WO2016189105A1

WO2016189105A1 - Management of broadcast encrypted digital multimedia data receivers

Info

Publication number: WO2016189105A1
Application number: PCT/EP2016/061942
Authority: WO
Inventors: Pierre Sarda; Pascal Junod
Original assignee: Nagravision SA
Current assignee: Nagravision SARL
Priority date: 2015-05-28
Filing date: 2016-05-26
Publication date: 2016-12-01
Anticipated expiration: 2017-11-28

Abstract

The disclosed method and server of a head-end managing at least one receiver take advantages of a unidirectional transmission link and a bidirectional transmission link. The unidirectional transmission is used by the head-end for transmitting to one or more receivers, streams comprising encrypted multimedia content data and conditional access data associated to the encrypted multimedia content data. In order to synchronize the receivers with the head-end at given time-periods, the head-end is configured to manage receivers that have been revoked or unreachable during a certain time. The method thus uses a hybrid broadcast encryption scheme consisting of using a stateless cryptographic attribute-based broadcast encryption scheme configured to exploit the available bidirectional transmission link between the head-end and the receivers in a very efficient way. Revoked receivers recover a non- revoked state involving synchronization with the head-end.

Description

MANAGEMENT OF BROADCAST ENCRYPTED DIGITAL MULTIMEDIA DATA

RECEIVERS

Technical field The present disclosure relates to encrypted digital multimedia data broadcasting technology using a conventional broadcast channel combined with a broadband bidirectional channel for distributing scrambled multimedia content to user's receivers in a secure way.

Technical background Traditional conditional access systems (CAS) deployed over a broadcast channel typically rely on a hardware security module, such as a smartcard or a secure chip, associated with a user's receiver to enforce access rights. In such systems the media-encrypting key, usually named control word (CW), is sent by a managing center or head-end in a global entitlement control message (ECM) to every receiver; this entitlement control message is itself encrypted with a global key shared by all receivers. Conditional access rights are further sent by the head-end through individual entitlement management messages (EMMs) to the security modules. Based on this information, the security module decides whether or not it can send the control word recovered from the ECM control message to a descrambler associated with the receiver.

It is however important to understand that the control word is present in (or can be computed by) the security module, i.e., on the receiver side, and the whole security of the conditional access system depends on the capability of the security module to keep the control word secret in case the receiver access rights are not sufficient. In other words, if one is able to hack the security module by extracting the control word, or by modifying the rights database stored in its memory, the conditional access system becomes insecure.

Cryptographic broadcast encryption can be realized through a family of cryptographic algorithms configured to secure a broadcast channel, notably by allowing the revocation of individual receivers. Thanks to these cryptographic algorithms, receivers which are not allowed to get the control word, or which are outside the system, do not have enough information to reconstruct or to decrypt the control word. In other words, the conditional access equation is defined and enforced on the headend side, instead of being defined in the head-end and enforced in the security module of the receiver. As the media is not directly encrypted by the broadcast encryption scheme, which instead encrypts a media-encrypting key, most of conventional or broadcast encryption based systems suffer from the control word- sharing problem. In other words, if the control word can be obtained from a receiver having sufficient access rights, then it can be shared on the Internet. To thwart this issue, a secure channel becomes mandatory between the conditional access system part and the descrambler, which should be confined in a secure chip.

Broadcast encryption aims at sending a ciphertext to a set of privileged receivers, named non-revoked receivers, using a broadcast channel. Each receiver possesses a set of individual decryption keys, and as long as it does not belong to the set of revoked receivers, it can recover the plaintext. Receivers in the revoked set or system outsiders are not able to decrypt any ciphertext. When using a broadcast channel, one assumes that the receivers are stateless; in other words, no synchronization between the broadcaster and the receivers can be assumed, and all the information required for decrypting the ciphertexts (besides the individual private keys that are stored on each receiver) has to be transmitted in the ciphertext. In particular, this lack of synchronism means that for a typical Pay-TV scenario, the set of revoked receivers tends to increase in a monotonic fashion. This is a consequence of the fact that when a user sees his access rights change (e.g., because of a subscription change towards a less expensive subscription), the head-end is usually forced to revoke it before assigning it new key material; otherwise, the user could continue using the key material associated with his previous subscription and this would violate the CAS security. In addition, in most broadcast encryption schemes, it is necessary to transmit a description of the set or a list of revoked receivers leading to an increasing length of the ciphertext. As this description cannot be removed or reduced, the broadcast encryption scheme progressively becomes impractical, because of its ever-increasing size of the list of revoked receivers that leads to increasing bandwidth consumption. In a fully connected world, as for example in the case where the receivers are connected to the head-end via a bidirectional communication network rendering possible a complete synchronization between the head-end and the receivers, several cryptographic schemes have been proposed to setup a group key, such as the Logical Key Hierarchy scheme, for instance. However, the costs of the communication between the head-end and the receivers can also quickly become overwhelming, in particular for systems involving tens or hundreds of millions of receivers, or when the media-encrypting key must change every 10 seconds and the access rights have to be instantly enforced, for example. Document WO2013/027206A1 discloses a method for broadcast encryption that allows a broadcaster to send encrypted data to a set of users such that only a subset of authorized users can decrypt the data. The method supports permanent revocation of users and comprises the following modifications to the four stages of the basic Cipher-text Policy Attribute-Based Encryption techniques: a) In the setup stage: a random control component is added by the broadcaster to the master key; b) In the key generation stage: the broadcaster sends to each user a private key that includes the attributes of the user and a component that includes the state of the user, wherein the state of the user is a function of the random control component; c) In the encryption stage: the broadcaster constructs a ciphertext by use of an algorithm that includes a global secret key, wherein the global secret key is encrypted by the private keys of the subset of authorized users; and d) in the decryption stage: the broadcaster sends the ciphertext which encrypts the global secret key to the authorized users, whereupon only users in the subset of authorized users are able to decrypt and use the global secret key.

If one or more users are admitted to or revoked from the subset of authorized users, thereby forming a new subset of authorized users the method proceeds as follows: b) Changing the master key and the state of each user and their private keys; thereby, c) Changing the global secret key to a new global secret key, which is encrypted by the private keys of the new subset of authorized users; thereby, d) Only allowing users in the new subset of authorized users to decrypt ciphertext that has been encrypted by the broadcaster using an algorithm that includes the new global secret key; and therefore, e) Only allowing users in the new subset of authorized users to use the new global secret key.

The method of document WO2013/027206A1 solves the problem of ever-increasing size of the revocation lists by changing the master key and the global secret key for recovering authorization of the receivers to decrypt ciphertext encrypted by the broadcaster. Therefore, there is still a need for an improved solution for preventing ever-increasing size of revocation lists without renewing the keys of the receivers.

Summary

According to one embodiment, a method, according to claim 1 , is proposed for managing at least one receiver by a head-end.

A head-end manages at least one receiver configured to process broadcast encrypted digital multimedia data by using an Attribute-Based Broadcast Encryption scheme, called hereafter ABBE scheme. An ABBE scheme is a special type of broadcast encryption scheme that supports attributes, i.e., cryptographic elements that can be distributed in an individualized form to receivers sharing the same properties, such as a right to access a certain TV channel, a certain package of TV channels, or having the same geographical location, for example. The ciphertexts can then grant the right to be decrypted to receivers satisfying a certain combination of attributes only, by enforcing an access equation that is frequently expressed as a Boolean equation defined over the set of attributes. Hence, an ABBE scheme allows addressing large sets of receivers having attributes compatible with the access equation in a very efficient way. In addition, an ABBE scheme allows revoking individual receivers in an efficient way.

The at least one receiver is connected to the head-end on the one hand via a broadcast channel unidirectionally transmitting streams of digital data comprising encrypted multimedia content data, control messages such as entitlement control messages ECM, and on the other hand via a secure broadband bidirectional channel, transmitting further control messages for managing the receiver. In practice, the head-end manages a set comprising more than one receiver. The set may include receivers having a non-revoked state and a revoked state.

The broadcast channel is to be understood as a unidirectional data streams transmission link from a source to at least one receiver as provided for example by a satellite, a terrestrial broadcast emitter, cable, a wired or wireless network performing streaming by using for example IP (Internet Protocol) multicast.

The secure broadband bidirectional channel is to be understood as a bidirectional data streams transmission link from a source to a receiver and vice-versa provided preferably through a TCP/IP network. The security (i.e., confidentiality, authenticity and integrity) of that broadband bidirectional channel can be ensured for example thanks to the TLS (Transport Layer Security) protocol.

According to the method, the head-end generates at least one synchronization element and at least one media-encrypting key element, the at least one synchronization element is configured to synchronize each receiver of a set of receivers with the head-end at predefined time periods.

The head-end transmits periodically to each receiver of the set, via the broadcast channel, at least one synchronization cryptogram comprising, for a current time- period, the at least one synchronization element encrypted with the encrypting key of the ABBE scheme. It further transmits at least one time cryptogram comprising a current media-encrypting key element encrypted with the encrypting key of the ABBE scheme.

A non-revoked receiver of the set decrypts the synchronization cryptogram received via the broadcast channel and determines the at least one synchronization element. The receiver also receives the at least one time cryptogram and determines the current media-encrypting key element, provided it has sufficient access rights. An operation of combining the at least one synchronization element and the at least one media-encrypting key element is performed by the receiver in order to obtain a final media-encrypting key. This final media-encrypting key is then used for decrypting the encrypted multimedia content data at the current time-period, the receiver thus being synchronized with the head-end. If the receiver losses synchronization with the head-end at the current time period, it requests, at the head-end via a secure broadband bidirectional channel, a new synchronization element by transmitting at least an identifier to the head-end. In response to the request, the head-end transmits, via the broadband bidirectional channel, the new synchronization element comprising the preceding synchronization element combined with an updated synchronization element. The new synchronization element, the preceding synchronization element and the updated synchronization element are cryptographically chained together in a sequential way.

The receiver detects a synchronization loss when temporal data in the synchronization element do not correspond to the current time period, for example, when the current date is different from the date of the synchronization element. This time shift may occur for example when the synchronization cryptogram is not received at a given time because of a defective or noisy broadcast channel, or during a zapping operation or because the receiver was switched off for a certain time. If the receiver is temporally revoked, for instance because of a subscription change, it obtains via the secure broadband bidirectional channel, after the head-end has verified the access rights with the identifier, a new identifier, new decryption key material and an updated synchronization element in order to recover a non-revoked state and the synchronization with the head-end. The identifier of the previously revoked receiver is deleted from the list of revoked receivers comprised in the updated synchronization element.

According to a preferred embodiment, the at least one synchronization cryptogram is transmitted by the head-end in form of a first entitlement control message at first crypto-periods and the at least one time cryptogram in form of a second entitlement control message at second crypto-periods. The first crypto-period typically has duration greater than the duration of the second crypto-period as for example one day for the first crypto-period and 30 seconds for the second one. The final media- encrypting key thus changes at periods corresponding to the second crypto-period, i.e. every 30 seconds according to the example. The method of the present disclosure takes advantages of both the broadcast channel and the broadband bidirectional channel. The broadcast channel is used for transmitting to a set of receivers, streams comprising encrypted multimedia content data and control messages associated with the encrypted multimedia content data. The broadband bidirectional channel is used for managing receivers that have lost synchronization because they were out of service during a certain time, either because the streams were unreachable (e.g., in case of a storm), or because the receiver was off, or because the receiver was temporally revoked due to a subscription change for example and thus needs a new identifier and corresponding new decryption key material.

The method thus involves a hybrid broadcast encryption scheme consisting of using a stateless cryptographic ABBE scheme configured to exploit the available broadband bidirectional channel linking the head-end to each receiver in a very efficient way to recover receivers from an unsynchronized state to a synchronized state. The following advantages may be achieved:

- The broadcast channel is used for transmitting media streams and control messages to all receivers in a global, efficient, and fast way.

- The relatively costly bi-directional secure channel is only used in exceptional situations, i.e., in case of a synchronization loss, or in case of subscription package change implying a temporary revocation.

- This synchronization allows for the implementation of traditional broadcast encryption schemes in a much more efficient way, notably in terms of the length of encrypted elements, i.e., the bandwidth used for security reasons and decryption time on the receiver side. This advantage is achieved by maintaining the number of simultaneously revoked receivers at a low number, thanks to the synchronization mechanism. Further objects of the present disclosure relate to a head-end comprising at least one server configured according to claim 6 and to a receiver, according to claim 10, configured to receive encrypted multimedia content data and to be managed by the at least one server of the head-end.

The head-end coupled to at least one receiver via the broadcast channel and the broadband bidirectional channel form a conditional access system. Brief description of the drawing

Figure 1 shows a block schematic representing a head-end and a receiver configured to perform the method of the present disclosure by using a hybrid broadcast encryption scheme exploiting a broadcast channel and a broadband bidirectional channel.

Detailed description

Three different solutions for a conditional access system involving a large number of receivers, for example 1 million receivers, may be considered:

A first solution involves only a unidirectional broadcast channel, a second one involves only a broadband bidirectional channel such as for example a high speed broadband Internet Protocol (IP) channel of VDSL (Very High Bitrate Digital Subscriber Line) type, and a third one involves a combination of two channels, i.e. a broadcast channel and a broadband channel, this combination being also called hybrid broadcast-broadband. The first solution uses a unidirectional broadcast channel from the head-end to the receivers and a conditional access system (CAS) relying on a cryptographic broadcast encryption scheme as described for example in Ref. 1 or Ref. 2.

According to such a configuration, the head-end transmits cryptographic group elements to the receivers as ciphertext, one or more additional group elements for revoked receivers, and a description of the set of revoked receivers for example in form of a list of revoked receivers identifiers. According to most existing broadcast encryption schemes, this list is necessary for the receivers to be able to decrypt ciphertexts. When access rights recorded in a receiver have to be updated, the head-end revokes old access rights and replaces them by new ones through an individual control message. This means that the length of the ciphertext or at least the description of the set of revoked receivers increases rapidly in monotonic fashion, as previously revoked receivers must be kept revoked forever; otherwise, the CAS security would be violated.

In the example involving 1 million receivers, assuming that 1 % of the receivers change their subscriptions each month, a message that may have a length of 68 bytes for example, comprising cryptographic elements and an identifier, is transmitted by the head-end to each receiver. Every second, ciphertexts are also transmitted to sustain a crypto-period of 60 seconds so that the bandwidth will be already 1 '000'000^*0.01 ^*68^*8 = 5.4 Mbit/s after the first month and continues growing at a rate of 5.4 Mbit/s each month. Such a situation related to broadcast encryption presents major drawbacks when only one broadcast channel is used. Therefore, a cryptographic broadcast encryption scheme becomes inapplicable in practice on a medium or large sized pay-TV CAS system, without even considering increasing decryption times on the receivers' side. The second solution uses a bidirectional channel involving a broadband-based system where all receivers are synchronized with the head-end. For example, an Internet link may connect the receivers with the head-end. In this case, each receiver maintains a secure channel in form of a persistent TCP (Transmission Control Protocol) connection secured with help of a security protocol, such as TLS (Transport Layer Security), and receives, from the head-end, a control word CW every minute involving an exchange of at least 128 bytes, for example. The total bandwidth for security management would thus be at least 1 '000'000^*128^*8/60 = 17 Mbit/s, which is not really a problem by today's standards. However, one server of the head-end can usually handle no more than 1000 simultaneous communications by taking into account decryption times and access rights checking in real-time, which means that at least 1 ΌΟΟ'000/1000/60 = 17 servers have to be setup to handle this load, which is rather expensive. This number of servers has to be increased by further taking into account availability and redundancy issues. To summarize, if it is to be able to handle a crypto-period of reasonably small duration, a fully connected conditional access system CAS will involve large costs on the head-end side in terms of computing capacities.

One embodiment is a so-called hybrid solution using a broadcast channel and a broadband bidirectional channel. As one can expect that, for example each crypto- period, at least 95% of the receivers will be able to remain synchronized (without return path) with the broadcast channel only, a synchronization element using the ABBE scheme is transmitted every day, and receivers that become unsynchronized can then recover their synchronized state thanks to the broadband channel, as long as their access rights are sufficient.

This means that the list of revoked receivers only contains the receivers revoked during a predetermined period t (one day for example), and that these receivers will disappear from the list at the next day {t+1). In other words, instead of having 1 %/30 = 0.03 % of the receivers increasing the revocation l ist every day, without ever having the possibility to "clean" this list without sending individual messages to each receiver, a revocation l ist of about 0.03% of the total nu mber of receivers is maintained all the time, which means that a bandwidth of 1 '000'000*0.01 /30*68*8 = 181 kbit/s is dedicated to security by taking 68 bytes messages as in the first solution involving a broadcast channel only, while at the head-end side, only about 0.03%*1 '000'000 = 300 TCP connections per second are required to sustain every crypto-period, which can easily be managed by a single server (without considering availability-related aspects). Thus, with the hybrid solution, while a very light bandwidth on the broadcast stream is used for security purposes, one solves the problem of continuous increase of the ciphertext in the broadcast encryption classical scheme, and a very precise and synchronized system with a light broadband infrastructure is ensured at the headend and in terms of necessary bandwidth for synchronization. The conditional access system CAS illustrated by the block schematic of figure 1 comprises a head-end HE configured to manage encryption and to transmit a scrambled video transport stream SCR(TS) and a receiver REC configured to descramble the received transport stream for rendering by a television set for example. The receiver REC is configured to receive broadcast content via a broadcast channel BRC, and to exchange control data, i.e. at least one synchronization element, with the head-end HE via a broadband bidirectional channel BIC, such as an Internet link.

The synchronization element is provided by the head-end preferably in form of a synchronization cryptogram comprising for a current time-period the at least one synchronization element encrypted with the encryption key of the ABBE scheme. The synchronization cryptogram comprises temporal data, a description of the access equations in terms of attributes, cryptographic group elements and a list of revoked receiver's identifiers.

The attributes represent for example geographical location, technical capabilities such as supporting HD content or 4K content, operating system type and version, access conditions, i.e. subscription type defined by access to particular channels packages for a given time period, etc. In general, a broadcaster or content provider may authorize receivers to access to multimedia content data according to a complex access equation such as all receivers having access to a predefined bouquet of programs, having a predefined version of operating system but not located in a particular region or country.

The head-end updates the synchronization element periodically as for example each day by updating the list of revoked receiver's identifiers where the identifiers of receivers recovering a non-revoked state are cancelled. The broadcast channel BRC allows for a large set of receivers to be addressed in a very efficient way; however, such unidirectional transmission cannot guarantee any synchronism between the head-end HE and the receiver, as no return path is available. Conversely, the broadband bidirectional channel BIC allows for a receiver REC to be kept fully synchronized with the head-end HE; however, a different session has to be maintained with every receiver REC, which may be rather expensive.

Contrarily to the method disclosed by document WO2013/027206A1 based on changing the master key and the global secret key for recovering authorization of the receivers to decrypt ciphertext encrypted by the broadcaster, the method of the present disclosure solves the problem of ever-increasing size of revocation lists without renewing the keys of the receivers. In fact, the method of the present disclosure implies using a chaining mechanism where all synchronization elements are cryptographically chained together in a sequential way. Hence, a receiver missing a single synchronization element will be desynchronized with the head-end. Re-synchronization can only be achieved starting from a correct state in the chain of synchronization elements. The identifier transmitted with the request allows retrieving the preceding synchronization element, which is then cryptographically combined with a fresh synchronization element.

The resulting new synchronization element combined with the previous synchronization element and the current media-encrypting key element gives the final media-encrypting key for decrypting the encrypted multimedia content data at the current time-period. To generalize, each time a new synchronization element is requested by the receiver, the head-end provides a combination of the preceding synchronization element combined with the updated synchronization element. The combination operation may use cryptographic and/or mathematical functions or operations, such as a cryptographically secure hash function, for instance.

When the head-end receives, via the broadband bidirectional secure channel, the request from the receiver, the new synchronization element is returned to the receiver if the provided identifier has sufficient access rights and is absent of the list of revoked receivers identifiers. If the receiver is not revoked, it recovers synchronization with the head-end at the current time period. The new synchronization element is used with the corresponding media-encrypting key element for deriving the media-encrypting key and then decrypting the encrypted multimedia content data.

In fact, in case of synchronization loss, the receiver sends a corresponding request message to the head-end via the broadband bidirectional secure channel BIC. Only an authorized receiver may obtain the new synchronization element valid for the current time period (the current day for example) in response to the request message, i.e. when the receiver is not revoked and its access rights are sufficient.

The video stream scrambling is performed by the head-end HE where a generator CWg generates the secret elements (synchronization elements and media- encrypting key elements) from which the media-encrypting key, also called control word CW and having similar properties as a symmetrical cryptographic key, is derived. The media-encrypting key element is provided by the head-end preferably in form of a time cryptogram comprising for a current time-period the at least one media- encrypting key element encrypted with an encryption key of the ABBE scheme.

The media-encrypting key element comprises also temporal data, a description of the access equations in terms of attributes, cryptographic groups elements and a list of revoked receiver's identifiers. Contrarily to the case of the synchronization element, the list of revoked receiver's identifiers of the media-encrypting key element is not used according to a preferred embodiment.

According to a further preferred embodiment, the time cryptogram is transmitted by the head-end at short crypto-periods having a duration of 30 seconds for example corresponding to crypto-periods at which the key of the multimedia stream scrambling scheme changes, while the synchronization cryptogram is transmitted at long crypto-periods having a duration of one day for example.

The media-encrypting key element is combined with the previous and the current synchronization elements at each crypto-period in order to generate for a current time period a final media-encrypting key used as a control word CW to decrypt the broadcast multimedia content. The combination of these elements may be performed thanks to cryptographic functions and/or mathematical operations, such as a cryptographically secure hash function. According to a preferred embodiment, the synchronization cryptogram forms an entitlement control message ECM transmitted every day and the time cryptogram forms another entitlement control messages ECM transmitted every 30 seconds.

According to an example, if no ECM message is received after 25 seconds, i.e. 5 seconds before the end of the 30 seconds crypto-period, the receiver REC is no more able to compute the control word CW depending on the previous and the current synchronization elements and the media-encrypting key element; it therefore uses the broadband bidirectional channel BIC to get at the head-end HE the ECM message corresponding to the next crypto-period. In addition, at startup, or after a channel change for the very first crypto period, the receiver may also use the bidirectional channel BIC to get the correct ECM message, instead of waiting for the next one to be received via the broadcast channel BRC.

To scramble the stream TS of multimedia content, a conventional DVB Common Scrambling Algorithm (DVB-CSA) or software scrambler based on AES-128 (128 bit key Advanced Encryption Standard) operated in counter CTR mode may be used to minimize processing load and descrambling time at the receiver side.

According to a preferred configuration, the head-end HE uses a JK-ABBE public key scheme encryptor BE (Junod-Karlov Public-Key Attribute-Based Broadcast Encryption Scheme) as described in Ref. 3, for encrypting synchronization elements and media-encrypting key elements forming respectively the synchronization cryptogram and the time cryptogram. In an initialization phase, at first connection to the head-end, a receiver gets a key comprising an individualized, unique JK-ABBE private key K_pri comprising individualized attributes and an identifier ID. According to an embodiment, other cryptographic and/or mathematical operations may also be used for performing the combination of synchronization and media- encrypting key elements.

At start, each receiver is equipped with the initial private key K_pri or can request its private key from the head-end HE via the secure broadband channel BRC at installation time and uses the private key K_pri to recover the at least one synchronization element and the at least one media-encrypting key element and then re-compute the final media encrypting key or control word CW.

Then, a list St of revoked receivers' identifiers is defined, i.e. receivers that are not allowed to access the video content stream because their access rights are expired, for example. The encryptor BE takes into account this list St of revoked identifiers ID for building the cryptograms containing a synchronization element and a media- encrypting key element.

During the decryption's operation by the receivers, one of three situations may occur: a) Individual revocation: an identifier ID is present in the list St of revoked receivers and the revoked receiver cannot perform the decryption. b) Revocation through the access equation: an identifier ID is absent from the list St of revoked receivers, but the access equation is not compatible with the current attributes of the receiver; in this case the decryption is also not possible by the receiver. c) Access granted: an identifier ID is absent from the list St of revoked receivers and the access equation is compatible with the attributes of the receiver. In this case, the decryption is possible.

In case of a change of a subscription associated with a receiver, the corresponding identifier is added into the list of revoked receivers in the synchronization element during one synchronization period and the head-end provides to the receiver, following a request, a new identifier, new individualized attributes and a new ABBE decryption key via the secure broadband channel. For example, when a user wishes to change his subscription, he may request a subscription change via a link distinct from the broadband bidirectional channel as for example a phone call to the operator managing the head-end to which the receiver is connected. The head-end revokes temporally the receiver, which is no more able to decrypt multimedia content received via the broadcast channel. In this case, the receiver sends a request for a new subscription with its current identifier to the head-end via the broadband bidirectional channel. In response to the request, the head-end transmits via the same channel a new identifier and a new decrypting key comprising new attributes including the access rights corresponding to the new subscription. The receiver is then resynchronized with the head-end and the identifier of the preced ing subscription canceled from the list of next synchronization element.

As the maximum size for an ECM message is usually limited, for example to 188 bytes, as defined by the MPEG transport stream TS standard, multiple ECM messages may be transmitted in the video content stream for a same cryptogram and associated information. In particular, depending on the number of revoked identifiers ID, multiple ECM messages are necessary to transmit the list of revoked receivers' identifiers and associated description. Decryption can be performed only when the receiver has received all ECM messages carrying each different part of the necessary information to determine the control word CW for a current crypto-period. The head-end HE represented by figure 1 comprises a control word generator CWg configured to generate a random value S, representing either a media-encrypting key element, or a synchronization element, used by the encryptor BE to build the corresponding cryptograms and as an input parameter for a key derivation algorithm (implemented for example by a SHA-256 hash function used in Hash Message Authentication Code (HMAC) mode). This key derivation process gives a pair of control words including one for a current crypto-period and one for the next crypto- period. The encryptor BE receives a command "Get ECM from S" from a multiplexer module MUX associated to the scrambler SCR each time a cryptogram, that can be an encrypted synchronization element or a media-encrypting key element, has to be generated and transmitted in an ECM message. The multiplexer module MUX forms the scrambled stream SCR(TS) transmitted to each receiver via the broadcast channel BRC. This stream contains audio / video content packets as well as the ECM messages required by the receiver REC for descrambling the stream, i.e. the ECM messages including the synchronization element and the ECM including the media-encrypting key element.

The encryptor BE is associated to a transceiver configured to transmit, via the broadband bidirectional secure channel BIC, at least one new synchronization element to the receiver upon reception of a synchronization request comprising at least an identifier of the receiver REC.

The encryptor BE may further use a network interface Wl connected to a server handling a database, via a local network or Internet for example, providing a list of revoked receivers' identifiers Rev REC ID forming a set St defined for a given time- period t. This list is then taken into account by the JK-ABBE scheme to build the cryptogram that will be incorporated into one or more ECM messages.

The ECM messages further comprise an identifier of the ECM message, information related to the number of messages and frames required to complete information when multiple ECM messages are required.

The receiver REC comprises a descrambler DSCR operating with a DVB-CSA or an AES-CTR algorithm similar to the one of the scrambler SCR of the head-end HE. The ECM messages, ignored by the descrambler DSCR, are transferred to a decryptor BD configured to operate with the inverse of the JK-ABBE scheme used by the encryptor BE of the head-end HE. The control words CW and related information are then reconstructed from the information extracted from one or more ECM messages before being used by the descrambler DSCR. The decryptor BD further comprises a transceiver linked to the broadband bidirectional channel BIC that is mainly used, in case of synchronization loss, to request and retrieve information such as updated synchronization elements that would normally be transmitted through the broadcast channel BRC when the receiver is synchronized with the head-end.

References

Ref 1 : "Revocation and Tracing Schemes for Stateless Receivers", Dalit Naor, Moni Naor, Jeff Lotspiech, IBM Almaden Research Center, San-Jose, CA. 95120, USA

Ref 2: "Collusion Resistant Broadcast Encryption With Short Ciphertexts and Private Keys", Dan Boneh, Craig Gentry, Brent Waters, Stanford University, Stanford, CA 94305, USA.

Ref 3: "An Efficient Public-Key Attribute-Based Broadcast Encryption Scheme Allowing Arbitrary Access Policies", Pascal Junod, Alexandre Karlov, Workshop on Digital Rights Management (DRM'10), ACM (Association for Computing Machinery), 2010.

Claims

1 . A method for managing, by a head-end, at least one receiver, the head-end transmitting unidirectionally, by using an attribute-based broadcast encryption scheme, data streams comprising encrypted multimedia content data and cryptograms configured to manage the at least one receiver, the method is characterized in that it comprises steps of:

- generating by the head-end at least one synchronization cryptogram and at least one time cryptogram,

- transmitting periodically by the head-end the at least one synchronization cryptogram and the at least one time cryptogram to the at least one receiver,

- decrypting, by the receiver, with a decrypting key of the attribute-based broadcast encryption scheme, the at least one synchronization cryptogram and the least one time cryptogram, obtaining at least one current synchronization element and at least one current media-encrypting key element,

- determining, by the receiver, a current final media-encrypting key from a previous and the current synchronization element and the current media-encrypting key element, decrypting the encrypted multimedia content data with said current final media-encrypting key, the receiver being synchronized with the head-end at a current time period,

- if the receiver is unsynchronized at the current time period, requesting, at the headend via a bidirectional link, a new synchronization element by transmitting at least an identifier to the head-end,

- receiving by the receiver, via the bidirectional link, the new synchronization element comprising a preceding synchronization element combined with an updated synchronization element, the new synchronization element, the preceding synchronization element and the updated synchronization element being cryptographically chained together in a sequential way, the receiver recovering synchronization with the head-end at the current time period, the new synchronization element being used with a next media-encrypting key element for decrypting the encrypted multimedia content data.

2. The method according to claim 1 characterized in that, the synchronization element and the media-encrypting key element comprise an identifier, temporal data, cryptographic group elements, an access equation and a list of identifiers of revoked receivers.

3. The method according to claim 2 characterized in that it comprises a step of verifying, by the head end, the identifier received from the at least one receiver, via the bidirectional link, with the preceding synchronization element previously stored by the head-end, the new synchronization element being returned to the at least one receiver if the identifier is linked with attributes that are conform to the access equation and is absent of the list of revoked receivers identifiers.

4. The method according to anyone of claim 1 to 3 characterized in that the at least one synchronization cryptogram is transmitted by the head-end in form of a first entitlement control message at first crypto-periods and the at least one time cryptogram in form of a second entitlement control message at second crypto- periods, the first crypto-period having a duration greater than the duration of the second crypto-period, the final media-encrypting key changing at periods corresponding to the second crypto period.

5. The method according to anyone of claim 1 to 3 characterized in that in case of a change of a subscription associated with a receiver it further comprises steps of: receiving, by the head-end, via a link distinct from the bidirectional link, a request for a subscription change, revoking temporally, by the head-end, the receiver by adding the current identifier of the receiver into the list of identifiers of revoked receivers in the synchronization element, receiving, by the head-end, via the bidirectional link, a request for a new subscription and a current identifier of the receiver, transmitting, by the head-end, via the bidirectional link a new identifier and a new decrypting key comprising new attributes including access rights corresponding to the new subscription, the receiver being resynchronized with the head-end and the current identifier canceled from the list of next synchronization element.

6. A head-end comprising at least one server configured to transmit unidirectionally, by using an attribute-based broadcast encryption scheme, data streams comprising encrypted multimedia content data and cryptograms configured to manage the at least one receiver, the at least one server is characterized in that it comprises: a generator configured to generate at least one synchronization element and at least one media-encrypting key element, an encryptor configured to form at least one synchronization cryptogram and at least one time cryptogram by encrypting respectively with an encrypting key of the attribute-based broadcast encryption scheme the at least one synchronization element and the at least one media-encrypting key element, a transmitter configured to unidirectionally transmit periodically to the at least receiver the at least one synchronization cryptogram and the at least one time cryptogram, and a transceiver configured to transmit, via a bidirectional link, at least one new synchronization element comprising a preceding synchronization element combined with an updated synchronization element, the at least one new synchronization element, the preceding synchronization element and the updated synchronization element being cryptographically chained together in a sequential way.

7. The head-end according to claim 6 characterized in that the at least one server is configured to verify the identifier received from the at least one receiver, via the bidirectional link, with the synchronization element previously stored in a memory of the server, the preceding synchronization element comprising an identifier and a list of identifiers of revoked receivers, the server being further configured to return to the at least one receiver the new synchronization element obtained by a combination of the preceding synchronization element and an updated synchronization element, if the identifier's attributes are conform to an access equation and if the identifier is absent of the list of revoked receivers identifiers.

8. The head-end according to claim 6 or 7 characterized in that the at least one server is configured to transmit the at least one synchronization cryptogram in form of a first entitlement control message at first crypto-periods and the at least one time cryptogram in form of a second entitlement control message at second crypto- periods, the first crypto-period having a duration greater than the duration of the second crypto-period, the final media-encrypting key changing at periods corresponding to the second crypto period.

9. The head-end according to anyone of claim 6 to 8 characterized in that the at least one server is further configured to: receive, via a link distinct from the bidirectional link, a request for a change of a subscription associated with a receiver, revoke temporally the receiver by adding the current identifier of the receiver into the list of identifiers of revoked receivers in the synchronization element, receive via the bidirectional link, a request for a new subscription and a current identifier of the receiver, transmit, via the bidirectional link, a new identifier and a new decrypting key comprising new attributes including access rights corresponding to the new subscription, the receiver being resynchronized with the head-end and the current identifier canceled from the list of next synchronization element.

10. A receiver configured to receive encrypted multimedia content data and to be managed by the at least one server of the head-end according to claim 6, the receiver is characterized in that it comprises: a decryptor configured to decrypt with a decrypting key of the attribute-based broadcast encryption scheme for a current time-period the at least one synchronization cryptogram and the at least one time cryptogram received from the head-end, and to determine the at least one synchronization element and the at least one media-encrypting key element, a descrambler configured to combine the at least one synchronization element and the at least one media-encrypting key element, to obtain a final media-encrypting key and to decrypt the encrypted multimedia content data, the receiver being synchronized with the head-end at the current time period, a transceiver, associated to the decryptor, configured to request at the head-end, via the bidirectional link, if the receiver is unsynchronized at the current time period, a new synchronization element by transmitting at least an identifier, and to receive the new synchronization element comprising a preceding synchronization element combined with an updated synchronization element, the at least one new synchronization element, the preceding synchronization element and the updated synchronization element being cryptographically chained together in a sequential way, the receiver recovering synchronization with the head-end at the current time period, the new synchronization element combined with a next media-encrypting key element being used for decrypting the encrypted multimedia content data.