Method for generating and managing a local area network

• US 20060161969A1
• Filed: 07/06/2004
• Published: 07/20/2006
• Est. Priority Date: 07/14/2003
• Status: Active Grant

• Current Assignee: Nagravision SA (Kudelski SA)
• Original Assignee: Nagravision SA (Kudelski SA)
• Inventors: Moreillon, Guy
• Granted Patent: US 7,725,720 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273

Abstract

The present invention relates to a method for creating and managing a local area network including at least one device for reproducing an encrypted data flow and a device for transmitting and re-encrypting all or part of said encrypted data, which devices include security modules. The method includes the steps of connecting a so-called master security module in one of the devices connected to the local area network, causing the master security module to generate a network key, securely transmitting the network key to one or more so-called user security modules, decrypting the data encrypted by the transmission and re-encryption device, re-encrypting the data with said device by means of a local key, transmitting the re-encrypted data to the reproduction device, and holding the reproduction device to perform decryption using the user security module associated therewith and provided with means for locating the local key.

Claims

1. Method for creating and managing a local network, this network comprising at least one restitution device for an encrypted data stream and a diffusion and re-encrypting device for all or part of said encrypted data, said devices comprising security modules, the method comprising the following steps:

connecting a master security module in one of the devices connected to the local network,

establishing a network key by the master security module,

securely transmitting this network key to one or several user security modules,

decrypting encrypted data by the diffusion and re-encrypting device,

re-encrypting of the data by said device with a local key,

transmitting the re-encrypted data to the restitution device,

decrypting by said restitution device thanks to the associated user security module, which disposes of means to find the local key.

2. Method for creating and managing a local network according to claim 1, wherein the local key is a randomly generated session key encrypted by the network key.

3. Method for creating and managing a local network according to claim 1, wherein the local key is the network key.

4. Method for creating and managing a local network according to claim 1, wherein the establishment of the network key is obtained by the pseudo-random generation of a key during the initialization of the local network.

5. Method for creating and managing a local network according to claim 1, wherein the establishment of the network key is carried out during an initialization step of the master module.

6. Method for creating and managing a local network according to claim 1, wherein the master module is placed in a removable security module.

7. Method for creating and managing a local network according to claim 6, wherein said removable security module comprises a user module forming part of the network administrated by the master module.

8. Method for creating and managing a local network according to claim 1, wherein the user security modules are in the form of an electronic circuit mounted during the manufacture of the restitution device.

9. Method for creating and managing a local network according to claim 1, wherein the user security module is in the form of a removable security module.

10. Method for creating and managing a local network according to claim 1, wherein the diffusion and re-encrypting device includes a security module, called converter module, said module receives and keeps an identifier of the master module that created the network, the converter module re-encrypting the data for said network.

11. Method for creating and managing a local network according to claim 10, wherein said master module identifier is transmitted to a management center during a connection step to said management center.