Method and apparatus for secure communication of information between a plurality of digital audiovisual devices

• US 6,904,522 B1
• Filed: 07/14/1999
• Issued: 06/07/2005
• Est. Priority Date: 07/15/1998
• Status: Expired due to Fees

• Current Assignee: Canal+ Technologies (Vantiva SA)
• Original Assignee: Canal+ Technologies (Vantiva SA)
• Inventors: Benardeau, Christian, Dauvois, Jean-Luc
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/744,040
• Time in Patent Office: 2,155 Days
• Field of Search: 713/156, 713/168, 713/171, 713/175, 713/200, 713/201, 380/232, 380/239
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04N 21/4181 for conditional access
• CPC Class Codes: H04N 21/43632 involving a wired protocol, e.g. IEEE 1394 high-speed IEEE 1394 serial bus H04L12/40052
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58

Abstract

The present invention relates to a method of providing secure communication of information between at least a first and second digital audiovisual device (30, 52) and characterized in that the first device (30) communicates to the second device (52) a certificate Ct(KpubT) comprising a transport public key KpubT encrypted by a management private key KpriMan, the second device (52) decrypting the certificate using an equivalent management public key KpubMan and thereafter using the transport public key KpubT to encrypt information sent to the first device, the first device using an equivalent private key KpriT to decrypt the information. The present invention is particularly applicable to a method of providing secure communication between a first and second decoder.

Claims

1. A method of providing secure communication of information between at least a first and second digital audiovisual device and characterised in that the second device receives a certificate comprising a transport public key encrypted by a management private key, the second device decrypting the certificate using an equivalent management public key and thereafter using the transport public key to encrypt information sent to the first device, the first device using an equivalent private key to decrypt the information.

2. A method as claimed in claim 1 in which the transport private/public key pair are uniquely associated with the first and second device.

3. A method as claimed in claim 1 in which the encrypted information sent by the second device comprises a session key.

4. A method as claimed in claim 3 in which the session key is a key generated by the second device and usable in conjunction with a symmetric encryption algorithm.

5. A method as claimed in claim 3 in which the session key is used by the first device to encrypt control word information subsequently communicated to the second device.

6. A method as claimed in claim 5 in which the second device decrypts the control word information using the equivalent session key and thereafter descrambles the section of a scrambled transmission associated with this control word.

7. A method as claimed in claim 1 in which the first and second devices comprise a respective first and second portable security module.

8. A method as claimed in claim 1 in which the second device receives a system certificate comprising the management public key encrypted by a system private key, the second device decrypting the system certificate using a system public key so as to obtain the management public key used thereafter to decrypt the encrypted transport public key.

9. A method as claimed in claim 1 in which the communication link between the first and second devices is implemented by a bus connection.

10. A method as claimed in claim 1 in which the first and second digital audiovisual devices comprise a first and second decoder.

11. A method as claimed in claim 10 in which the first and second decoders are adapted to receive digital television transmissions.

12. A method as claimed in claim 1 in which the first and second digital audiovisual devices comprise a decoder device and a recorder device.

27. A method as claimed in claim 3 in which the session key is a key generated by the second device and usable in conjunction with an asymmetric encryption algorithm.

28. A method as claimed in claim 3 in which the session key is used by the first device to encrypt data subsequently communicated to the second device.

29. A method as claimed in claim 28 which the session key is used by the second device to decrypt the encrypted data.

46. A method as claimed in claim 4 in which the session key is used by the first device to encrypt data subsequently communicated to the second device.

47. A method as claimed in claim 27 in which the session key is used by the first device to encrypt data subsequently communicated to the second device.

13. A method of providing secure communication of information between a decoder device and a recorder device and characterised in that a first one of the devices communicates to the second device a certificate comprising a device public key encrypted by a management private key, the second device decrypting the certificate using an equivalent management public key and thereafter using the device public key to encrypt information sent to the first device, the first device using an equivalent device private key to decrypt the information.

14. A method as claimed in claim 13 in which the first device communicates to the second device a system certificate comprising the management public key encrypted by a system private key, the second device decrypting the system certificate using a system public key so as to obtain the management public key used thereafter to decrypt the device certificate.

15. A method as claimed in claim 13 in which the device private/public key pair are uniquely associated with the identity of the first device.

16. A method as claimed in claim 13 in which the management private/public key pair are uniquely associated with the source of the first device.

17. A method as claimed in claim 14 in which the system private/public key pair are uniquely associated with the source of the second device.

18. A method as claimed in claim 13 in which the encrypted information sent by the second device comprises a session key.

19. A method as claimed in claim 18 in which the session key is a key generated by the second device and usable in conjunction with a symmetric encryption algorithm.

20. A method as claimed in claim 18 in which the session key is used by the decoder device to encrypt control word information subsequently communicated to the recorder device.

21. A method as claimed in claim 20 in which the recorder device may decrypt the control word information using the equivalent session key and thereafter re-encrypt the control word information using a recording encryption key, the re-encrypted control word information being stored by the recorder device on a recording support medium together with the scrambled transmission data associated with that control word information.

22. A method as claimed in claim 21 in which the recorder device communicates to the decoder device a copy of the recording encryption key.

23. A method as claimed in claim 22 in which the recorder device communicates a copy of the recording encryption key as encrypted by the session key.

24. A method as claimed in claim 13 in which at least one of the recorder device and decoder device comprises at least one portable security module.

25. A method as claimed in claim 13 in which the first device corresponds to a recorder device and the second device to a decoder device.

26. A method as claimed in claim 13 in which the decoder device is adapted to receive a digital television transmission.

30. A method as claimed in claim 18 in which the session key is a key generated by the second device and usable in conjunction with an asymmetric encryption algorithm.

31. A method as claimed in claim 18 in which the session key is used by the decoder device to encrypt data subsequently communicated to the recorder device.

32. A method as claimed in claim 31 in which the session key is used by the recorder device to decrypt the encrypted data.

48. A method as claimed in claim 19 in which the session key is used by the decoder device to encrypt data subsequently communicated to the recorder device.

49. A method as claimed in claim 30 in which the session key is used by the decoder device to encrypt data subsequently communicated to the recorder device.

33. A combination comprising a first and a second digital audiovisual device, wherein the second device is adapted to receive a certificate comprising a transport public key encrypted by a management private key, to decrypt the certificate using an equivalent management public key and thereafter to use the transport public key to encrypt information to be sent to the first device, the first device being adapted to use an equivalent private key to decrypt the information.

34. A combination as claimed in claim 33 wherein the second device is adapted to use the transport public key to encrypt a session key to be sent to the first device.

35. A combination as claimed in claim 34 in which the session key is a key usable in conjunction with a symmetric encryption algorithm.

36. A combination as claimed in claim 34 in which the session key is a key usable in conjunction with an asymmetric encryption algorithm.

37. A combination as claimed in claim 34 in which the first device is adapted to use the session key to encrypt data to be subsequently communicated to the second device.

38. A combination as claimed in claim 37 in which the second device is adapted to use the session key to decrypt the encrypted data.

39. A combination as claimed claim 33, wherein one of said first and second devices is a portable security module.

40. A combination comprising a decoder device and a recorder device, wherein a first one of the devices is adapted to communicate to the second device a certificate comprising a device public key encrypted by a management private key, the second device being adapted to decrypt the certificate using an equivalent management public key and thereafter to use the device public key to encrypt information sent to the first device, the first device being adapted to use an equivalent device private key to decrypt the information.

41. A combination as claimed in claim 40 wherein the second device is adapted to use the device public key to encrypt a session key to be sent to the first device.

42. A combination as claimed in claim 41 in which the session key is a key usable in conjunction with a symmetric encryption algorithm.

43. A combination as claimed in claim 41 in which the session key is a key usable in conjunction with an asymmetric encryption algorithm.

44. A combination as claimed in claim 42 in which the first device is adapted to use the session key to encrypt data to be subsequently communicated to the second device.

45. A combination as claimed in claim 44 which the second device is adapted to use the session key to decrypt the encrypted data.

50. A combination as claimed in claim 43 in which the first device is adapted to use the session key to encrypt data to be subsequently communicated to the second device.

51. A combination as claimed in claim 50 in which the second device is adapted to use the session key to decrypt the encrypted data.