EP1454489A1

EP1454489A1 - Protocol for controlling the mode of accessing data transmitted in point-to-point or point-to-multipoint mode

Info

Publication number: EP1454489A1
Application number: EP02801107A
Authority: EP
Inventors: Claudia Becker; Chantal Guionnet; André CODET; Pierre Fevrier
Original assignee: Viaccess SAS
Current assignee: Viaccess SAS
Priority date: 2001-12-12
Filing date: 2002-12-09
Publication date: 2004-09-08
Also published as: FR2833446B1; JP4249626B2; KR100847338B1; WO2003051055A1; AU2002364820A1; US20050108563A1; KR20040075875A; CN100367796C; CN1620811A; FR2833446A1; JP2005512250A

Abstract

The invention relates to a data access mode control protocol using rights, access criteria and an electronic token facility. According to the invention: each access right and electronic token facility is established (A) in the form of a set of variables comprising independent variables containing at least one validity duration variable and a variable that identifies the access right or the electronic token facility; and each access criterion is established (B) according to another set of variables comprising independent variables containing at least one access date variable and a variable that identifies the type of access criteria and the access right. Subsequently, an access mode proposal is established (C) in order to define the access constraints and said proposal is submitted (D) for an evaluation of access constraints in relation to access rights. The access mode is accepted for the true value of the evaluation and is otherwise not pursued. The invention can be used to control the mode of accessing data transmitted in point-to-multipoint transmission.

Description

Protocol for controlling the mode of access to data transmitted in point-to-point or point-to-point mode.

The invention relates to a protocol for controlling the mode of access to data and the application of such a protocol to operations for controlling access to this data in the context of transactions or electronic commerce.

More specifically, it is indicated that the aforementioned data, and the information supported by them, can be transmitted in clear or, on the contrary, encrypted or scrambled. Encryption or scrambling of this data makes it possible to ensure more stringent access control, access to scrambled or encrypted data being able to be totally prohibited.

Access control to data, particularly when it is encrypted or scrambled, has experienced unprecedented growth, thanks to the advent of techniques for transmitting information over a network.

These techniques were originally proposed, on a large scale, in the context of applications in the transmission and display of information on television receivers for information, entertainment or other purposes.

In particular, an access control system applied to systems such as the "ANTIOPE" and "TITAN" systems was proposed in French patent application 79 02995 (2 448 825) made available to the public on September 5 1980. The abovementioned access control system uses a double key system comprising a service key, making it possible to lock the information, this service key being changed randomly at short intervals of a few minutes and a subscription key, can take several Ci values, depending on the type of subscription. The subscription key also changes randomly, at longer intervals, of the order of a month.

It is registered on a subscription medium, such as a microprocessor card or credit card, this medium being introduced into a receiving station. Special messages composed on transmission and transmitted with the data locked or scrambled make it possible, in the receiving station, to restore the service key and then unlock, that is to say descramble the scrambled information transmitted. Many developments of the above process have given rise to the establishment of standard UTE C90-007 "Conditional access system for digital broadcasting systems".

Access control systems meeting the requirements of the aforementioned standard make it possible to remotely manage access control to scrambled data by means of a service key and transmitted between a transmission center and at least a receiving station. The transmission center includes a module for calculating a control word, CW, containing at least the service key, and a module for encrypting the control word using an operating key, SOK, for generating a cryptogram of the control word.

Access control management is carried out using access rights or titles, registered on the subscription medium and access title control parameters, or access criteria, generated from the program. For this purpose, a generator of access title control messages, ECM messages, containing at least the cryptogram of the control word and access title control parameters, designated access criteria, and a module generating access credential management messages, EMM messages, are provided. ECM messages and EMM messages may be multiplexed in the stream of scrambled information transmitted.

Each receiving station comprises at least one terminal for descrambling scrambled data and an access control module comprising a security processor hosted for example by an access control card, playing the role of subscription support, and introduced into the terminal. The security processor includes the SOK operating key and access titles, stored in secure internal memory, and a decryption module. The security processor makes it possible, from the operating key and the cryptogram of the control word, to restore the service key, on a criterion of verification of at least one of the registered access titles, from the transmitted access criteria.

Each descrambling terminal includes a descrambling module making it possible, from the restored service key, to descramble the scrambled data transmitted, for use by the authorized subscriber user holding the subscription medium.

Such systems are satisfactory, in particular due to the fact that the process of managing access titles, by means of the EMM messages transmitted, on the one hand, and the control of these access titles on the basis of the criteria of Access, on the other hand, with a view to authorizing or refusing the continuation of access by descrambling of scrambled information is completely independent of the scrambling / descrambling process proper.

Such a character of independence makes it possible, in particular, to manage subscriptions of subscribers and / or groups of subscribers independently of the management of the operating key SOK, which can then be modified by the authority responsible for ensure the operation of the access control system on the basis of criteria relating only to the security of the data transmitted, in order to ensure the non-compromise of this operating key and, consequently, of the cryptogram of the control word then finally scrambled data.

To this end, the above-mentioned standard UTE C90-007 provides for a system for addressing EMM messages according to group addressing. Each subscriber thus has, independently of the conditional access process proper, a group address attached to a service identifier. From this address, the authority responsible for operating the access control system, the broadcasting operator, can hide or select one or more groups. The addressing associated with the service identifier parameter has the highest priority level. When a user belongs to a hidden group for example, he cannot access the scrambled data regardless of the valid access credentials that he otherwise possesses, on the one hand, and the valid exploitation key that he holds, on the other hand.

The aforementioned rights or access titles, registered and transmitted, in fact condition the continuation of access control as part of the aforementioned priority process. However, access titles, within the framework of strict compliance with the standard

UTE C90-007 allow to define modes of access limited to:

- subscription by theme / level;

- subscription by list; - reservation of session intervals;

- impulse purchase by program;

- impulse purchase per unit of time;

- purchase in preview, "preview" in Anglo-Saxon language. For a more detailed description of the previous access modes, one can usefully refer to the text of the aforementioned standard, in particular in chapter 2.3 "System functionalities", paragraph 2.3.1, "Access modes", pages 10 and 11.

In operation, the aforementioned access modes appear to be substantially compartmentalized. In particular, they do not allow, by reason of their definition and coding, to a user having acquired access tickets by booking session intervals, to access scrambled data transmitted in access mode by impulse purchase for example. Indeed, within the framework of strict compliance with the provisions of the aforementioned standard, the emission of ECM messages comprising parameters for controlling access rights, or access criteria, corresponding to one of the access modes previous, gives any program or scrambled data transmission a corresponding access mode, independently of the scrambling process proper of the aforementioned data. In addition, broadcasting operators are asking for new access modes, which, not listed in the text of the aforementioned standard, cannot therefore be implemented in the absence of a specific definition and coding of these latter.

Such access modes concern, for example: - access to a plurality N of broadcasts of the same broadcast program;

- the dynamic choice by the user of N programs among M programs, M> N, capable of being selected;

- in access mode by impulse purchase, possibility of a specific account of the access service to scrambled data according to the specificity of the customer user and / or of the application associated with the accessed data; - access by fixed price according to a limited access time for a given interval of broadcast programs;

- access in impulsive mode with overall cost capped.

The aforementioned new access modes are not limiting. In particular, for this purpose, the present invention relates to the implementation of a protocol for controlling the mode of access to data on the basis of access rights or titles and access criteria for defining or specific coding allowing the implementation of the most diverse access modes and / or combinations of access modes. Another object of the present invention, due to the diversity and flexibility of the access modes capable of being defined, coded and implemented in accordance with the access mode control protocol according to the invention, is the application of such a protocol to access to data of all kinds, scrambled or unscrambled, the mode of definition and coding of the titles and access criteria allowing adaptation and application of the protocol, object of the invention, to any information.

Another object of the present invention is the implementation of a protocol for controlling the mode of access to data, based on access rights or titles and access criteria subject to a validity condition of at least one access right or an electronic token holder of access values.

The protocol for controlling the mode of access to data from access rights and access criteria subject to a condition of validity of at least one access right or of an electronic token holder of values d access, object of the present invention, is remarkable in that it consists in establishing each access right and each electronic token holder of access value, acquired by an authorized user, in the form of a first set of variables constituted by independent variables and linked variables. The independent variables of this first set contain at least one validity duration variable and one identification number variable for each right or access title respectively of each electronic token holder. It also consists in establishing each access criterion in the form of a second set of variables constituted by independent variables and linked variables. The independent variables of this second set contain at least one access date variable, an access criterion type identification variable and an access right or electronic token identification number variable, and, in the case of '' an electronic token holder, an access cost variable. It also consists in establishing a proposed mode of access to the data in the form of a logical combination of access criteria to generate access constraints.

Finally, it consists in subjecting the proposed mode of access to an assessment of access constraints vis-à-vis access rights or titles and electronic token holder of acquired access values. The access mode is accepted and access to the data is continued for the true value of the evaluation and the access mode and access to the data is not continued otherwise.

The protocol object of the present invention finds application to point-to-point or multipoint toll transmission of data, whether this data is encrypted or scrambled or not.

It finds, in particular, application to the control of access to digital data, support for multimedia works, in the form of audio and / or video files, encrypted or not, the transmission being a point-to-point transmission between a remote client terminal and a server center, according to the IP protocol for example.

In addition, the protocol which is the subject of the present invention finds application in controlling access to television or broadcast programs, in point-to-multipoint transmission, when the digital data, the support of these programs, is scrambled or encrypted. The transmission, in the latter case, can be carried out either by radio network, by wired terrestrial network or by IP network.

It will be better understood on reading the description and the observation of the drawings below, in which:

- Figure 1 shows, by way of illustration, an example of implementation of the protocol object of the present invention, at a server center, the transmission of data to which access is granted can be performed, following verification access mode, via a network using the IP protocol for example; FIG. 2a represents, by way of illustration, a first variant of implementation of the protocol object of the present invention represented in FIG. 1, the remote client terminal having access rights and one or more specific electronic token holders, from which an access mode proposal request can be transmitted to the server center;

FIG. 2b represents, by way of illustration, a second variant of implementation of the protocol object of the present invention, as shown in FIG. 2a, in which the data for which access is requested is divided into quanta of data, following a pre-validation of the access mode proposal request, and a control message containing specific access criteria associated with a current quantum of data are transmitted to the remote terminal, the mode control operation d 'access proper being then implemented at the remote terminal considered for each quantum of data and for the control message associated with the latter; - Figure 2c shows, by way of illustration, a third variant of implementation of the protocol object of the present invention, corresponding to a simplification of the second variant according to Figure 2b, in which, following an authentication of the request for proposal mode of access, the pre-validation step is deleted, the control of the access mode being carried out on the other hand, at the remote terminal, in a manner similar to that of FIG. 2b;

- Figure 3a shows, by way of illustration, another example of implementation of the protocol object of the present invention, the transmission of the data for which access is requested being carried out in a point-to-multipoint mode, from a broadcast network, between a transmission center and at least one terminal ensuring the descrambling of the data when the latter are scrambled, an access control module equipped with a security processor being associated with the aforementioned terminal;

- Figure 3b shows, by way of illustration, an advantageous variant of implementation of the protocol object of the present invention according to Figure 3a, in which, in the absence of any request for access proposal, an offer message acquisition of specific access mode is transmitted on the initiative of the sending center or the server center; FIG. 4a represents, by way of illustration, a flowchart for controlling the mode of access to an access right required by the subscribed user, the aforementioned access right being able to be registered either at a remote terminal, during a point-to-point transmission, either in an access control module associated with a descrambling terminal, during a point-to-multipoint transmission;

FIG. 4b represents, by way of illustration, a flowchart for controlling the access mode during the acquisition of an access unit intended for an electronic token holder, this acquisition being proposed in punctual mode, during a point-to-point transmission, respectively in impulse mode, during a point-to-multipoint transmission;

FIG. 4c represents, by way of illustration, a flowchart for controlling the access mode during the acquisition of an access right intended for an electronic token holder, this acquisition being proposed in punctual mode, during a point-to-point transmission, respectively in impulse mode, during a point-to-multipoint transmission;

FIG. 4d represents, by way of illustration, a flowchart for controlling the access mode during the acquisition of a new electronic token holder, this acquisition being proposed in punctual mode during a point-to-point transmission, respectively in impulse mode, during point-to-multipoint transmission;

- Figure 5 shows, by way of illustration, the diagram of an installation, emission center, allowing the combination of two access conditions, according to an access mode by impulse mode acquisition of a fixed price or mode d access on an existing package, accompanied by a reading of consumption of access units by the subscriber, during a transmission in point-to-multipoint mode, the transmitted data being, moreover, scrambled.

A more detailed description of the protocol which is the subject of the present invention will now be given in conjunction with FIG. 1 and the following figures.

In general, it is recalled that the protocol object of the present invention can be implemented, firstly, when the data object of the access is transmitted in point-to-point mode between a center server and a remote terminal, the transmission of the aforementioned data being carried out, by way of nonlimiting example, according to the IP protocol for example.

In such a situation, it is recalled that the user subscriber was able to subscribe to the server center a right of use or subscription to a service, this service being of any kind, such as commerce or electronic transactions, the corresponding services being carried out in the form of data exchanges to which the authorized user subscriber requests access.

Access to the service is then made, for a fee, from access rights and access criteria, the control of the access mode being subject to a condition of validity of at least one of the rights of the aforementioned access which benefits the authorized subscriber subscriber or an electronic token holder for example.

In general, it is indicated that the protocol for controlling the mode of access to this data, in accordance with the object of the present invention, can be implemented in full, at the server center, under the conditions which will be explained below in conjunction with FIG. 1.

In order to manage the control of the mode of access to the abovementioned data, the protocol object of the present invention advantageously consists in establishing each access right and each electronic token holder acquired by the authorized user or the subscriber in the form of a first set of variables consisting of independent variables and related variables.

The step of establishing each access right is represented in step A of FIG. 1, the access rights being denoted AR and the electronic token holder being denoted PU, each one verifying the relation (1):

AR = [Validity] Rightld [RightSubld [Level]]

(1) PU = [Validity] Purseld [PurseSubld] PurseUnits [RE] The coding of the AR access rights and the PU electronic token holders, in accordance with the object of the present invention, makes it possible to confer a generic character on these insofar as the independent variables contain at least one validity duration variable and one identification number variable for each access right or each token holder electronic, and, in the case of electronic token holders, a unit credit variable.

In general, it is also recalled that, in accordance with the specific coding of the access rights AR and electronic token holder PU, it is indicated that any variable between square brackets is considered to be optional. Thus, with reference to relation (1), we indicate that the variables:

- Validity: indicates a validity interval, which can be fixed, and represented by a start date and an end date of access right, or sliding and then defined in number of days, expiration date. The validity interval can then be transformed into a fixed value at the first use for example.

Note that the validity variable is optional. When the validity variable field is empty, the validity variable not being coded, the access right is always valid. Such a coding mode corresponds for example to the allocation of a permanent right according to the choices of the broadcasting operator or the server center.

- Rightld, RightSubld: the above variables correspond to identifiers and sub-identifiers of a right allowing in particular to reference this right in the access criteria. It is understood in particular that the identifier being a mandatory independent variable, the sub-identifier being optional, the Rightld identifier makes it possible to reference the same family of services for an operator, such as for example a game access service and the RightSubld sub-identifier is used to reference a game among this family, one or more games if necessary. - Level: the aforementioned variable defines a level value representative of a maximum access position for the right considered.

- Purseld and PurseSubld: designate variables of identifiers or sub-identifiers of an electronic token holder allowing in particular to reference this electronic token holder in any transaction and, in particular, in any punctual transaction, an electronic token holder or, if applicable if necessary, an electronic wallet that can be assigned to a specific transaction, as will be described later in the description. According to a particularly advantageous aspect of the protocol which is the subject of the present invention, it will be observed, in connection with relation (1), that, like the access rights, the electronic token holder comprises the same independent variables of duration of validity and of identification of the electronic token holder than those which allow AR access rights to be defined.

In addition, the electronic token holder has the following variables:

- PurseUnits: this variable defines the amount, in access value, of the electronic token holder associated with the access rights of the authorized user. The unit of such an access amount can be different from one token holder or electronic wallet to another, with different identifiers, i.e. access values or unit values. different access account.

- RE: represents a variable linked to the independent Purse Units variable, the RE variable designating a so-called deferral variable allowing the carry-over of the content of the electronic token holder considered, or of the credit balance of the latter, to a token holder of the same kind or on the same wallet or electronic token holder with an identical identifier.

In general, it is indicated that the variable RE is optional and that it can also include a deadline for postponing the token holder denoted Rdate and in a variable for maximum postponement of the token holder denoted RPurse.

The protocol which is the subject of the present invention also consists in establishing each access criterion in the form of a second set of variables constituted by independent variables and linked variables, this step being represented in step B of FIG. 1. The variables independent of access criteria contain at least one access date variable noted Date, an identification variable of type of access criterion and a linked variable in the type of access criteria, the identification variable in the type of access criteria corresponding to a variable of identification numbers of access rights or electronic token holder, as will be described below.

Thus, with reference to FIG. 1, the access criteria advantageously include the following access criteria verifying the relation (2): - Criterion per nominal access right noted ACAR:

- ACAR = Date Rightld [RightSubld [Level]]

- Criterion per unit of quantity of data accessed (2) and correspondingly of data consumed in an ACU electronic token holder:

- ACU = Date Unitld [UnitSubld] Cost [CostMax] In the previous relationship, the above variables denote:

- Date: date of the access criterion. The date must be within the validity period of the AR access right or the PU electronic token holder used. - Unitld UnitSubld: variable for identifying and under-identifying an access unit allowing the accumulation of access units, in particular for a statement or subsequent consultation of the consumption of each electronic token holder.

- Cost: variable for the cost of the one-time acquisition, the Cost variable being a complex variable verifying the relationship:

- Cost = Costld Purseld [PurseSubld] CostUnits

In the previous relationship, Costld designates the acquisition identifier, CostUnits designates the one-time acquisition cost in a given electronic token holder. - CostMax: maximum cost variable, designates a ceiling from which the criterion is verified with authorization or prohibition of access. The costs of all consumption with the same identifier and sub-identifier of the criterion accessed are cumulated to compare with this ceiling for example.

The protocol which is the subject of the present invention then consists, in step C, of establishing a proposal for a mode of access to the data in the form of a set of logical combinations of access criteria for defining access constraints.

The proposed mode of access checks the relation (3):

9 (AR, PU, ACAR, ACU) (3) It is understood, in fact, that from the access rights, AR of the electronic token holder (s) PU and the access criteria ACAR, ACU defined above and, of course, of a request made by the authorized subscriber , the implementation of rules of comparison between the variables of access criteria and access rights actually acquired by the subscriber subscriber makes it possible to establish the access proposal according to the above-mentioned relation (3).

Step C is then followed by a step D consisting in subjecting the proposed mode of access 9 to an evaluation of the access constraints vis-à-vis the access rights and electronic token holder acquired. The operation of step D verifies the relation (4):

S (έP (AR, PU, ACAR, ACU)) (4)

Step D is then followed by a step E consisting in verifying the true value of the evaluation S. The access mode is accepted and access to the data is continued in step F for the true value of l evaluation E. Access to the data is not continued in the opposite case when the evaluation E is not verified in step G of FIG. 1.

It is thus understood that each access criterion comprises constraint variables to be applied to the variables of the access rights AR or electronic token holder PU to carry out the implementation of the steps D, E above and thus ensure the control of the mode d 'access required by the subscriber.

A specific, non-limiting mode of implementation of the protocol which is the subject of the present invention, in the context of a point-to-point transmission of the data to which access is requested, will now be given in connection with FIG. 2a.

In this case, step C consisting in establishing a proposed access mode can consist, in step C1a, in transmitting, from the remote terminal of address j to the server center, an access request comprising at least access rights or the electronic token holder, this request verifying for example the relation (5): 9.9. (AR, PU) (5)

The C2a one-step server center extracts the rights

AR and the electronic token holder PU and then establishes the proposed mode of access for the remote terminal of address j mentioned above in step C3a, as shown in FIG. 2a. The process is then continued in accordance with steps D, E, F, G of FIG. 1.

A second alternative embodiment of the protocol which is the subject of the present invention will now be described with FIG. 2b. In the implementation mode according to the aforementioned variant, it is indicated that the data transmission is carried out in point-to-point mode, a preflight check being carried out at the server center, while the process of controlling the access mode properly said is performed at each remote terminal of address j. In the same way as in the case of FIG. 2a, the authorized user transmits a request for a proposal for an access mode in step C1b and the server performs the extraction of rights AR and of the electronic token holder PU at l 'step C2b.

Step C2b is followed by a test step C3b, called pre-validation, carried out at the server center and consisting in verifying certain aspects of the validity of the transaction. The pre-validation step, in step C3b, can consist, for example, of verifying, in addition to certain parameters of identification of the requesting user subscriber, the character of solvency, that is to say the presence of tokens. in the PU electronic token holder. On a negative response in step C3b, the absence of continuation of the access mode is incurred in step C4b. On a positive response to step C3b, a step C5b is launched, which consists for example in defining a quantum

Qlsoi _Dkj of data which will be transmitted to the terminal Tj of address j.

Besides the quantum data cited above, a control message ECM _kj ^ noted ACAR, ACU) is calculated, this control message of course containing the access criteria as defined in accordance with the protocol object of the present invention. According to a particularly remarkable aspect of the protocol which is the subject of the present invention, this then consists of a step C6b in carrying out the transmission not only of the aforementioned quantum of data, but also of the control message to the remote terminal of address j. The operations carried out in steps C5b and C6b are then continued for any successive quantum of data in step C7b, this operation being denoted k = k + 1, k designating the rank of the defined quantum of data then transmitted to the remote terminal of address j.

It is understood, in particular, that this operating mode is particularly advantageous in the case of a point-to-point transmission according to the IP protocol insofar as the transmission of the data to which access is requested is carried out in packets, the quantum of data QISOKDI <J can correspond to a determined number of packets, which can be linked to the remaining value of the electronic token holder PU for example. On reception of the control message ECM (ACAR, ACU) and of the quantum of data QlsoiDkj at the level of the remote terminal j, a step C8b is called to calculate the proposed access mode r? _k (AR, PU, ACAR, ACU), this step being followed by a step Db consisting in carrying out the evaluation for the above-mentioned access mode proposal 9 ^ (.). Of course, the process in steps C8b and Db is continued for k = k + 1 for each successive quantum of data in step C9b. The access mode control process can then be continued in accordance with FIG. 1, the access mode continuation being carried out as long as the evaluation for each access mode proposition of rank k is evaluated at the true value. . It is understood that the second mode of implementation of the protocol object of the present as shown in Figure 2b allows on the one hand, thanks to the upstream control performed through the pre-validation in step C3b, perform direct management of each electronic token holder PU at the server center and, on the other hand, remove any need to perform a consumption statement at the remote terminal of address j. Finally, a simplified version in a third variant of implementation of the protocol which is the subject of the present invention, a simplified version with respect to the mode of implementation of FIG. 2b, will now be described in conjunction with FIG. 2c. In FIG. 2c, it is considered, in a step C1c, that the authorized user subscriber simply sends a request to the server, this request being denoted 91 _j (-, -). This request can simply include the address j of the remote terminal Tj, parameters for identifying the requester and justifying their authorization to interrogate the server center. The aforementioned request also includes a reference to the requested service, that is to say to the data for which access is requested. In this third mode of implementation, the upstream control carried out by the pre-validation step of FIG. 2b is eliminated. Under these conditions, a step C2c is called, which corresponds to steps C5b and C6b of FIG. 2b, step C2c corresponding to the transmission of the quantum of data and of the control message previously described in connection with FIG. 2b. Step C2c is systematically reproduced in step C3c denoted k = k + 1 for the various successive quanta constituting all the support data of the service requested.

On reception of the successive quanta of data at the remote terminal of address j, a step C4c is called, which consists in establishing the proposed access mode in the same way as in step C8b in FIG. 2b. Step C4c is followed by a step De consisting in carrying out the evaluation of the proposed mode of access S ^.) Previously described in connection with FIG. 2b. The process is continued for any quantum of data of rank k by step C5c, denoted k = k + 1, as long as data is transmitted and the evaluation carried out in step De is verified at the true value. The access mode control process can then be continued by steps E, F and G of FIG. 1 in the same way as in the case of FIG. 2b.

The mode of implementation according to the third variant of implementation of FIG. 2c of the protocol which is the subject of the present invention makes it possible to carry out the entire evaluation process at each remote terminal of address j, the operations at host level being reduced to their simplest expression, and consisting in subdividing the service support data into successive amounts of information. However, this variant embodiment requires verification or consumption statements made from each authorized subscriber having a remote terminal with address j. A preferred mode of implementation of the protocol for controlling the mode of access to data which is the subject of the present invention will now be described, secondly, in conjunction with FIGS. 3a and 3b in the case of a transmission of this data in multipoint point mode.

The aforementioned mode of implementation then appears to be more particularly suitable for implementation in the context of the transmission of broadcast television programs, whether these programs are transmitted in scrambled or clear form.

When the program data is transmitted in scrambled form, it is recalled, by way of nonlimiting example, that this data is transmitted between a center for transmitting scrambled information, scrambling being carried out by means of a service key contained in a control word and the control word being encrypted by means of an exploitation key. The operating key can then be changed for security purposes, the message to change the operating key being encrypted by means of a management key during any change of the aforementioned operating key. Changes to the encrypted control word and the encrypted operating key are synchronized with scrambled information for transmission to one or more descrambling terminals. Authorized user customers have a subscription and form an address group, for example. Each remote terminal T ,, where l denotes the group address, or where appropriate, the address of a single terminal when the group consists of a single subscriber, is provided with a security processor denoted PS,

Under these conditions, and in accordance with a particularly advantageous aspect of the protocol which is the subject of the present invention, step A, consisting in establishing each access right AR and each electronic token holder PU, described in conjunction with FIG. 1, can consist to be transmitted, to each descrambling terminal T, and to the access control module associated with this last, in a step A ', messages for managing access rights and electronic token holders, these messages verifying the relationship (6):

EMM _f (AR, PU) (6)

Likewise, the abovementioned step A ′ is followed by a step B ′ making it possible to establish each access criterion in accordance with step B of FIG. 1 and advantageously consisting in transmitting to each descrambling terminal T, and to the access control module associated with each of these access control messages checking the relation (7):

ECM _f (ACAR, ACU) (7)

On reception, by each remote terminal 1 ₍ and by the security processor PS _f associated with each of the latter, of the aforementioned messages, the content of these messages, after verification, is stored in the access control module, which can then proceed, at step C, to the establishment of the access mode proposal in a similar manner to step C of FIG. 1, then to step D of evaluation of the mode proposal d above access.

In FIG. 3a, the proposed mode of access checks the relation (8):

9 ₍ (AR, PU, ACAR, ACU) (8)

and the evaluation checks the relation (9):

S (rJ ⁾ AR, PU, ACAR, ACU)) (9)

The protocol for controlling the access mode is continued in steps E, F, G in the same way as in the case of FIG. 1. The latter is however, implemented at the level of each terminal T _f and of the security processor PS, of the access control module associated with each of the latter.

A more detailed description of a variant implementation of the data access control protocol object of the present invention will now be described in conjunction with FIG. 3b in the more specific case of a one-off offer from acquisition of rights to different subscribers, this one-off offer being more commonly designated, in the context of point-to-multipoint transmission, by impulse purchase offer.

This possibility of controlling access mode appears to be particularly advantageous insofar as any subscriber, provided with a descrambling terminal T, and an access control module equipped with a security processor PS, can see offer, at any time, a possibility of access at the sole initiative of the broadcasting operator.

Under these conditions, with reference to FIG. 3b, it is indicated that the step consisting in establishing each access right and each electronic token holder can consist, in a step A ", in transmitting, to each authorized user, messages verifying the relation (10):

EPM AR, PU, PD, Cost [PUId, UC]) (10)

These access proposal offer messages contain at least the AR or electronic token holder access rights PU, a proposal or offer date date variable PD, as well as a Cost cost variable defined from constraints on the identification number variable of at least one electronic token holder PUId and of an account unit variable denoted UC of this or these corresponding electronic token holders.

Given the similar coding of the access rights AR and the electronic token holders PU, it is understood that the messages verifying the relation (10) can correspond either: - to an impulsive proposal for acquiring access rights:

- IPAR = Date AR Cost with Cost = Costld Purseld [PurseSubld] CostUnits, - or a proposal to acquire an IPPurse electronic token holder, such as:

- IPPurse = Date PUrse Cost, with Cost = Costld Purseld [PurseSubld] CostUnits. In this mode of implementation, it is recalled that Date defines the date of the offer PD, AR defines the right of access as defined previously in the description and Cost defines the cost variable, as previously mentioned with the set of parameters, Costld designating a purchase identifier, Purseld designating an electronic token holder identifier, PurseSubld, an electronic token holder sub-identifier and CostUnits corresponding to the UC account unit previously defined in the description.

It is indicated that the link between identifiers and sub-identifiers and the actual access mode, such as subscription, time plan or other, is then carried out in the form of wording recorded in clear in the data blocks of the control module d 'access, the latter can be achieved in the form of a microprocessor card, as mentioned above, in order to allow a presentation in clear to the subscriber by simple display. The corresponding data blocks are on the other hand write-protected under the control of the broadcasting operator.

A more detailed description of specific applications of the access mode control protocol which is the subject of the present invention will now be given in connection with FIGS. 4a to 4d in different situations corresponding to the acquisition of AR access rights, the acquisition by punctual action or by impulsive purchase of units via an electronic token holder, the acquisition of a right via a punctual offer or impulse purchase offer, by the through an electronic token holder, and the acquisition, in punctual or impulse mode, of a new electronic token holder through an electronic token holder held by the subscriber in his access control module or dedicated microprocessor card.

In general, it is recalled that the different variables constituting the access rights AR and the access criteria AC correspond to coded values the wording of which can be translated in clear for the purposes of informing the subscriber user.

By way of nonlimiting example, it is indicated that the values of the variables can be defined in the following manner: • Rightld = subscription / session / geographic group

• Unitld = Byte (byte) / time, time designating a duration

• Purseld = token credit / subscription package / session package / duration package / volume package.

The correspondence between the coded values of the aforementioned variables and their wording can be defined in private data, of text or digital type for example, in the access control module or microprocessor card and, in particular, in the memory areas of the security processor equipping them. By way of nonlimiting example, the values of the above coded variables and the corresponding wording can be established according to the table below:

Table T1

By observing the above table, it is understood, in particular, that: - the access rights are defined by the Rightld identification variables for the rights corresponding to the labels of subscription, session, geographic group respectively; - the token holders are defined by the variable Purseld for the values corresponding to the labels credit of tokens, subscription package, session package, time package, volume package respectively.

For electronic token holders, a conversion rate can advantageously be used, the conversion rate making it possible to modulate the access mode selected by the subscribed user as a function of the access mode granted and the counting unit of the information or data accessed, the unit corresponding to monetary account units, for example Euros or other, subscription or number units. Finally, an overdraft can be associated and granted for certain access modes such as for example the credit package or the token credit. The value of the associated overdraft is given in real value.

Finally, Unitld access unit variables can correspond to a time unit label, time during which access to information or data is granted, or in volume unit, volume of information or data to which the access is granted. As for the token identification variable, a conversion rate parameter is provided, allowing to modulate the access mode taking into account the unit used, the second for the time unit, the Koctet per example for the volume unit.

It is understood in particular that, within the framework of a point-to-point transmission, the variable of access unit, identifier and sub-identifier of an access unit, can for example correspond to a volume unit such that the Koctet, as mentioned previously in the description.

The unit of time, the second, can, on the contrary, be used for point-to-multipoint transmissions in which the transmission is substantially regular and regulated by the periodic sending of the ECM messages of change of the service key or control word. for example. In the description below, the various examples illustrated by FIGS. 4a to 4d are given, these examples corresponding to specific modes of implementation of the evaluation step from the access proposal step, as described previously in the description for steps D and C of FIG. 1 or the variant embodiments of the latter according to FIGS. 2a to 2c and 3a, 3b.

It is understood in particular that, following the choice of the user subscriber, and according to their access mode wishes, and the acquisition offers made by the broadcasting operator, the access mode proposal makes it possible to carry out the evaluation of the access constraints established on the basis of the access criteria ACAR, ACU applied to the access rights AR respectively to the electronic token holder PU.

In the description below, it is indicated that the variables of the access rights will be designated by simple designations corresponding substantially to the preceding designations, while the corresponding variables of the access criteria will be designated by variables indexed by the letters AC for recall their belonging to the definition of the aforementioned access criteria and distinguish them, if necessary, from the corresponding variables defining the access rights.

Evaluation of the access mode control on criteria by right of access as such. Example according to figure 4a, Control_ACAR:

the aforementioned access mode criterion is checked if it exists in the dedicated file of the subscriber's access control module, that is to say of the microprocessor card of which he is the holder or in the latter's remote terminal, an access right verifying the test 40a according to which the identification of the right designated by the RightldAc access criterion is equal to the identification of the right of the Rightld subscriber. On a negative response to this test, a step 40b of end of evaluation for the right considered FE is called which can cause an alarm at the remote terminal or the descrambling terminal.

On a positive response to test 40a, a test 40c is called consisting in verifying whether the right sub-identifier of the RightSubld access criterion _A c is equal to access right sub-identifier or if one of the two sub-identifiers is not specified.

The test in step 40c checks the relationship:

RightSubld _Ac = RightSubld or Wφ. The notation Wφ. Denotes the absence of one of the sub-identifiers of the previous relation.

The test 40c can, if necessary, be executed in a similar manner on the combination of variable / sub-variable RightSubld _A c [Level], when the sub-variable Level is present. On a negative response to test 40c, the end of assessment step 40b for the right considered FE is called again. On the contrary, on a positive response to the test 40c, the step 40d is called consisting of a verification test of the level of the access criterion vis-à-vis the corresponding level of the access right registered in the subscriber card or in the remote terminal thereof. The 40d test checks the relationship:

LAC ≤ L or Wφ. The notation Wφ. Indicates that one of the variables of level LAC of the access criterion respectively L of the right of access is not specified, this condition being noted in a manner analogous to test 40c.

On a negative response to test 40d, the end of evaluation step for the right considered FE of step 40b is called. On the contrary, on a positive response to the 40d test, the AR right registered in the card is considered valid from the point of view of the definition of the corresponding access mode vis-à-vis the access criterion designated by the broadcaster corresponding controls. The verification steps 40a, 40c, 40d in fact correspond to a verification of the access mode and of the compatibility of the access modes registered with the subscriber as an access right with respect to the criteria of access transmitted by ECM control messages.

The process for verifying the aforementioned access mode is then followed, on a positive response to the test step 40d, with a temporal verification of the access mode under the following conditions: the aforementioned temporal verification applies to three different situations depending on whether the AR access right registered in the subscriber's access control module, or in the terminal of this last, corresponds to a right to fixed dates, to a right to activable dates or to a right without date.

It is understood, in particular, that the variable Validity of the access right AR corresponds to a start date and an end date of the right. These dates are generally designated by Dates and the Date variable of each access criterion ACAR, ACU is designated by Date _A c-

Under these conditions, the temporal verification of the access mode can consist in carrying out a 40th test consisting in verifying whether the dates Dates defining the validity variable Validity of the access right constitute fixed dates.

On a positive response to the 40th test, a 40f test is called, which consists in checking whether the date DatβAc of the access criterion is understood, in the broad sense, between the start date and the end date of the abovementioned right of access. The 40f test checks the relationship: Datβ _To this Validity where Validity represents the fixed dates Dates of the registered access right AR.

On negative response to test 40f, an end of evaluation step 40g, similar to step 40b previously mentioned, is called. This step may include an alarm intended to inform the user subscriber. On the contrary, on a positive response to test 40f, the temporal verification procedure of the access mode is continued by the establishment of an evaluation variable at step 40h, noted EVC = 1, this variable corresponding to the value true of the evaluation for example.

On the contrary, on a negative response to the 40th test, a return is made for a resumption of the temporal verification of the access mode for discrimination of the Validity parameter of the access right registered AR, according to activatable dates or the absence of date.

Under these conditions, a test 40i is called, which consists in checking whether the registered access right AR includes activatable dates. On a positive response to the 40i test, a 40j test is called, which consists in checking whether the date of the access criterion DatβAc is less than or equal to the expiration date of the registered access right AR. The 40j test checks the relationship:

Date _At this Validity On negative response to the test 40j, an end of evaluation step 40k, analogous to the preceding step 40b, is called, an alarm being able to be triggered at the level of the remote terminal or of the descrambling terminal.

On the contrary, on a positive response to the test 40j, a step 401 is called. In the case where the subscriber has given his agreement for the activation of the dates, and therefore in positive response to the test 401, the right to activatable date is activated, that is to say that this right is transformed into a right on fixed dates. This operation is carried out in step 40n, the transformation operation consisting in taking as the fixed start date of validity the current effective date, Date, contained in the access control message, taking into account the agreement given by the maid. Step 40n can then be followed by a return to the right criteria verification process on fixed dates, that is to say by a return upstream of the test 40f for example, to ensure similar subsequent management for example of the right to fixed dates thus created by the user. On the contrary, on a negative response to test 401, the user subscriber not having given his agreement, a step of requesting agreement 40m is called, this step being followed by a return upstream of the test step 401 to continue the process.

It is understood in particular that, on a positive response to the test step 401, following the transformation of the right to activatable date into a right to fixed dates, the control of rights generated by the next control message, such as a message ECM, previously mentioned in the description and carrying access criteria, will be verified by the process of verifying rights on fixed dates according to the procedure described previously in the description, with steps 40e, 40f and 40g.

On the contrary, on a negative response at step 40i, the AR registered access right having no fixed date or activatable date, a verification test 40p is called, which consists in verifying that the registered AR right is a right undated, that is to say a right whose Validity parameter is in fact not specified, the right, in this case, can be validated.

On a positive response to the 40p test, i.e. in the absence of specification of the Validity parameter for the registered access right AR, the Access control process is continued by the call of the aforementioned step 40h, no control being carried out on the date of the transmitted access criterion.

On negative response to the test 40p, a step 40q of end of evaluation for the right considered FE is called.

Verification of access mode control based on criteria per unit consumed in an electronic token holder. Figure 4b, Purchase_Unit:

The process described in connection with FIG. 4b allows the acquisition of a unit by acquisition operation, such as impulse purchase, via an electronic token holder stored in the subscriber's access control module or in the card of it.

The protocol object of the present invention appears particularly remarkable insofar as, due to the similar coding mode of the electronic token holders PU and the access rights AR, the same test criteria can be applied substantially to the electronic token holders and to the AR registered access rights for this reason.

Consequently, in FIG. 4b, the test steps 40a, 40c and 40d no longer relate to the identifiers of the access rights and the access criteria respectively of the sub-identifiers of access rights and of access criteria and level of access criteria and access rights, but, on the contrary, respectively on electronic token holder identifiers, electronic token holder sub-identifiers and cost of the operation of acquiring a token holder electronic vis-à-vis the remaining units in the electronic token holder entered in the subscriber's card. Thus, tests with the same references verify the relationships:

- 40a: PurseldAc = Purseld, the identifier of the token holder transmitted by the ACU access criterion is equal to the identifier of the Purseld token holder entered in the subscriber's card;

- 40c: the sub-identifier of the PurseSubld token holder _A c transmitted by the ACU access criterion is equal to the sub-identifier of the token holder entered in the PurseSubld card where one of the two has no sub-identifier, the 40c test checking the relation: PurseSubldAc = PurseSubld or Wφ, one of the two sub-identifiers not being specified.

- 40d: Cost _AC (PUId, UC) with UC <CO, the cost of the operation of acquiring a right via a token holder entered in the card is less than or equal to the remaining CO units of the token holder of the subscriber.

The operation of verifying the corresponding access mode having been successful on positive response to the aforementioned test 40d, the process is continued by a temporal verification of the access mode, as in FIG. 4a.

By way of nonlimiting example, it is indicated that steps 40e, 40f to 40m, 40p, 40q represent the same test and / or operation steps as in the case of FIG. 4a, the variables Datβ _A c and Validity representing however the date of impulsive acquisition of the right by an electronic token holder respectively the validity variable.

Under these conditions, step 40n in FIG. 4b does not concern the transformation of the right to fixed dates, as in the case of FIG. 4a, but the transformation of the electronic token holder into a token holder on fixed dates, under operational conditions similar to those in Figure 4a for the acquired right of access.

Finally, it is indicated that the operation 401 relates to the verification of the subscriber's agreement on the operation carried out, the request for agreement 40m may consist, on the one hand, in the request for agreement for the activation the electronic token holder, which is transformed into an electronic token holder with fixed dates and, on the other hand, into the request for a final purchase agreement for the unit in question.

Following the satisfaction of one of the criteria, as in the case of FIG. 4a, step 40h is called, for which the evaluation or the evaluation variable EVC is considered to be true. However, a unit consumption parameter, designated by UC archiving, is stored, this parameter can be characterized by the identifier and sub-identifier of units resulting from the operation and the number of units consumed with l identifier and sub-identifier of the electronic token holder associated with these. This operation is carried out in step 40ha, prior to step 40h for example. Of course, the remaining electronic token holder units CO are also reduced by the cost of the purchase, this operation being noted, in step 40ha: NCO = CO - UC.

Impulsive acquisition of rights. Figure 4c. Purchase_AR; This operation comprises the same steps 40a, 40b, 40c, 40d allowing the implementation of the access mode verification as in the case of FIG. 4b. The different variables represent, for these tests, the same elements as in the case of FIG. 4b.

It is the same with regard to the temporal verification of the access mode of steps 40e, 40f, 40g, 40h and 40i, 40j, 40k, 401, 40m and 40n, 40p and 40q corresponding substantially to the same steps carrying the same references in Figure 4b.

Due to the similar coding of the access rights and the access criteria, step 40ha corresponds substantially to an updating of the remaining units reduced by the cost of the acquisition by NCO = CO - UC, as mentioned previously with respect to the Figure 4b.

Step 40ha is then followed by a step 40hb of recording the right proper at the level of the access control module available to the subscriber. In the test steps 40f and 40j, it is indicated that Validity designates the validity variable of the electronic token holder inscribed in the card and DatβAc designates the date on which the operation is actually executed.

Impulsive purchase of electronic token holder. Figure 4d, Purchase_PU; This operation allows the impulsive purchase of a new electronic token holder via an electronic token holder registered in the subscriber's access control module if the conditions below are satisfied. In general, it is recalled, due to the substantially identical coding of the electronic token holders PU and the access rights AR, so as to constitute generic rights, that the process represented in FIG. 4d comprises the same steps for verifying the mode of access with tests 40a, 40c, 40d, then of temporal verification of the mode of access, steps 40e to 40h, 40i to 40n, 40p, 40q and 40ha being identical to those of FIG. 4c for this reason. However, the step 40hb of recording the right of FIG. 4c is replaced this time by the step of recording the new token holder 40hb. It is thus understood, on observing FIGS. 4a to 4c, that the step of evaluating the constraints of the access rights and the electronic token holder acquired preferably comprises a step of verifying the mode of access and the compatibility of the rights registered with regard to the access criteria, then, in the case of the aforementioned figures, a step of temporal verification of the access mode. These stages can be reversed in their succession, without disadvantage. The generic access rights and the generic access criteria in accordance with the object of the present invention appear to be particularly flexible to use, insofar as the latter allow the implementation of particularly advantageous control messages. Indeed, these command messages can be programmable, so as to include a logical combination of conditions whose binary result of the True or False logical verification makes it possible to generate a conditional branching of actions, these actions being processed sequentially by the terminal or the destination security processor.

It is understood, under these conditions, that it is possible to combine punctual offers or impulse purchase offers thanks to the aforementioned logical combinations, in order to produce complex offers conferring very great flexibility of use for user subscribers.

An example of the implementation of messages of this type comprising two access conditions, such as for example an impulse offer to purchase a package, designated package number A, or consumption on a package, designated package number B, acquired by the subscriber and a consumption report for a package will now be described in conjunction with FIG. 5.

In general, it is indicated that the protocol which is the subject of the present invention, in particular for achieving the combination of different access modes, appears to be particularly well suited to applications in point-to-multipoint transmission when the data is transmitted in a scrambled manner. , as described previously in the description. Of course, such a point-to-multipoint transmission mode is not limiting and it is entirely it is conceivable to transmit the data in clear, or even in scrambled form, by a point-to-point transmission via an IP type transmission protocol for example.

Consequently, with reference to FIG. 5, the protocol which is the subject of the present invention, in this application for combining distinct access modes, will be described when the latter is implemented from a transmission center CE to a descrambling terminal denoted T, equipped with an access control module CAM, formed for example by a microprocessor card and equipped with a security processor PS ,. Conventionally, the emission center CE can advantageously include, as shown in FIG. 5, a subscriber commercial management system, noted SGC, connected to a unit managing ATM access titles, the assembly allowing '' generate messages, called subscription management messages or EMM messages for Entitlement Management Messages. The EMM messages are transmitted to a messaging broadcaster DM and a data collector makes it possible to collect data from each subscriber via a return channel, such as for example the switched telephone network or the like. The return channel makes it possible to ensure the return of fundamental information in order to carry out invoicing for example and thus remunerate the broadcaster or the beneficiaries of the latter. The data collector is of course directly connected to the system managing the GTA access titles.

Finally, a CTA access ticket controller generates control messages called ECM messages for Entitlement Control Messages. The set of EMM messages and ECM messages delivered by the messaging broadcaster DM respectively by the CTA can then be multiplexed with the data in clear, which, before transmission, can be coded and then scrambled in a manner known as such. The transmission to the descrambling terminal is then carried out either by satellite or by terrestrial cable for example. The ECM messages containing the cryptogram of the control words can then make it possible to descramble the data scrambled on reception at the level of the descrambling terminal T, taking into account the existence of access rights AR and / or of electronic token holder PU registered in the access control module CAM ,,, as described previously in the description.

In connection with FIG. 5, it is indicated that the access mode control process combining two distinct access modes can be accessible by subscription, as will be described below.

By way of nonlimiting example, access control by subscription can be carried out on the basis of a criterion by right of access, as described in connection with FIG. 4a by a message of the Control_ACAR type.

If the subscriber does not have the corresponding subscription, impulse purchase offers associated with the program allow access, such as:

- The acquisition of the subscription in a package from an impulse purchase message of rights, as described in connection with Figure 4c, of the type Purchase_AR;

- the acquisition of a subscription package to then be able to access the subscription in the package, that is to say according to the combination of messages

Purchase_PU, as previously described in connection with Figure 4d, plus the message Purchase_AR, as previously described in connection with Figure 4c.

The protocol which is the subject of the present invention then consists in synchronizing the following messages, ECM messages and EMM messages, the aforementioned EMM messages being designated EPM messages because of the access mode offer offered by the latter.

The following sequence is then transmitted by the CE emission center:

- the access criteria and the control words CW in the form: - ECM = If Control_ACAR, then Decipher_CW.

It is understood, in particular, that the message ECM comprises the logical combination of the decryption of the control word at the level of the security processor PS, associated with the descrambling terminal and with the execution of the decryption of the control word CW from the key current operations.

- the possibilities of impulse access mode, via EPM messages, of the form: - EPMi = Purchase_AR, as described previously according to FIG. 4c,

- EPM ₂ = Purchase_PU, as described with Figure 4d. The detailed content of the above messages is as follows:

Table T2

The access condition

Access mode acquisition proposals

With reference to table T2, it is indicated that the proposals for acquisition of access mode, as described in detail in the aforementioned table, correspond to the impulse purchase of package previously described in connection with FIG. 4d, respectively a proposed mode of access and therefore consumption in a subscription package. The access rights parameters, that is to say token holder for the corresponding package, respectively corresponding subscription package, are also given in table T2.

Relative to the criteria by access rights, it is indicated that the variable Storable corresponds to the possibility of registration or not by the user.

The access mode control process will now be described in two distinct situations corresponding on the one hand to the case where the subscriber already has the subscription plan and / or on the other hand, the subscriber does not have the plan number of subscriptions, package number B. In the latter case, he must acquire the subscription package, then the subscription in this package to be able to access the broadcast program.

First case: the subscriber already has subscription plan B: Before the access mode control process itself, the subscriber's access control module contains:

Table T3. Labels and conversion rates in the card (Private data)

B subscription package

Credit

The procedure for checking the access mode is as follows: the subscriber will charge his access mode in his subscription plan B.

- First presentation of ECM message: the subscriber does not access the broadcast data program because he does not have the subscription. The descrambling terminal T performs a search for proposals for access mode by impulse purchase associated with the scrambled data program broadcast. He presents these proposals to the CAM access control module.

Presentation of EPM impulse purchase messages: • Processing of EPMi, Purchase_AR message, according to Figure 4c. The proposed mode of access indicates that the right can be purchased through a Purseld type 20 token holder for a cost of 1 depending on the conversion rate. In table T3, the concepts of unit conversion rate and overdraft, if any, correspond to the concepts previously defined in the description. The same is true for the validity variables. In the example given in the subscriber's card, the subscription package B corresponds to a type 1 token holder, subscription package valid on the date of acquisition. Sufficient units remain, number of subscriptions = 6; the CAM access control module can then respond with a request for agreement from the subscriber, indicating the package used. The subscriber can then acquire the subscription via his subscription package B.

- Second presentation of ECM message: the subscriber accesses the program because he has the subscription. After the implementation of the access mode control process previously described in connection with tables T2 and T3, the CAM access control module contains: the different data according to table T4: Table T4

Labels and conversion rates in the card (Private data)

B subscription package

Consumption of Access Rights

ConsR = Date AR Cost with Cost = Purseld Units

The aforementioned table T4 includes the labels and conversion rates in the card, in the form of private data, the state of the subscription package B. It also includes, in the form of data not accessible to the user, written in italics, consumption data for access rights designated ConsR and in the form Date, AR and Cost access rights for cost, with Cost = Purseld Units.

Finally, the card contains data relating to the subscription associated with the previous consumption. The content of the statement is then given by table T5

Table T5

Consumption of Access Rights

ConsR = Date AR Cost with Cost = Purseld Units

The data in this table can correspond, for example, to the data on the consumption of access rights and to the subscription associated with the previous consumption, as described previously in connection with table T4. Of course, these contents of the statement are not accessible in writing by the user and can be transmitted as a statement of consumption to the emission center CE by the return channel.

- Second case: the subscriber does not have the subscription plan B which is necessary for him. He must, in this situation, acquire such a package, then the subscription in this package to access the broadcast data program.

Before implementing the corresponding access mode control process, the CAM access mode module contains:

- the labels and conversion rate in the card in the form of private data,

- the credit allocated to the electronic token holder with Purseld identifier and defined in number of units in the Units column.

These data are shown in Table T6: Table T6

Labels and conversion rates in the card (Private data)

The procedure for controlling the access mode is as follows:

- First presentation of ECM messages: the subscriber does not access the program because he does not have the subscription.

The terminal T _f performs a search for acquisition proposals in impulse mode associated with the broadcast program. These proposals are presented to the CAM _f access control module.

Presentation of acquisition EPM messages in impulsive mode: • Processing of Purchase_PU type EPM ₂ message according to Figure 4b: the acquisition proposal indicates that the subscription package A can be purchased via a token holder type 10 for a cost of 10 units of account. In the card dedicated to the subscriber, the credit allocated to the latter is none other than a type 10 token holder (see Table T6) valid on the date of purchase. The number of units equal to 50 is sufficient. The subscriber's card responds with an agreement request indicating the package used, this agreement request corresponding substantially to the test operation £ 40 in FIG. 4c. The subscriber can then acquire the subscription package via his credit and he can then buy the subscription through this package which is also a type 20 token holder.

When an agreement is recorded, in the agreement request step 40, for the subscription package A, the re-transmission of impulse purchase EPM ₂ messages causes the purchase of the subscription package A with the credit that is debited.

• The processing of the EPM _T message of the Purchase_AR type is as follows: the proposed acquisition of access mode indicates that the right can be acquired via a type 20 token holder for a cost of one unit account (Confer the wording of the corresponding message in table T2).

In the memories of the subscriber's card or access control module, there is no electronic token holder of type 20, the credit data simply indicating the existence of an electronic token holder of type 10, token credit. The CAM access control module responds by notifying the absence of a relevant electronic token holder. The subscriber cannot therefore acquire the required subscription.

- Second presentation of ECM messages: the subscriber accesses the broadcast program, because he has, of course, the subscription. Following the implementation of the access mode control protocol object of the present invention, as previously described, the card contains the information stored below, according to table T7: Table T7 Labels and conversion rates in the card (Private data)

Consumption of Access Rights

ConsR = Date Purse Cost with Cost = Purseld Units

Subscription package A associated with previous consumption

Consumption of Access Rights

ConsR = Date AR Cost with Cost = Purseld Units

This information includes the labels and conversion rates in the card in the form of private data.

Credit is allocated to the card, this data can be read by the user.

In addition, the data stored in the card contains data relating to the consumption of access rights, data from subscription plan A associated with the preceding consumption, data from consumption of access rights, the service plan. subscription A associated with the previous consumption and the subscription associated with the previous consumption being explained.

In the same way as in the first case, statement content information can then be established according to table T8:

Table T8

. Consumption of Access Rights

ConsR = Date Purse Cost with Cost = Purseld Units

. Consumption of Access Rights

ConsR = Date AR Cost with Cost = Purseld Units

As in the previous case, the data in table T8 can correspond to the data on consumption of access rights, subscription package A associated with the previous consumption, consumption of access rights and subscription associated with previous consumption, data which can only be read by the user.

Thus, with reference to the first and second cases described above, it is understood that a combination of generic access modes can be implemented by synchronization of a succession of ECM messages and EMM messages. In these conditions, a control of the access mode by criterion per unit of quantity of data accessed can be carried out from an access mode by criterion by nominal access right, through a proposal d acquisition in impulsive mode of right of access respectively of electronic token holder.

Claims

1. Protocol for controlling the mode of access to data on the basis of access rights and access criteria, the control of the access mode being subject to a condition of validity of at least one access right or an electronic token holder, characterized in that it consists:

to establish each right of access and each electronic token holder acquired by an authorized user in the form of a first set of variables constituted by independent variables and related variables, said independent variables containing at least one variable of duration of validity and a variable of identification number of each access right respectively of each electronic token holder;

- to establish each access criterion in the form of a second set of variables consisting of independent variables and related variables, said independent variables containing at least one access date variable, one identification variable of type of criterion access and a variable of identification number of access right or electronic token holder;

- to establish a proposed mode of access to data in the form of a logical combination of access criteria to define access constraints;

- to submit said proposed mode of access to an evaluation of the access constraints vis-à-vis said access rights and electronic token holder acquired, the access mode being accepted and access to said data being continued for the true value of said evaluation and the mode of access and access to said data not being continued otherwise.

2. Protocol according to claim 1, characterized in that each access criterion further comprises constraint variables to be applied to said variables of said access rights or electronic token holder.

3. Protocol according to claim 1 or 2, characterized in that said variable for identifying the type of access criterion designates a criterion by nominal access right or a criterion per unit of quantity of data accessed.

4. Protocol according to one of claims 1 to 3, characterized in that, for a point-to-point transmission between a server center and a terminal remote, said step of establishing a proposed access mode consists of at least:

to transmit, from the remote terminal to the server center, an access request comprising at least said access rights or electronic token holder, and at said server center,

- to establish said proposed mode of access to data from said access rights and said access criteria to define said access constraints.

5. Protocol according to one of claims 1 to 3, characterized in that, for a point-to-point transmission between a server center and a remote terminal, said step consisting in establishing a proposed mode of access consists at least:

- to submit said access rights or electronic token holder transmitted to a pre-validation test; and on the pre-validation test criteria verified,

- generating a current quantum of data and an access control message specific to this current quantum of data and containing at least said access control criteria;

to transmit, from said server center to said remote terminal, said current quantum of data and said access control message; and

to continue, by iteration, the steps consisting in generating a quantum of data for a next quantum of data and an access control message specific to this next quantum of data, as long as said pre-validation test criterion is verified ; and, at said remote terminal,

- establish said proposed mode of access from said access criteria and said access rights for each successive quantum of data received.

- to submit each successive access mode proposal to the said evaluation, access to the data being continued for any receipt of a current quantum of data and a specific control message associated with this quantum of data.

6. Protocol according to one of claims 1 to 3, characterized in that said protocol being implemented in multipoint point transmission between a center for transmitting scrambled information by means of a service key contained in a control word , the control word encrypted by means of an exploitation key and the exploitation key encrypted by means of a management key during a change and synchronized with the scrambled information for transmission to at least one descrambling terminal associated with an access control module, provided with a security processor, this further consists of:

to transmit to said descrambling terminal and said access control module messages for managing access rights and electronic token holder, EMM messages, comprising said access rights or the electronic token holder;

to transmit to said descrambling terminal and said access control module messages for controlling access tickets, ECM messages, comprising said access control criteria.

7. Protocol according to one of claims 1 to 6, characterized in that it also consists in verifying the value of the access date variable, of the identification variable of type of access criterion and of the access right identification number variable, vis-à-vis the corresponding variables of said access rights or electronic token holder.

8. Protocol according to one of claims 1 to 3, characterized in that the step consisting in establishing each access right and each electronic token holder consists in transmitting to each authorized user messages containing at least, said rights of access or electronic token holder, a proposal date variable, a cost variable defined from constraints on the variable of identification number of at least one electronic token holder and a variable of account unit values of this electronic token holder (s).

9. Protocol according to one of claims 1 to 8, characterized in that, after acceptance of the mode of access to said scrambled data, it also consists:

- to establish a consumption variable of quantity of data accessed respectively by rights or electronic token holder in the form of a set of variables constituted by independent variables and related variables, said independent variables containing at least said constituent variables of said proposition access mode,

- to update, update, said electronic token holder according to said consumption variable.

10. Protocol according to claim 9, characterized in that said variable of consumption of quantity of data accessed, comprises, depending on the type of access criterion:

- a consumption variable for access rights, or - a consumption variable for account units.

11. Protocol according to one of claims 1 to 10, characterized in that said access rights also comprise a linked variable of sub-identifier and a linked variable of level, said linked variables being optional.

12. Protocol according to one of claims 1 to 11, characterized in that said electronic token holder further comprises a linked variable of sub-identifier and a linked variable for reporting the content of the electronic token holder, said linked variables being optional.

13. Protocol according to one of claims 3 to 12, characterized in that said access criterion by nominal access right further comprises a linked variable of sub-identifier and a linked variable of level, said linked variables being optional .

14. Protocol according to one of claims 3 to 13, characterized in that said access criterion per unit of quantity of data accessed further comprises a linked variable of sub-identifier of an access unit and a linked variable maximum cost designating a ceiling from which the verification of the access criterion is followed by an authorization in the absence of debit or an access ban, said linked variables being optional.

15. Protocol according to one of claims 1 to 14, characterized in that said step of evaluating the constraints of the access rights and acquired electronic token holder comprises at least:

a step of verifying the mode of access and the compatibility of the registered access rights with respect to said access criteria, and,

a step of temporal verification of the access mode, said steps being able to be reversed.

16. Protocol according to one of claims 1 to 15, characterized in that said period of validity of each registered access right and of each electronic token holder is coded according to a type of date, fixed dates, activatable dates or absence of date specification.

17. Protocol according to claims 15 and 16, characterized in that said step of temporal verification of the access mode consists of at least:

- to discriminate the type of date, fixed dates, activatable dates or absence of date specification, the discrimination of the type of activatable dates being followed, following a verification of validity of the date belonging to this type of date, by a step consisting of:

to transform said right of access respectively said electronic token holder with activatable date into a right respectively into an electronic token holder with fixed dates, which then makes it possible to process said right of access, respectively said electronic purse according to a right respectively corresponding fixed date electronic money.

18. Protocol according to claim 17, characterized in that said step consisting in transforming said right of access respectively said electronic token holder is conditional on the agreement of the subscriber, relating to this transformation.

19. Protocol according to one of claims 1 to 18, characterized in that it consists of a combination of access modes, implemented from programmable control messages, so as to comprise a logical combination of conditions , whose binary result of the True or False logical verification makes it possible to generate a conditional branching of actions.

20. Protocol according to claims 6 and 19, characterized in that, for a multipoint point transmission of scrambled data to at least one descrambling terminal equipped with an access control module comprising a security processor, and for carrying out of a combination of generic access modes, this consists in synchronizing a succession of access control messages, ECM messages, and access title management messages, EMM messages, which makes it possible to carry out a control of the access mode by criterion per unit of quantity of data accessed on the basis of a criterion by nominal right of access, via a proposal for acquisition in impulsive mode of right of access respectively of door electronic tokens.