CN101047829A - Mobile multimedia service implementing method and condition receiving system - Google Patents

Abstract

The present invention provides a mobile multimedia service implementation method and a conditional access system. The present invention adds a time-varying key TBEK to the authorized encryption layer on the basis of the existing four-layer encryption structure, and utilizes the time-varying key TBEK to encrypt program streams. The encryption key is encrypted, and the transmission process of the time-varying key TBEK is combined with the mobile communication system, which provides a new way for the conditional access system to realize mobile multimedia services, so that the conditional access system can be based on the time-varying key The time-varying period of TBEK realizes the real-time billing function of mobile multimedia services, and the time-varying period of the time-varying key TBEK of the present invention can be flexibly set according to the accuracy of billing; the present invention does not change the existing mobile multimedia service implementation method, It only provides an achievable way for the receiving end to watch mobile multimedia programs in occasional, impromptu and other situations; thereby achieving the purpose of improving the flexibility of implementing mobile multimedia services.

Description

Method for realizing mobile multimedia service and conditional access system

technical field

The invention relates to the technical field of network communication, in particular to a conditional access-based mobile multimedia service implementation method and a conditional access system.

Background technique

The development of cellular mobile communication has greatly improved the mobility of people's living space, thus giving birth to an increasing number of mobile phone users. With the development of digital multimedia technology, people can no longer be satisfied with the situation that mobile terminals can only make calls, send text messages, and simply surf the Internet. The demand for audio-visual multimedia information is becoming stronger and stronger. People hope that they can watch or listen to news, various information, songs, video programs, etc. through handheld terminals at any place and any time. 3G is an option, but the 3G network does not completely solve the bandwidth problem, the number of users that 3G can carry is limited, and the charges are expensive.

Multimedia information has a strong asymmetry, and a lot of information is the information that the public wants to obtain, and has a strong commonality. Because broadcasting can use the least resources to allow the public to obtain these common information, mobile digital multimedia broadcasting, which fully considers the mobile characteristics of terminals, emerges as the times require. DVB-H of European ETSI, MediaFLO of the United States, and S-DMB of South Korea all belong to such multimedia broadcasting systems.

In broadcasting systems, in order to prevent illegal users from receiving programs, it is common practice to encrypt programs, which is also called scrambling in broadcasting systems. The encrypted program is transmitted to the user side, the legitimate user can use the authorized information to correctly decrypt the program, and the unauthorized user cannot correctly decrypt the program because there is no authorization information, therefore, on the display terminal All I saw were some disorganized dots or mosaics. This is Conditional Access CA (Conditional Access). The related system that realizes conditional access is called CAS (Conditional Access System, conditional access system).

A typical conditional access system is mainly composed of two parts: the front end and the receiving end system. The front end mainly includes: program management system, user management system, database system, CA core system, encryption device or module, and scrambling device. The receiving end is mainly composed of two separate receiving and processing devices, that is, a set-top box and a smart card.

The conditional access system involves two encryption systems, one is program encryption system and the other is layered key encryption system.

The program encryption system encrypts the content of broadcast programs, which can also be called scrambling. The program encryption system encrypts the program stream as shown in Figure 1.

In Figure 1, the program encryption system uses the key to encrypt the program stream through the scrambling module. The key used to encrypt the program stream is traditionally called CW (Control Word, Control Word). The function of the control word is to disrupt the program signal. Therefore, unauthorized users cannot watch encrypted programs.

Since the CW is transmitted along with the TS stream, once the CW is cracked by a stealer, the encryption system will collapse. In order to prevent cracking by stealers, CW is often changed randomly. The change cycle of CW is generally very short, usually every few seconds, or even several times per second, and the CW needs to be encrypted with a key, which is the SK in the hierarchical key encryption system.

SK is generally generated by service providers to control the services they provide. The use of SK is related to the user's payment conditions. Generally, users can pay once a month, and SK also changes on a monthly basis. It is also called a monthly key in some specific systems. The time limit of SK is determined by the service time limit. In special services provided by network operators, such as PPV (Pay-per-View, single pay-per-view), the time limit of SK may only be a few hours.

Although the CW has been encrypted by the SK, this key can still be read by anyone. Once the SK is cracked, it means that the subscribers and non-subscribers of a specific service will enjoy the same rights, and it is difficult for network operators to control specific services. There are still problems with the security of the user and the network, therefore, the SK must be encrypted and protected again. This encryption process needs to be carried out according to the characteristics of each user.

Each user terminal has a unique address code that can identify itself. In practical applications, an array associated with this address code is often used to encrypt the SK. This sequence is a key, and since this sequence is determined by personal characteristics, this sequence is often referred to as PDK (Personal Distribution Key).

PDK is generally automatically generated and strictly controlled by CA system equipment. At the terminal device, the sequence is generally burnt into the PROM of the descrambler by the special device provided by the network operator through the CA system, and cannot be read out again. In order to provide various services of different levels and types, a CA system often allocates several PDKs to a user to meet various business requirements.

The above-mentioned encryption process of CW and SK is realized by a layered key encryption system. The main purpose of the layered key encryption system is to perform layered encryption to ensure the security of the control word CW. The implementation process of hierarchical key encryption is shown in Figure 2, Figure 3 and Figure 4.

In Figure 2, Figure 3, and Figure 4, the CA system uses SK (Service Key, business key) to encrypt the CW through a certain encryption algorithm, and the encrypted CW information and program information such as program prices pass the ECMG (Entitle Control Message Generator, authorization control information generator) generates an ECM (EntitleControl Message, authorization control information) message. In order to transmit SK, use PDK (Personal Distributed Key, personal key) to encrypt SK through a certain encryption algorithm, and the encrypted SK information and address, user authorization information, etc. generate EMM (Entitle Manage Message, authorization management information) information. The ECM and EMM information generated above is transmitted along with the encrypted TS (program) stream.

When receiving the program stream, the user receiving end first receives ECM and EMM, and uses the PDK key in the smart card on the terminal device to decrypt the EMM to obtain the service key SK; then, uses the SK to decrypt the ECM to obtain the CW, and then Use CW to initialize the scrambling module, so that the user's receiving end can synchronize with the transmitting end, so as to correctly decrypt the program.

In the multiple sets of CA systems actually operated in Europe, America and other places, there are many ways for operators to encrypt and authorize end users, such as: manual authorization, magnetic card authorization, IC card authorization, and smart card authorization, which use IC to form a card with analysis and judgment capabilities. Authorization, centralized addressing authorization in the center means no need to insert a card but direct addressing authorization by the control center, an authorization method shared by the smart card and the central authorization, etc. Among them, the smart card authorization method is the mainstream in the market, and has also been determined by my country's State Administration of Radio, Film and Television as a standard accessory for my country's network access equipment.

The above-mentioned encryption method of the program stream by the CA system and the decryption method of the program stream by the user terminal have become technical standards.

The encryption of mobile TV at the service level basically adopts the above-mentioned encryption process. The service level usually adopts a four-layer encryption structure. Typical encryption systems such as the service protection model of DVB-H and the service protection model of OMA BCAST all adopt a four-layer encryption structure. .

The four-layer encryption structure of the service level abstracted from the standard CA system will be described below with reference to FIG. 5 .

In Figure 5, the first layer is the registration encryption layer, which mainly completes the registration function and generates REK (RegisterEncryption Key, registration key). The registration key is used to encrypt authorization information.

The second layer is the authorization encryption layer, which mainly completes the encryption and delivery of SEK/PEK (Service Encryption Key/Program Encryption Key, business key/program key), as well as the authorization function for users. The service key SEK/PEK can be encrypted with the registration key REK. The encrypted information can be sent through the broadcast network, and can also be sent through the mobile communication network. If the DRM (Digital Rights Management) scheme is adopted, the key and related information are issued in the form of RO (Right Object).

The third layer is the traffic key transmission layer, which mainly completes the encryption and distribution of TEK (Traffic Encryption Key, business traffic key). SEK/PEK can be used to encrypt TEK, and the encrypted information is sent through the broadcast network.

The fourth layer is the business encryption layer, which mainly completes the business encryption and delivery functions. Business data is encrypted with TEK, and the encrypted information is delivered through the broadcast network.

On the user side, the user decrypts the service key information according to the obtained REK to obtain SEK/PEK, and then uses SEK/PEK to decrypt the service flow key information to obtain TEK. Finally, the user can correctly decrypt the service data by using TEK.

In the existing mobile phone TV encryption system, operators generally charge users by controlling the granting of service keys. After the user terminal and the network side establish the registration key, the user terminal initiates the subscription process, and the network side performs corresponding processing, granting the user a service key and deducting the user's fee.

If the real-time billing is realized by shortening the valid time of the service key, then all users, including monthly subscription and channel subscription users, also need to frequently apply for keys, which will inevitably have a major impact on the resources of the mobile communication network.

It can be seen from the above description that the existing digital multimedia broadcasting CA system can provide ideal security performance, and can achieve the purpose of differentiated charging by controlling SK and PDK. However, the means of such differentiated charging are limited. Generally, operators can only provide billing methods such as monthly subscription billing, billing by channel, and billing by program, and cannot provide real-time billing.

Contents of the invention

The purpose of the present invention is to provide a mobile multimedia service implementation method and conditional access system based on conditional access. On the basis of the existing four-layer encryption structure, by adding a time-varying key TBEK in the authorization encryption layer, the conditional access The system provides a new way of realizing mobile multimedia service, which enables the conditional access system to realize the real-time billing function of mobile multimedia service, thus making the way of realizing mobile multimedia service of the conditional access system more flexible.

In order to achieve the above object, a method for implementing a mobile multimedia service based on conditional access provided by the present invention includes: a registration encryption layer, an authorization encryption layer, a service stream key transmission layer and a service encryption layer, and the method includes:

a. The sending end adds a time-varying key TBEK in the authorization encryption layer, and the sending end encrypts the encryption key of the program stream through TBEK, and sends the encrypted information along with the program stream;

b. The sending end sends the information of obtaining TBEK to the receiving end through the mobile communication system;

c. The receiving end obtains the TBEK according to the received information, decrypts the TBEK, obtains the encryption key of the program stream, and watches the mobile multimedia broadcasting program according to the obtained encryption key of the program stream;

d. The sending end controls the charging processing of the charging system on the receiving end according to the time-varying period of the key TBEK. Described step a comprises:

a1. After receiving the authorized encryption layer time-varying key request sent by the receiving end, the sending end determines that the receiving end is allowed to watch mobile multimedia broadcasting programs according to the viewing restriction conditions, and encrypts the program stream according to the time-varying key TBEK Encrypt and send the encrypted information along with the program stream.

The viewing restriction conditions in the step a1 include: the account balance of the receiving end, and/or the receiving authority.

In the step a1, the sending end encrypts the encryption key of the program stream by TBEK, including:

The sending end encrypts the encryption key of the program stream through the ECM generator according to the key TBEK.

Said step a1 comprises:

a11. When the receiving end is turned on and needs to receive the mobile multimedia broadcasting program, the receiving end transmits the authentication information to the sending end;

a12. After the sending end successfully authenticates the receiving end, when determining that the receiving end is allowed to watch the mobile multimedia broadcasting program according to the viewing restriction condition, it encrypts the encryption key of the program stream according to the key TBEK, and sends the encrypted information along with the program stream sent.

Said step a11 comprises:

When the receiving end is turned on and needs to receive mobile multimedia broadcasting programs, and determines that the key TBEK stored by itself is invalid, the authentication information is transmitted to the sending end.

Said step a11 comprises:

The receiving end sends the key request carrying the authentication information to the sending end.

Said step a1 comprises:

During the process of watching the mobile multimedia broadcasting program, the receiving end regularly sends the key request to the sending end through the mobile communication system according to the validity period of the obtained key TBEK;

When the sending end determines that the receiving end is allowed to watch the mobile multimedia broadcasting program according to the viewing restriction condition, it encrypts the encryption key of the program stream according to the key TBEK, and sends the encrypted information along with the program stream.

Said step a also includes:

The sending end sends key rejection information to the receiving end whose authentication fails through the mobile communication system; or

The sending end sends key rejection information to the receiving end that is prohibited from receiving the key through the mobile communication system according to the viewing restriction condition; or

When the key TBEK sent by the sending end becomes invalid and no key request from the receiving end is received again, the sending end sends a key rejection message to the receiving end through the mobile communication system.

Said step c comprises:

The receiving end judges whether the information for obtaining the key TBEK sent by the sending end is received within a predetermined time interval;

If the receiving end receives the information about obtaining the key TBEK sent by the sending end, the receiving end obtains the key TBEK according to the received information about obtaining the key TBEK, and decrypts it according to the key TBEK to obtain the encryption key of the program stream, and then, according to The encryption key of the program stream for watching mobile multimedia broadcasting programs;

If the information about obtaining the key TBEK or the key rejection information sent by the sending end is not received, the key request is sent to the sending end again through the mobile communication system.

The information of obtaining the key TBEK in the step b includes:

The information obtained by encrypting the key TBEK through the EMM generator according to the SIM card information of the receiving end or the registered encryption layer key information.

Described step b comprises:

The sending end sends the information of obtaining the key TBEK to the receiving end through the signaling method of the mobile communication system or the short message method.

The present invention also provides a conditional access system based on mobile multimedia broadcasting, including: a registration encryption layer, an authorization encryption layer, a service stream key transmission layer and a service encryption layer, and an encryption module, a key sending module and a computer A fee control module, the receiving end is provided with a receiving module;

Encryption module: used to encrypt the encryption key of the program stream according to the variable key TBEK added in the authorized encryption layer, send the encrypted information with the program stream, and output the key TBEK;

Key sending module: used to send the information of obtaining the key TBEK to the receiving module through the mobile communication system after receiving the key TBEK;

Receiving module: used to obtain the key TBEK according to the received information, decrypt according to the key TBEK, obtain the encryption key of the program stream, and watch the mobile multimedia broadcasting program according to the encryption key of the program stream;

Billing control module: used to control the billing process of the billing system on the receiving end according to the time-varying period of the key TBEK sent by the key sending module.

The receiving module includes:

Key request submodule: send a key request to the sender through the mobile communication system;

Receiving sub-module: Obtain key TBEK according to the received information, decrypt according to key TBEK, obtain encryption key of program stream, and watch mobile multimedia broadcasting programs according to encryption key of program stream.

The encryption module includes:

Storage sub-module: used for storing restricted viewing conditions;

Encryption sub-module: used for receiving the key request sent by the receiving end, according to the restricted viewing conditions stored in the storage sub-module, when it is determined that the receiving end is allowed to watch the mobile multimedia broadcasting program, according to the received key TBEK to program stream The encrypted encryption key is encrypted, and the encrypted information is sent with the program stream. When it is determined that the receiving end is prohibited from watching the mobile multimedia broadcasting program, the key sending module is notified to send the key rejection information to the receiving end.

The receiving module also includes:

Judgment sub-module: judge whether the receiving end has received the information of obtaining the key TBEK sent by the sending end within a predetermined time interval, and will obtain the key when it is determined that the receiving end has received the information of obtaining the key TBEK sent by the sending end The TBEK information is transmitted to the receiving sub-module, and when it is determined that the information of obtaining the key TBEK or the key rejection information sent by the sending end is not received, the key request sub-module is notified to perform the key request processing process.

The system also includes:

Authentication module: authenticate the receiving end according to the authentication information sent by the sending end, and notify the encryption module to start the encryption process when the authentication is successful.

It can be seen from the description of the above technical solution that the present invention adds a time-varying key TBEK to the authorization encryption layer on the basis of the existing four-layer encryption structure, and uses the time-varying key TBEK to encrypt the encryption key of the program stream, Combining the transmission process of the time-varying key TBEK with the mobile communication system, a new way to realize mobile multimedia services is provided for the conditional access system, so that the conditional access system can realize mobile communication according to the time-varying period of the time-varying key TBEK For the real-time billing function of multimedia services, the time-varying period of the time-varying key TBEK of the present invention can be flexibly set according to the accuracy of billing; Watching mobile multimedia programs under impromptu and other situations provides a realizable way; the present invention is compatible with existing CA systems, and the technical solution of the present invention does not affect the original billing methods such as monthly subscription and channel subscription of mobile multimedia services. In this way, when the receiving end is not a dual-mode terminal capable of simultaneously receiving mobile communication network signals and mobile video broadcasting network signals, the traditional charging method can still be used to charge for programs received by the receiving end; The traditional charging method charges the program received by the receiving end, and the technical solution of the present invention can also be used to charge the program received by the receiving end in real time, which greatly enhances the flexibility of the charging method; thereby realizing the improvement of mobile multimedia through the technical solution of the present invention. The purpose of business flexibility.

Description of drawings

Fig. 1 is the schematic diagram that the program encryption system encrypts the program stream;

Fig. 2 is a schematic diagram 1 of the implementation process of hierarchical key encryption in the prior art;

FIG. 3 is a second schematic diagram of the implementation process of layered key encryption in the prior art;

Fig. 4 is a schematic diagram three of the implementation process of layered key encryption in the prior art;

FIG. 5 is a schematic diagram of a four-layer encryption structure at the business level in the prior art;

FIG. 6 is a schematic diagram of a four-layer encryption structure at the service level according to an embodiment of the present invention;

FIG. 7 is a first schematic diagram of a method for implementing a mobile multimedia service according to an embodiment of the present invention;

FIG. 8 is a second schematic diagram of a method for implementing a mobile multimedia service according to an embodiment of the present invention;

FIG. 9 is a third schematic diagram of a method for implementing a mobile multimedia service according to an embodiment of the present invention;

FIG. 10 is a fourth schematic diagram of a method for implementing a mobile multimedia service according to an embodiment of the present invention;

FIG. 11 is a fifth schematic diagram of a method for implementing a mobile multimedia service according to an embodiment of the present invention;

FIG. 12 is a sixth schematic diagram of a method for implementing a mobile multimedia service according to an embodiment of the present invention;

FIG. 13 is a seventh schematic diagram of a method for implementing a mobile multimedia service according to an embodiment of the present invention.

Detailed ways

The present invention improves the encryption system involved in the current existing conditional access system based on mobile multimedia broadcasting, and its main improvement points are shown in Figure 6. Authorize the encryption layer to increase the time-varying key TBEK. The sending end encrypts the encryption key of the program stream through TBEK, and sends the encrypted information along with the program stream. The sending end communicates the transmission of the time-varying key TBEK with the mobile communication system. In combination, that is to say, the present invention combines the sending end, that is, the transmission process of the time-varying key TBEK that the network side encrypts the encryption key of the program stream, with the mobile communication system, so that the receiving end can pass through the mobile communication system. After receiving the acquisition information of the time-varying key TBEK, the receiving end obtains the time-varying key TBEK through the acquiring information of the time-varying key TBEK, so that the receiving end can decrypt the encryption key of the program stream through NSK, so as to watch mobile multimedia broadcasting programme. The time-varying key TBEK in the present invention can flexibly change periodically according to actual needs, so that the network side can realize the real-time charging function for mobile multimedia services through the time-varying key TBEK, and the network side can adjust the time-varying key TBEK Change the change period of the key TBEK to adjust the accuracy of real-time billing.

The mobile communication network in the present invention is a two-way mobile communication network, such as GSM, GPRS, EDGE, CDMA, WCDMA, CDMA2000, TD-SCDMA, WIMAX, etc., as long as it is a two-way mobile communication network.

The main flow of the technical solution provided by the present invention is shown in Figure 7.

In Fig. 7, first, the sending end encrypts the encryption key of the program stream according to the time-varying key TBEK. The time-varying key TBEK encrypts the encryption key of the program stream and sends it along with the program stream. The sending end can encrypt the encryption key TEK of the program stream or the service encryption layer key such as CW through the ECM generator according to the time-varying key TBEK. Set the encrypted information generated by the sender for the key TEK or CW through the ECM generator according to the time-varying key TBEK as NECM (New Entitle Control Message, new authorization control information). The implementation here may not change the encryption process of the existing key system, that is, the information sent together with the program stream also includes: ECM, EMM, etc. generated by using the existing key system.

Then, the sending end sends the information of obtaining the time-varying key TBEK to the receiving end through the mobile communication system. Here, the information of obtaining the time-varying key TBEK can be directly the information of the time-varying key TBEK, or it can be the time-varying key Information encrypted by TBEK. Here, the time-varying key TBEK can be encrypted by using the PDK and the SIM card information of the receiving end. For example, the sending end encrypts the time-varying key TBEK through the EMM generator according to the PDK or the SIM card information of the receiving end. Set the encrypted information generated by the sending end for the time-varying key TBEK through the EMM generator according to the PDK or the SIM card information of the receiving end as NEMM. The NEMM here needs to be sent to the receiving end through the mobile communication system. The sending end can send the NEMM to the receiving end by means of signaling or SMS. When the sending end adopts the signaling mode, a link needs to be established between the receiving end on the user side and the sending end on the network side.

After the sending end sends the NEMM, the receiving end can obtain the time-varying key TBEK according to the NEMM, and then, according to the time-varying key TBEK, the receiving end decrypts the NECM received along with the program stream to obtain the encrypted key of the program stream The encryption key of the service encryption layer such as the key CW, so that the receiving end can watch mobile multimedia broadcasting programs according to the CW.

In the above implementation process, the information sent from the sending end to the receiving end is shown in FIG. 8 . In Figure 8, the information sent by the sender to the receiver includes: NECM, ECM, EMM, NEMM (New EntitleManage Message, new authorization management information) and the scrambled program stream. NECM, ECM, and EMM are multiplexed together with the program stream and then sent to the receiving end, while NEMM is sent to the receiving end through the mobile communication network.

A schematic diagram of generating the information sent from the sending end to the receiving end is shown in FIG. 9 .

In Figure 9, the sending end uses the time-varying key TBEK to encrypt the encryption key of the service encryption layer such as CW, and the encrypted information is NECM; the sending end uses SK to encrypt the CW, and the encrypted information is ECM; The end uses PDK to encrypt SK, and the encrypted information is EMM; the sending end uses PDK or the SIM card information of the receiving end to encrypt the key TBEK, and the encrypted information is NEMM.

The sending end in the present invention may execute the operation process described in the above embodiments when receiving the key request from the receiving end. In order to ensure the legitimacy of receiving mobile multimedia broadcast program streams at the receiving end, the present invention can perform authentication processing on the receiving end, and only execute the operation process described in the above-mentioned embodiments for the receiving end that has successfully authenticated. The present invention can further verify the legitimacy of receiving mobile multimedia broadcasting program streams at the receiving end according to the predetermined restricted viewing conditions, that is, execute the operation process described in the above-mentioned embodiment for the receiving end that is successfully authenticated and meets the restricted viewing conditions . The viewing restriction conditions here can be set according to the actual needs of the operator. For example, the viewing restriction conditions can be: the account balance of the receiving end, information of the receiving end that is not authorized to receive set by the operator, and the like.

The implementation process of the mobile multimedia service combined with the mobile communication network of the present invention will be described below with reference to FIG. 10 .

In Figure 10, first, the receiving end transmits the authentication information to the authentication center through the mobile communication network, and the receiving end can transmit the authentication information to the authentication center through a key request, and the authentication center performs authentication processing on the receiving end . After the authentication is successful, the service center, that is, the service center that provides mobile multimedia services, determines that the receiving end is prohibited from receiving program streams according to the viewing restriction conditions, and can send key rejection information to the receiving end, and the implementation process of this mobile multimedia service is over. When the service center determines that the receiving end is allowed to receive the program stream according to the restricted viewing conditions, the service center encrypts the program stream with a service encryption layer key such as CW, and encrypts the service encryption layer key such as CW with SK, and the encrypted CW The business encryption layer key is combined with other information to form an ECM; at the same time, the business center uses the time-varying key TBEK of the authorized encryption layer to encrypt the CW, and the encrypted CW is combined with other information to form a NECM (New Entitle ControlMessage, New authorization control information). The business center uses the authorized encryption layer key PDK to encrypt the SK, and the encrypted SK is combined with other information to form an EMM; at the same time, the business center uses the PDK or SIM card information to encrypt the time-varying key TBEK, and the encrypted SK and Other information is combined to form NEMM (New Entitle Manage Message, new authorization management information). Here, SIM card information includes but not limited to IMSI.

Then, ECM, NECM, EMM and the encrypted program stream are multiplexed and then transmitted to the receiving end through the transmission network. The service center transmits the NEMM to the receiving end through the mobile communication network.

The receiving end obtains the time-varying key TBEK according to the NEMM it receives through the mobile communication network, and uses the time-varying key TBEK to decrypt the NECM to obtain the application encryption layer key CW, etc., and the receiving end receives it according to the obtained CW Decrypt the program stream to watch mobile multimedia broadcasting programs.

Since the time-varying key TBEK has a time-varying period, that is, a life cycle, the receiving end needs to send a key request to the sending end through the mobile communication network according to the life cycle of the time-varying key TBEK to obtain a new time-varying key TBEK, In order to ensure that the receiving end can continuously watch the mobile multimedia broadcasting program. When the receiving end sends the key request to the sending end again through the mobile communication network, the authentication information may not be carried in the key request. At this time, the service center can directly determine whether the receiving end can watch the mobile multimedia broadcasting program according to the viewing restriction condition.

As can be seen from the description of the above steps, the present invention adds a time-varying key TBEK to the original encryption system, and the time-varying key TBEK changes according to time, and the change cycle of the time-varying key TBEK can be determined according to the operator's It is determined by the operating strategy, such as the change period of the time-varying key TBEK can range from tens of seconds to tens of minutes. For users who do not have the ability to decrypt the key of the service stream key transport layer such as SK, if they need to receive programs, they must obtain the time-varying key TBEK, and use the time-varying key TBEK to decrypt the service encryption layer key such as CW etc., and then use the service encryption layer key such as CW to decrypt the program, so as to achieve the purpose of correctly receiving the program.

Since the validity period of the time-varying key TBEK is relatively short, the operator can control the receiving end to receive programs by controlling the real-time grant of the time-varying key TBEK to the receiving end, thereby realizing real-time charging for mobile multimedia services. The granting mode of the key in the present invention is bidirectional, and the NEMM is transmitted in the mobile communication network.

Since the implementation cost of mobile multimedia broadcasting is much lower than that of 3G network multimedia services, it is completely acceptable to charge by the minute. Generally, the change period of the time-varying key TBEK can be several minutes.

The reason why the present invention does not directly use CW and other service encryption layer keys for real-time charging is that the cycle of CW change is too fast, which will occupy a large amount of mobile communication network resources. If the change frequency of the service encryption layer key is deliberately slowed down in order to realize real-time billing, the confidentiality will be greatly reduced.

After adding the time-varying key TBEK in the present invention, it does not affect the original charging method of the charging system for the user. It just adds a more flexible billing method for mobile multimedia services: real-time billing.

The mobile communication network in the present invention includes PHS, GSM, GPRS, EDGE, WCDMA, CDMA2000, TD-SCMDA, but not limited to these networks. Any communication network capable of providing two-way interaction will do.

It should be noted that the technical solution of the present invention is completely different from the existing simulcryption technology. The essence of simulcryption technology is a multi-CA system, while the essence of the technical solution of the present invention is a multi-key system, that is to say , the key in the service stream key transmission layer in the present invention, such as SK and time-varying key TBEK, can be generated by the same CA system, which is different from the simulcryption technology. Of course, in the technical solution of the present invention, it is also allowed that the key in the service stream key transport layer and the time-varying key TBEK are generated by different CA systems. Another difference between the present invention and the simulcryption technology is that the NEMM generated by the present invention is not transmitted together with the program stream after multiplexing, but transmitted through the mobile communication network.

The complete implementation process of the mobile multimedia service provided by the present invention will be described in detail below with reference to FIG.

In Fig. 11, the receiving end, that is, the user terminal, starts the mobile multimedia broadcasting receiving circuit. The user terminal needs to receive the mobile multimedia broadcasting program, and the receiving end judges whether the TV program it needs to receive needs to be decrypted. Directly receive the program stream sent by the sending end; if the program to be received by the receiving end needs to be processed, the receiving end judges whether the time-varying key TBEK in its key storage area is valid, and if the time-varying key TBEK in the key storage area If the key TBEK is invalid, the receiving end uses the mobile communication network to send the key request signaling Key Request to request to obtain the key. The reception status of the receiving end, such as initial reception, can be added to the key request. According to the requirements of the network, the key request may also include authentication information for authenticating the receiving end. At the same time, the receiving end starts the receiving key timer T1, waiting to receive the key sent by the sending end.

After receiving the Key Request, the sending end, that is, the network side, performs authentication processing on the receiving end according to the authentication information in the Key Request; if the authentication is successful, it is determined that the receiving end is a legal user; When the receiving end receives the program stream, if it is determined that the balance of the receiving end is sufficient, it will reply Key ACK to the receiving end, and send the information encrypted by the time-varying key TBEK to the receiving end, and at the same time, the sending end will notify the billing system to start billing. If the authentication of the receiving end fails, or although the authentication is successful, but the sending end determines that the receiving end is prohibited from receiving the program stream according to the viewing restriction conditions, such as the account balance of the receiving end is insufficient, or when the receiving end has no right to receive the program stream due to other reasons, the sending end sends The receiving end sends Key REJ, and Key REJ can carry the rejection reason.

If the receiving end does not receive the information encrypted by the time-varying key TBEK or the Key REJ information when the timer T1 expires, the receiving end will send a Key Request to the network side again, requesting the sending end to transmit the key. , the Key Request can be accompanied by authentication information and reception status such as initial reception. The receiving end restarts the timer T1 while sending the Key Request.

If the receiving end receives the information encrypted by the time-varying key TBEK sent from the network side before the timer T1 expires, however, when the receiving end determines that the time-varying key TBEK it has obtained is incorrect, the receiving end sends a new message to the network side Sending a Key Request requires the sender to transmit the key. At this time, the Key Request can be accompanied by a reason value, such as receiving a key error and other reason values. However, it is not necessary to attach the authentication information. The receiving end restarts T1 while sending the Key Request.

The network side judges the received Key Request. If the Key Request carries key transmission error information, the network side does not need to perform authentication processing, but replies Key ACK to the receiving end again; if the Key Request carries If the timer expires, the receiving end will perform authentication processing on the receiving end according to the authentication information in the KeyRequest, reply to the receiving end with Key ACK or KeyREJ and other processing procedures described above, until the receiving end receives the correct key or receives to the key rejection message.

In the above described process, if the receiving end receives the Key REJ, the receiving end stops sending the key request and closes the dynamic multimedia broadcast receiving circuit.

In the above description process, the valid time of the time-varying key TBEK and the life cycle of the time-varying key TBEK can be n minutes. For all receiving ends of real-time billing, the value of n is the same, that is, the sending end is sent by different receiving ends. The valid time of the time-varying key TBEK is the same; the KeyACK sent by the sender to the user can carry the life cycle TTL of the time-varying key TBEK.

When the receiving end is in the process of receiving the mobile multimedia program stream through the above-mentioned processing procedures such as authentication, the receiving end needs to periodically request a new time-varying key TBEK from the sending end in order to continuously receive the mobile multimedia program stream Key TBEK.

The acquisition process of the new time-varying key TBEK is shown in Fig. 12 .

In Figure 12, in step 1, when the time-varying key TBEK is about to expire, the network side checks the balance of the user and judges whether the receiving end can continue to receive the mobile multimedia program stream. If the balance of the receiving end is insufficient, the network side receives the end sends the message of insufficient balance, stops sending new keys to the receiving end, and sends information to the billing system to stop billing the receiving end; otherwise, when the time-varying key TBEK fails, the network side will receive The end starts the timer T2, waiting for the new key request signaling Next Key Request from the receiving end. If the network side does not receive the Next Key Request sent by the receiving end when the timer T2 expires, the network side sends information to the billing system to stop charging the receiving end, and stops sending keys to the receiving end.

In step 2, for the receiving end, the receiving end judges the time when the key expires according to the TTL. At a random time before the key expires, if the receiving end wishes to continue receiving the program stream, the receiving end sends a new key to the sending end. The key request signaling Next Key Request, and start the receiving key timer T1, waiting to receive the new key sent by the sending end.

In step 3, after the network side receives the new key request signaling Next Key Request, the timing of the timer T2 is terminated, and if the network side determines that the receiving end is allowed to continue receiving the program stream according to the restricted viewing conditions, the network side replies Next to the receiving end Key ACK, and send a new time-varying key TBEK encrypted information to the receiving end; if the network side determines that the receiving end is prohibited from continuing to receive the program stream according to the viewing restriction conditions, it refuses to send the new key to the receiving end, and the network side Reply Next Key REJ to the receiving end, and carry the rejection reason in Next Key REJ.

If the timer T1 of the receiving end expires, and the receiving end has not received the time-varying key TBEK or key rejection information sent by the sending end, the receiving end resends the Next KeyRequest to the network side, and attaches the receiving key to the Next Key Request. At the same time, the receiving end restarts the timer T1; if the time-varying key TBEK received by the receiving end is wrong, the receiving end resends the Next Key Request to the network side, and attaches the key transmission error information to the Next Key Request . At this point, the network side performs the process described in step 3 above until the receiving end receives the correct time-varying key TBEK or receives the key rejection information.

When the receiving end receives a new key or key rejection information, it terminates the timing of the receiving key timer T1.

In the above description, the reasons why the network side rejects the receiver’s new key request may be: timer T2 expires, billing is stopped because the receiver’s account balance is insufficient, and the initialization request Key Request resent by the receiver is received.

When the receiving end stops receiving programs, the processing flow of the receiving end and the sending end is shown in FIG. 13 .

In Fig. 13, in step 1, when the receiving end stops receiving mobile multimedia programs and closes the digital TV receiving circuit, the receiving end sends a Stop Billing Request to the network side.

In step 2, after receiving the stop billing request from the receiving end, the network side notifies the billing system to stop billing, and sends a Stop Billing ACK to the receiving end.

Of course, the receiving end can also not send any information to the sending end when the digital TV receiving circuit is turned off. In this way, the sending end will not receive the key request sent by the receiving end after the time-varying key TBEK becomes invalid. Therefore, the network side will terminate the charging due to the timeout of the timer T2.

If the receiving end is restarted due to battery replacement or other reasons during receiving the program, when the receiving end receives the mobile multimedia program again, for the receiving terminal with real-time billing, it is first necessary to determine whether the key in the key storage area is Still valid, if valid, then can utilize the key stored in the key storage area to continue to receive mobile multimedia programs; To apply for the time-varying key TBEK encrypted information.

In the technical solution of the present invention, the accuracy of the real-time billing of the programs received by the receiving end at the network side is determined by the life cycle of the time-varying key TBEK. The accuracy of real-time billing is even worse.

As can be seen from the above description, on the basis of not changing the original standard CA system scheme, the present invention adds another set of keys, and by combining the transmission of the added keys with the mobile communication network, the present invention can The receiving end receives the mobile multimedia program to realize the real-time billing function. The invention is compatible with the existing CA system, and does not affect the original billing mode of the mobile multimedia service. In this way, when the receiving end is not a dual-mode terminal capable of simultaneously receiving mobile communication network signals and mobile video broadcasting network signals, the traditional charging method can still be used to charge for programs received by the receiving end; The traditional charging method charges for programs received at the receiving end, and the technical solution of the present invention can also be used to charge for receiving programs at the receiving end in real time, which greatly enhances the flexibility of the charging method.

The present invention is a conditional access system based on mobile multimedia service broadcasting. The system of the present invention is still provided with a registration encryption layer, an authorization encryption layer, a service stream key transmission layer and a service encryption layer. The network side of the present invention, that is, the sending end is provided with an encryption module, a key sending module, a billing control module and an authentication module, and the receiving end is provided with a receiving module.

The authentication module is mainly used to: authenticate the receiving end according to the authentication information sent by the sending end, and notify the encryption module to start the encryption process when the authentication is successful.

The encryption module is mainly used to encrypt the encryption key of the program stream according to the time-varying key TBEK added in the authorization encryption layer, send the encrypted information along with the program stream, and output the key TBEK. The encryption module can use the time-varying key TBEK to encrypt the encryption key of the program stream when receiving the key request Key Request or Next KeyRequest transmitted from the receiving end.

The key sending module is mainly used for: after receiving the time-varying key TBEK, send the information of obtaining the time-varying key TBEK to the receiving module through the mobile communication system. The key sending module can directly send the time-varying key TBEK to the receiving module, and can also send the encrypted information of the time-varying key TBEK to the receiving module.

The receiving module is mainly used to obtain the time-varying key TBEK according to the information it receives, and decrypt it according to the time-varying key TBEK to obtain the encryption key of the program stream, and then encrypt the program stream according to the encryption key of the program stream obtained by decryption. Decryption is performed so that the receiving end can watch mobile multimedia broadcasting programs according to the time-varying key TBEK.

The billing control module is mainly used to: control the billing process of the billing system on the receiving end according to the time-varying period of the time-varying key TBEK sent by the key sending module. The billing processing here is real-time billing processing, and the accuracy of real-time billing processing is related to the time-varying period of the time-varying key TBEK, such as sending billing start and stop billing information to the billing system. When the billing control module receives the Stop BillingRequest sent by the receiving end, it controls the billing system to stop billing processing on the receiving end. Specifically as described in the above method.

The receiving module in the present invention is composed of a key request submodule, a judging submodule and a receiving submodule.

The judging sub-module is mainly used for: when it is determined that the time-varying key TBEK in the key storage area of the receiving end is valid, the time-varying key TBEK is sent to the receiving sub-module, so that the receiving sub-module can use the time-varying key TBEK stored in the key storage area The key receives the mobile multimedia program; the judging sub-module can start the receiving key timer T1, and wait for receiving the key sent by the sending end. The judging sub-module can also notify the key request sub-module to resend the key to the key sending module of the sending end when the receiving end has not received the time-varying key TBEK or key rejection information sent by the sending end when the timer T1 expires. Next Key Request, and attach receiving status information on the Next Key Request, at the same time, the judging submodule restarts the timer T1; if the time-varying key TBEK received by the receiving module is wrong, the judging submodule notifies the key request submodule to The key sending module at the sending end resends the Next Key Request, and attaches the key transmission error information to the Next Key Request. When the receiving end stops receiving mobile multimedia programs and closes the digital TV receiving circuit, the judging submodule sends a Stop Billing Request to the key requesting submodule to the billing control module at the sending end. Specifically as described in the above method.

The key request sub-module is mainly used for: when receiving the notification from the judging sub-module, send a key request to the sender through the mobile communication system. Here, the key request sent by the key request sub-module is KeyRequest or Next Key Request. Authentication information for authenticating the receiving end may be attached to the key request. The key request sub-module also needs to send a Stop Billing Request to the billing control module at the sending end according to the information transmitted by the judging sub-module. Specifically as described in the above method.

The receiving sub-module is mainly used to obtain the time-varying key TBEK according to the information sent by the key request sub-module or the key sending module, and decrypt according to the time-varying key TBEK to obtain the encryption key of the program stream, and then, according to the program Stream the encryption key for watching mobile multimedia broadcasting programs. Specifically as described in the above method.

The encryption module is composed of a storage submodule and an encryption submodule.

The storage sub-module is mainly used for: storing restricted viewing conditions, such as storing the minimum amount that allows the receiving end to receive the program stream, receiving right item information, etc.

The encryption sub-module is mainly used for: after receiving the key request sent by the receiving end, according to the restricted viewing conditions stored in the storage sub-module, when it is determined that the receiving end is allowed to watch the mobile multimedia broadcasting program, according to the received key TBEK to program The encryption key of the stream is encrypted, and the encrypted information is sent with the program stream. When it is determined that the receiving end is prohibited from watching the mobile multimedia broadcasting program, the key sending module is notified to send the key rejection information to the receiving end. When the time-varying key TBEK is about to expire, the encryption sub-module checks the balance of the user and judges whether the receiving end can continue to receive the mobile multimedia program stream. end sends a new key, and sends information to the billing control module to stop billing the receiving end; otherwise, when the time-varying key TBEK becomes invalid, the encryption submodule starts timer T2 for the real-time billing receiving end, and waits for The new key request signal at the receiving end is Next Key Request. If the encryption submodule does not receive the Next Key Request sent by the receiving end when the timer T2 expires, it will send information to the billing control module to stop charging the receiving end, and stop sending the key to the receiving end. Specifically as described in the above method.

Although the present invention has been described by way of example, those of ordinary skill in the art know that there are many variations and changes in the present invention without departing from the spirit of the invention, and the claims of the application document of the present invention include these variations and changes.

Claims (17)

1. A method for realizing mobile multimedia services based on conditional access, comprising: a registration encryption layer, an authorization encryption layer, a service flow key transmission layer and a service encryption layer, wherein the method includes: a. The sending end adds a time-varying key TBEK in the authorization encryption layer, and the sending end encrypts the encryption key of the program stream through TBEK, and sends the encrypted information along with the program stream; b. The sending end sends the information of obtaining TBEK to the receiving end through the mobile communication system; c. The receiving end obtains the TBEK according to the received information, decrypts the TBEK, obtains the encryption key of the program stream, and watches the mobile multimedia broadcasting program according to the obtained encryption key of the program stream; d. The sending end controls the charging processing of the charging system on the receiving end according to the time-varying period of the key TBEK. 2. A method for realizing a conditional access-based mobile multimedia service according to claim 1, wherein said step a comprises: a1. After receiving the authorized encryption layer time-varying key request sent by the receiving end, the sending end determines that the receiving end is allowed to watch mobile multimedia broadcasting programs according to the viewing restriction conditions, and encrypts the program stream according to the time-varying key TBEK Encrypt and send the encrypted information along with the program stream. 3. A method for realizing a mobile multimedia service based on conditional access as claimed in claim 2, characterized in that the viewing restriction condition in the step a1 includes: the account balance of the receiving end and/or the receiving authority. 4. A method for realizing mobile multimedia services based on conditional access as claimed in claim 2, characterized in that, in the step a1, the sending end encrypts the encryption key of the program stream by TBEK, comprising: The sending end encrypts the encryption key of the program stream through the ECM generator according to the key TBEK. 5. A method for realizing a conditional access-based mobile multimedia service according to claim 2, wherein said step a1 comprises: a11. When the receiving end is turned on and needs to receive the mobile multimedia broadcasting program, the receiving end transmits the authentication information to the sending end; a12. After the sending end successfully authenticates the receiving end, when determining that the receiving end is allowed to watch the mobile multimedia broadcasting program according to the viewing restriction condition, it encrypts the encryption key of the program stream according to the key TBEK, and sends the encrypted information along with the program stream sent. 6. A method for implementing a conditional access-based mobile multimedia service according to claim 5, wherein said step a11 comprises: When the receiving end is turned on and needs to receive mobile multimedia broadcasting programs, and determines that the key TBEK stored by itself is invalid, the authentication information is transmitted to the sending end. 7. A method for realizing a conditional access-based mobile multimedia service according to claim 5, wherein said step a11 comprises: The receiving end sends the key request carrying the authentication information to the sending end. 8. A method for realizing a conditional access-based mobile multimedia service according to claim 2, wherein said step a1 comprises: During the process of watching the mobile multimedia broadcasting program, the receiving end regularly sends the key request to the sending end through the mobile communication system according to the validity period of the obtained key TBEK; When the sending end determines that the receiving end is allowed to watch the mobile multimedia broadcasting program according to the viewing restriction condition, it encrypts the encryption key of the program stream according to the key TBEK, and sends the encrypted information along with the program stream. 9. A conditional access-based mobile multimedia service implementation method according to any one of claims 2 to 8, characterized in that said step a further comprises: The sending end sends key rejection information to the receiving end whose authentication fails through the mobile communication system; or The sending end sends key rejection information to the receiving end that is prohibited from receiving the key through the mobile communication system according to the viewing restriction condition; or When the key TBEK sent by the sending end becomes invalid and no key request from the receiving end is received again, the sending end sends a key rejection message to the receiving end through the mobile communication system. 10. A method for implementing a conditional access-based mobile multimedia service according to claim 9, wherein said step c comprises: The receiving end judges whether the information for obtaining the key TBEK sent by the sending end is received within a predetermined time interval; If the receiving end receives the information about obtaining the key TBEK sent by the sending end, the receiving end obtains the key TBEK according to the received information about obtaining the key TBEK, and decrypts it according to the key TBEK to obtain the encryption key of the program stream, and then, according to The encryption key of the program stream for watching mobile multimedia broadcasting programs; If the information about obtaining the key TBEK or the key rejection information sent by the sending end is not received, the key request is sent to the sending end again through the mobile communication system. 11. A conditional access-based mobile multimedia service implementation method according to any one of claims 1 to 8, characterized in that the information for obtaining the key TBEK in the step b includes: The information obtained by encrypting the key TBEK through the EMM generator according to the SIM card information of the receiving end or the registered encryption layer key information. 12. A conditional access-based mobile multimedia service implementation method according to any one of claims 1 to 8, characterized in that said step b comprises: The sending end sends the information of obtaining the key TBEK to the receiving end through the signaling method of the mobile communication system or the short message method. 13. A conditional access system based on mobile multimedia service broadcasting, comprising: a registration encryption layer, an authorization encryption layer, a service stream key transmission layer and a service encryption layer, characterized in that an encryption module, a key transmission module and billing control module, the receiving end is provided with a receiving module; Encryption module: used to encrypt the encryption key of the program stream according to the variable key TBEK added in the authorized encryption layer, send the encrypted information with the program stream, and output the key TBEK; Key sending module: used to send the information of obtaining the key TBEK to the receiving module through the mobile communication system after receiving the key TBEK; Receiving module: used to obtain the key TBEK according to the received information, decrypt according to the key TBEK, obtain the encryption key of the program stream, and watch the mobile multimedia broadcasting program according to the encryption key of the program stream; Billing control module: used to control the billing process of the billing system on the receiving end according to the time-varying period of the key TBEK sent by the key sending module. 14. A conditional access system based on mobile multimedia service broadcasting according to claim 13, wherein said receiving module comprises: Key request submodule: send a key request to the sender through the mobile communication system; Receiving sub-module: Obtain key TBEK according to the received information, decrypt according to key TBEK, obtain encryption key of program stream, and watch mobile multimedia broadcasting programs according to encryption key of program stream. 15. A conditional access system based on mobile multimedia service broadcasting according to claim 14, wherein the encryption module includes: Storage sub-module: used for storing restricted viewing conditions; Encryption sub-module: used for receiving the key request sent by the receiving end, according to the restricted viewing conditions stored in the storage sub-module, when it is determined that the receiving end is allowed to watch the mobile multimedia broadcasting program, according to the received key TBEK to program stream The encrypted encryption key is encrypted, and the encrypted information is sent with the program stream. When it is determined that the receiving end is prohibited from watching the mobile multimedia broadcasting program, the key sending module is notified to send the key rejection information to the receiving end. 16. A conditional access system based on mobile multimedia service broadcasting according to claim 15, wherein said receiving module further comprises: Judgment sub-module: judge whether the receiving end has received the information of obtaining the key TBEK sent by the sending end within a predetermined time interval, and will obtain the key when it is determined that the receiving end has received the information of obtaining the key TBEK sent by the sending end The TBEK information is transmitted to the receiving sub-module, and when it is determined that the information of obtaining the key TBEK or the key rejection information sent by the sending end is not received, the key request sub-module is notified to perform the key request processing process. 17. A conditional access system based on mobile multimedia service broadcasting according to claim 13 or 14 or 15 or 16, characterized in that the system further comprises: Authentication module: authenticate the receiving end according to the authentication information sent by the sending end, and notify the encryption module to start the encryption process when the authentication is successful.

Images