DE19511298B4 - Procedure for issuing and revoking the authorization to receive broadcasts and decoders - Google Patents

Abstract

Procedure for issuing and revoking the authorization to receive broadcasts protected by encryption with a decoder,
The keys of all the decoders concerned form a tree structure,
- where the nodes following the root and the individual nodes are assigned keys,
Wherein the leaves of this tree are assigned fixed keys which are uniquely associated with a decoder or part of a decoder (eg a chip card),
- Wherein the keys, each forming a branch of the tree structure, are stored in a respective decoder, and
The keys stored in a respective decoder serve to decrypt received cryptograms which cause changes to the stored keys and a stored system key,
- Wherein the root of the tree structure of the system key is assigned, which is used to decrypt a control word received with the respective broadcast and
- where those keys that are assigned to such nodes, which ...

Description

The The invention relates to a method for issuing and withdrawing the Authorization to receive broadcasts protected by encryption, with a decoder and one suitable for carrying out the method Decoder.

Paid Broadcasts, which also include the keywords pay-TV, pay-radio, become known are encrypted with a key CW. user are thereby authorized to receive that one gives them the key (control word) CW confidentially. This will be in general, the user a personal key PK to disposal usually physically secured against duplication, for example stored on a chip card.

The Control word CW is encrypted as a cryptogram ECM (Entitlement Control Message) over a Data channel of the radio station from the receiver or decoder received. By decryption this cryptogram by means of the personal key PK the control word CW is retrieved. When under the name EuroCrypt became known system becomes another cryptogram EMM (Entitlement Management Message) of a SK key sent. This cryptogram can be decrypted with the help of PK become. The key thus obtained SK is used to calculate CW from the cryptogram ECM. This access control system is described in DIN EN 50094. For safety's sake, the key is CW changed frequently.

A important task of the access control system is to provide users, not their fees have paid the permission to receive the broadcast to withdraw. This can on the one hand by a negative addressing happen at which a message is sent to the decoder, in which he is asked to cease his activity. These possibility is however basically unsure, as such news of a fraudulent Users can be intercepted and thus ineffective.

at the positive addressing will disable the decoder causes the information contained in it is made worthless. This happens in that all other decoders receive new information that will help decipher future ones It is absolutely necessary to use radio broadcasts, only the one to be switched off Decoder not.

The Although the method of positive addressing certainly leads to Disconnecting the decoder of each user, it is, however with big Expenses connected because to turn off a decoder messages must be sent to all other decoders.

By EP 0 641 103 A2 For example, a method and arrangement for key distribution in a selective broadcasting system having a plurality of subscribers has become known, wherein changeable groups of privileged subscribers are provided with keys and the keys are arranged in a tree structure. A withdrawal of the authorization to receive broadcasts is not provided.

Of the Invention is based on the object, a method for issuing and to propose the withdrawal of the right to receive broadcasts, where required for decryption Information in a particular decoder be made worthless can, without all other decoders must be addressed individually.

• – wobei die Schlüssel aller betroffenen Decoder eine Baumstruktur bilden,
• – wobei den der Wurzel und den einzelnen Knoten nachfolgenden Knoten Schlüssel zugeordnet sind,
• – wobei den Blättern dieses Baumes feste Schlüssel zugeordnet sind, die eindeutig einem Decoder oder einem Teil eines Decoders (z.B. einer Chipkarte) zugeordnet sind,
• – wobei die Schlüssel, die jeweils einen Ast der Baumstruktur bilden, in jeweils einem Decoder gespeichert werden und
• – wobei die in jeweils einem Decoder gespeicherten Schlüssel zur Entschlüsselung von empfangenen Kryptogrammen dienen, welche Änderungen der gespeicherten Schlüssel und eines gespeicherten Systemschlüssels bewirken,
• – wobei der Wurzel der Baumstruktur der Systemschlüssel zugeordnet ist, der zur Entschlüsselung eines mit der jeweiligen Rundfunksendung empfangenen Kontrollwortes dient und
• – wobei diejenigen Schlüssel, die solchen Knoten zugeordnet sind, welche einem bestimmten Knoten unmittelbar nachfolgen, dazu dienen, Kryptogramme zu entschlüsseln, die einen Schlüssel enthalten, der dem bestimmten Knoten neu zugeordnet werden soll.

This object is achieved with the method according to the invention,

• The keys of all the decoders concerned form a tree structure,
• - where the nodes following the root and the individual nodes are assigned keys,
• Wherein the leaves of this tree are assigned fixed keys which are uniquely associated with a decoder or part of a decoder (eg a chip card),
• - Wherein the keys, each forming a branch of the tree structure, are stored in a respective decoder, and
• The keys stored in a respective decoder serve to decrypt received cryptograms which cause changes to the stored keys and a stored system key,
• - Wherein the root of the tree structure of the system key is assigned, which is used to decrypt a control word received with the respective broadcast and
• - wherein the keys associated with such nodes immediately following a particular node serve to decrypt cryptograms containing a key to be reassigned to the particular node.

With 1,000,000 decoders 999,999 messages would have to be transmitted in the process mentioned above to deactivate one of the decoders four. In the method according to the invention with, for example, a 2-ary tree of depth 20, only about 40 messages are necessary.

to encoding the data can in the method according to the invention Both symmetric and asymmetric methods are used become.

An advantageous embodiment of the method according to the invention is that the tree structure is m-regular, where m ^t ≥ n with m = number of nodes following a node or root, t = number of levels formed by nodes, and n = number of decoders , As a result, a simple assignment of the cryptograms, which cause changes to the stored keys, possible.

• – für jeden Decoder außer dem bestimmten Decoder, der zusammen mit dem bestimmten Decoder demselben Knoten nachfolgt, ein Kryptogramm gesendet wird, das den mit dem festen Schlüssel des Decoders verschlüsselten Schlüssel enthält, der dem gemeinsamen Knoten neu zugeordnet wird,
• – beginnend mit dem Knoten, der dem gemeinsamen Knoten vorausgeht, bis zur Wurzel für jeweils alle nachfolgenden Knoten aller dem bestimmten Decoder mittelbar vorausgehenden Knoten jeweils ein Kryptogramm gesendet wird, das den mit dem Schlüssel des jeweils nachfolgenden Knotens verschlüsselten Schlüssel enthält, der dem dem bestimmten Decoder mittelbar vorausgehenden Knoten neu zugeordnet wird.

For the withdrawal of the authorization of a particular decoder can be provided in the inventive method that

• For each decoder other than the particular decoder which follows the same node together with the particular decoder, a cryptogram containing the key coded with the decoder's fixed key, which is reassigned to the common node, is sent;
• Starting with the node preceding the common node, until the root for each subsequent node of all the node indirectly preceding the particular decoder, a cryptogram containing, respectively, the key encrypted with the key of the respective subsequent node is sent Decoder is indirectly remapped to the preceding node.

One advantageous decoder for carrying out the Method according to one of the preceding claims, characterized that several keys storable where at least part of the keys are received by the broadcasts Cryptograms that can be decrypted using one of the stored keys are, changeable are.

One embodiment the invention is illustrated in the drawing with reference to several figures and explained in more detail in the following description. It shows:

1 a schematic representation of the tree-forming nodes, each associated with a key, the number of decoders is greatly reduced compared to reality, and

2 a sequence of messages to be sent to revoke the authority of a particular decoder.

1 shows as an example a 3-ary tree of depth 2 with keys associated with the node of the tree. The keys K (2, i) are permanently assigned to a decoder Di or a chip card. In the illustrated example, i = 1, ..., 9. The root of the tree is assigned the system key SK = K (0,1), while the m successor node of the node to which the key K (r, s) is assigned which are assigned keys K (r + 1, m ^s-1 + 1), ... K (r + 1, m ^s-1 + m).

A decoder with the key K (m, x) - while in 1 Example K (2, i) - the authorization to receive a pay-service broadcasting program may be granted by communicating valid keys on the way within the tree from K (m, x) to K (0,1). This requires a maximum of t-1 messages with the cryptograms of the next higher key. A decoder with the key K (m, x) can be deprived of the authorization to receive a paid radio program by replacing all keys on the way from K (m, x) to K (0,1). This requires a maximum of t · m messages with the cryptograms of the new keys. The keys that need to be exchanged to grant or revoke privilege can be easily calculated using a regular tree structure.

2 shows a sequence of messages to decoder D9 using the in 1 to disable the described tree structure of the keys. Each message can be broadcast over a broadcast channel. It has an address and a payload in 2 separated by a vertical bar. With the help of the address, each decoder recognizes whether it has to process a specific received message. The payload contains a cryptogram that can only be evaluated by the addressed decoders. The notation A <B> means that the information B was encrypted with the key A. The algorithm for decryption is known in the decoder.

Line a the 2 shows a message to the decoder D7, with which this new K gets a new key (1,3). The decoder D8 also receives the same new key, but in this case it is decrypted via the key K (2,8) (line b). In the message according to line c, an address is given, which is common to the decoders D1 to D3 and in 2 is designated group 1. These have in common the key K (1,1), which is used to decrypt the new system key SKneu. In the same way then for the group 2 (decoder D4 to D6) and for the group 3 (decoder D7 to D9), the new system key SKnew transmitted (lines d and e). However, the decoder D9 is not able to decrypt the cryptogram K (1,3) new <SKnew>. The decoder D9 thus receives no new system key SKnew and can no longer decode the subsequently transmitted useful signals.

Claims (4)

Procedure for issuing and revoking the authorization for receiving broadcasts by encryption protected are, with a decoder, - in which the keys all affected decoders form a tree structure, - in which the key assigned to the root and the individual nodes are, - in which the leaves This tree is assigned fixed keys are clearly a decoder or part of a decoder (e.g., a smart card), - where the keys, the each forming a branch of the tree structure, each in a decoder be saved and - in which the decryption key stored in each decoder serve received cryptograms, which changes the stored key and a stored system key, - in which the root of the tree is assigned to the system key used for decryption a control word received with the respective broadcast serves and - in which those keys, which are assigned to such nodes, which a specific node immediately succeed, to decrypt cryptograms that a key which is to be reassigned to the particular node. Method according to claim 1, characterized in that the tree structure is m-regular, where m ^t ≥n with m = number of nodes following a node or root, t = number of levels formed by nodes, and n = number of decoders. Method according to one of claims 1 or 2, characterized that to Withdrawal of the authorization of a particular decoder - for each Decoder except the particular decoder, along with the particular decoder Following the same node, a cryptogram is sent, which is the with the firm key encrypted by the decoder key contains which is reassigned to the common node, - starting with the node preceding the common node to the root for each all subsequent nodes of all the particular decoder indirectly each node is sent a cryptogram, the the one with the key contains the encrypted key of each successive node, the reassigned to the node indirectly preceding the particular decoder becomes. Decoder for performing the method according to a of the preceding claims, characterized in that a plurality Key storable are at least part of the keys through with the broadcasts received cryptograms that can be decrypted using one of the stored keys are, changeable are.