WO2007085597A1 - Method for updating the firmware of a security module - Google Patents
Method for updating the firmware of a security module Download PDFInfo
- Publication number
- WO2007085597A1 WO2007085597A1 PCT/EP2007/050654 EP2007050654W WO2007085597A1 WO 2007085597 A1 WO2007085597 A1 WO 2007085597A1 EP 2007050654 W EP2007050654 W EP 2007050654W WO 2007085597 A1 WO2007085597 A1 WO 2007085597A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- stream
- security module
- messages
- identifier
- firmware
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 28
- 238000012545 processing Methods 0.000 claims abstract description 3
- 230000004048 modification Effects 0.000 description 3
- 238000012986 modification Methods 0.000 description 3
- 230000005540 biological transmission Effects 0.000 description 2
- 230000002441 reversible effect Effects 0.000 description 2
- 238000012795 verification Methods 0.000 description 2
- 230000008901 benefit Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000012790 confirmation Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006870 function Effects 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 230000002035 prolonged effect Effects 0.000 description 1
- 230000004044 response Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
- H04N21/23—Processing of content or additional data; Elementary server operations; Server middleware
- H04N21/235—Processing of additional data, e.g. scrambling of additional data or processing content descriptors
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
- H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
- H04N21/262—Content or additional data distribution scheduling, e.g. sending additional data at off-peak times, updating software modules, calculating the carousel transmission frequency, delaying a video stream transmission, generating play-lists
- H04N21/26291—Content or additional data distribution scheduling, e.g. sending additional data at off-peak times, updating software modules, calculating the carousel transmission frequency, delaying a video stream transmission, generating play-lists for providing content or additional data updates, e.g. updating software modules, stored at the client
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/20—Servers specifically adapted for the distribution of content, e.g. VOD servers; Operations thereof
- H04N21/25—Management operations performed by the server for facilitating the content distribution or administrating data related to end-users or client devices, e.g. end-user or client device authentication, learning user preferences for recommending movies
- H04N21/266—Channel or content management, e.g. generation and management of keys and entitlement messages in a conditional access system, merging a VOD unicast channel into a multicast channel
- H04N21/26606—Channel or content management, e.g. generation and management of keys and entitlement messages in a conditional access system, merging a VOD unicast channel into a multicast channel for generating or managing entitlement messages, e.g. Entitlement Control Message [ECM] or Entitlement Management Message [EMM]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/41—Structure of client; Structure of client peripherals
- H04N21/418—External card to be used in combination with the client device, e.g. for conditional access
- H04N21/4181—External card to be used in combination with the client device, e.g. for conditional access for conditional access
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
- H04N21/435—Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/43—Processing of content or additional data, e.g. demultiplexing additional data from a digital video stream; Elementary client operations, e.g. monitoring of home network or synchronising decoder's clock; Client middleware
- H04N21/438—Interfacing the downstream path of the transmission network originating from a server, e.g. retrieving MPEG packets from an IP network
- H04N21/4383—Accessing a communication channel
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/40—Client devices specifically adapted for the reception of or interaction with content, e.g. set-top-box [STB]; Operations thereof
- H04N21/45—Management operations performed by the client for facilitating the reception of or the interaction with the content or administrating data related to the end-user or to the client device itself, e.g. learning user preferences for recommending movies, resolving scheduling conflicts
- H04N21/462—Content or additional data management, e.g. creating a master electronic program guide from data received from the Internet and a Head-end, controlling the complexity of a video stream by scaling the resolution or bit-rate based on the client capabilities
- H04N21/4623—Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/60—Network structure or processes for video distribution between server and client or between remote clients; Control signalling between clients, server and network components; Transmission of management data between server and client, e.g. sending from server to client commands for recording incoming content stream; Communication details between server and client
- H04N21/65—Transmission of management data between client and server
- H04N21/654—Transmission by server directed to the client
- H04N21/6543—Transmission by server directed to the client for forcing some client operations, e.g. recording
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N21/00—Selective content distribution, e.g. interactive television or video on demand [VOD]
- H04N21/80—Generation or processing of content or additional data by content creator independently of the distribution process; Content per se
- H04N21/81—Monomedia components thereof
- H04N21/8166—Monomedia components thereof involving executable data, e.g. software
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N7/00—Television systems
- H04N7/16—Analogue secrecy systems; Analogue subscription systems
- H04N7/162—Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
- H04N7/163—Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing by receiver means only
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N7/00—Television systems
- H04N7/16—Analogue secrecy systems; Analogue subscription systems
- H04N7/162—Authorising the user terminal, e.g. by paying; Registering the use of a subscription channel, e.g. billing
- H04N7/165—Centralised control of user terminal ; Registering at central
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04N—PICTORIAL COMMUNICATION, e.g. TELEVISION
- H04N7/00—Television systems
- H04N7/16—Analogue secrecy systems; Analogue subscription systems
- H04N7/167—Systems rendering the television signal unintelligible and subsequently intelligible
- H04N7/1675—Providing digital key or authorisation information for generation or regeneration of the scrambling sequence
Definitions
- the present invention relates to the field of updating or modifying the firmware of a security module within the scope of Pay-TV. More particularly, it handles on the modification of the software of user units' security modules according to the different types or generations of processors available in these modules.
- a security module The role of a security module is to control the access to a stream transporting encrypted digital data made available to users by a broadcasting server.
- a user unit or decoder allows the access and decryption of the encrypted audio/video data stream broadcasted according to the rights registered in the security module associated to said decoder.
- the security module may mainly be provided according to three different forms.
- One of these is a microprocessor card, a smart card or more generally a protected electronic module that is reputedly tamper-proof. This type of generally removable module is inserted into a suitable reader that connects it to the decoder.
- a second known form is that of an integrated circuit case placed, generally irremovably and definitively, inside the box of the decoder.
- An embodiment is made up of a circuit mounted on a socket or connector as a SIM card (Subscriber Identity Module) in a mobile telephone for example.
- SIM card Subscriber Identity Module
- the security module is arranged inside the case of an integrated circuit having also another function, for example in a decryption module or in the central microprocessor of the decoder.
- These security modules provided with communication interfaces receive messages intended on one hand to manage the access rights to the broadcasted stream and on the other hand to update or modify the software or firmware assuring the functioning of the module itself. These messages are called administration or management messages EMM (Entitlement Management Message).
- EMM Entitlement Management Message
- the updates of the rights in the security modules of the user units are carried out by sending of management messages EMM addressed to the concerned units.
- the management center receives a request transmitted by the security module and transmits in response an EMM message containing, for example, a key allowing the updating of access rights.
- the security module transmits a reception confirmation message to the management center.
- the modifications in general in the form of pieces of code (patches), constitute a set of EMM messages transmitted to the module in the transport stream of the digital data or in the stream of the control messages ECM or also in a separate stream.
- the document US2005/0091699 describes a method and a system of redirection of software downloading in a cable television network.
- a downloading control message transmitted from a management center to reception terminals (set top boxes) controls the loading and installation of programs by these terminals.
- the message provides to the terminal all the necessary information for instantaneous acquisition of data such as a program identifier, a transmission channel identifier, a packet identifier PID or an LJRL address allowing the location of the data to be downloaded.
- the message also contains the information allowing the terminal to authenticate and install the new data.
- the latter compose programs intended to control the terminal or to add supplementary functionalities such as a messaging service or a television program guide.
- the operating system of the terminal as well as the applications using this system can also be updated by this method.
- the document EP1607821 describes a secure updating method of software in a security module.
- the method consists of determining a target area in the memory of the security module. Once the location of this area is known, the content that had been programmed during the personalization of the module can be retrieved thanks to the data stored by the management center. A second block obtained by a reversible mixing operation of this data with the block to be broadcasted is transmitted to the concerned security module. On reception, the content of the target memory is read in order to obtain, by a reverse mixing operation, the initial program block that will be stored in the memory of the security module.
- a new card inserted into the decoder leads, for example, to a prolonged absence of the image on the television screen; such an interruption being unacceptable.
- the aim of the present invention is to avoid the aforementioned drawbacks and to ensure the fast loading of a firmware patch in a card with a large number of EMM messages. Therefore, the frequency of the updates can be increased with insignificant negative effects on the reception of the broadcasted content.
- This aim is achieved by a method for updating the firmware of a security module associated to a user unit for processing digital data broadcasted in a transport stream, said unit being connected to a conditional access system transmitting to the security module, in said transport stream, a first stream of management messages, said method is characterized in that it comprises the following steps:
- trigger messages comprising version information allowing establishing whether said security module is up-to-date, and an identifier indicating to said security module the suitable patch stream,
- the method allows the security module to "jump" towards a dedicated separate patch message stream thanks to the trigger messages stream broadcasted in a main stream of management messages. Once the update of the firmware is complete, the security module is again directed towards the main stream. This return can be carried out automatically, namely with a switch message comprising an identifier of the first stream.
- the security module when the access to digital data of a broadcasted program is no longer possible due to obsolete firmware, the security module can "jump" automatically towards a separate stream of patch messages. It can also “jump” periodically towards this stream for maintaining the constant updating of its firmware. This embodiment is applied either, when the security module does not transmit the data of its firmware version to the conditional access system, or when the security module ignores its version allowing it to interpret the trigger messages.
- the security module then receives in a minimum time a set of messages forming the entire patch and corresponding to its firmware.
- the patch messages are broadcasted in the transport stream in longer periods and mixed with other management messages. This mixed transmission requires numerous verifications by the security module in order to determine if a received message concerns its firmware or not; these verifications increase considerably the updating time.
- At least three types of management messages can be used, namely:
- Trigger messages comprise a code of the type of security module with a final version reference of the firmware or the version to be reached if the current version is inferior, as well as an identifier indicating the stream of patch messages.
- Each message contains the code of the type of security module, the initial and final version reference, an index identifying the position of a message in the chain and the data of the updating patch.
- the messages contain a specific key in place of the data concerning the type and version.
- Switch messages transmitted at the end of a patch message chain, allow the security module to receive the first message stream when the update is complete. They are used to redirect the security module towards a common stream (the main message stream) to which all the security modules are connected during their normal functioning.
- the security module is associated to a conditional access system which transmits the stream of management messages serving on one hand to control the access rights to data broadcasted in the transport stream and on the other hand to manage the updating of the firmware. Therefore, each security module includes an identifier of the appropriate conditional access system.
- a correspondence table is defined that associates the conditional access system identifiers to identifiers of different streams used in the updating process.
- the trigger and switch messages do not thus contain an identifier of a stream, but rather the identifier of the conditional access system transmitting this stream.
- the table therefore converts the conditional access system identifiers into identifiers that indicate the stream towards which the security module has to be directed.
- One advantage of this type of a table is that the allocations of a stream with a given identifier to an access control system can be modified at any moment according to the available updates and to the used types of security modules.
- Figure 1 shows an overview of the mechanism allowing a security module "to jump" towards a dedicated patch message stream when the version of its firmware becomes obsolete.
- FIG 1 shows a simplified diagram of the updating method for security modules (SM1 , SM2, SM3, SM4) with trigger messages (T) and patch messages (EP) using a table (CAT).
- the latter associates the identifiers (CASID) of access control systems with identifiers (PID) of the stream (PO, P1 , P2, Pt) of management messages (EMM).
- the example in Figure 1 shows a stream (P1 ) of patch messages identified by the identifier (PID) with reference 172 that allow the updating of the security modules (SM3) of type 1 from the firmware version a towards version b, then from version b towards the final version c.
- the message with reference EP(1 , a-b, 1 ) represents the first message of a chain of three patch messages valid for the security modules of type 1 containing the data necessary to update version a towards version b.
- the first parameter (1 ) is related to the type or the generation of the security module processor
- the second parameter (a-b) indicates that the update is carried out from the initial version a towards version b
- the third parameter is an index indicating the position of the message in the chain, here (1 ) for the first message.
- the second message with reference EP(1 , a-b, 2) only differs from the first except with respect to its index (2) and its program data contents which constitute the continuation of those of the first message and so on for all the messages of one chain.
- the last message of the stream (P1 ) with reference SW(1 , c, 1802) is a switch message of an identifier of the conditional access system.
- This message allows the redirection towards the access control system of identifier (CASID) 1802 of the security modules of type 1 which updating towards version c has been successful.
- the correspondence table (CAT) indicates that the stream transmitted by the access control system 1802 corresponds to the stream (PO) which identifier (PID) is 120, that is to say a stream of common or main management messages (EMM) transmitted to all the security modules.
- the arrow and the bracket show that the security modules (SM3) and (SM4) of different types are connected to the main stream (PO) of (PID) 120.
- Another stream (P2) of patch messages identified by the identifier (PID) 173 relates to security modules (SM4) of type 2.
- the chain here includes two updating messages EP(2, a-b.1 ) and EP(2, a-b, 2) that allow the passage of version a towards version b of the firmware.
- the switch message SW(2, b, 1802) redirects the security modules of type 2 towards the main stream (PO) of identifier (PID) 120 as that of stream (P1 ) mentioned previously relating to the security modules of type 1.
- trigger messages T(1 , ⁇ c, 1821 ) and T(2, a, 1822) are transmitted in the main stream (PO) of identifier (PID) 120.
- the first trigger message T(1 , ⁇ c, 1821) instructs all the security modules of type 1 (first parameter) of the version inferior to c (second parameter) to connect to the access control system of identifier (CASID) 1821 (third parameter).
- the second trigger message T(2, a, 1822) is responsible for directing the security modules (SM4) of type 2 and of version a towards the access control system of identifier (CASID) 1822.
- the table indicates that this system (1822) transmits the stream (P2) of (PID) 173 allowing the updating of the security modules (SM4) of type 2 of version a towards version b.
- T trigger messages
- the security modules (SM1 ) and (SM2) respectively of type 1 and 2 with firmware of an initial version are intended to be connected to the access control system of identifier (CASID) 1801 .
- the identifier (CASID) 1801 is associated to a stream (Pt) identified by the identifier (PID) 170 comprising the trigger messages T(1 , ⁇ c, 1821 ) and T(2, a, 1822).
- Pt the identifier
- the patch messages (EP) can be grouped in one stream with a given identifier (PID) according to a family of types of security module.
- a family can be defined according to a type of processor, technology or software implemented in the security module.
- a stream of patch messages also includes several message chains intended for several types of a same modules family.
- the first parameter can for example designate a family and a type instead of only the type of module as in the example in Figure 1.
- the number of update streams and accordingly access systems is thus reduced according to the number of module types that can be grouped in families.
- the patch messages can be broadcasted in a stream to which the security module is connected by default.
- the update When the update is completed or when the module is already up-to-date, it switches automatically towards the main stream broadcasting the EMM management messages. Therefore, the broadcasting of the trigger messages in the main stream becomes superfluous. Only the switch messages can be broadcasted in the main stream to direct the security module towards the patch stream when an update of its firmware is available.
Abstract
Method for updating the firmware of a security module (SM3, SM4) associated to a user unit for processing digital data broadcasted in a transport stream, said unit being connected to a conditional access system transmitting, in said transport stream, to the security module (SM3, SM4) a first stream (P0) of management messages (EMM), said method is characterized in that it comprises the following steps: - broadcasting at least a second stream (P1, P2) comprising the patch messages (EP) suitable for updating the firmware of the security module (SM3, SM4), said second stream (P1, P2) being identified by an identifier (PID) associated to a predetermined type of security module (SM3, SM4), - adding to the first stream (P0) of management messages, trigger messages (T) comprising version information allowing establishing whether said security module (SM3, SM4) is up-to-date, and an identifier indicating to said security module the suitable patch stream (P1, P2), - if the current version of the firmware of the security module (SM3, SM4) is inferior to the patch version, directing the security module (SM3, SM4) towards the stream (P1, P2) of patch messages (EP) designated by the identifier included in the trigger message (T), - updating the firmware of the concerned security module (SM3, SM4) related to the stream (P1, P2) of patch messages (EP), - directing the security module (SM3, SM4) towards the first stream (P0) of management messages (EMM) when the update of the firmware is completed.
Description
METHOD FOR UPDATING THE FIRMWARE OF A SECURITY MODULE
Field of the Invention
The present invention relates to the field of updating or modifying the firmware of a security module within the scope of Pay-TV. More particularly, it handles on the modification of the software of user units' security modules according to the different types or generations of processors available in these modules.
Technical Background
The role of a security module is to control the access to a stream transporting encrypted digital data made available to users by a broadcasting server. In the particular case of the Pay-TV field, a user unit or decoder allows the access and decryption of the encrypted audio/video data stream broadcasted according to the rights registered in the security module associated to said decoder.
The security module may mainly be provided according to three different forms. One of these is a microprocessor card, a smart card or more generally a protected electronic module that is reputedly tamper-proof. This type of generally removable module is inserted into a suitable reader that connects it to the decoder.
A second known form is that of an integrated circuit case placed, generally irremovably and definitively, inside the box of the decoder. An embodiment is made up of a circuit mounted on a socket or connector as a SIM card (Subscriber Identity Module) in a mobile telephone for example.
In a third form, the security module is arranged inside the case of an integrated circuit having also another function, for example in a decryption module or in the central microprocessor of the decoder.
These security modules provided with communication interfaces receive messages intended on one hand to manage the access rights to the broadcasted stream and on the other hand to update or modify the software or firmware assuring the functioning of the module itself.
These messages are called administration or management messages EMM (Entitlement Management Message).
The updates of the rights in the security modules of the user units are carried out by sending of management messages EMM addressed to the concerned units. According to an example of configuration, the management center receives a request transmitted by the security module and transmits in response an EMM message containing, for example, a key allowing the updating of access rights. The security module transmits a reception confirmation message to the management center.
Concerning the firmware stored in the security module, the modifications, in general in the form of pieces of code (patches), constitute a set of EMM messages transmitted to the module in the transport stream of the digital data or in the stream of the control messages ECM or also in a separate stream.
At present, these patches are limited in size and certain cards (or security modules) that cannot be updated to the most recent version are able to decrypt the stream or access to it. Therefore, a new card or a recycled card accessing the stream for first time is immediately functional even without the updating of its firmware. A possible modification of the latter is carried out progressively with EMM messages broadcasted in the stream during periods of reduced data throughput.
The document US2005/0091699 describes a method and a system of redirection of software downloading in a cable television network. A downloading control message transmitted from a management center to reception terminals (set top boxes) controls the loading and installation of programs by these terminals. The message provides to the terminal all the necessary information for instantaneous acquisition of data such as a program identifier, a transmission channel identifier, a packet identifier PID or an LJRL address allowing the location of the data to be downloaded. The message also contains the information allowing the terminal to authenticate and install the new data. The latter compose programs intended to control the terminal or to add supplementary functionalities such as a messaging service or a television program guide. The operating system of the terminal as well as the applications using this system can also be updated by this method.
The document EP1607821 describes a secure updating method of software in a security module. When a program block is ready to be broadcasted, the method consists of determining a target area in the memory of the security module. Once the location of this area is known, the content that had been programmed during the personalization of the module can be retrieved thanks to the data stored by the management center. A second block obtained by a reversible mixing operation of this data with the block to be broadcasted is transmitted to the concerned security module. On reception, the content of the target memory is read in order to obtain, by a reverse mixing operation, the initial program block that will be stored in the memory of the security module.
The method and the system of the document US2005/0091699 do not allow the loading or updating of the firmware of the security module but only of the software or applications of the reception terminal. A new version of the software of the terminal can certainly ensure the improved working of a security module but in certain cases, however it becomes necessary to update the firmware of the security module itself.
The drawback of the method of the document EP1607821 resides in the fact that it only allows the loading or updating of security module firmware with successive blocks, which can be tedious when the program and/or the frequency of the updates are large. Certain types of security modules or chip cards require patches having a relatively large size and a large number of EMM messages to transmit them entirely. When these messages are transmitted in the digital data stream also comprising the encrypted audio/video data of content and the control messages, the update can take several hours until the reception of the complete patch.
In case the patch is essential for decrypting the data of the stream, a new card inserted into the decoder leads, for example, to a prolonged absence of the image on the television screen; such an interruption being unacceptable.
Summary of the Invention
The aim of the present invention is to avoid the aforementioned drawbacks and to ensure the fast loading of a firmware patch in a card with a large number of EMM messages. Therefore, the frequency of the updates can be increased with insignificant negative effects on the reception of the broadcasted content.
This aim is achieved by a method for updating the firmware of a security module associated to a user unit for processing digital data broadcasted in a transport stream, said unit being connected to a conditional access system transmitting to the security module, in said transport stream, a first stream of management messages, said method is characterized in that it comprises the following steps:
- broadcasting at least a second stream comprising the patch messages suitable for updating the firmware of the security module, said second stream being identified by an identifier associated to a predetermined type of security module,
- adding to the first stream of management messages, trigger messages comprising version information allowing establishing whether said security module is up-to-date, and an identifier indicating to said security module the suitable patch stream,
- if the current version of the firmware of the security module is inferior to the patch version, directing the security module towards the patch message stream designated by the identifier included in the trigger message,
- updating the firmware of the concerned security module with the patch message stream,
- directing the security module towards the first management message stream when the update of the firmware is completed.
The method allows the security module to "jump" towards a dedicated separate patch message stream thanks to the trigger messages stream broadcasted in a main stream of management messages. Once the update of the firmware is complete, the security module is again directed towards the main stream. This return can be carried out automatically, namely with a switch message comprising an identifier of the first stream.
According to an embodiment, when the access to digital data of a broadcasted program is no longer possible due to obsolete firmware, the security module can "jump" automatically towards a separate stream of patch messages. It can also "jump" periodically towards this stream for maintaining the constant updating of its firmware. This embodiment is applied either, when the security module does not
transmit the data of its firmware version to the conditional access system, or when the security module ignores its version allowing it to interpret the trigger messages.
The security module then receives in a minimum time a set of messages forming the entire patch and corresponding to its firmware. According to the prior art, the patch messages are broadcasted in the transport stream in longer periods and mixed with other management messages. This mixed transmission requires numerous verifications by the security module in order to determine if a received message concerns its firmware or not; these verifications increase considerably the updating time.
For a preferred implementation of the method, at least three types of management messages can be used, namely:
a) Trigger messages (trigger EMM) comprise a code of the type of security module with a final version reference of the firmware or the version to be reached if the current version is inferior, as well as an identifier indicating the stream of patch messages.
b) Numerous chained messages (patch EMM) forming the patch allowing the updating of the firmware of the security module from an initial version towards a new version. Each message contains the code of the type of security module, the initial and final version reference, an index identifying the position of a message in the chain and the data of the updating patch. According to one embodiment, the messages contain a specific key in place of the data concerning the type and version.
c) Switch messages (switch EMM), transmitted at the end of a patch message chain, allow the security module to receive the first message stream when the update is complete. They are used to redirect the security module towards a common stream (the main message stream) to which all the security modules are connected during their normal functioning.
According to one embodiment, the security module is associated to a conditional access system which transmits the stream of management messages serving on one hand to control the access rights to data broadcasted in the transport stream and on
the other hand to manage the updating of the firmware. Therefore, each security module includes an identifier of the appropriate conditional access system. In order to allow the directing of the security module towards the suitable message stream, a correspondence table is defined that associates the conditional access system identifiers to identifiers of different streams used in the updating process.
The trigger and switch messages do not thus contain an identifier of a stream, but rather the identifier of the conditional access system transmitting this stream. The table therefore converts the conditional access system identifiers into identifiers that indicate the stream towards which the security module has to be directed.
One advantage of this type of a table is that the allocations of a stream with a given identifier to an access control system can be modified at any moment according to the available updates and to the used types of security modules.
Brief Description of the drawing
The invention will be better understood thanks to the following detailed description that refers to the annexed drawing given as non-limitative example.
Figure 1 shows an overview of the mechanism allowing a security module "to jump" towards a dedicated patch message stream when the version of its firmware becomes obsolete.
Detailed Description of a preferred mode of carrying out the invention
Figure 1 shows a simplified diagram of the updating method for security modules (SM1 , SM2, SM3, SM4) with trigger messages (T) and patch messages (EP) using a table (CAT). The latter associates the identifiers (CASID) of access control systems with identifiers (PID) of the stream (PO, P1 , P2, Pt) of management messages (EMM).
The example in Figure 1 shows a stream (P1 ) of patch messages identified by the identifier (PID) with reference 172 that allow the updating of the security modules (SM3) of type 1 from the firmware version a towards version b, then from version b towards the final version c. The message with reference EP(1 , a-b, 1 ) represents the first message of a chain of three patch messages valid for the security modules of
type 1 containing the data necessary to update version a towards version b. The first parameter (1 ) is related to the type or the generation of the security module processor, the second parameter (a-b) indicates that the update is carried out from the initial version a towards version b and finally the third parameter is an index indicating the position of the message in the chain, here (1 ) for the first message. The second message with reference EP(1 , a-b, 2) only differs from the first except with respect to its index (2) and its program data contents which constitute the continuation of those of the first message and so on for all the messages of one chain.
For the passage of version b to the final version c, the example only shows one message EP(1 , b-c, 1 ). The last message of the stream (P1 ) with reference SW(1 , c, 1802) is a switch message of an identifier of the conditional access system. This message allows the redirection towards the access control system of identifier (CASID) 1802 of the security modules of type 1 which updating towards version c has been successful. For this operation, the correspondence table (CAT) indicates that the stream transmitted by the access control system 1802 corresponds to the stream (PO) which identifier (PID) is 120, that is to say a stream of common or main management messages (EMM) transmitted to all the security modules. In Figure 1 , the arrow and the bracket show that the security modules (SM3) and (SM4) of different types are connected to the main stream (PO) of (PID) 120.
Another stream (P2) of patch messages identified by the identifier (PID) 173 relates to security modules (SM4) of type 2. The chain here includes two updating messages EP(2, a-b.1 ) and EP(2, a-b, 2) that allow the passage of version a towards version b of the firmware. The switch message SW(2, b, 1802) redirects the security modules of type 2 towards the main stream (PO) of identifier (PID) 120 as that of stream (P1 ) mentioned previously relating to the security modules of type 1.
In order to start the updating of the security modules (SM3, SM4) respectively of type 1 and 2 connected to the access control system of identifier (CASID) 1802, trigger messages T(1 , <c, 1821 ) and T(2, a, 1822) are transmitted in the main stream (PO) of identifier (PID) 120. The first trigger message T(1 , <c, 1821) instructs all the security modules of type 1 (first parameter) of the version inferior to c (second parameter) to connect to the access control system of identifier (CASID) 1821 (third parameter).
This connection is established thanks to the table (CAT) that indicates that the system of identifier (CASID) 1821 corresponds to the stream (P1 ) of patch messages which identifier (PID) is 172. The updating towards version c will thus be carried out for modules (SM3) of type 1 of version a and version b as described above. A module of version b will not be affected by the three patch messages relating to the passage of version a towards b, but only by the message EP(1 , b-c, 1) which will update the module of version b towards version c.
The second trigger message T(2, a, 1822) is responsible for directing the security modules (SM4) of type 2 and of version a towards the access control system of identifier (CASID) 1822. The table indicates that this system (1822) transmits the stream (P2) of (PID) 173 allowing the updating of the security modules (SM4) of type 2 of version a towards version b.
A new security module (SM1 , SM2) inserted for the first time in a user unit, such as for example a Pay-TV decoder, is connected to a particular access control system essentially transmitting trigger messages (T).
According to Figure 1 , the security modules (SM1 ) and (SM2) respectively of type 1 and 2 with firmware of an initial version are intended to be connected to the access control system of identifier (CASID) 1801 . In the table (CAT) the identifier (CASID) 1801 is associated to a stream (Pt) identified by the identifier (PID) 170 comprising the trigger messages T(1 , <c, 1821 ) and T(2, a, 1822). These messages allow the triggering respectively of the security modules of type 1 with a version inferior to c towards the access control system of identifier (CASID) 1821 and the security modules of type 2 with version a towards the access control system of identifier (CASID) 1822. These two systems 1821 and 1822 transmit respectively the stream (P1 ) which identifier (PID) is 172 and the stream (P2) of (PID) 173 according to the table (CAT). These streams (P1 , P2) then carry out the updating of these new security modules (SM1 , SM2) in the same way as for on-line security modules (SM3, SM4) as described above. At the end of the update, the respective switch messages SW(1 , c, 1802), SW(2, B, 1802) redirect these modules towards the main stream (PO) transmitted by the access control system of identifier (CASID) 1802 that is to say, still according to the table (CAT), towards the main stream (PO) identified by the identifier (PID) 120.
In case of error, unconditional switch messages (SW), that is to say without the final version parameter, can be transmitted in an updating stream to force the security module to return towards the main stream (PO) regardless of the version of its firmware.
When the number of types or generations of security modules becomes larger, the number of identifiers (CASID) corresponding to access control systems (CAS) transmitting the update message stream increases in the same ratio. According to one embodiment, in order to optimize the method, the patch messages (EP) can be grouped in one stream with a given identifier (PID) according to a family of types of security module. Such a family can be defined according to a type of processor, technology or software implemented in the security module. A stream of patch messages also includes several message chains intended for several types of a same modules family. The first parameter can for example designate a family and a type instead of only the type of module as in the example in Figure 1. The number of update streams and accordingly access systems is thus reduced according to the number of module types that can be grouped in families.
According to another embodiment, the patch messages (EP) can be broadcasted in a stream to which the security module is connected by default. When the update is completed or when the module is already up-to-date, it switches automatically towards the main stream broadcasting the EMM management messages. Therefore, the broadcasting of the trigger messages in the main stream becomes superfluous. Only the switch messages can be broadcasted in the main stream to direct the security module towards the patch stream when an update of its firmware is available.
Claims
1. Method for updating the firmware of a security module (SM3, SM4) associated to a user unit for processing digital data broadcasted in a transport stream, said unit being connected to a conditional access system transmitting, in said transport stream, to the security module (SM3, SM4) a first stream (PO) of management messages (EMM), said method is characterized in that it comprises the following steps:
- broadcasting at least a second stream (P1 , P2) comprising the patch messages (EP) suitable for updating the firmware of the security module (SM3, SM4), said second stream (P1 , P2) being identified by an identifier (PID) associated to a predetermined type of security module (SM3, SM4),
- adding to the first stream (PO) of management messages, trigger messages (T) comprising version information allowing establishing whether said security module (SM3, SM4) is up-to-date, and an identifier indicating to said security module the suitable patch stream (P1 , P2),
- if the current version of the firmware of the security module (SM3, SM4) is inferior to the patch version, directing the security module (SM3, SM4) towards the stream (P1 , P2) of patch messages (EP) designated by the identifier included in the trigger message (T),
- updating the firmware of the concerned security module (SM3, SM4) related to the stream (P1 , P2) of patch messages (EP),
- directing the security module (SM3, SM4) towards the first stream (PO) of management messages (EMM) when the update of the firmware is completed.
2. Method according to claim 1 , characterized in that the security module (SM3, SM4) includes an identifier (CASID) of the conditional access system to which it is connected.
3. Method according to claims 1 and 2, characterized in that a correspondence table (CAT) is defined that associates the identifier (CASID) of the conditional access system to the identifier (PID) of the stream (PO, P1 , P2) transmitted by said conditional access system.
4. Method according to claims 1 to 3, characterized in that when the update of the firmware is completed, a switch message (SW), transmitted after the patch messages (EP), directs the security module (SM3, SM4) towards an access control system transmitting the first stream (PO) of management messages (EMM), the identifier (PID) of said stream being determined by the table (CAT) with the identifier (CASID) of the conditional access system.
5. Method according to claim 1 , characterized in that the patch messages (EP) are transmitted in a chain, each message (EP) comprising at least a code of the type of security module to be updated, a parameter indicating a final version of said update, an index indicating the position of the message in the chain and program data of the update.
6. Method according to claims 1 to 3, characterized in that the trigger messages (T) comprise at least a code of the type of security module to be updated, a final version reference of the firmware, as well as the identifier (CASID) of the conditional access system transmitting the stream (P1 , P2) of patch messages (EP) relating to the security modules (SM3, SM4) of the corresponding type, the identifier (PID) of said stream being determined by the table (CAT) with the identifier (CASID) of the conditional access system.
7. Method according to claim 4, characterized in that the switch message (SW) includes at least a code of the type of security module, a final version reference obtained after updating and the identifier (CASID) of the conditional access system transmitting the first stream (PO) of management messages (EMM).
8. Method according to claims 1 to 3, characterized in that a new security module (SM1 , SM2) associated for the first time to a user unit is connected to a particular conditional access system transmitting a stream (Pt) of trigger messages (T) comprising at least one message allowing directing towards a conditional access system transmitting a stream (P1 , P2) of patch messages (EP) adapted to the type and to the version of the firmware of said security module.
9. Method according to claim 1 , characterized in that the patch messages (EP) are transmitted grouped in one stream with a given identifier (PID) according to a family of types of security module.
10. Method according to claims 4 and 9, characterized in that the patch messages (EP), the trigger messages (T) and the switch messages (SW) comprise at least one code designating the family and the type of security module.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP07704088.9A EP1980105B1 (en) | 2006-01-24 | 2007-01-23 | Method for updating the firmware of a security module |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP06100799A EP1811778A1 (en) | 2006-01-24 | 2006-01-24 | Verfahren für Aktualisierung des microprogramme eines Sicherheitsmoduls |
EP06100799.3 | 2006-01-24 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2007085597A1 true WO2007085597A1 (en) | 2007-08-02 |
Family
ID=36295436
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/EP2007/050654 WO2007085597A1 (en) | 2006-01-24 | 2007-01-23 | Method for updating the firmware of a security module |
Country Status (3)
Country | Link |
---|---|
US (2) | US8352734B2 (en) |
EP (2) | EP1811778A1 (en) |
WO (1) | WO2007085597A1 (en) |
Families Citing this family (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP1811778A1 (en) * | 2006-01-24 | 2007-07-25 | Nagracard S.A. | Verfahren für Aktualisierung des microprogramme eines Sicherheitsmoduls |
EP1968316A1 (en) | 2007-03-06 | 2008-09-10 | Nagravision S.A. | Method to control the access to conditional access audio/video content |
DE602008002891D1 (en) | 2008-02-11 | 2010-11-18 | Nagravision Sa | Method for updating and managing an application for processing audiovisual data in a multimedia unit via a conditional access module |
US20110107081A1 (en) * | 2008-03-24 | 2011-05-05 | Keum-Yong Oh | Method and apparatus for processing of broadcast data |
EP2262259A1 (en) * | 2009-06-08 | 2010-12-15 | Nagravision S.A. | Method for monitoring execution of data processing program instructions in a security module |
US8677128B2 (en) * | 2009-10-13 | 2014-03-18 | Sergio Demian LERNER | Method and apparatus for efficient and secure creating, transferring, and revealing of messages over a network |
US8862879B2 (en) * | 2009-10-13 | 2014-10-14 | Sergio Demian LERNER | Method and apparatus for efficient and secure creating, transferring, and revealing of messages over a network |
CA2839236C (en) | 2011-07-01 | 2019-05-21 | Nagravision S.A. | A method for playing repeatable events on a media player |
KR102208696B1 (en) * | 2014-05-13 | 2021-01-28 | 삼성전자주식회사 | Method and Apparatus for Obtaining Sensing Data |
CN104717055B (en) * | 2015-03-25 | 2018-11-20 | 成都信息工程学院 | A kind of template attack method for SM4 cryptographic algorithm wheel input Hamming weight |
CN104868990B (en) * | 2015-04-15 | 2018-04-06 | 成都信息工程学院 | A kind of template attack method for the output of SM4 cryptographic algorithms wheel |
CN109429110A (en) * | 2017-08-29 | 2019-03-05 | 上海高清数字科技产业有限公司 | The detection and filter method and system of satellite television data |
CN109429111B (en) * | 2017-08-29 | 2021-03-16 | 上海高清数字科技产业有限公司 | Satellite television list management method and system, front-end equipment and receiver |
US11200187B2 (en) * | 2019-03-27 | 2021-12-14 | Dell Products L.P. | Configuring programmatic interfaces of bus bridges in computer systems |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050091699A1 (en) * | 1999-09-03 | 2005-04-28 | Christopher Poli | Method and system for directing the download of software and firmware objects over a network such as a cable television system |
EP1607821A1 (en) * | 2004-06-17 | 2005-12-21 | Nagracard S.A. | Method for secure software upgrade in a security module |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5003591A (en) * | 1989-05-25 | 1991-03-26 | General Instrument Corporation | Functionally modifiable cable television converter system |
US5951639A (en) * | 1996-02-14 | 1999-09-14 | Powertv, Inc. | Multicast downloading of software and data modules and their compatibility requirements |
US7194756B2 (en) * | 2003-06-20 | 2007-03-20 | N2 Broadband, Inc. | Systems and methods for provisioning a host device for enhanced services in a cable system |
EP1632848A1 (en) * | 2004-09-06 | 2006-03-08 | Irdeto Access B.V. | Method of providing patches for software |
EP1811778A1 (en) * | 2006-01-24 | 2007-07-25 | Nagracard S.A. | Verfahren für Aktualisierung des microprogramme eines Sicherheitsmoduls |
-
2006
- 2006-01-24 EP EP06100799A patent/EP1811778A1/en not_active Withdrawn
-
2007
- 2007-01-23 WO PCT/EP2007/050654 patent/WO2007085597A1/en active Application Filing
- 2007-01-23 EP EP07704088.9A patent/EP1980105B1/en active Active
- 2007-01-23 US US11/656,468 patent/US8352734B2/en active Active
-
2012
- 2012-12-11 US US13/711,014 patent/US20130103941A1/en not_active Abandoned
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20050091699A1 (en) * | 1999-09-03 | 2005-04-28 | Christopher Poli | Method and system for directing the download of software and firmware objects over a network such as a cable television system |
EP1607821A1 (en) * | 2004-06-17 | 2005-12-21 | Nagracard S.A. | Method for secure software upgrade in a security module |
Also Published As
Publication number | Publication date |
---|---|
US20070174617A1 (en) | 2007-07-26 |
EP1980105B1 (en) | 2014-05-07 |
EP1980105A1 (en) | 2008-10-15 |
US20130103941A1 (en) | 2013-04-25 |
EP1811778A1 (en) | 2007-07-25 |
US8352734B2 (en) | 2013-01-08 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
EP1980105B1 (en) | Method for updating the firmware of a security module | |
EP1281282B1 (en) | Method and system for controlling the download of software and firmware objects over a cable television system | |
EP1834483B1 (en) | Method and system for enabling reception of multimedia contents at a user's tv set via a communications terminal | |
US8191095B2 (en) | Backup communication modes | |
US20060136898A1 (en) | Method of providing patches for software | |
US20060020938A1 (en) | Method, article of manufacture and apparatus for updating software in a consumer device | |
EP1116379B1 (en) | Application data table for a multiservice digital transmission system | |
EP1010320B1 (en) | Broadcast receiving system comprising a computer and a decoder | |
CN103370933B (en) | Be used for the method for the reception of the entitlement management messages of optimizing pay television system | |
US20040047364A1 (en) | Adaptive communication modes | |
US7403619B2 (en) | Interface module and decoder for host | |
EP1053633B1 (en) | Configuring method and device | |
CA2375288A1 (en) | Dynamic movement of the control channel for broadband communication devices | |
US7523479B2 (en) | Dynamically changing communication modes | |
KR20040094836A (en) | Downloading of software programs | |
KR100947315B1 (en) | Method and system for supporting roaming based on downloadable conditional access system | |
MXPA00007588A (en) | Configuring method and device |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 2007704088 Country of ref document: EP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |