US20130103941A1

US20130103941A1 - Method for updating data in a security module

Info

Publication number: US20130103941A1
Application number: US13/711,014
Authority: US
Inventors: Xavier Carrel; Olivier Brique; Henri Kudelski; Nicolas Fischer
Original assignee: Individual
Current assignee: Nagravision SARL
Priority date: 2006-01-24
Filing date: 2012-12-11
Publication date: 2013-04-25
Also published as: EP1980105A1; WO2007085597A1; EP1811778A1; EP1980105B1; US20070174617A1; US8352734B2

Abstract

A method for updating operating data in a security module associated to a user unit for processing digital data broadcast in a transport stream, said unit being connected to a conditional access system transmitting, in said transport stream, to the security module a first stream comprising management messages includes: broadcasting a second stream of operating data patch messages, adding to the first stream of management messages, a trigger message to direct the security module to a conditional access system transmitting a second stream transporting suitable operating data patch messages if a current version of the operating data in the security module requires an update, updating the operating data of the concerned security module with the operating data patch messages from the second stream, directing the security module towards the conditional access system transmitting another stream based on an identifier of the conditional access system in the security module.

Description

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation-in-part of U.S. patent application Ser. No. 11/656,468 entitled “METHOD FOR UPDATING THE FIRMWARE OF A SECURITY MODULE” filed Jan. 23, 2007 claiming priority of European application EP06100799.3 filed Jan. 24, 2006.

FIELD OF THE INVENTION

The present invention relates to the field of updating or modifying operating data in a security module within the scope of Pay-TV. More particularly, it handles on modification of operating data related to security, parameters, access rights, program code, keys, etc. according to different types or generations of processors, memory and/or other hardware components available in the security modules.

TECHNICAL BACKGROUND

The role of a security module is to control the access to a stream transporting encrypted digital data made available to users by a broadcasting server. In the particular case of the Pay-TV field, a user unit or decoder allows the access and decryption of the encrypted audio/video data stream broadcast according to the rights registered in the security module associated to said decoder.
The security module may mainly be provided according to three different forms. One of these is a microprocessor card, a smart card or more generally a protected electronic module that is reputedly tamper-proof. This type of generally removable module is inserted into a suitable reader that connects it to the decoder.
A second known form is that of an integrated circuit case placed, generally irremovably and definitively, inside the box of the decoder. An embodiment is made up of a circuit mounted on a socket or connector as a SIM card (Subscriber Identity Module) in a mobile telephone for example.
In a third form, the security module is arranged inside the case of an integrated circuit having also another function, for example in a decryption module or in the central microprocessor of the decoder.
These security modules provided with communication interfaces receive messages intended on one hand to manage the access rights to the broadcast stream and on the other hand to update or modify the software or firmware assuring the functioning of the module itself.
These messages are called administration or management messages EMM (Entitlement Management Message).
The updates of the rights in the security modules of the user units are carried out by sending of management messages EMM addressed to the concerned units. According to an example of configuration, the management center receives a request transmitted by the security module and transmits in response an EMM message containing, for example, a key allowing the updating of access rights. The security module transmits a reception confirmation message to the management center.
Concerning the firmware stored in the security module, the modifications, in general in the form of pieces of code (patches), constitute a set of EMM messages transmitted to the module in the transport stream of the digital data or in the stream of the control messages ECM or also in a separate stream.
At present, these patches are limited in size and certain cards (or security modules) that cannot be updated to the most recent version are able to decrypt the stream or access to it. Therefore, a new card or a recycled card accessing the stream for first time is immediately functional even without the updating of its firmware. A possible modification of the latter is carried out progressively with EMM messages broadcast in the stream during periods of reduced data throughput.
The document US2005/0091699 describes a method and a system of redirection of software downloading in a cable television network. A downloading control message transmitted from a management center to reception terminals (set top boxes) controls the loading and installation of programs by these terminals. The message provides to the terminal all the necessary information for instantaneous acquisition of data such as a program identifier, a transmission channel identifier, a packet identifier PID or an URL address allowing the location of the data to be downloaded. The message also contains the information allowing the terminal to authenticate and install the new data. The latter compose programs intended to control the terminal or to add supplementary functionalities such as a messaging service or a television program guide. The operating system of the terminal as well as the applications using this system can also be updated by this method.
The document EP1607821 describes a secure updating method of software in a security module. When a program block is ready to be broadcast, the method consists of determining a target area in the memory of the security module. Once the location of this area is known, the content that had been programmed during the personalization of the module can be retrieved thanks to the data stored by the management center. A second block obtained by a reversible mixing operation of this data with the block to be broadcast is transmitted to the concerned security module. On reception, the content of the target memory is read in order to obtain, by a reverse mixing operation, the initial program block that will be stored in the memory of the security module.
The method and the system of the document US2005/0091699 do not allow the loading or updating of the firmware of the security module but only of the software or applications of the reception terminal. A new version of the software of the terminal can certainly ensure the improved working of a security module but in certain cases, however it becomes necessary to update the firmware of the security module itself.
The drawback of the method of the document EP1607821 resides in the fact that it only allows the loading or updating of security module firmware with successive blocks, which can be tedious when the program and/or the frequency of the updates are large. Certain types of security modules or chip cards require patches having a relatively large size and a large number of EMM messages to transmit them entirely. When these messages are transmitted in the digital data stream also comprising the encrypted audio/video data of content and the control messages, the update can take several hours until the reception of the complete patch.
In case the patch is essential for decrypting the data of the stream, a new card inserted into the decoder leads, for example, to a prolonged absence of the image on the television screen; such an interruption being unacceptable.

SUMMARY OF THE INVENTION

The aim of the present invention is to avoid the aforementioned drawbacks and to ensure the fast loading of operating data in a security module with a large number of management messages. Therefore, the frequency of operating data updates can be increased with insignificant negative effects on the reception of the broadcast content.
This aim is achieved by a method for updating operating data in a security module associated to a user unit for processing digital data broadcast in a transport stream, said unit being connected to a conditional access system transmitting, in said transport stream, to the security module a first stream comprising management messages, said security module including an identifier of the conditional access system transmitting the first stream, said method comprising steps of:
broadcasting at least one second stream of management messages configured as operating data patch messages comprising each at least a type code of the security module to be updated, an initial and a final version reference and program data configured to update operating data in the security module,
adding to the first stream of management messages, a management message configured as a trigger message comprising at least the type code of the security module to update, a version information indicating whether said security module is up-to-date, and an identifier indicating to said security module the conditional access system transmitting a second stream transporting suitable operating data patch messages corresponding to the security module defined by the type code, wherein a correspondence table is defined that associates the identifier of the conditional access system to identifiers of the first and second streams transmitted by said conditional access system,
if a current version of the operating data in the security module requires an update, directing the security module towards the conditional access system transmitting the second stream transporting operating data patch messages designated by the identifier included in the trigger message and corresponding to the type of security module defined by the type code, and
updating the operating data of the concerned security module related to the stream of operating data patch messages with the operating data patch messages from the second stream,
directing the security module towards the conditional access system transmitting another stream being determined by the correspondence table with the identifier of the conditional access system.
The method allows the security module to “jump” towards a dedicated separate operating data patch messages stream thanks to the trigger messages stream broadcast in a first stream of management messages. Once the update of the operating data is complete, the security module is directed again either towards the first stream or towards another stream. This return can be carried out either automatically, or by using a switch message comprising an identifier of the first stream or any other stream.
According to an embodiment, when the access to digital data of a broadcast program is no longer possible due to obsolete operating data, the security module can “jump” automatically towards a separate second stream of operating data patch messages. It can also “jump” periodically towards this stream for maintaining the constant updating of its operating data. This embodiment is applied either, when the security module does not transmit operating data version information to the conditional access system, or when the security module ignores its version allowing it to interpret the trigger messages.
The security module then receives in a minimum time a set of messages forming the entire patch and corresponding to its operating data. According to the prior art, the patch messages are broadcast in the transport stream in longer periods and mixed with other management messages. This mixed transmission requires numerous verifications by the security module in order to determine if a received message concerns its operating data or not; these verifications increase considerably the updating time.
The operating data of a security module comprise operating parameters, access control data such as DRM data (Digital Right Management), access rights, program code, firmware, encryption/decryption keys, or any other data related to security.
The user unit may consist of a TV set top box, a personal computer PC, a tablet PC, a smart phone or any other user unit able to receive access controlled audio/video data.
The first stream comprises audio/video data, entitlement control messages ECM, entitlement management messages EMM associated with rights management in the security module and particular management messages intended to be received by the security module configured as trigger message to deviate reception by the security module to a second stream transporting operating data for update.
For a preferred implementation of the method, at least three types of management messages can be used, namely:
a) Trigger messages comprising a code of the type of security module with a final version reference of the operating data or the version to be reached if the current version requires an update, for example when the current version reference is inferior to the targeted version reference, as well as an identifier indicating the conditional access system transmitting the stream of patch messages including operating data.
b) Numerous operating data patch messages forming the patch allowing the updating of the operating data of the security module from an initial version towards a new version. Each patch message contains the code of the type of security module, the initial and final version reference of the updating patch and the operating data. According to an embodiment, the patch messages may contain a specific key in place of the data concerning the type and version.
According to a further embodiment, the operating data patch messages may form a chain. In this case, each patch message further comprises an indication, for example in form of an address or an index defining the position of the message in the chain.
c) Switch messages, transmitted at the end of an operating data patch message chain, allow the security module to receive the first message stream, the second or any other stream when the update is complete. They are used to redirect the security module towards a common stream (the first message stream) to which all the security modules are connected during their normal functioning. The switch messages may be optional since the trigger messages can indicate the conditional access system transmitting the first or a second stream to which the security module should be redirected after update is terminated. The identifier of the stream is determined by the correspondence table.
Entitlement management messages EMM or entitlement control messages ECM or any other message configured to be received by the security module may be used as trigger messages, operating data patch messages or switch messages. The term “management message” designates thus any messages configured in such a way that they are able to be received by the security module. The manner a management message is processed by the security module or not depends on particular configuration of the message in question.
According to an embodiment, the security module is associated to a conditional access system which transmits the stream of management messages serving on one hand to control the access rights to data broadcast in the transport stream and on the other hand to manage the updating of the operating data. Therefore, each security module includes an identifier of the appropriate conditional access system.
The trigger and switch messages do not thus contain an identifier of a stream, but rather the identifier of the conditional access system transmitting this stream. The table therefore converts the conditional access system identifiers into identifiers that indicate the stream towards which the security module has to be directed.
One advantage of this type of a table is that the allocations of a stream with a given identifier to an conditional access system can be modified at any moment according to the available updates and to the used types of security modules.

BRIEF DESCRIPTION OF THE DRAWING

The invention will be better understood thanks to the following detailed description that refers to the annexed drawing given as non-limitative example.

FIG. 1 shows an overview of the mechanism allowing a security module “to jump” towards a dedicated patch message stream when the version of its operating data becomes obsolete.

DETAILED DESCRIPTION OF A PREFERRED MODE OF CARRYING OUT THE INVENTION

FIG. 1 shows a simplified diagram of the updating method for security modules (SM1, SM2, SM3, SM4) with trigger messages (T) and patch messages (EP) using a table (CAT). The latter associates the identifiers (CASID) of conditional access systems with identifiers (PID) of the stream (P0, P1, P2, Pt) of management messages (EMM).
The example in FIG. 1 shows a stream (P1) of patch messages identified by the identifier (PID) with reference 172 that allow the updating of the security modules (SM3) of type 1 from the operating data version a towards version b, then from version b towards the final version c. The message with reference EP(1, a-b, 1) represents the first message of a chain of three patch messages valid for the security modules of type 1 containing the data necessary to update version a towards version b. The first parameter (1) is related to the type or the generation of the security module processor, the second parameter (a-b) indicates that the update is carried out from the initial version a towards version b and finally the third parameter is an index indicating the position of the message in the chain, here (1) for the first message. The second message with reference EP(1, a-b, 2) only differs from the first except with respect to its index (2) and its program data contents which constitute the continuation of those of the first message and so on for all the messages of one chain.
For the passage of version b to the final version c, the example only shows one message EP(1, b-c, 1). The last message of the stream (P1) with reference SW(1, c, 1802) is a switch message of an identifier of the conditional access system. This message allows the redirection towards the conditional access system of identifier (CASID) 1802 of the security modules of type 1 which updating towards version c has been successful. For this operation, the correspondence table (CAT) indicates that the stream transmitted by the conditional access system 1802 corresponds to the stream (P0) which identifier (PID) is 120, that is to say a stream of common or main management messages (EMM) transmitted to all the security modules. In FIG. 1, the arrow and the bracket show that the security modules (SM3) and (SM4) of different types are connected to the first stream (P0) of (PID) 120.
Another stream (P2) of patch messages identified by the identifier (PID) 173 relates to security modules (SM4) of type 2. The chain here includes two updating messages EP(2, a-b.1) and EP(2, a-b, 2) that allow the passage of version a towards version b of the operating data. The switch message SW(2, b, 1802) redirects the security modules of type 2 towards the first stream (P0) of identifier (PID) 120 as that of stream (P1) mentioned previously relating to the security modules of type 1.
In order to start the updating of the security modules (SM3, SM4) respectively of type 1 and 2 connected to the conditional access system of identifier (CASID) 1802, trigger messages T(1, <c, 1821) and T(2, a, 1822) are transmitted in the first stream (P0) of identifier (PID) 120. The first trigger message T(1, <c, 1821) instructs all the security modules of type 1 (first parameter) of the version inferior to c (second parameter) to connect to the conditional access system of identifier (CASID) 1821 (third parameter). This connection is established thanks to the table (CAT) that indicates that the system of identifier (CASID) 1821 corresponds to the stream (P1) of patch messages which identifier (PID) is 172. The updating towards version c will thus be carried out for modules (SM3) of type 1 of version a and version b as described above. A module of version b will not be affected by the three patch messages relating to the passage of version a towards b, but only by the message EP(1, b-c, 1) which will update the module of version b towards version c.
The second trigger message T(2, a, 1822) is responsible for directing the security modules (SM4) of type 2 and of version a towards the conditional access system of identifier (CASID) 1822. The table indicates that this system (1822) transmits the stream (P2) of (PID) 173 allowing the updating of the security modules (SM4) of type 2 of version a towards version b.
A new security module (SM1, SM2) inserted for the first time in a user unit, such as for example a Pay-TV decoder, is connected to a particular conditional access system essentially transmitting trigger messages (T).
According to FIG. 1, the security modules (SM1) and (SM2) respectively of type 1 and 2 with operating data of an initial version are intended to be connected to the conditional access system of identifier (CASID) 1801. In the table (CAT) the identifier (CASID) 1801 is associated to a stream (Pt) identified by the identifier (PID) 170 comprising the trigger messages T(1, <c, 1821) and T(2, a, 1822). These messages allow the triggering respectively of the security modules of type 1 with a version inferior to c towards the conditional access system of identifier (CASID) 1821 and the security modules of type 2 with version a towards the conditional access system of identifier (CASID) 1822. These two systems 1821 and 1822 transmit respectively the stream (P1) which identifier (PID) is 172 and the stream (P2) of (PID) 173 according to the table (CAT). These streams (P1, P2) then carry out the updating of these new security modules (SM1, SM2) in the same way as for on-line security modules (SM3, SM4) as described above. At the end of the update, the respective switch messages SW(1, c, 1802), SW(2, B, 1802) redirect these modules towards the first stream (P0) transmitted by the conditional access system of identifier (CASID) 1802 that is to say, still according to the table (CAT), towards the first stream (P0) identified by the identifier (PID) 120.
In case of error, unconditional switch messages (SW), that is to say without the final version parameter, can be transmitted in an updating stream to force the security module to return towards the first stream (P0) regardless of the version of its operating data.
When the number of types or generations of security modules becomes larger, the number of identifiers (CASID) corresponding to conditional access systems (CAS) transmitting the update message stream increases in the same ratio. According to one embodiment, in order to optimize the method, the patch messages (EP) can be grouped in one stream with a given identifier (PID) according to a family of types of security module. Such a family can be defined according to a type of processor, technology or software implemented in the security module. A stream of patch messages also includes several message chains intended for several types of a same modules family. The first parameter can for example designate a family and a type instead of only the type of module as in the example in FIG. 1. The number of update streams and accordingly access systems is thus reduced according to the number of module types that can be grouped in families.
According to a further embodiment, the patch messages (EP) can be broadcast in a stream to which the security module is connected by default. When the update is completed or when the security module is already up-to-date, it switches automatically towards the conditional access system transmitting the first stream broadcasting the EMM management messages. Therefore, broadcasting the trigger messages in the first stream becomes superfluous. Only switch messages may be broadcast in the first stream to direct the security module towards the patch stream when an update of its operating data is available.
According to a further embodiment, the trigger message may contain priority change data and conditional access system identifiers referring to stream identifiers for setting an order of streams to receive when a first update is made. The switch messages may be not necessary when priorities are set (for example, priority 1 for security module update, priority 2 for getting new keys, priority 3 for returning to the first stream). In case of errors the receiver may be switched automatically to the first stream for repeating the process at the start.
Thanks to multiple streams, the update may be performed steps wise depending on the nature of the operating data. For example, a stream transmits firmware patch messages; another one transmits new keys and a further one transmits access rights update data. After all updates are performed, the security module switches automatically to the conditional access system transmitting the first stream.
According to a further embodiment, the operating data patch messages of the second stream may be transmitted to the security modules by positive addressing i.e. the patch messages comprise specific addresses or identifiers of individual security modules or a range of addresses or identifiers defining a group of security modules. Only the concerned security modules will then be updated while the others will ignore the patch messages. Trigger messages may also be transmitted in the first stream by positive addressing to perform targeted update on predefined security modules, the others ignoring these particular trigger messages.

Claims

1. A method for updating operating data in a security module associated to a user unit for processing digital data broadcast in a transport stream, said unit being connected to a conditional access system transmitting, in said transport stream, to the security module a first stream comprising management messages, said security module including an identifier of the conditional access system transmitting the first stream, said method comprising steps of:

broadcasting at least one second stream of management messages configured as operating data patch messages comprising each at least a type code of the security module to be updated, an initial and a final version reference, and program data configured to update operating data in the security module,

adding to the first stream of management messages, a management message configured as a trigger message comprising at least the type code of the security module to update, a version information indicating whether said security module is up-to-date, and an identifier indicating to said security module the conditional access system transmitting a second stream transporting suitable operating data patch messages corresponding to the security module defined by the type code, wherein a correspondence table is defined that associates the identifier of the conditional access system to identifiers of the first and second streams transmitted by said conditional access system,

if a current version of the operating data in the security module requires an update, directing the security module towards the conditional access system transmitting the second stream transporting operating data patch messages designated by the identifier included in the trigger message and corresponding to the type of security module defined by the type code,

updating the operating data of the concerned security module related to the stream of operating data patch messages with the operating data patch messages from the second stream, and

directing the security module towards the conditional access system transmitting another stream being determined by the correspondence table with the identifier of the conditional access system.

2. The method according to claim 1, wherein the security module is directed towards the conditional access system transmitting the first stream when updating of the operating data is terminated.

3. The method according to claim 1, wherein the operating data patch messages form a chain, each operating data patch message further comprising an indication defining the position of the operating data patch message in the chain.

4. The method according to claim 3, wherein the chain of operating data patch messages is followed by a management message configured as a switch message comprising at least the type code of the security module, a reference of a final version reached after updating and the identifier of the conditional access system transmitting the first stream or a further second stream, the security module being directed with the switch message towards the conditional access system transmitting the first stream or a further second stream being determined by the correspondence table with the identifier of the conditional access system.

5. The method according to claim 1, wherein the trigger messages further comprise an identifier of the conditional access system transmitting the first or a further second stream, the correspondence table determining the first or the further second stream to which the security module is directed after updating the operating data.

6. The method according to claim 1, wherein the security module is automatically directed towards the conditional access system transmitting the first or a second stream after updating the operating data.

7. The method according to claim 1, wherein a new security module associated for the first time to a user unit is connected to a particular conditional access system transmitting a stream of trigger messages comprising at least one message allowing directing towards a conditional access system transmitting the second stream of operating data patch messages adapted to the type and to the version of the operating data of said security module.

8. The method according to claim 1, wherein the operating data patch messages are transmitted grouped in one stream with a given identifier according to a family of types of security module.

9. The method according to claim 4, wherein the operating data patch messages, the trigger messages and the switch messages comprise at least one code designating the family and a type of security module.

10. The method according to claim 1, wherein the operating data patch messages of the second stream are transmitted to the security modules by positive addressing, the operating data patch messages comprising specific addresses or identifiers of individual security modules or a range of addresses or identifiers defining a group of security modules.

11. The method according to claim 1, wherein the trigger messages of the first stream are transmitted by positive addressing, the trigger messages comprising specific addresses or identifiers of individual security modules or a range of addresses or identifiers defining a group of security modules.

12. A conditional access system to which is connected at least one user unit for processing digital data broadcast in a transport stream, said unit being associated to a security module, the conditional access system being configured to transmit, in the transport stream, to the security module, a first stream of management messages, said security module including an identifier of the conditional access system transmitting the first stream, the conditional access system comprising hardware and software configured to update operating data of the security module by performing steps of:

broadcasting at least one second stream of management messages configured as operating data patch messages, each operating data patch message comprising at least a type code of the security module to be updated, an initial and a final version reference, and program data suitable for updating the operating data of the security module,

adding to the first stream of management messages, a management message configured as a trigger message comprising at least the type code of the security module to update, a version information indicating whether said security module is up-to-date, and an identifier indicating to said security module the conditional access system transmitting a second stream transporting the suitable operating data patch messages corresponding to the security module defined by the type code, wherein a correspondence table is defined that associates the identifier of the conditional access system to identifiers of the first and second streams transmitted by said conditional access system,

if a current version of the operating data of the security module requires an update, directing the security module towards the conditional access system transmitting the second stream transporting operating data patch messages designated by the identifier included in the trigger message and corresponding to the type of security module defined by the type code,

updating the operating data of the concerned security module with the operating data patch messages from the second stream, and

13. The conditional access system according to claim 12 configured to direct the security module to the first stream when updating of the operating data is terminated.

14. The conditional access system according to claim 12, wherein the operating data patch messages form a chain, each operating data patch message further comprising an indication defining the position of the operating data patch message in the chain.

15. The conditional access system according to claim 14, wherein the chain of operating data patch messages is followed by a management message configured as a switch message comprising at least the type code of the security module, a reference of a final version reached after updating and the identifier of the conditional access system transmitting the first stream or a further second stream, the security module being directed with the switch message towards the conditional access system transmitting the first stream or a further second stream being determined by the correspondence table with the identifier of the conditional access system.

16. The conditional access system according to claim 12, wherein the trigger messages further comprise an identifier of the conditional access system transmitting the first or a further second stream, the correspondence table determining the first or the further second stream to which direct the security module after updating the operating data.

17. The conditional access system according to claim 12, wherein the operating data patch messages are transmitted grouped in one stream with a given identifier according to a family of types of security module.

18. The conditional access according to claim 14, wherein the operating data patch messages, the trigger messages and the switch messages comprise at least one code designating a family and a type of security module.

19. The conditional access system according to claim 12, wherein the operating data patch messages of the second stream are transmitted to the security modules by positive addressing, the operating data patch messages comprising specific addresses or identifiers of individual security modules or a range of addresses or identifiers defining a group of security modules.

20. The conditional access system according to claim 12, wherein the trigger messages of the first stream are transmitted by positive addressing, the trigger messages comprising specific addresses or identifiers of individual security modules or a range of addresses or identifiers defining a group of security modules.