Method for providing a secure communication between two devices and application of this method

• US 20020126844A1
• Filed: 03/18/2002
• Published: 09/12/2002
• Est. Priority Date: 04/03/1996
• Status: Active Grant

• Current Assignee: Irdeto B.V. (MultiChoice Group Ltd.)
• Original Assignee: Andrew Glasspool, Donald Watts Davies, Simon Paul Ashley Rix
• Inventors: Glasspool, Andrew, Rix, Simon Paul Ashley, Davies, Donald Watts
• Granted Patent: US 7,171,553 B2
• Time in Patent Office: Days
• US Class Current: 380/211
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

A method of providing a secure communication between first and second devices is described. The method includes encrypting a random key using an encryption key at a first device and transferring the encrypted random key to the second device for encryption of data communicated from the second device to the first device. The encrypted data received from the second device is decrypted using the random key. The method typically includes transferring a control word encrypted with an encryption key to the second device for decryption, and encryption using the random key. The encrypted control word received from the second device is then decrypted using the random key. The invention extends to a method of enabling a decoder, and to a decoder, to decode a data stream. It also extends, inter alia, to a method of authenticating an enabling device and to an enabling device.

Claims

1. Method for providing a secure communication between two devices, wherein a first device generates a random key (Ci) and transfers said key to a second device in a first message encrypted using a public key, wherein said second device decrypts the first encrypted message by means of a corresponding secret key to obtain said random key (Ci), wherein said random key is used to encrypt and decrypt transmissions between said devices.

2. Method according to claim 1, wherein after decrypting said encrypted message, said second device first returns said random key (Ci) in a second encrypted message with an authentication to said first device.

3. Method according to claim 2, wherein for providing said authentication said first device further generates a random number (A) and transfers this random number (A) together with said random key (Ci) in said first encrypted message to the second device, wherein the second device uses said random number (A) for authentication in the second encrypted message.

4. Method according to claim 3, wherein said second device encrypts said random number (A) under said random key (Ci) to obtain said second encrypted message.

5. Application of the method of anyone of the preceding claims in a decoder for a pay TV system, wherein said decoder comprises a conditional access module (CAM) and a smart card (SC), wherein said method is applied to provide a secure communication between the control access module and the smart card.

6. Application of the method of anyone of claims 1-4 in a decoder for a pay TV system, wherein said decoder comprises a conditional access module (CAM) and a smart card (SC), wherein said method is applied to provide a secure communication between the decoder and the conditional access module.

7. Decoder for a pay TV system, comprising a conditional access module and a smart card, said conditional access module comprising means for generating a random key (Ci), means for encrypting said key in a first encrypted message using a public key encryption method, means for transfering said first encrypted message to the smart card, said smart card comprising means for receiving and decrypting said first encrypted message to obtain said random key, means for encrypting transmissions to the conditional access module under said random key, said conditional access module having means to decrypt said transmissions received from the smart card.

8. Decoder according to claim 7, wherein said smart card comprises means for returning said random key to the conditional access module in a second encrypted message with an authentication.

9. Decoder according to claim 8, wherein said generating means of the conditional access module further generates a random number which is included in said first encrypted message, wherein the smart card is adapted to use said random number as authentication in the second encrypted message.

10. Decoder for a pay TV system, comprising a conditional access module and a smart card, wherein said decoder comprises means for generating a random key (Ci), means for encrypting said key in a first encrypted message using a public key encryption method, means for transfering said first encrypted message to the conditional access module, said conditional access module comprising means for receiving and decrypting said first encrypted message to obtain said random key, means for encrypting transmissions to the decoder under said random key, said decoder having means to decrypt said transmissions received from the conditional access module.

11. Decoder according to claim 10, wherein said conditional access module comprises means for returning said random key to the decoder in a second encrypted message with an authentication.

12. Decoder according to claim 11, wherein said generating means of the decoder further generates a random number which is included in said first encrypted message, wherein the conditional access module is adapted to use said random number as authentication in the second encrypted message.