Method for controlling access to a plurality of channels by a receiver/decoder

Patent metadata

Field	Value
Publication number	US-9609280-B2
Application number	US-201113042011-A
Country	US
Kind code	B2
Filing date	Mar 7, 2011
Priority date	Mar 5, 2010
Publication date	Mar 28, 2017
Grant date	Mar 28, 2017

Abstract

A method for controlling access to a plurality of channels by a unit comprising a security module, each channel being encrypted by a specific control word and having a channel identifier, this method comprising the steps of: tuning to a first channel having first channel identifier and receiving first messages containing a first control word; decrypting the first messages and using the first control word; storing the first control word and the first channel identifier; tuning to a second channel having second channel identifier; calculating the second control word by: calculating a root control word with an inverse cryptographic function F −1 using the first control word and the first channel identifier; calculating the second control word with the cryptographic function F using the root control word and the second channel identifier; and using the second control word to access the second channel.

First claim

The invention claimed is:

1. A method for controlling access to a plurality of channels by a receiver/decoder comprising a security module, each channel being encrypted by a specific channel control word, each channel having a channel identifier and transporting entitlement messages containing at least the current channel control word and the channel access conditions, this method comprising the steps of:
tuning to a first channel having a first channel identifier by the receiver/decoder;
transmitting the first channel identifier to the security module by the receiver/decoder;
receiving first entitlement messages containing at least a first control word by the receiver/decoder;
transmitting the first entitlement messages to the security module by the receiver/decoder;
decrypting the first entitlement messages and verifying the channel access conditions by the security module;
if the access conditions are met, returning the first control word to the receiver/decoder by the security module;
storing of the first control word and the first channel identifier by the security module;
tuning to a second channel having a second channel identifier and encrypted by a second control word by the receiver/decoder, the first control word being the result of a cryptographic function using the first channel identifier and a root control word, the second control word being the result of the cryptographic function using the second channel identifier and the root control word;
transmitting the second channel identifier to the security module by the receiver/decoder;
calculating, by the security module, the second control word by the following steps:
calculating the root control word with an inverse cryptographic function using the first control word and the first channel identifier;
calculating the second control word with the cryptographic function using the root control word and the second channel identifier; and
returning the second control word to the receiver/decoder,

wherein the root control word is not received by the receiver/decoder.

2. The method of claim 1 , wherein the security module comprises a list, each entry of the list comprising at least a channel identifier and a control value, the method further comprising the steps of:
before returning the second control word, verifying that the control value corresponding to the second channel identifier authorizes the access to the second channel; and
returning the second control word only if the access is authorized.

3. The method of claim 2 , wherein the control value is a counter, the verification of the control value comprising the verification that the counter is positive and said counter being decremented while the second control word is returned to the receiver/decoder.

4. The method of claim 3 , further comprising the steps of:
receiving a second entitlement message containing at least the second control word by the receiver/decoder;
transmitting the second entitlement messages to the security module by the receiver/decoder;
decrypting the second entitlement messages and verifying the channel access conditions by the security module;
if the access conditions are met, returning the second control word to the receiver/decoder by the security module; and
setting the counter of the second channel to a positive value by the security module.

5. The method of the claim 1 , further comprising the steps of:
diversifying the first channel identifier with a diversification value before applying the inverse cryptographic function; and
diversifying the second channel identifier with the diversification value before applying the cryptographic function.

6. The method of claim 5 , characterized in that the diversification value is extracted from the first entitlement message.

7. A method for controlling access to a plurality of channels by a receiver/decoder comprising a security module, each channel being encrypted by a specific channel control word, each channel having a channel identifier and transporting entitlement messages containing at least the current channel control word and the channel access conditions, this method comprising the steps of:
tuning to a first channel having a first channel identifier by the receiver/decoder;
transmitting the first channel identifier to the security module by the receiver/decoder;
receiving first entitlement messages containing at least a first control word by the receiver/decoder;
transmitting the first entitlement messages to the security module by the receiver/decoder;
decrypting the first entitlement messages and verifying the channel access conditions by the security module;
if the access conditions are met, returning the first control word to the receiver/decoder by the security module;
calculating a root control word with an inverse cryptographic function using the first control word and the first channel identifier by the security module;
storing the root control word by the security module;
tuning to a second channel having a second channel identifier and encrypted by a second control word by the receiver/decoder, the first control word being the result of a cryptographic function using the first channel identifier and the root control word, the second control word being the result of the cryptographic function using the second channel identifier and the root control word;
transmitting the second channel identifier to the security module by the receiver/decoder;
calculating, by the security module, the second control word with the cryptographic function using the root control word and the second channel identifier; and
returning the second control word to the receiver/decoder by the security module,
wherein the root control word is not received by the receiver/decoder.

8. The method of claim 7 , wherein the security module comprises a list, each entry of the list comprising at least a channel identifier and a control value, the method further comprising the steps of:
before returning the second control word, verifying that the control value corresponding to the second channel identifier authorizes the access to the second channel; and
returning the second control word only if the access is authorized.

9. The method of claim 8 , wherein the control value is a counter, the verification of the control value comprising the verification that the counter is positive and said counter being decremented while the second control word is returned to the receiver/decoder.

10. A method for controlling access to a plurality of channels by a security module, the method comprising the steps of:
receiving a channel identifier for a first channel and a control word for a first channel from a receiver/decoder;
decrypting the encrypted control word for the first channel;
transmitting the control word for the first channel to the receiver/decoder;
calculating a root control word using an inverse cryptographic function, the decrypted control word from the first channel and the identifier for the first control channel;
receiving a second channel identifier from the receiver/decoder;
calculating a second control word using the second channel identifier, a cryptographic function inversely related to the inverse cryptographic function, and the root control word;
transmitting the second control word to the receiver/decoder,
wherein the root control word is not received by the receiver/decoder.

11. The method of claim 10 , wherein the security module comprises a list, each entry of the list comprising at least a channel identifier and a control value, the method further comprising the steps of:
before returning the second control word, verifying that the control value correspon

Assignees

• Kudelski Andre
• Nagravision Sa

Inventors

• Kudelski Andre

Classifications

• H04L2209/60

  Digital content management, e.g. content distribution · CPC title

• H04N7/163

  by receiver means only · CPC title

• H04N21/4627

  Rights management {associated to the content (security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08)} · CPC title

• H04N21/4623

  Processing of entitlement messages, e.g. ECM [Entitlement Control Message] or EMM [Entitlement Management Message] {(arrangements for conditional access to broadcast information or to broadcast-related services H04H60/14)} · CPC title

• H04N21/4181

  for conditional access · CPC title