption period CP, the encryption duration, and the like, and continuously generate, store, and update the CW. Sending CW and other information to the service platform through an interface with a plurality of mobile communication system network service platforms, and obtaining program stream encryption control information (ECM) such as encrypted CW (ie, scrambled CW) from the service platform, and providing the encryption machine to the encryption machine 209; and, through the interface with the content broadcast control system, obtain information such as the start and end time of the corresponding program, align the start of the new CP, and use the CW as the encrypted CP range as the program stream key with the service platform. The basis for synchronization.

The encrypting machine 209, uses CW to encrypt the encoded program stream, multiplexes the encrypted control information of the plurality of networks into the output data stream, and synchronously outputs the same to the multiplexing system;

a program source coding module 211, configured to compress and encode each originally accessed audio and video content, and output the device to the device;

The content broadcast control management module 212 is configured to program the program stream to generate program units that do not overlap in each time period; and further have an interface with the scrambler and the mobile communication system network service platform, and the mobile communication system network service platform synchronizes the program content. Information that does not contain the program stream data itself;

Figure 3 is a schematic diagram of the user terminal service usage process, including the following steps:

Step 301: The user starts the client of the mobile multimedia broadcast system on the terminal, and the client program starts to work. Step 302: comprehensively determine whether the ESG needs to be taken, and if yes, perform step 303, otherwise, Perform step 304;

The judgment includes: Whether to re-acquire the ESG every time you turn it on, whether there is an ESG locally, and whether the local ESG is out of date or not up to date.

Step 303, interacting with the service platform by means of HTTP, etc., to obtain ESG data; when encountering an interrupt, you can transfer 312, ask whether to exit the process, and if it exits, end; otherwise, continue the process, after the process is completed, execute step 304; The situation includes a failure occurring more than a specified number of times during reception, a user interrupt operation, and the like.

Step 304: According to the ESG displayed by the client, the user views current and future services, and selects to watch a valid television program;

Users can choose to use the business. For the current ongoing program, you can order and watch immediately; for future business, you can order it first and watch it later.

Step 305, it is determined whether the user needs to order first, if yes, go to step 306, otherwise, go to step 307;

Step 306: The user performs service subscription, and the terminal interacts with the network service platform of the mobile communication system to complete the service subscription process.

When encountering an interrupt, you can go to 312, ask whether to exit the process, if you exit, end; otherwise, continue the process, after the process is completed, go to step 307;

Step 307: The terminal identifies the service by using the service identifier Service_ID according to the current service selected by the user, demultiplexing and receiving the corresponding encrypted program stream, and receiving the encrypted program stream key information of the program stream, the Service_ID and the The program stream identifier Stream_ID corresponds to;

Step 308, the terminal according to the service key identifier SK_ID in the ECM information, determine whether the corresponding valid service key has been stored on the terminal, if yes, go to step 310, otherwise, go to step 309;

Step 309: The terminal actively initiates a service key request to the network service platform of the mobile communication system, and carries the service key identifier in the request, and after receiving the service, the service platform finds the corresponding service key according to the service key identifier. Encrypted with the user key of the terminal and returned to the terminal;

When an interrupt is encountered, the step can be turned 312, asking whether to exit the process, if the exit, the end; otherwise, continue the process, after the process is completed, execute step 310; Step 310: The terminal decrypts a single encrypted program stream by using the ECM.

The process is as follows: The terminal obtains multiple network ECMs from the program stream, and selects to use the ECM according to the MNSP_Code information stored in the terminal. According to the service key identifier in the ECM, the encrypted service key stored by the terminal is selected, and after the terminal decrypts the user key using the user key, the obtained service key and the corresponding decryption algorithm are used to decrypt the encrypted program in the ECM. The stream key is judged to be valid, and if valid, the obtained program stream key is used to decrypt the program stream data.

When an interrupt is encountered, you can go to 312 and ask if you want to exit the process. If you exit, the process ends. Otherwise, continue the process. After the process is complete, go to step 311.

Step 311: Decode and play back the decrypted program stream data, and perform step 313. When an interrupt is encountered, it may turn to 312 to ask whether to exit the process, and if it exits, end; otherwise, continue the process, and then execute after the process is completed. Step 313;

Step 313, exit the client. Usually due to user operation exit.

4 is a schematic diagram of a program stream key encryption process, including the following steps:

Step 401: The program key management module 210 of the broadcast system network continuously generates, stores, and updates the CW according to the management rule, and manages the encryption use period thereof.

Step 402, the program key management module 210 sends a program stream key encryption request message to the service platform key management module 205 of the plurality of mobile communication system networks according to the configured rules, and the request message carries the message. The parameters include a session identifier Session_ID, a program stream identifier Stream ID, a control word identifier CW_ID, and control word data CW_Data;

Step 403: The key management module 205 of each mobile communication system network receives the encryption request of the program key management module 210, finds a corresponding service key according to the input parameter Stream_ID matching, and uses the service key as a parameter to encrypt the control word data. And generate a certain format of ECM, the format of the ECM is detailed below;

Step 404, the key management module 205 of each mobile communication system network sends a program stream key encryption response message to the program key management module 210, using the same Session_ID and Stream_ID as the request, and carrying the generated ECM;

Step 405, the program key management module 210 stores the encryption returned by each mobile communication system network. After the ECM;

Step 406, the program key management module 210 sends the ECM of the plurality of networks to the encryptor 209 before using the ECM;

Step 407: After receiving the ECM, the encryptor 209 returns a response to the program key management module.

In addition, the service platform should be able to send the service key, the service key identifier, and the program stream key valid sequence number range encrypted by the user's user key to the user who has subscribed to the service according to the user's subscription relationship. The network active push mode is mainly used, and when the terminal obtains the service key request, the corresponding service key is found, and the user key is used as the parameter encryption, and the service key identifier and the program stream key are valid. The serial number interval is sent to the terminal together.

In the broadcast system network, after the encoding of the broadcast program stream data is completed, the program stream key of the program is used to encrypt the encoded program stream, and the encrypted program stream and the encrypted program stream key information are synchronously output to the multiplexing system. Broadcast after multiplexing. The encrypted program stream key information contains an identification of each program stream and its ECM in each mobile communication system network.

The program stream key encryption request message data parameters in the above process include:

Session ID Session_ID, used to connect the session key management module 210 and the key management 205 session, and uniquely identify the identifier of a session message;

The program stream identifier Stream_ID is an identifier used by the program key management module 210 and the service platform to uniquely identify a program stream. The encryption period start sequence number CP_Index indicates the CW data transmitted at the time, and the CP used to encrypt the program stream. Start sequence number; the absolute time CP-Timestamp at the beginning of the encryption cycle, corresponding to the CP-Index, which is optional;

The number of periods of the encryption duration length CP— Duration, used to indicate the number of persistent CPs (duration) that the CW is about to be used to encrypt the program stream;

Control word (program stream key) identifies CW_ID; Control word (program stream key) data CW_Data, used to indicate the original C data before the CW is encrypted by the service key;

Mobile communication system network coding BN-Code, used to identify different mobile multimedia broadcasting systems, reserved for expansion, this parameter is optional.

The above parameters are used as request message parameters, and their order is not limited, and there may be other supplementary parameters. Among them, Session_ID, Stream_ID, CW-ID, and CW-Data are important parameters that are indispensable.

The data parameters in the program stream key encryption response message in the above process include:

The session identifier Session_ID, the session connecting the program key management module 210 and the key management 205, uniquely identifies the identifier of a session message, the parameter matches the session identification parameter of the request message; the program stream identifier Stream_ID is the program key The management module 210 and the service platform are used to uniquely identify an identifier of a program stream, and the parameter matches the program stream identification parameter of the request message;

The encryption cycle start sequence number CP_Index, indicating the CW data transmitted this time, will be used to encrypt the CP start sequence number of the program stream;

The composition information of the ECM: the encrypted control word CW-Edata, that is, the encrypted program stream key; the service key identifier SKJD; the mobile communication system network service platform code MNSP_Code.

The mobile communication system network service platform code MNSP-Code in ECM represents a certain service network of a specific network, including MN coded MNC, multimedia service platform coded MSP and service key system code. The MNC is the identifier of the mobile communication system network, which uniquely distinguishes the mobile communication system network; the MSP code uniquely identifies a mobile communication system network service platform; the service key system service platform code is used to distinguish the service platform's service key encryption and decryption program The algorithm of the stream key can be ignored using the default algorithm.

The above parameters are not limited to their order, and there may be other supplementary parameters. Encryption cycle start sequence number CP_Index is optional.

The following table is the syntax structure of the encrypted program stream key information broadcast simultaneously with the program stream data: Parameter number syntax parameter description

701 Stream— Count number of program streams

For(i=0; i<N; i++)

{

702 Stream—ID program stream identifier

703 MNSP— Count Number of mobile service system network service platforms for(i=0; i<M; i++)

{

704 CW_EData Encrypted Control Word (Program Stream Key)

705 SK—ID Service Key Identifier

706 MNSP— Code Mobile Communication System Network Service Platform Coding

}

It can be seen that the parameters included in the structure are: number of program streams 701, for each program stream, including the following information: program stream identification 702, number of mobile communication system network service platforms 703, and ECM for each mobile communication system network. The syntax structure of parameters 701-706 represents a method for encrypting a program stream key by using a plurality of different mobile network operator service keys in a mobile program stream in an encrypted program stream to implement key security. In order for the broadcaster to control the program stream key, each mobile operator controls and manages its own service key. While ensuring security and confidentiality, it also facilitates the application of the business.

Industrial Applicability The present invention provides a method for implementing key security of a multi-network convergence mobile multimedia broadcast system, so that the mobile multimedia broadcast system network can integrate multiple or multiple mobile communication system network service platforms with different key management functions. , a program stream of the mobile multimedia broadcasting system can At the same time serving these mobile communication system network service platforms, it greatly saves spectrum resources and reduces the complexity of the converged system. Therefore, it has industrial applicability.

Claims

Claim

A method for realizing key security of a multi-network convergence mobile multimedia broadcasting system, which is applied to a system in which a broadcast system network and a plurality of mobile communication system networks are fused, the broadcast system network has a scrambler, and the mobile communication system network There is a business platform, and the method includes the following steps:

(a) The scrambler of the broadcast system network generates, stores and updates the program stream key according to the set rule, and the service platform of each mobile communication system network generates, stores and updates the service key according to the set rule, and the service key corresponds to Unique service key identifier, each mobile communication system network separately distributes the service key and its identifier to the user terminal that subscribes to the corresponding service;

(c) scrambling of the broadcast system network # encrypts the encoded corresponding program stream using the program stream key, and outputs the program stream and the encryption section I) stream key information together, and multiplexes and broadcasts the encrypted program. The stream key information includes each program stream identifier and its encryption control information in each mobile communication system network;

U) after the user terminal selects the program, receives the corresponding program stream and its encryption control information, finds the corresponding service key identifier according to the identifier of the network of the mobile communication system, and determines the local service key to be used, and the service key is The parameter decrypts the encrypted program stream key, and then decrypts the program stream data using the obtained program stream key.

2. The method for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 1, wherein:

In the step (a), the user terminal generates a user key and reports the service platform when the authentication is performed. The service platform generates a user key for the user who subscribes to the service according to the same rule, and verifies the user key reported by the user terminal. Whether it is consistent, if yes, encrypt the service key with the user key as a parameter, and then send the encrypted service key and its identifier to the user terminal for storage; in step (d), the user terminal determines that it should be used. After the business key, find the storage first. The encrypted service key is decrypted by using the local user key as a parameter to obtain a service key, and the encrypted program stream key is decrypted by the service key.

3. The method for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 1, wherein:

Step (b) is further divided into the following steps:

(bl) the scrambler of the broadcast system network sends a program stream key encryption request to the service platform of the plurality of mobile communication system networks according to the configured management rule, carrying the session identifier, the program stream identifier, and the program stream Key identification and program stream key data;

(b2) after receiving the encryption request, the service platform of each mobile communication system network finds the corresponding service key according to the program stream identifier matching, uses the service key as a parameter, encrypts the control word data, and generates an encryption control of the program stream. Information

(b3) each mobile communication system network service platform sends a program stream key encryption response message to the scrambler, using the same session identifier and program stream identifier as the request, and carrying the generated encryption control information, including the encrypted program stream. Key, service key identification, and identification parameters of the mobile communication system network;

(b4) The service platform stores an encrypted control letter of the program stream returned by each mobile communication system network

4. The method for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 1, wherein: step (d) is further divided into the following steps:

( dl ) the user activates the client of the mobile multimedia broadcast system on the terminal, and the client program starts working;

(d2) if the client needs to obtain an electronic service guide, the client interacts with the service platform to obtain and display the electronic service guide data, and if not, directly display;

(d3) the user selects to watch an effective television program according to the electronic service guide displayed by the client, and if the program needs to be ordered, interacts with the service platform to complete the service ordering process;

(d4) the terminal according to the current service selected by the user, demultiplexing and receiving the corresponding encrypted program stream according to the service identifier, and receiving the encrypted program stream key information; (d5) the terminal obtains the encryption control information of the plurality of networks from the encrypted program stream key information, and selects the encryption control information of the network of the mobile communication system according to the identification parameter of the mobile communication system network stored by the terminal;

(d6) The terminal determines, according to the service key identifier in the encryption control information, whether the terminal has stored a corresponding valid service key, and if not, initiates a service key request to the mobile communication system network service platform, and acquires a user who uses the terminal. The service key of the program stream after the key is encrypted, and if yes, performing the next step;

5. The method for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 2, wherein:

The terminal acquires the Ks from the service platform during the initialization process, generates a user key, and obtains an identification parameter of the mobile communication system network to which the user key belongs. When the user authenticates, the terminal authentication request carries the user key index and the self-generated The key, the mobile communication system network service platform finds or generates Ks based on the authentication multi-group obtained by the HLR, and then generates a user key according to the Ks, and the service platform performs the user key of the same user reported by the local and the terminal. Verification, if the same, the user key is used as a parameter, and the service key of the service subscribed by the user is encrypted by a prescribed encryption algorithm. Otherwise, an error code is returned to the terminal.

6. The method for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 3, wherein:

The parameter in the program stream key encryption request message further includes one or a combination of the following: an encryption period start sequence number, indicating that the program stream key data transmitted at the time is used to encrypt the program stream. The absolute time at which the encryption cycle begins; the number of cycles of the encryption duration length, indicating the number of consecutive encryption cycles that the program stream key is about to be used to encrypt the program stream; and the mobile communication system network code used to identify different mobile communication systems Network; and/or

The parameter in the program stream key encryption response message further includes an encryption period start sequence number.

7. The method for realizing key security of a multi-network convergence mobile multimedia broadcasting system according to claim 1. Law, which is characterized by:

The identification parameter of the mobile communication system network is a mobile communication system network service platform code, which represents a specific mobile communication system network service platform, including a mobile communication system network coding, a multimedia service platform coding, and a service key system coding; a mobile communication system network The code is the identifier of the mobile communication system network, which uniquely distinguishes the mobile communication system network; the multimedia service platform code uniquely identifies the mobile communication system network service platform; the service key system code is used to distinguish the service key from the service platform to encrypt and decrypt the program stream The algorithm of the key.

8. The method for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 1, wherein:

The information distributed by the service platform to the terminal in step (a) includes, in addition to the service key and the service key identifier, an effective sequence number interval of the program stream key;

The program stream key obtained by the terminal decryption in step (d) is a time period sequence number, and the terminal first verifies whether the sequence number is within the range of the program stream key valid sequence number range, and if so, the key is valid; The program stream key is then used to decrypt the program data stream.

9. The method for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 1, wherein:

In the step (a), the service key has the uniqueness of the local network key identifier, and has respective valid periods, and the validity period management is used to guide the key update and the validity verification.

10. A system for realizing key security of a multi-network convergence mobile multimedia broadcast system, comprising a mobile communication system network, a user terminal, and a broadcast system network, wherein

The user terminal is configured to acquire a user key, receive a program stream of the broadcast system network, and encrypt control information, and decrypt the corresponding program stream, and interact with the network of the mobile communication system of the corresponding type and location to complete the authentication of the user key. Store or update the business key;

Broadcast system network, used to generate, store and update program stream keys, send program stream keys Go to each mobile communication system network, and store the received encryption control information; encrypt the encoded corresponding program stream by using the program stream key, and multiplex the program stream and the encrypted program stream key information, and then broadcast and transmit.

11. The system for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 10, wherein:

The user terminal further includes the following modules:

An initialization module, configured to obtain a user key and a home mobile communication system network service platform code during the initialization process; the user key is used to encrypt the service key and the decrypted service key, and each user's user key is not the same;

a user authentication module, configured to perform a terminal authentication process with the mobile communication system network, and carry a user key index and a self-generated key on the terminal authentication request for verification by the network side of the mobile communication system;

a service key management unit, configured to receive, by the mobile communication system network service platform, a current service key, a service key identifier, and a program stream key effective sequence number distributed by the user of the subscribed service, for storage or update;

a program stream receiving module, configured to receive, according to a program stream identifier of the current program, a corresponding program stream, including receiving encrypted program stream key information;

The program stream decryption module selects and uses the program stream encryption control information corresponding to the network from the program stream according to the mobile network service platform code, obtains a corresponding service key identifier, and selects an encrypted service key stored on the terminal according to the identifier, The local user key is used to decrypt the parameter to obtain the service key, and then the encrypted service stream key is decrypted by the service key, and the validity of the key is verified according to the effective serial number interval of the program stream key, and the obtained effective program is used again. The stream key decrypts the program data stream.

12. The system for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 11, wherein:

The service key management unit, if the service is started to be used, does not store a valid service key locally, and initiates an active request to obtain a service key of the service from the corresponding mobile communication system network; the network service platform of different mobile communication systems and the terminal thereof In the system, the terminal only receives the service key distributed by the contracted mobile communication system network service platform, and has been encrypted by the corresponding user key.

13. The system for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 10, wherein:

The service platform of the mobile communication system network further includes the following modules: a service center, a key management module, where:

a service center, providing a service interface with the user terminal, and implementing business logic control of the service platform, scheduling and using functional modules within the service platform or other service platforms, including distributing service keys; and a key management module for generating, storing, or The user key is updated, and the service key is generated according to the valid user key, and the encryption of the program stream key by the service key is completed.

14. The system for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 13, wherein:

The key management module further includes: a user key management unit, a service key management unit, a service key distribution unit, and a program stream key encryption unit, where:

a user key management unit, configured to generate a user key, and store or update; when the terminal initializes, the Ks is obtained from the service platform, and the user key is generated, and the service platform receives the user key index and the terminal generated key of the terminal. When the authentication request is performed, the Ks is found or generated according to the index, and then the service platform verifies the user key of the same user reported by the terminal. If the same, the message is notified to the service key management unit. Otherwise, the error code is returned. Terminal

a service key management unit, configured to: after receiving the user key confirmation information sent by the user key management unit, configure the user key as a parameter, and encrypt the service key by using a predetermined encryption algorithm to generate And storing a corresponding service key, and establishing a corresponding relationship with the service key identifier, the service key is associated with the program stream identifier by using the service identifier, and the service key has uniqueness of the local network key identifier, and has respective Validity period

The service key distribution unit is configured to distribute the service key through the service center, and the service platform sends the service key encrypted by the user key of the user to the user who has subscribed the service according to the subscription relationship of the user; Mainly, or when receiving the request for obtaining the service key from the terminal, the corresponding service key is found, encrypted by the user key, and then sent to the terminal;

The program stream key encryption unit refers to the service platform receiving the program stream key sent by the broadcast system network scrambler, and encrypting the encrypted program stream key and the program stream key after encrypting with the corresponding service key. And other encryption parameters are encapsulated into a program stream key message according to the specified data format, and returned to the scrambler.

15. The system for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 10, wherein:

The broadcast system network includes:

a program source encoding module, configured to compress and encode each originally accessed audio and video content, and output the same to the scrambler;

a scrambler for generating, storing, and updating a program stream key, transmitting the program stream key to each mobile communication system network, and storing the received encryption control information; and encrypting the encrypted program stream key control word An encoded program stream, and outputting the program stream and the encryption control information to a multiplexing system;

The multiplexing system is configured to multiplex a plurality of encrypted program streams and their encryption control information in a plurality of mobile communication system networks, and output them through a broadcast system network.

16. The system for implementing key security of a multi-network convergence mobile multimedia broadcast system according to claim 15, wherein:

The scrambler further includes a program key management module and an encryption machine,

a program key management module, configured to manage a control word of the program stream key, an encrypted control word, an encryption period, and an encryption duration, continuously generate, store, and update a control word; and communicate with a plurality of mobile communication system network service platforms The interface sends a program stream key encryption request to the service platform, and carries a session identifier, a program stream identifier, a program stream key identifier, and program stream key data; and obtains program stream encryption control information from the service platform and stores the information, including the encrypted Program stream key, service key identifier and identification parameter of the mobile communication system network; obtaining the start and end time information of the corresponding program through the interface with the content broadcast control system, aligning to start a new encryption period, and program streaming The key is used as the encryption encryption period range, as the basis for synchronizing with the program stream key of the service platform;

The encryption machine encrypts the encoded program stream using the encrypted program stream key, multiplexes the encrypted control information of the plurality of networks into the output data stream, and outputs the encoded data stream to the multiplexing system.