Conditional access system and method prevention of replay attacks

• US 7,590,240 B2
• Filed: 03/02/2001
• Issued: 09/15/2009
• Est. Priority Date: 03/02/2001
• Status: Expired due to Term

• Current Assignee: TiVo Solutions Inc. (Adeia Inc.)
• Original Assignee: TiVo Inc. (Adeia Inc.)
• Inventors: Goodman, Andrew, Platt, David C., Zenchelsky, Daniel
• Primary Examiner(s): Hoffman; Brandon S
• Application Number:
  US10/220,356
• Publication Number:
  US 20040126093A1
• Time in Patent Office: 3,119 Days
• Field of Search: None
• US Class Current: 380/210
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04N 2005/91364 the video signal being scrambled
• CPC Class Codes: H04N 21/258 Client or end-user data management, e.g. managing client capabilities, user preferences or demographics, processing of multiple end-users preferences to derive collaborative data arrangements for services using the result on the distributing side of broadcast systems H04H60/66; profiles in network data switching protocols H04L67/30
• CPC Class Codes: H04N 21/25891 being end-user preferences retrieval of video data in a video database based on user preferences G06F16/739; arrangements for recognizing users' preferences H04H60/46; user profiles in network data switching protocols H04L67/306; processing of user preferences or user profiles in wireless networks H04W8/18
• CPC Class Codes: H04N 21/4126 The peripheral being portable, e.g. PDAs or mobile phones
• CPC Class Codes: H04N 21/426 Internal components of the client ; Characteristics thereof H04N5/44 takes precedence
• CPC Class Codes: H04N 21/4367 Establishing a secure communication between the client and a peripheral device or smart card
• CPC Class Codes: H04N 21/4622 Retrieving content or additional data from different sources, e.g. from a broadcast channel and the Internet web site content organization and management for information retrieval from the Internet G06F16/958; transmission by internet of broadcast information H04H60/82; stock exchange data over packet-switching network H04L12/1804; push services including data channel over packet-switching network H04L12/1859
• CPC Class Codes: H04N 21/4623 Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14
• CPC Class Codes: H04N 21/47 End-user applications
• CPC Class Codes: H04N 21/4782 Web browsing , e.g. WebTV
• CPC Class Codes: H04N 21/63345 by transmitting keys key distribution for secret or secure communication H04L9/08; network support of key management H04L63/06
• CPC Class Codes: H04N 21/816 involving special video data, e.g 3D video
• CPC Class Codes: H04N 21/84 Generation or processing of descriptive data, e.g. content descriptors systems specially adapted for using meta-information in broadcast systems H04H60/73
• CPC Class Codes: H04N 5/782 on tape
• CPC Class Codes: H04N 5/913 for scrambling ; for copy protection
• CPC Class Codes: H04N 7/163 by receiver means only
• CPC Class Codes: H04N 7/1675 Providing digital key or authorisation information for generation or regeneration of the scrambling sequence pseudo-random number generators in general G06F7/58
• CPC Class Codes: H04N 7/17309 : Transmission or handling of upstream communications

Abstract

In a conditional access system, a headend transmits content to one or more receivers in encrypted transport streams. The system provides a multi-layer security architecture, rendering the system resistant to key replay attacks; if one layer is circumvented, subsequent layers remain intact. A first layer prevents unencrypted keys from being recorded by shielding the unencrypted keys from users and encrypting the path from the receiver'"'"'s conditional access module to the transport decryption module; a second layer prevents a key recorded on one receiver from being played back to the transport decryption module on a second receiver; a third layer prevents a user from decrypting transport streams without the encryption module by encrypting the stream a second time prior to being passed through any user-accessible memory or processor. Events tables are transmitted with the transport stream, either unencrypted for immediate use or encrypted, to prevent unauthorized use.

Claims

1. A cryptographic method for rendering a conditional access system resistant to replay attacks comprising the steps of:

generating a set of one or more keys usable for encryption or decryption, said generating caused by an authorization module controlling authorization of access to a plurality of transport streams, said authorization module on or in communication with a receiver among a plurality of receivers in communication with a headend;

storing an encrypted transport stream transmitted from said headend, wherein said encrypted transport stream is further encrypted at said receiver, using one or more keys from said set of one or more keys usable for encryption or decryption, so that a doubly encrypted transport stream is stored on a storage medium on or accessible to said receiver; and

decrypting said doubly encrypted transport stream by a decryption module on or in communication with said receiver using one or more keys from said set of one or more keys usable for encryption or decryption.

2. The method of claim 1, further comprising:

adding multiple layers of security such that if one layer is circumvented, subsequent layers remain intact.

3. The method of claim 2, wherein a first layer of said multiple layers of security comprises preventing unauthorized access to said set of one or more keys usable for encryption or decryption by avoiding exposing said set of one or more keys usable for encryption or decryption to user accessible and user programmable resources within said receiver.

4. The method of claim 3, wherein said first layer of said multiple layers of security further comprises encrypting a communication path between said authorization module and said decryption module.

5. The method of claim 2, wherein said receiver is a first receiver, and wherein a second layer of said multiple layers of security comprises preventing said set of one or more keys usable for encryption or decryption from being used by a second decryption module on or in communication with a second receiver by performing said generating of said set of one or more keys usable for encryption or decryption in a manner particular to said first receiver.

6. The method of claim 2, wherein a third layer of said multiple layers of security comprises the step of preventing unauthorized access to an unencrypted version of said encrypted transport stream.

7. The method of claim 6, wherein the step of preventing unauthorized access to an unencrypted version of said encrypted transport stream comprises further encrypting said encrypted transport stream prior to storage.

8. The method of claim 1, wherein said generating step further comprises said authorization module encrypting keys that represent a subset of said set of one or more keys usable for encryption or decryption.

9. The method of claim 1, wherein a corresponding event table is built for said encrypted transport stream prior to transmission of said encrypted transport stream.

10. The method of claim 9, wherein said event table is transmitted along with said encrypted transport stream so that said event table is available for immediate use by said receiver.

11. The method of claim 9, wherein said event table is encrypted prior to transmission of said event table to prevent unauthorized use.

12. The method of claim 1, further comprising:

creating a random secret at said headend,

wherein said random secret is usable for encryption or decryption;

receiving said random secret by a reception module on or in communication with said receiver;

receiving said random secret by said authorization module; and

receiving said random secret by said decryption module.

13. The method of claim 1, wherein said step of storing an encrypted transport stream transmitted from said headend further comprises:

transmitting an encrypted decryption key and said encrypted transport stream from said headend to a reception module on or in communication with said receiver;

said reception module further encrypting said encrypted transport stream to create said doubly encrypted transport stream; and

said reception module storing said encrypted decryption key and said doubly encrypted transport stream in said storage medium.

14. The method of claim 1, wherein said step of decrypting said doubly

encrypted transport stream further comprises:

said decryption module retrieving said doubly encrypted transport stream and an encrypted decryption key from said storage medium;

said decryption module decrypting said doubly encrypted transport stream to obtain said encrypted transport stream; and

said decryption module decrypting said encrypted transport stream.

15. The method of claim 1, wherein said decryption module is uniquely capable of decrypting said doubly encrypted transport stream.

16. The method of claim 1, wherein said doubly encrypted transport stream is encrypted at least once more before being stored on said storage medium.

17. A conditional access system resistant to replay attacks, comprising:

a generated set of one or more keys usable for encryption or decryption,

said generation caused by an authorization module controlling authorization of access to a plurality of transport streams,

said authorization module on or in communication with a receiver among a plurality of receivers in communication with a headend,

said receiver capable of further encrypting an encrypted transport stream transmitted from said headend using one or more keys from said generated set of one or more keys usable for encryption or decryption, so that a doubly encrypted transport stream is stored on a storage medium on or accessible to said receiver; and

a decryption module on or in communication with said receiver for decrypting said doubly encrypted transport stream.

18. The system of claim 17, the system further including:

a first layer among one or more layers of security, said first layer preventing unauthorized access to said generated set of one or more keys usable for encryption or decryption by avoiding exposing said set of one or more keys usable for encryption or decryption to user accessible and user programmable resources within said receiver.

19. The system of claim 18, wherein said first layer further comprises a module for encrypting a communication path between said authorization module and said decryption module.

20. The system of claim 17, wherein said receiver is a first receiver, the system further including:

a second layer among one or more layers of security, said second layer preventing said generated set of one or more keys usable for encryption or decryption from being used by a second decryption module on or in communication with a second receiver by generating said generated set of one or more keys usable for encryption or decryption in a manner particular to said first receiver.

21. The system of claim 20, wherein said second layer further comprises said authorization module encrypting keys that represent a subset of said generated set of one or more keys usable for encryption or decryption.

22. The system of claim 17, the system further comprising:

a third layer among one or more layers of security, said third layer preventing unauthorized access to an unencrypted version of said encrypted transport stream.

23. The system of claim 22, wherein said third layer further comprises further encrypting said encrypted transport stream prior to storage.

24. The system of claim 17, further comprising a corresponding event table for said encrypted transport stream, wherein said event table is built prior to transmission of said encrypted transport stream.

25. The system of claim 24, wherein said event table is transmitted along with said encrypted transport stream.

26. The system of claim 24, wherein said event table is encrypted prior to transmission of said encrypted transport stream.

27. The system of claim 17, further comprising:

a reception module on or in communication with said receiver having access to a random secret;

said authorization module having access to said random secret;

said decryption module having access to said random secret;

wherein said random secret is usable for encryption or decryption; and

wherein said random secret is transmitted from said headend.

28. The system of claim 17, further comprising:

said storage medium on or accessible to said receiver storing said doubly encrypted transport stream and an encrypted decryption key,

wherein said doubly encrypted transport stream and said encrypted decryption key are stored by at least the following steps;

transmitting said encrypted decryption key and said encrypted transport stream from said headend to a reception module on or in communication with said receiver;

said reception module further encrypting said encrypted transport stream to create said doubly encrypted transport stream; and

said reception module storing said encrypted decryption key and said doubly encrypted transport stream in said storage medium.

29. The system of claim 17, further comprising:

an unencrypted version of said doubly encrypted transport stream, wherein said doubly encrypted transport stream is unencrypted using at least the following steps;

said decryption module retrieving said doubly encrypted transport stream and an encrypted decryption key from said storage medium;

said decryption module decrypting said doubly encrypted transport stream to obtain said encrypted transport stream; and

said decryption module decrypting said encrypted transport stream.

30. The system of claim 17, wherein said decryption module is uniquely capable of decrypting said doubly encrypted transport stream.