WO1985000491A1

WO1985000491A1 - Encrypted broadcast television system

Info

Publication number: WO1985000491A1
Application number: PCT/GB1984/000237
Authority: WO
Inventors: Arthur Gordon Mason
Original assignee: Independent Broadcasting Authority
Priority date: 1983-06-30
Filing date: 1984-07-02
Publication date: 1985-01-31
Also published as: DE3474496D1; US4736422A; EP0148235B1; EP0148235A1

Abstract

A conditional access system for transmitting and receiving scrambled television signals over-air includes means for addressing each of the receiving apparatus with an over-air signal whereby to permit reception and descrambling of the signal. The transmitter is provided with means for assembling a cipher block of information including a first key for use in descrambling the television signal and information relating to a plurality of users, and means for encyphering the cipher block with a second key which is common to the plurality of users. On reception, a receiver applies the second, common key to the received cipher block, recovers the first key for use in descrambling the signal and the information relating to the respective user and descrambles the television signal. Further, it is proposed to transmit a further key in encrypted form and to use the first key to decrypt the further key which is then used to descramble the television signal. This provides a three level key system which is very secure but by using a common second key for a plurality of users, the time to access each user is short.

Description

ENCRYPTED BROADCAST TELEVISION SYSTEM

The present invention realtes to the broadcasting of a television signal in scrambled form and more particu¬ larly to a system for enabling the scrambled television signal to be descrambled by authorised viewers only. It has already been proposed to broadcast scrambled television signals. It has also been proposed to transmit with the scrambled television signal the key for descramb¬ ling the signal but the key is encrypted by a further key, an identification key, which is unique to each viewer. In order to decrypt the key the viewer must use his identifica¬ tion key signal and await the broadcast encrypted key.

This is acceptable as long as the number of viewers is not considerable but where one is broadcasting to a considerable number of viewers, for example with satellite broadcasting, it can take a considerable time to access all the viewers with their own encrypted key signal to enable them to descramble the broadcast television signal. While this problem can be overcome by leaving the receiving^' apparatus powered up continuously, this is not a convenient or inexpensive solution to the problem. Furthermore, when the receiver is first purchased a long waiting time results.

It is an object of the present invention to provide a system for sending encrypted programme entitlements together with a period key to one of a large number of viewers in such a way that he can relatively quickly access the encrypted entitlements and period key which enable him to decypher the scrambled teleivision signal. The period key (P) is also known as the authorisation key (A), but it will be called the period key here. The present invention provides for sending to a plurality of viewers their individual programme entitlement and the period key, encrypted together as one cipher text block by means of a single distribution key which is used by each viewer to obtain the necessary information for descrambling the television signal. Hence the distribution key and the cipher text block is shared between the plurality of viewers. The sharing of information in this way enables a reduction in the total means of bits that have to be transmitted without compribmising the security. The reduction of bits occurs because in a shared block, only one period key needs to be sent a-nd its^" overhead is shared.. If the cipher text block was not shared a separate period key, which needs to be a large number of bits, would have to be appended to each viewers entitlements for reasons of security.

The present invention also provides a secure scramb¬ ling system for apparatus for transmitting a scrambled information signal comprising means for generating a first encryption signal (S), first encryption means for encrypting the information signal in accordance with the encrypting key signal (S), means for generating a second encryption key signal (P), second encryption means for encrypting the first encryption key signal in accordance with the second encryption^* key signal (P), means for generating a third. encryption key (D), third encryption means for encrypting the second encryption key signal (P) in accordance with 'the third encryption key signal (D) , and means for transmitting the scrambled information signal and at least the encrypted second encryption scrambling key signal.

OMPI Features and advantages of the present invention will become more apparent from the following description of .an embodiment thereof given by way of example, in which: Figure 1 shows a block diagram of an encryption systςm;

Figure 2 shows the structure of one part of one of the signals sent in the system shown in Figure 1 ;

Figures 3a a^nα- 3b show diagrammatically two ways of implementing a part of Figure 2 ; and Figure 4 shows a method of replacing shared distribu¬ tion keys.

A preferred embodiment of the present invention will be described in relation to an over-air addressing DBS television encryption system as shown in Figure 1. A subscriber cannot make use of a conditional access tele¬ vision programme without being in possession of the key that was used for the signal encryption. Furthermore, this key must be kept secret from the customer. Since the broadcast signal, in this case the satellite signal, is common to all subscribers, it follows that the key which is used to cipher the television signal must also be common to everyone. It is generally regarded as insecure to have the same key held in millions of receivers for long periods of time. This is because the key might be discovered by one subscriber who could then distribute it to others customers, who would use it to obtain free television programmes. The only way to avoid this problem is to change this key, which we call the session key (S), at very frequent intervals. The session key (S) is also known in other references as the central word (CW) or the initialisation word (I) or indeed the service key (S). The session key interval may be of the order of one to ten seconds to avoid long access times when different channels are selected. Clearly the only way to send " a new session key, that changes every few seconds, is

OMPI with the broadcast signal. The session key is not sent with the television signal in the clear - it is encrypted with another key that is stored in the receiver. Ultimately, there will have to be a key stored in each receiver that has to be kept secret from the user. One way to achieve this secrecy is to 'bury' the key in an integrated circuit or some device which cannot easily , be broken open. Since it is not possible to send new security devices to each customer at regular very short intervals - It follows that the key stored in each device must be unique to each subscriber for reasons of system security. The customer unique key that is stored in the security device will be called the distribution key (D). Since there are a huge number of distribution keys, using this key to distribute the session key to each customer is impractical . This is because the time taken to send _ the session key would be much longer than the one second duration for which the session key is valid. In order to overcome this problem a period key (P) is introduced. This key is available for some period which is defined by the broadcaster - the period may be as little as one hour or as much as one month. the duration of the period is a compromise between security and the operational difficulties in receiving the key. The period key is common to all subscribers and is used to carry the session key.

The period key is itself carried by the customer distribu¬ tion keys which are stored in each receiver.

Figure 1 shows schematically how a practical system might be implemented. An information signal A, in this case a television signal, is to be scrambled for trans¬ mission. Firstly a session key S is generated by suitable circuitry 10 and this key S is used to scramble the signal A in accordance with the key S as represented by the block 11. So that the key S can be securely sent to a receiver, ^{~~ *} it is also scrambled in a circuit 12 in accordance with a further scrambling routing identified by a second key P generated by suitable circuitry 14- Both the session key S and the second key P are changed at intervals but the second key need be changed at less frequent intervals than the session key S.

Finally, the second key P is scrambled in a circuit 16 by a third key, the distribution key D, generated by a circuit 17- The scrambled information signal, the scrambled session key and the scrambled second key are then transmitted using any suitable equipment.

In a receiver, the reverse operation is carried out. It is first necessary for a customer to decrypt the second key P using his distribution key D before the session key S can be recovered for decrypting the inform- ation signal. Thus a first decryption circuit 20 responsive to distribution key D is provided for decryptin the second key P and a second decryption circuit 21 responsive to the second key P is provided for decrypting the session key S which is then used in a third decryption circuit 23 for decrypting the information signal A.

Dif erent customers may require dif erent entitle¬ ments to the service. Furthermore, the entitlement may take different forms, e.g. a simple indication of whether a basic subscription has been paid or note, or they may indicate an over-air credit payment or they may simply indicate a tier level to which the viewer subscribes,. The entitlements,- are represented by a small number of bits which are preferably sent together with the period key (P) in a shared cipher text block. The example described below makes use of the entitlement bits for tiering. However, the mode of use of the entitlement bits does not affect the principle of showing a distribution key and an encrypted cipher text block together between a plurality of viewers. ---^■ - _ The tiering level of the signal (Ts) is sent with the session key. The tiering level requested by the customer (Tc) is sent to him with the period key using his distribution key. The security device compares Ts and Tc and decides whether the session key can be released for the purpose of deciphering the television signal (A) .

The session key (S) is used to encipher the tele¬ vision signal . It is sent together with the tiering level of the programme (Ts) by encrypting these signals with the period key P(T + S + P) . The reason for duplicating the period key (P) in the message, before .encryption with the same key P, will be described later. More than one session key may be sent if more than one operator is broadcasting simultaneously on the same sate¬ llite signal. This may happen for instance if one operator provides the television programme and another organisation provides a data service. (The symbol ^■+^■ means that the bits of the signals are appended together.) The main problem with this system is the time taken to send the signal D(Tc + P) to each customer. If a unique key D is defined for each subscriber the cycle time of this validation signal, after error correction has been applied, can take many hours. We propose reducing the validation cycle time by sharing the same distribution key D between a number of customers. This still offers excellent system security since, if the number of customers sharing the same key is small, the probability of finding another customer with the same key as ones own it tiny. For example, if 20 customers share each key and there are 20 million subscribers in the system, the probability of finding another customer with the same key as ones own is 10 In fact some 1000 customers could share the same key with negligible effect upon the system security. We propose to send the period key and the entitle¬ ment signals indicative of each of a plurality of sub¬ scribers in one block as shown in Figure 2. In the numerical example shown below a block size of 510 bits is used .

A BCH error correcting code is defined by the block to allow correct reception at a specified bit error rate. The BCH code requires several bits within the block to be used for error correction leaving the remainder for use as a message which contains the following information : (i) A period key of about 5ό bits. The period key bits could be evenly distributed through¬ out the message block. However, this is not really necessary because of the nature of the block encryption algorithm which is used, (ii) A byte of about S bits for each customer in the block. A number of customers have bytes in the one block. The ^'following represents an example of the proposal, (i) no. of bits per block N = 510

(ii) no. of bits for error correction E = 136 (iii) no. of bits for the message M = 374 (iv) no. of bits for period key P = 56 With this arrangement if each customer used 8 bits then 46 customers could each share the block. In practice a mode word of 6^: bits and a date stamp of 24 bits is also included which is shared by the plurality of customers. This allows 36 customers to share the block which gives a cycle time of 10 minutes for

15 million subscribers when a data rate of around 350K Bits/sec is used. However, the technique may be generalised to any number of bits.

The block is encrypted using an algorithm which has the properties of error extensions. Such an algorithm δ -

can be constructed from a block or feedback cipher arrange¬ ment which has the property that if one bit of the cipher text is falsified the resulting plain text message will loock look completely random even when the correct distribution key is used to decrypt the block.

This also means that there does not exist a unique set of 56 bits in the ciphered message to which the distribution key could be applied in order to recover the period key. In order to find the period key, without knowledge of the distribution key, either an exhaustive search of the 374 bits is needed or the encryption algorithm needs to be broken. After deciphering the message, each security device looks in the correct place within the block for the customer entitlement bits that are intended for that receiver. Clearly this function must be buried in the security device along with the distribution key.

The block or feedback cipher should have the following property. If one bit of the cipher text is altered, a number of bits of the plain text will be altered, under the same key, and these altered bits will be evenly distributed over the plain text message.

Figure 3a shows schematically- how long blocks may be ciphered using a number of 64 bit sub-blocks. Each sub-block is a 64 bit block cipher.

The essential features is to overlap the sub-blocks and form an intermediate stage. The final cipher text block is guaranteed to have the properties described above by reversing the direction in which the sub-blocks are overlapped during the second stage. The same tech¬ nique of forming an intermediate stage and reversing the direction in which the algorithm is performed for the second stage can be applied to cipher feed back in order to achieve the necessary cipher text properties. - - Cipher feedback is a well ^• known technique and the

OMPI technique of reciphering the cipher text in the reverse direction is shown in Figure 3b.

The proposed system of sharing a distribution key between several subscribers suffers from the problem that if one customer becomes a pirate, removal of the

» key affects the other customers who also share that key. There are basically two methods of overcoming this problem which are described below.

Instead of storing just one secret distribution key, each customer has a plurality of keys e.g. two-, stored in his receiver. The first key would be common to a first set of customers while the second key would be common to a second set of customers. One one member of the first set can be in the second set. Each customer is then given a unique combination of two keys from the total number of keys available. The total number of combinations far exceeds the total number of keys availabl

A pirate is eliminated by removing both of his keys from the cycle . Since the customers who share his two keys all have another but different key remaining, they are able to continue. This results from the fact that the pirate is the only customer who is a member of both shared key sets.

It can be shown mathematically, that because the number of combinations is huge, the probability of disabling honest customers after many pirate combinations have been removed is small.

Instead of storing two distribution keys which are both shared, two keys may be stored via the receiver and used in the following way.

The first key is the shared distribution key and the second is a unique key which is not shared and it is different for each customer. When a pirate is detected a new shared distribution key (D..-,-.) is sent to -each of the remaining honest customers by encrypting it with

ϊE t

OMPI their personal Unique key (U) ^* see Figure 3- Hence if X, Y and Z share a block which is normally encrypted with the shared Distribution key (D___n) and X becomes a piratej customers Y and Z are send D_NFW by trans- itting U_γ (^D _EW) and U-, (D_N„-.) . Clearly the format for the transmission of U(D) is much less efficient than the shared distribution key cycle D(M+P) but this is not important because the second cycle only includes a very small number of customers. A broadcaster can be sure that his customer has received this new shared distribution key (D) by transmitting the U(D)signal until his customer has returned say two subscription payments. Since the cycle time of the U(D) signals will be very small, probably less than one minute, and because the customer has returned more than one subscription payment -_ the broadcaster can be confident that his customer will have received the new shared key. This confidence relies upon the assumption that each sub¬ scriber will be watching television for more than one minute during a subscription period for which he has paid.

The idea of transmitting a small U(D) cycle for a long period of time allows the cycle time/data capacity to expand to cater for an emergency update and then contract again af erwards. Hence the average cycle time/data capacity stays approximately constant during the lifetime of the system; it is illustrated in Figure 3_* lei order to maximise the efficiency of the system the same technique can be applied to reconfigure into new shared blocks those customers who have become the only members of an old shared block. This is achieved by sending new addresses to old customers using the same method described above.

The information that is contained within the _ _. encrypted block not only contains the new shared dis- tribution key D and the new address (a), but also the U key. The encrypted block then takes the form U(D+a+U). The U key is sent in the encrypted block for the purpose of checking that the information has been received correctly. Provided that the secret U key is also found in the message after decryption, the remainder of the information is accepted.

The above described system makes use of storing of the secret distribution keys in a user held security device. Since the copying of the contents of the security device is likely to represent a weak link in the system - re-issue of the security device from time to time might be required by the broadcaster. Therefore, an alternative approach is to mount the security device in such a way that is can be re-issued periodcially at little expense. Such a device could be a security microprocessor mount in a SMART card.

If it is required to remove a key before the re-issue date, the broadcaster simply contacts the other customers who share that key and sends them a new

SMART card. Since the number of customers who share the removed key is very small (approx. 36) this practice unlikely to cause much of a problem. Furthermore, the broadcaster might offer one month's free viewing to compensate for the inconvenience caused to the honest key holders.

Modifications to the above described system may be made which will improve the practicality of the system. For example, the period key that is sent in the validation cycle may be the key for the next period. Although this key may be received quickly it should not be able to be used straight away. This would mean that a new customer may have to wait for several weeks before he could receive television programmes. In order to overcome this problem the current period key is sent encrypted with the next _- .

OMPI period key - ^P _NEXT ^rπR E ^ _" Provided the customer is permitted to receive programme during the next month, say, he may begin viewing from the time he has received his validation signal. A further modification is to send a known code encrypted with the period key. This signal is useful for the purpose of deciding whether the period key has been received correctly and that the encrypted block has not been falsified. The code could be made secret by using the period key for the special code. The receiver finds a binary word that it thinks is the period key by decrypting the signal D(T +P) . Provided the period key P has been received without error, using it to decrypt the signal P(P) or P(Ts-s-S+P) will reveal the same period key P. this can be checked by comparing the received

P key value with the value of the P key contained in the message T + S + P. If the comparison is negative the receiver makes the decision to interrogate the address cycle again. The check also ensures that the signal P(Ts+S+P) as well as the signal P(Tc+P) is a valid signal,

The encryption system signals may be formatted into a data frame in a packet system such as is proposed for the sound for the European Satellite Broadcast signal standard. A sync word and address word are needed to locate the various signals. the security device uses the address word to find the particular 510 bit block, in the long validation cycle, that is intended for that receiver.

A method of synchronising the key changes may be achieved in a packet multiplexing system by having two signals. The first is a frame counter on line 625 which represents a clock. Keys arrive asynchronously and are changed during line 625 at specified times. A second signal is sent in the packet multiplex which labels the. trans- mitted keys with the time that they are to be activated. An alternative approach, which eliminates the need for a time label, is to transmit the keys synchronously with the television signal. There are two keys that need to be changed - the period key and the session key.

WIPO

Claims

CLAIMS :

1. Apparatus for transmitting a scrambled information signal to a plurality of users, comprising means for scrambling the information signal, means for use in identifying the scrambling technique used, means for generating a plurality of information signals (Tc) each representing information concerning a respective user: means for producing a data block by appending together a small plurality of information signals (Tc) together, with the encryption key (P), and encrypting the whole block with a distribution key (D) which is common to the small plurality group of users whose information signals (Tc) are contained in the block whereby to reduce the time to cycle around all the subscribers in a given data capacity by reducing the total number of bits to be transmitted.

2. Apparatus according to claim 1 wherein the distribu¬ tion key (D) which is common to the small plurality of users may be changed to a new key after one or more of the plurality of user information signals (Tc) has been removed from the shared encrypted data block.

3. Apparatus according to claim 2 wherein the new distribution key (D) that has been used to encrypt the data block is securely transmitted to the users, by the transmission system, by encrypting the new shared distribu¬ tion key (D) with another key (U) which is unique and different for each user.

4. Apparatus according to claim 2 wherein the new shared distribution key (D) is sent to the remaining plurality of users in a detachable module.

OMPI

5 - Apparatus according to claim 1, and comprising means for generating a further encryption key signal (S) which is used as the key in the encryption of the signal (A) means for encrypting the further key signal (S) in accordance with the first mentioned key signal (P) in order to increase the security of the transmissions.

6. Apparatus according to claim 5_. wherein the means for generating a further encryption key signal (S) is arranged to alter the further encryption key signal (S) at a first frequency, and the means for generating the first-mentioned encryption key signal (P) is arranged to alter the first-mentioned encryption key signal (P) at a second frequency lower than the first .

7. Apparatus according to claims 1,5 or 6 wherein a

CODE signal is encrypted with the first mentioned encryption key (P) to form an encryption signal P(CODE) or P(Ts + CODE) or P(Ts + S + CODE), where Ts is a parameter of the signal and (S) is the key signal described in claims 5 and 6, the purpose of the CODE signal being to check that all the transmitted information, and in particular the two signals D(Tc + P) and P(Ts + S + CODE), have been received correctly and have not been falsified.

8. Apparatus according to claim 7- wherein the CODE signal is the first-mentioned encryption key (P) .

9. Apparatus for receiving and descrambling a scrambled information signal comprising first decrypting means (20) responsive to a user key signal (D) for receiving a trans¬ mitted signal encrypted by the user key signal (D) and containing a first key signal (P) applicable to a plurality of receivers and a plurality of information signals (Tc) each relating to one of the plurality of receivers-, the _- . first decryption means being arranged to recover the first key signal (P) and the information relating to its receiver, and a further decrypting means (23) for receiving the encrypted information signal (A) and responsive to recovery of the first key signal (P) for descrambling the information signal (A) .

10. ' Apparatus according to claim 9 wherein both the distribution key (D) which is shared amongst a plurality of users and a unique key (U) which is not shared is stored in the receiver; and means is provided for using the unique key (U) to decrypt the transmitted signal described in claim 2 to recover the new shared key (D) and replace the old shared key which is held in the receiver.

11. Apparatus according to claim 9 wherein a plurality of distribution keys (D), which may or may not be shared and stored in the receiver and may be used to decrypt the information relating to the receiver but where only one distribution key is used at any one time.

12. Apparatus according to claim 9 , and including the another decrypting means (21) for receiving a transmitted second key signal (S) encrypted by the first key signal (P) and for recovering the second key signal (S) , the further decrypting (23) using the recovered second key signal (S) and in response thereto decrypting the information signal (P).

13- Apparatus according claim 12, wherein the said another decrypting means (21) is arranged to receive the encrypted second key signal (S) and a further signal (Ts) relating to the information signal (A) and to recover both the second key signal (S) and the further signal (Ts), and control means are arranged to compare the information (Tc) from the first descrambling means with the further signal

(Ts) and to gate the application of the second key signal

(S) to the third descrambling means (23) in accordance with said comparison. ^^ ^

^{' '} OM

14. Apparatus according to claim 12 and 13 wherein, after descryption, the user information (Tc) is placed in a store in the receiver and the further signal (Ts) is used in a way such as to cause the said receiver store to alter its contents.

15. Apparatus according to any one of claims 9 to 14_. wherein a CODE signal is receovered in the receiver by decrypting a transmitted signal with the first key (P) the purpose of the CODE signal being to use it to check that all the received information, and in particular the two signals D(Tc + P) and P(Ts + S + CODE), have been received correctly and have not been falsified.

16. Apparatus according to claim 15- wherein the CODE signal is the first key signal (P).

17. Apparatus according to any one of claims 9 to 16, wherein the user key signal (D) is contained in circuitry permanently associated with the first decrypting means (20)

lδ. Apparatus according to claims 9 to 17₅ wherein the user key signal (D) is contained in a module which is removable by the user from the receiving apparatus.

19. Apparatus according to any one of claims 1 to lδ, wherein the algorithm used to encrypt or decrypt the trans¬ mitted signals has the property that if any part of the encrypted signal is altered this results in a decrypted signal which is approximately random when the encrypted signal is decrypted with the correct key; the purpose of this being to render any o the received signals useless .

OMPI