System and method for security key transmission with strong pairing to destination client

System and method for transmitting security key to target user with strong pairingTechnical field

[0001] The present invention relates to an access and copy protection system. More specifically, the present invention relates to a method and system for secure key authentication.

Background technique

[0002] The implementation of paid video broadcasting requires a conventional conditional access (CA) system to prevent non-users or unauthorized users from receiving signal broadcasting. For example, encryption algorithms can be used for content protection in digital set-top box systems and other systems used in paid video broadcasting. Therefore, the security key plays an important role in the encryption and decryption process initiated by the encryption algorithm. For each encryption algorithm used in a paid video broadcasting system, there may be a set of associated security keys that the algorithm requires. For example, in a typical set-top box system using a chip integrated circuit, the security key generation module and the target module using the security key may not be in the same chip, depending on the security subsystem in the circuit. For example, the security key generation module and the target module using the security key may not be in the same design module. The distance between the security key generation module and the target module may require a dedicated bus to transmit the security key to the appropriate destination, which reduces the speed and efficiency of the circuit. The addressability of the key pair target module is currently the only known pairing method between the security key generation module and the security key target module.

[0003] A complete CA system usually includes three main functions: scrambling/descrambling functions, rights control functions, and rights management functions. The scrambling/descrambling function is used to make the program incomprehensible to unauthorized users. Scrambling can be applied to different elementary stream components of the program together or separately. For example, the video, audio, and data stream components of a TV program can be scrambled to make these streams incomprehensible. The convection component can be scrambled by using various scrambling algorithms. The scrambling algorithm usually uses a key, called a control word. When the signal is received, any receiver holding the key or control word is descrambled by using a scrambling algorithm before transmission. Generally speaking, the operation of scrambling and descrambling will not cause any damage to the signal quality. The commonly used algorithm for scrambling digital data in CA systems is symmetric key cryptography. The control word used by the scrambling algorithm is a secret parameter, which is only known to the scrambler and authorized descrambler. In order to maintain the integrity of the encryption process, the control word needs to be changed frequently to prevent unauthorized users from searching exhaustively and attempting to find the control word.

[0004] The rights and associated keys required to descramble a program are called rights. The rights control function provides conditions for accessing scrambled programs and encryption parameters for authorized users to perform signal access. These data are broadcast as conditional access messages, called entitlement control messages (ECM). The ECM bears the control word in encrypted form with access parameters, or the method of restoring the control word, such as service identification and identification of the conditions required to access the service. After receiving the ECM, the receiver sends the encrypted control word and access characteristics to a security device, such as a smart card. If it is confirmed that the user is authorized to watch the program, the security device checks the source and identification of the control word and access parameters, and then decrypts the control word and sends it to the decryptor.

[0005] The rights management function is related to the allocation of rights to receivers. There are several rights matching different devices to "buy" video programs. These rights are also broadcast as conditional access messages, called rights management messages (EMM). EMM is used to transfer rights or keys to users, or to invalidate or delete rights or keys. The rights control function and the rights management function require the use of keys and encryption algorithms. For example, most modern conditional access systems use smart cards to store keys and securely run encryption algorithms.

[0006] Most CA systems scramble and/or randomize the transmitted data bits so that unauthorized decoders cannot decode them.

CN 1655495 Β

Data bits sent by the code. A key is sent to the authorized decryptor, and the key can initialize a circuit that reverses the randomization of data bits. In this article, the word "scrambling" is associated with pseudo-random switching of data bits based on a key valid for a short time. In addition to scrambling, the key can also be converted into an encryption key to protect it from unauthorized users. From a cryptographic point of view, converting a key into an encryption key is the only part of the system that protects data from ulterior motives or hackers. As a result, the process of scrambling itself can easily fail if the key is not encrypted. The CA system is usually associated with a system that performs key encryption and distributes encryption keys. A CA system with scrambling and decryption functions must meet the general requirements of video transmission as follows: protection of signals from being stolen, effective scrambling, flexibility, multiple supported formats, and easy implementation.

[0007] As for a strong protection signal from being stolen, it must be difficult for a third party to perform unauthorized reception. In addition, the content of the scrambled signal must not be understood. It must be able to effectively scramble all kinds of signals, and when these signals are restored (quality signal restoration), the quality cannot be reduced (perception). The CA system should also be flexible, because it may be applied on a basic stream-to-stream basis and, if necessary, should include the ability to selectively scramble the bit stream in the program in the program. Moreover, various service formats, such as multi-channel services and billing schemes, can be supported by low operating costs, and each program provider can use a dedicated encryption system as a part of the CA system. The CA system with scrambling and encryption functions can be used in standard consumer devices, and it can also ensure that the receiver is inexpensive.

[0008] With conditional access systems or copy protection systems, dedicated (secure) keys are almost always used to scramble and descramble high-value content or to protect highly sensitive transactions. In the CA system, the content scrambling key must be protected. In order to ensure the correct function, the CA system should be scrambled according to the characteristics of the data before transmission. In addition, the CA system should periodically change the key to maintain the security of the scrambling system, and use a hierarchical encryption system to send the key information to the receiver in a secure form. Moreover, for paid broadcasting services, the reception should be controlled according to the subscription details of each user.

[0009] This type of CA system can be implemented in various ways according to the type of business, required functions and security. Figure 1 shows a block diagram of a conditional access system using a conventional key ladder system. The configuration of the CA system in Figure 1 has been recommended by the International Telecommunication Union-Department of Wireless Communications (ITU-R). 1, there is shown a block diagram of an exemplary recommended access system 100, which includes a scrambler 102, a descrambler 108, encryptors 104 and 106, decryptors 110 and 112, a switch 115, and a viewing enable/disable circuit 114. In the sending side-TX in the figure, the compressed audio/video signal is scrambled by the scrambler 102 using the scrambling key Ks 118 to obtain the scrambled broadcast signal 128. The program attribute information 120 can be encrypted by the encryptor 104 using the work key Kw 122 to obtain the rights control message 130. The program subscription information 124 is encrypted by the encryptor 106 using the master key 126 to obtain the rights management message 132.

[0010] When the signal in the CA system 100 is scrambled, the scrambling key Ks 118 determines the scrambling pattern. The scrambling key is usually changed at regular intervals (for example, every few seconds) to keep the system secure. Therefore, the scrambling key 118 must be continuously transmitted to the user's receiver. This is done in the CA system: the scramble key 118 is encrypted by the encryptor 104 and transmitted in the right control message 130. The ECM 130 may also include program attribute information 120. The program attribute information 120 can be used, for example, to determine whether the subscriber has the right to watch the program. In order to prevent the ECM 130 including the scrambling key 118 from being understood by a third party, the ECM 130 is encrypted by the encryptor 104 using the working key Kw122 before sending. The work key Kwl22 can be updated monthly or annually. The work key Kw 122 and the contract information 124 are sent to the receiver through the right management information 132 together. The subscription information 124 may also include any subscription update information of a specific user.

[0011] In addition to in-band transmission, EMM132 can also be sent out-of-band using other media, such as the Internet, telephone lines, signaling networks, or smart cards. Before sending, EMM132 is encrypted by master key Km 126. The master key is unique to each receiver, and its security must be jointly managed between different broadcast operators that use the same type of receiver. Usually this can be achieved by setting up an organization for unified key management. For example, in the CA system shown in Figure 1, the content scrambling key 118 is

CN 1655495 Β

The work key 122 is protected, and the work key is protected by the master key 126. This key protection "chain" is called the key ladder.

[0012] On the receiving side-RX in the figure, the same key ladder is used to decrypt the necessary security key and the scrambled broadcast audio/video signal 128. The master key 126 can be used with the decryptor 112 to decrypt the EMM 132 and the work key 122. As a result, the work key 122 can be obtained as an output of the decryptor 112. Then, the decrypted work key 122 is used by the decryptor 110 to decrypt the ECM 130 and the scramble key 118. As a result, the scramble key 118 can be obtained as an output of the decryptor 110. The decrypted scrambling key 118 is used by the descrambler 108 to descramble the scrambled broadcast signal 128 and obtain a compressed audio/video signal output 140.

[0013] The user access to the compressed audio/video signal output 140 is determined according to the user's subscription information 124 and the program attribute information 120. The decryptor 112 decrypts the EMM 132 and obtains the decrypted contract information 125. The decryptor 110 decrypts the ECM 130 to obtain the decrypted program attribute information 120. The watch activation/inhibition module 114 receives the decrypted subscription information 125 and the decrypted program attribute information 121, and then determines whether the user has the right to receive compressed audio/video output 140. If the user has the right to receive compressed audio/video output 140 (e.g. If the user has a valid subscription to a given program channel), the viewing enable/disable module 114 sends a control signal 134 to activate the switch 115. Once the switch 115 is activated, the decrypted scramble key 118 is allowed to enter the descrambler 108, The scrambler 108 allows the compressed audio/video output 140 to be descrambled.

[0014] FIG. 2 shows a block diagram of cracking a security key in a conventional key ladder system. Referring to FIG. 2, the key ladder system 200 may include a one-time programmable (OTP) memory 202, a security key generation module 206, and a key cracking module 206. The key cracking module 206 may include scramblers 208, 210, 212, and 214. Each of the scramblers 208, 210, 212, and 214 can use a symmetric encryption algorithm, such as data encryption standard (DES), 3DES, or advanced encryption standard (AES), to descramble the encrypted key input. The OTP memory 202 in the key ladder system 200 is suitable for storing the root key, such as the master key 126 in FIG. 1. The root key stored in the OTP memory 202 can be further protected by the security key generation module 204. The security key generation module 204 may include appropriate logic, circuits, and/or codes to adapt them to scramble, or to further enhance the security of the root key stored in the OTP memory 202.

[0015] The key cracking module 206 is suitable for cracking or descrambling various application keys, such as application keys 1,228 and application keys 2,230. To this end, the key cracking module 206 may use multiple decryption keys, for example, a decryption key 1,216, a decryption key 2,218, and a decryption key 3,220. Once the root key stored in the OTP memory 202 is scrambled by the security key generation module 204, the scrambled root key 205 can be used by the scrambler 208 to decrypt the encryption key 1,216 and obtain the decryption key 224. The decryption key 224 may include, for example, a work key. The decrypted key 224 can be used by the scrambler 210 to decrypt the encryption key 2,218 and obtain the decryption key 226. The decryption key 226 includes, for example, a scramble key.

[0016] The scrambler 212 may use the decrypted key 226 to decrypt the encryption key 3,220 and obtain the decrypted application key 1,228. Similarly, the scrambler 214 can use the decrypted application key 228 to decrypt the encryption key 4,222 and obtain the decrypted application key 2,230. The decrypted application keys 228 and 230 can be applied to various functions, such as copy protection of broadcast signals. By increasing the number of decryption keys and the corresponding scrambler, and using each previously decrypted application key to decrypt subsequent encryption keys in turn, the key ladder in the key cracking module 206 can be adapted to have different protections level. The key ladder can be used to "crack" the master key, work key, and encryption key. Then the master key, work key and encryption key can be used to decrypt one or more application keys.

[0017] Even if the key cracking module 206 can provide an increased level of protection by increasing the number of scramblers and encryption keys, it is still difficult to determine whether the encryption key received in the key ladder system 200 of FIG. 2 has been unauthorized. Square operation.

[0018] However, when decrypting data is transmitted on a non-secure channel, the sender and/or receiver need to monitor the transmission and obtain

CN 1655495 Β

Have to identify the verification of the other party, as well as the integrity and source of the encrypted data transmitted.

[0019] When a conditional access system or a copy protection system is used, the security key can be generated on the sending side or the receiving side of the paid video broadcasting system. The generated security key can be used for encryption/decryption of other keys, for example. In order for the security key to be used correctly by the target module, the security key needs to be paired with the address information of the target module. However, the security key data path generated, distributed and used by the target module is vulnerable to security breaches, because the only pair used is the addressability of the security key to the target module.

[0020] For those skilled in the industry, by comparing this system with certain aspects of the present invention, as described in the rest of the present invention in conjunction with the accompanying drawings, the limitations and shortcomings of conventional and traditional methods are obvious.

Summary of the invention

[0021] The embodiments of the present invention can be used in a system and method for transmitting a security key to a target user with a strong pairing. The method of the present invention includes: pairing the rule with the security key and its associated address, and sending the rule, the security key and its associated address to the destination together. The rule defines the target module defined by the associated address to define the allowed use, and can include command words that can be implemented by the data structure. The data structure may be associated with the allowed algorithm type, the size of the security key, and/or the source of the security key. If the sending rules are violated, an invalidation report can be received from the destination. The security key can be generated by a chip key generator, an off-chip device, and/or software. The rules, together with the security key and its associated address, can be sent serially to one or more destinations. Compare the rule with the algorithm configuration of at least one destination. If the rule does not match the algorithm configuration, an error message can be generated by the destination. If the rule does not match the algorithm configuration, the destination will invalidate the security key.

[0022] Another aspect of the present invention is to provide a machine-readable memory, which stores a computer program, in which at least one code part can be executed by the machine, so that the machine executes the above-mentioned method for transmitting the security key with strong pairing to The various steps of the target user.

[0023] In a different aspect of the present invention, a system for transmitting a security key to a target user in a strong pairing may include a rule paired with the security key and its associated address, and a combination of the rule and the security key. The key and its associated address are sent to at least one destination serializer. The rules can define the allowable use of the target module defined by the associated address, and can include command words. The data structure can be used to define the attributes of various command words. The data structure can be associated with the allowed algorithm type, the size of the security key, and/or the source of the security key. If the sent rules are violated, an invalidation report can be received from the destination. The security key can be generated by a chip key generator, an off-chip device, and/or software. Generators including chip key generators, off-chip devices, and/or software can be used to generate security keys. The serializer can serially send the rule, together with the security key and its associated address, to at least one destination. The target module processor compares the rule with the algorithm configuration of at least one destination. If the rules do not match the algorithm configuration, the target module processor can generate an error message and invalidate the security key.

[0024] According to one aspect of the present invention, a security key processing method is proposed. The method includes: pairing a rule with a security key and its associated address; and sending the rule, the security key and its associated address together to At least one destination.

[0025] Preferably, the rule defines the allowed use defined by the target module defined by the associated address.

[0026] Preferably, the rule includes command words.

[0027] Preferably, the method further includes implementing the command word with a data structure.

[0028] Preferably, the method further includes combining the data structure with at least one allowed algorithm type, security key size, and

CN 1655495 Β

The source of the security key is associated.

[0029] Preferably, the method further includes receiving an invalidation report from at least one destination if the sent rule is violated.

[0030] Preferably, the method further includes generating a security key by at least one of a chip key generator, an off-chip device, and software.

[0031] Preferably, the method further includes serially sending the rule and the security key and its associated address to at least one destination.

[0032] Preferably, the method further comprises comparing the rule with the algorithm configuration of at least one destination.

[0033] Preferably, the method further includes that if the rule does not match the algorithm configuration, an error message may be generated by at least one destination.

[0034] Preferably, the method further includes that if the rule does not match the algorithm configuration, the security key may be invalidated by at least one destination.

[0035] According to one aspect of the present invention, there is provided a machine-readable memory on which a computer program is stored. The program has at least one code portion for processing the security key, and the at least one code portion can be executed by a machine to make the machine The following steps are implemented: pairing the rule with the security key and its associated address: and sending the rule, the security key and its associated address together to at least one destination.

[0036] Preferably, the rule defines that the target module defined by the associated address can define the permitted use.

[0037] Preferably, the rule includes command words.

[0038] Preferably, the machine-readable memory further includes a code for implementing the command word with a data structure.

[0039] Preferably, the machine-readable memory further includes code for associating the data structure with at least one permitted algorithm type, security key size, and security key source.

[0040] Preferably, the machine-readable memory further includes a code for receiving a failure report from at least one destination if the transmitted rule is violated.

[0041] Preferably, the machine-readable memory further includes a code for generating a security key by at least one of a chip key generator, an off-chip device, and software.

[0042] Preferably, the machine-readable memory further includes a code for serially sending the rule and the security key and its associated address to at least one destination.

[0043] Preferably, the machine-readable memory further includes code for comparing the rule with the algorithm configuration of at least one destination.

[0044] Preferably, the machine-readable memory further includes a code for generating an error message from at least one destination if the rule does not match the algorithm configuration.

[0045] Preferably, the machine-readable memory further includes a code for invalidating the security key by at least one destination if the rule does not match the algorithm configuration.

[0046] According to one aspect of the present invention, a system for security key processing is proposed. The system includes: a rule paired with a security key and its associated address: and a rule, the security key and its associated address Serializers that are sent together to at least one destination.

[0047] Preferably, the rule defines the allowable use of the target module defined by the associated address.

[0048] Preferably, the rule includes command words.

[0049] Preferably, the system further includes a data structure defining the attributes of the command word.

CN 1655495 Β

[0050] Preferably, the data structure is associated with at least one of the allowable algorithm type, the size of the security key, and the source of the security key.

[0051] Preferably, the system further includes an invalidation report received from at least one destination if the sent rule is violated.

[0052] Preferably, the system further includes a generator for generating a security key.

[0053] Preferably, the generator includes at least one of a chip key generator, an off-chip device, and software.

[0054] Preferably, the serializer serially sends the rule and the security key and its associated address to at least one destination.

[0055] Preferably, the system further includes a target module processor, which compares the rule with the algorithm configuration of at least one destination.

[0056] Preferably, if the rule does not match the algorithm configuration, the target module processor generates an error message.

[0057] Preferably, if the rule does not match the algorithm configuration, the target module processor invalidates the security key.

[0058] These and other advantages, aspects and novel features of the present invention, as well as the details of the illustrated embodiments thereof, can be more fully understood through the following description and drawings.

Description of the drawings

[0059] FIG. 1 is a block diagram of a conditional access system using an existing key ladder system;

[0060] FIG. 2 is a block diagram of a security key descrambled in an existing key ladder system;

[0061] FIG. 3 is a block diagram of a security key cracking and signature authentication system according to an embodiment of the present invention;

[0062] FIG. 4 is a block diagram of an exemplary system for secure key generation, secure key signature, and secure key encryption according to an embodiment of the present invention;

[0063] FIG. 5 is a block diagram of an exemplary system for security key decryption and security key signature authentication according to an embodiment of the present invention;

[0064] FIG. 6 is a block diagram of an exemplary embodiment for generating a security key and sending a strong pairing to a target user according to an embodiment of the present invention;

[0065] FIG. 7 is a block diagram of an exemplary security architecture in an application specific integrated circuit (ASIC) using the security key generation and transmission system of FIG. 5 according to an embodiment of the present invention;

[0066] FIG. 8 is a flowchart of a method for sending a security key to a target user with strong pairing according to an embodiment of the present invention.

Detailed ways

[0067] In the existing security key generation and transmission system, the generated security key is only associated with the address indicating the target module that will use the security key. The implementation method of strong pairing is to associate the security key and its associated address with the security command word, and then send the security key, the security command word and the associated address together to the target module. Then the target module uses the security command to confirm the verification of the security key and compliance with the applicable pairing rules.

[0068] Certain aspects of the present invention can be used in a system and method for sending a security key to a target user in a strong pairing. The security key can be generated by a chip key generator, an off-chip device, and/or software. Then pair the rule with the security key and its associated address. The rule can define the permitted use of the target module defined by the associated address. The rule can include a command word, which can be associated with the allowed algorithm type, the size of the security key, and/or the source of the security key, etc.

CN 1655495 Β

The data structure to achieve. Rules, security keys, and addresses can be sent to the target module, and the rules and algorithm configurations are compared in the target module. If the rule does not match the algorithm configuration, an error message is generated by the target module and the security key can be invalidated. Therefore, a strong pairing of the entire security key data path can be realized, and the target module can be generated, distributed, and used. The method is to pair the rule (or security word) with the security key and the corresponding address associated with the target module.

[0069] FIG. 3 shows a block diagram of a security key cracking and signature authentication system according to an embodiment of the present invention. 3, the key ladder system 500 may include a one-time programmable (OTP) memory 502, a security key generation module 504, and a key cracking and signature authentication module 506.

[0070] The key cracking and signature authentication module 506 can be adapted to "crack", or descramble, various application keys, for example, application key 1,528 and application key 2,530. To this end, the key cracking and signature authentication module 506 can use several encryption and signing keys, such as encryption and signing keys 1,516, encryption and signing keys 2,518, encryption and signing keys 3,520, and encryption and signing keys. 4,522. According to one aspect of the present invention, the encryption and signature keys 516, 518, 520, and 522 can be initially signed by the sending entity using an asymmetric encryption algorithm, such as a public key algorithm, such as Rivert-Shamir-Adleman (RSA), digital letter algorithm (DSA), or Elliptic Curve Cryptography (ECC) and other types of algorithms. Then the signed key is encrypted with a symmetric encryption algorithm, such as DES, 3DES, or AES.

[0071] The key cracking and signature authentication module 506 can be a scrambler and signature authenticator 508, 510, 512, and 514. Each scrambler and signature authenticator 508, 510, 512, and 514 includes appropriate logic, circuits and/or code circuits to be adapted to use symmetric encryption algorithms, such as DES, 3DES, or AES, to descramble encryption The input of the signing key. Each scrambler and signature authenticator 508, 510, 512, and 514 can also be adapted to use a public key algorithm, such as RSA, DSA, or EC type algorithm, to authenticate the encrypted signature key.

[0072] The OTP memory 502 in the key ladder system 500 may be adapted to store a root key, such as a master key. The root key stored in the OTP memory 502 can be further protected by the security key generation module 504. The security key generation module 504 may include appropriate logic, circuits, and/or codes, which are adapted to scramble or further enhance the security of the root key stored in the OTP memory 502.

[0073] Once the root key stored in the OTP memory 502 is scrambled by the security key generation module 504, the scrambled root key 505 can be used by the scrambler and signature authenticator 508 to decrypt and authenticate the encryption and The signature of the signature key 1,516. In this way, the generated decryption key 524 can be authenticated. The decryption and authentication key 524 may include, for example, a work key. The decryption and authentication key 524 can be used by the scrambler 510 to decrypt and authenticate the encryption and signature key 2,518, and obtain the decryption and authentication key 526. The key 526 for decryption and authentication may include, for example, a scrambling key.

[0074] The decryption and authentication key 526 can be used by the scrambler 512 to decrypt and authenticate the encryption and signature key 3, 220, and obtain the decryption and authentication application key 1,528. Similarly, the decrypted and authenticated application key 528 can be used by the scrambler 514 to decrypt and authenticate the encrypted and signed key 4,522, and obtain the decrypted and authenticated application key 2,530. The decrypted and authenticated application keys 528 and 530 can be applied to various functions, such as copy protection of broadcast signals. According to one aspect of the present invention, by increasing the number of encryption and signature keys and the corresponding scrambler, and using each previously decrypted and certified application key to sequentially decrypt the subsequent encryption and signature keys, key cracking and signature certification The key ladder in the module 506 can then be adapted to have different protection levels. The key ladder can be used to "crack" the master key for signature and encryption, the working key for signature and encryption, and the scrambling key for signature and encryption. Then the master key, work key, and scramble key can be used to decrypt one or more application keys.

[0075] According to an embodiment of the present invention, strong pairing can be used in the security key cracking and signature authentication system 500. More specifically, the strong pairing can be used along the data path of the security key, from which the OTP memory 502 where the root key is stored

CN 1655495 Β

At the beginning, until the application keys 528 and 530 are generated in the key cracking and signature authentication module 506.

[0076] FIG. 4 is a block diagram of an exemplary system for security key generation, security key signature, and security key encryption according to an embodiment of the present invention. 4, the exemplary system 600 may include a key table 602, a sending server database 612, a key signature module 614, an input register 616, a secure master key generation module 604, a selector 606, an encryptor 608, and an intermediate target register 610 .

[0077] The sending server database 612 may include appropriate logic, circuits, and/or codes to generate multiple security keys, such as a master decryption key 618. The master decryption key 618 may include a master key K1'620 and a master key K2'622. According to one aspect of the invention, the master decryption key 618 can be used to encrypt and decrypt one or more security keys, such as a work key and/or a scramble key.

[0078] Once the master decryption key 618 is generated by the sending server database 612, the master decryption key 618 can be stored in the key table 602. Each master decryption key 620 and 622 includes a fixed number of bits. For example, in the key table 602, each master decryption key 620 and 622 can occupy 2 Mbit units. The key table 602 may be a part of random access memory (RAM), such as DRAM or SRAM. The key table 602 can also be adapted to store multiple master decryption keys.

[0079] After the master decryption key is stored in the key table 602, the master decryption key 618 can be sent to the secure master key generation module 604. The security master key generation module 604 may include appropriate logic, circuits and/or codes, which are adapted to further enhance the security of the master decryption keys K1,620 and K2,622. According to one aspect of the present invention, the secure master key generation module 604 may include an encryptor or a scrambler. The secure master key generation module 604 can enhance the security of the master decryption keys KP 620 and K2' 622, and can generate a secure master decryption key K1 624 and a secure master decryption key K2 626. [0080] The sending server database 612 can also generate multiple security keys 636, which can be sent from the sending server database 612 to the key signature module 614. The key signature module 614 may include appropriate logic, circuits, and/or code to adapt them to "sign" the security key 636 and generate a signed security key 638. According to one aspect of the present invention, the key signature module 614 can use a symmetric encryption algorithm and/or an asymmetric encryption algorithm to generate a signed security key 638. The signed security key 638 is then stored in the input register 616 before being sent to the encryptor 608.

[0081] The selector 606 may include appropriate logic, circuitry, and/or code to adapt them to select from one or more inputs and produce one or more outputs. According to one aspect of the present invention, the selector 606 can be a 2:1 selector that can generate three outputs from any two received inputs. For example, the secure master decryption keys 624 and 626 may be used as inputs by the selector 606 to generate an output, where the secure master decryption key 624 is selected twice and the secure master decryption key 626 is selected once.

[0082] Encryptor 608 may include appropriate logic, circuitry and/or code, adapted to decrypt any signature security key 638. According to one aspect of the present invention, the encryptor 608 may include a 3DES-encryption-decryption-encryption (DES) or a decryption-encryption-decryption (DED) encryption engine. The encryptor 608 can use the secure master key of the selector 606 to output and encrypt the signed secure key 638 to obtain the encrypted and signed key 632.

[0083] The encryption and signature key 632 may be copied to the intermediate target register 610, and then used by the selector 606 and the encryptor 608 to encrypt the subsequent signature security key 638. For example, the secure master decryption keys 624 and 626 may be used only once by the selector 606 and the encryptor 608 for the first pair of signed security keys received by the encryptor 608. The obtained encryption and signature security keys 628 and 630 may be stored in the intermediate target register 610 before the selector 606 and the encryptor 608 use them to encrypt the second and subsequent signature security key pair.

[0084] Due to the key generation, the signature and encryption system 600 generates encryption and signature keys 632, and the security key ladder protection is enhanced because the number of generated encryption and signature keys 632 increases. With the generation of encryption and signing key 632, it

CN 1655495 Β

They can be sent from output location 634.

[0085] According to embodiments of the present invention, strong pairing can be used in an exemplary system 600 for security key generation, security key signing, and security key encryption. More specifically, the strong pairing can be used along the security key data path, starting from the moment when the security key is generated by the sending server database 312 or the security master key generation module 604, until the encrypted and signed data is sent from the output location 634. Security key.

[0086] Referring now to FIG. 5, there is shown a block diagram of an exemplary system for security key decryption and security key signature authentication according to an embodiment of the present invention. The exemplary system 650 for security key decryption and security key signature authentication may include a one-time programmable non-volatile memory (OTP NVM) 652, a secure master key generation module 654, a CPU 653, an input register 672, and a selector 656 , Decryptor 658, input register 660, signature authentication module 662, intermediate target register 664, switch 668 and final target register 670.

[0087] The OTP NVM 652 may include random access memory (RAM), such as DRAM or SRAM. The OTP NVM 652 can be adapted to store, for example, read-only data 674, key 676, and start bit 678. The key 676 may include master decryption keys 680 and 681. For example, the master decryption keys 680 and 681 may each occupy an even number of bits in OTPNVM652. More specifically, the master decryption keys 680 and 681 each occupy a 2M bit unit in OTPNVM652. The read-only data 674 of the OTP NVM 652 may include chip identification information and other read-only information that the CPU 653 can access. The CPU 653 may be a microprocessor, a microcontroller, or other types of processors.

[0088] The master decryption keys 680 and 681 are sent to the secure master key generation module 654. The security master key generation module 654 may include appropriate logic, circuits, and/or codes to further enhance the security of the master decryption keys 680 and 681. According to one aspect of the present invention, the secure master key generation module 654 may include an encryptor, or a scrambler, which may receive the master decryption key 682 as input. The master decryption key 682 may include a master decryption key 680 and a master decryption key 681. The secure master key generation module 654 can enhance the security of the master decryption key 680 and the master decryption key 681, and can generate the secure master decryption key K1 683 and the secure master decryption key K2 684.

[0089] The selector 656 may include appropriate logic, circuitry, and/or code to select from one or more inputs and generate one or more outputs. According to one aspect of the present invention, the selector 656 can be a 2:1 selector that can generate three outputs from any two received inputs. For example, the secure master decryption keys K1 and K2, 683 and 684 can be used as input by the selector 656 to generate output, respectively. For example, the secure master decryption key 683 may be selected twice, and the secure master decryption key 684 is selected once.

[0090] The security key decryption and security key signature authentication system 650 may be adapted to receive the encrypted and signed key 646. The encryption and signing key 646 can be generated by, for example, a security key generation, a security key signature, and a security key encryption system, such as the system shown in FIG. 7. After the encryption and signature key 646 is received by the security key decryption and security key authentication system 650, it can be stored in the input register 672. The encryption and signing key 646 is then sent to the decryptor 658. According to an aspect of the present invention, the encryption and signature key 646 may include, for example, multiple 64 bits, and may include at least one of an encryption key, a key target, and/or a key signature.

[0091] The decryptor 658 may include appropriate logic, circuitry and/or code to decrypt any encryption and signature key 646. According to one aspect of the present invention, the encryptor 658 may include a 3DES-encryption-decryption-encryption (DES) or a decryption-encryption-decryption (DED) decryption engine. Decrypt keys K1, K2, 683 and 684. The decryptor 658 generates a cracked decryption key 688 and signature bytes 690 as output.

[0092] The cracked decryption key 688 can be sent to the intermediate target register 664, and then reconciled by the selector 656

Encryptor 658 is used to decrypt the subsequent encryption and signature key 646. For example, the secure master decryption key K1 683 and the secure master decryption key K2 684 can be used only once by the selector 656 and the decryptor 658 to decrypt the first pair of encryption and signature keys 646 received by the decryptor 658 . The obtained cracking and decryption keys K1 686 and K2 685 can be stored in the intermediate target register 664. The cracking and decryption keys 685 and 686 can then be used by the selector 656 and the decryptor 658 to decrypt the second pair received by the decryptor 658, the subsequent encryption and signing key pair 646. This cyclic process can continue until all the encryption and signature keys of the received key ladder are cracked and decrypted.

[0093] After the encryption and signature key 646 is decrypted by the decryptor 658, the signature bytes 690 of each encryption and signature key are generated as the output of the decryptor 658. The signature byte 690 is then input to the signature verification module 662. The signature verification module 662 may include appropriate logic, circuitry, and/or code to verify the authentication of the signature byte 690. According to an aspect of the present invention, the signature verification module 662 may use an asymmetric encryption algorithm, such as a public key encryption algorithm, to authenticate the received signature bytes 690. The authentication key 687 can be loaded by the CPU 653. The authentication key 687 may include, for example, a public key, which may be used to authenticate the signature 690. The authentication key 687 may be stored in the input register 660 initially. The signature authentication module 662 may use the authentication key (public key) 687 to authenticate the received signature 690. Then, the enable/disable signal 691 can be generated by the signature authentication module 662, and then the enable/disable signal 691 is transmitted to the switch 668.

[0094] The switch 668 may receive the cracked decryption key 688, and may allow or deny further sending of the cracked decryption key 688 through the final destination register 670. If the instruction 691 includes an enable instruction, the cracked decryption key 688 can be transferred to the final destination register 670 for further processing. If the instruction 691 includes a prohibition instruction, the decrypted decryption key 688 cannot be transferred to the final destination register 670. For example, if the signature verification module confirms that the signature 690 is not verified, a prohibition instruction 691 will be generated. For example, if the encryption and signature key 646 is manipulated by an attacker when it is transmitted to the secure key decryption and secure key authentication system 650, the signature 690 cannot be authenticated. The authentication of the signature 690 by the signature authentication module 662 can be enabled or disabled by the enable bit 678. Bit 678 may include a multi-level programming (MSP) bit. For example, the enable bit 678 may be set to a predetermined value, so that the signature verification module 662 is activated and the signature 690 is verified.

[0095] In an embodiment of the present invention, an encryption algorithm can be used to encrypt or decrypt data. In addition, security keys can be used to enhance the authentication process. Strong pairings can exist between various keys and target modules that use these keys. The use of strong pairing can increase the security and reliability in the transmission of the security key to the target module related to the key. For example, strong pairing can be used in the security key decryption and security key authentication system 650. More specifically, the instantaneous security key received through the input register 672 can be used along the security key data path from the moment when strong pairing is used, or generated by the security master key generation module 654, until the cracked and decrypted key Send to the final destination register 670.

[0096] FIG. 6 is a block diagram of an exemplary system 700 for generating and transmitting a security key to a target user in a strong pairing according to an embodiment of the present invention. Referring to FIG. 6, the system 700 may include an internal key generator 701, an external key generator 703, a security key sequence 705, and a target module 715. The security key sequence 705 may include a security key 707, which may be paired with a security instruction 709 and a target address 711. The internal key generator 701 may be placed in a circuit that uses a security key, such as an application specific integrated circuit (ASIC), which includes appropriate logic, circuit, and/or code to generate the security key. The external key generator 703 may be placed outside the circuit that uses the security key, and may include appropriate logic, circuits, and/or code adapted to generate the security key.

[0097] During operation, the security key 707 can be generated by the internal key generator 701 or the external key generator 703. The generated security key 707 may be associated with the target address 711 indicating the target module 715. The key 707 and its associated address 711 can be paired with the security instruction 709 to form a security key sequence 705. The security instruction includes a rule, and the rule can be associated with the characteristics of the target module 715. More specifically, the security command 709 can be transmitted with the security secret

CN 1655495 Β

The attributes of the Π/14 page key 707 are related to the permitted use. The security instruction 709 may include the method of encryption/decryption using the security key 707, the size of the security key 707, and/or information about the method used to calculate the security key 707.

[0098] After the security key sequence 705 is formed, it can be transmitted to the target module 715 through the transmission bus 713. The transmission bus 713 may include, for example, a serial transmission bus. In one aspect of the present invention, multiple target modules can receive a security key sequence, such as a security key sequence 705, and can determine which target module will process the received security key according to the security instruction in the security key sequence .

[0099] The strong pairing between the source of the security key 707 and the target module 715 can be achieved through the pairing of the security key 707 and the target address 711 with the security instruction 709, and then the security key sequence 705 is sent to the target Module 715. The strong pairing of the security key 707 and the target-related characteristics indicated by the security instruction 709 can be provided based on the generation of the security key 707, the distribution (sending) of the security key 709, and the use of the security key 707 by the target module 715 Strong pairing of the entire security key data path in the system 700.

[0100] FIG. 7 shows a block diagram of an exemplary security architecture in an application specific integrated circuit (ASIC) using the security key generation and transmission system shown in FIG. 6 according to an embodiment of the present invention. Referring to FIG. 7, the ASIC 832 may include a CPU 834, a transmission core 802, and external security users 821, 823, and 825. External security users 821, 823, and 825 may include deserializers 832, 834, and 836, respectively. The transmission core 802 may include a secure top 804 and internal secure users 808, 810, and 812. Internal security users 808, 810, and 812 may include deserializers 826, 828, and 830, respectively. The secure top 804 may include a transmission key serializer 807, an internal key generator 801, a register control 806, a key routing and control logic 805, an external key interface 803, and key serializers 811, 813, and 815.

[0101] The set-top box (STB) may include an ASIC, such as ASIC 832, and the ASIC may be adapted to use a secure key transmission and transmission system, such as the secure key transmission and transmission system shown in FIG. Strong pairing. ASIC 832 may include appropriate logic, circuits and/or codes to process audio/video satellite or terrestrial data, store these data on disks, and/or display these data on monitors, such as TV monitors .

[0102] The transmission core 802 in the ASIC 832 may include appropriate logic, circuits, and/or codes for audio/video data received from an ASIC interface or from a source such as a memory (for example, data received from a memory). The security top 804 in the transmission core 802 can be adapted to implement the security key calculation function in the transmission core 802, for example, any function required to implement a strong pairing between the security key and the target module.

[0103] The internal key generator 801 may include appropriate logic, circuits and/or codes to transmit the security key. The security key can also be transmitted by a key generator other than the ASIC 932, and then transmitted to the external key interface 804 through the connection line 804.

[0104] The key serializers 807, 811, 813, and 815 may include appropriate logic, code and/or circuitry for pairing the security key and its associated target module address with the security instruction to form a security key sequence , And then send the prepared security key sequence. For example, the key serializer 811 can be adapted to transmit a 256-bit security key, and the security key can be calculated 32 bits at a time. Therefore, the key serializer 811 can be adapted to support all the middle 32-bit parts until the entire 256-bit security key is available and can be sent.

[0105] The address part in each security key sequence can be configured by the CPU 834 writing to the register. The CPU writing to the register can be sent to the key serializer 811 through the register control 806. The security instruction in the security key sequence prepared by the key serializer can be determined by writing in the CPU register, or determined by hard coding of the value according to the calculation or generation method of the security key. When a certain segment of the safety instruction is hard-coded, the register write cannot be used to specify the value of the segment. For example, if the security key has been received through the external key interface 803, there are two bits in the security key command that can be used as

CN 1655495 Β

Hard-coded to indicate the source of the security key, which is an external source.

[0106] The key serializers 807, 811, 813, and 815 may use the security key generated by the internal key generator 801, or the security key received from the outside through the connection line 804 and the external key interface 803. The key serializers 807, 811, 813, and 815 can be separated according to security users to adapt them to services. For example, external security users 821, 823, and 825 may be involved in different services. An external security user 821 may run specific software related to the work of a disk drive, while external security users 823 and 825 may be involved in different jobs and do not need to share a serial key.Device resources. So, for example, to facilitate software implementation, each secure user 821, 823, and 825 can use their respective key serializers 811, 813, and 815, respectively.

[0107] Similarly, internal security users 808, 810, and 812 may need to share key serializer resources, so a single key serializer 807 can be provided to serve internal security users 808, 810, and 812. In one aspect of the present invention, the key serializer can be shared by multiple deserializers. In this case, the target address field can be used to specify the predetermined address of the key. The destination address can also be used in configurations where one key serializer is connected to only one key deserializer.

[0108] In another aspect of the present invention, the key serializer 807 can be implemented by a plurality of separated serializers, and the key serializers 811, 813, and 815 can be implemented by a single serializer.

[0109] In another aspect of the present invention, the security command word can be used to invalidate the key transmitted in the previous event. At this point, the safety instructions and addresses can be described. The transmitted signal can be received by the key serializer and can be used to invalidate the key that has been sent to the deserializer.

[0110] Each of the secure users 808, 810, 812, 821, 823, and 825 can be used to encrypt and/or decrypt data. In addition, each secure user 808, 810, 812, 821, 823, and 825 may include key deserializers 826, 828, 830, 832, 834, and 836, respectively. The key deserializer may include appropriate logic, circuits and/or codes to receive the signal sent by the security key sequence from the key serializer, and restore (separate) the security key and corresponding security instructions ( Or rules). After separating the security key and security instruction from the security key sequence in the deserializer, the security user can check the security instruction and determine how the security key is used and which target module associated with the security instruction can be used it. For example, the target module associated with the secure user may be adapted to use only the internally generated security key (ie, for example, there is a security key generated by the internal key generator 801). If the security instruction indicates that, for example, the deserialization security key is calculated using an external key generator, the security user can indicate that the received security key cannot be used. In this way, a strong pairing between the security key and the target module can be completed.

[0111] The security users in the ASIC 832 can be divided into internal security users and external security users. The internal security users 808, 810, and 812 can be used to transfer target modules in the core 802, and the internal security users 821, 823, and 825 can be used to transfer target modules outside the core 802.

[0112] Internal security users 808, 810, and 812 can be used to decrypt data received from content providers. For example, encrypted data can be received from a satellite or terrestrial cable connection. In this way, internal security users 808, 810, and 812 can be used as the initial decryption of data received by ASIC 832. In addition, internal security users 808, 810, and 812 can be used to receive/send security keys that may be required by the target module in the transmission core 802. ASIC832 can use multiple internal security users to process several encrypted data streams. For example, the internal security users 808 and 810 can be used to decrypt the two encrypted video streams received by the ASIC 832, and the internal security user 812 can be used to decrypt the received audio streams.

[0113] External security users 821, 823, and 825 can be used to connect to target modules outside the transmission core 802. Each external security user 821, 823, and 825 can be adapted to store more than one security key for different operations. In this way, the security key table can be associated with each external security user. The target module ground of each deserialized security key sequence

CN 1655495 Β

The address part can be used to determine which part of the key table or which target module is related to the received secure key transmission. The external security users 821, 823, and 825 can also be used for other encryption and/or decryption tasks that may be required after the received data is decrypted. Once the received encrypted data is decrypted in the ASIC 632 with the help of a security key, there will be requirements on how to store the decrypted data in the memory, how to store it on the hard disk, and how to transmit it on the network. For example, subsequent encryption may be required before storage in memory, storage on the hard disk, and transmission on the network. All these requirements related to the processing of data can be fulfilled by the security instructions sent together with the security key.

[0114] Using external security users 821, 823, and 825 instead of internal security users 808, 810, and 812, the hardware resources used to transmit the security key in the ASIC 832 can be reduced. In this way, since the physical distance between the external security users 821, 823, and 825 and other blocks in the ASIC 832 is reduced, the processing of the security key can be more effective. External security users 821, 823, and 825 can also be used for additional system applications, for example, if the decrypted data needs to be stored on the hard disk. External security users can then be used to encrypt data before storage. Each security user in ASIC 832, internal or external security user, can have different uses for the security key and the associated security instructions calculated for it.

[0115] The key routing and control logic 805 may be coupled to the internal key generator 801 and the external key generator 803, and may include appropriate logic, circuits and/or codes for calculating the security keys that can be used . For example, a set of rules can be associated with the permitted method of using the key received from the internal key generator 801 or from the external key generator 803, and a set of rules determines which target module to send the security to according to the transmission method of the security key. Key. For example, the key routing and control logic 805 can determine which key serializer in the ASIC 832 can be used for a particular key obtained from the external key generator 804.

[0116] The key routing and control logic 805 may also provide storage for intermediate results generated by the internal key generator 801 or the external key generator 803 during the security key generation process. In addition, the key routing and control logic 805 can also receive status signals sent back from the key serializers 807, 811, 813, and 815. For example, the serializer may be in the process of sending the security key. During the sending process, the serializer can also send a status message to inform the key routing and control logic 805 that a new security key cannot be sent at present. After the serializer completes the transmission of the security key, it can send back a signal to the key routing and control logic 805, indicating that it can receive a new key for transmission.

[0117] The register control 806 may be coupled to the CPU 832, and may include appropriate logic, circuits, and/or codes to configure the internal key generator 801, the external key interface 803, and the key routing and control logic 805, In order to correctly complete the generation and serialization of the security key. The register control 806 can configure the work of the internal key generator 801 before completing the operation. It can also be used to initiate the generation of new keys. In addition, the register control 806 can be coupled to the CPU 834 in the ASIC 832, and can execute instructions in the name of the CPU 834 for generating a security key, or an intermediate security key, for example, for future generation of a security key. The CPU 834 can provide the address portion of the security key sequence, which can then be used by the security key serializer.

[0118] When working, the security key can be generated by the internal security key generator 801. The security key can also be generated by a source outside of the ASIC 832, and then can be used by the ASDIC 832 through interfaces, such as the external key interface 803 and the communication path 804. The security key can be assembled through the key routing and control logic 805, and then the transmission key serializer 807, and/or the key serializer 81K813 and 815 can be used to distribute to the appropriate destination through a dedicated security key transmission bus . The key serializers 807, 811, 813, and 815 can be used to pair a security key and its associated target module address with a security instruction to obtain a security key sequence. The key serializers 807, 811, 813, and 815 then send the security key sequence to internal security users, such as later 808, 810, and 812, and/or external security users, such as security users 821, 823, and 825. The key serializers 811, 813, and 815 may include, for example, MEM-MEM key serializer, MEM-IDE key serializer, and/or HDMI

CN 1655495 Β

Key serializer. The external security users 821, 823, and 825 may include, for example, MEM-MEM, MEM-IDE, and/or HDMI security users. The US Patent Application Serial No. 10/414,844 filed on March 14, 2003 discloses a MEM-3DES-MEM system, the full text of which is incorporated herein by reference.

[0119] In the embodiment of the present invention, the strong pairing between the security key and the destination can be formed by pairing the security instruction (or data structure) with the security key and its associated security address to form a security key sequence to realise. The security key sequence can then be transmitted to the target user. The target module uses the security key and continues to work according to the control information contained in the attached data structure. The data structure may contain control information, such as the type of algorithm associated with the target module, the size of the security key, and the source of the security key. When the target module receives the security key, it can compare the security instruction (or data structure) with the selected attached configuration. If the attached configuration does not match the security key data structure, the target module can report an error and initiate an action. For example, the target module reports data corruption and initiates an action to restore the corrupted data.

[0120] In the embodiment of the present invention, the security key, its associated target module address, and the tagged security instruction (or data structure) can be serially transmitted to the target module through a dedicated serial bus.

[0121] FIG. 8 is a method 900 for strong pairing and transmitting a security key to a target user according to an embodiment of the present invention. In step 901, a security key is generated. For example, the security key can be generated by an internal key generator on the chip, or by an external key generator that is transmitted outside the chip by using a strong pairing key. In addition, the security key can be associated with the target module address, indicating the target module inside or outside the chip. In step 903, the generated security key and its associated target module address can be paired with the rule. The rules may include safety instructions and/or data structures.

[0122] In step 905, the rule and the security key and its associated target module address are allocated to the target module together. In step 907, the rule is compared with the algorithm configuration of the target module. In step 909, it can be determined whether the rule is violated. If the rule is violated, in step 911, a failure report from the target module can be received. In step 913, the security key is invalidated by the target module. If the rules are not violated, in step 915, the security key can be used by the target module.

[0123] Accordingly, the present invention can be implemented by hardware, software, or a combination of hardware and software. The present invention can be implemented on at least one computer system in a centralized manner, or implemented by distributing different components on several interconnected computer systems in a decentralized manner. Any type of computer system or other device adapted to implement the above method is applicable. A typical combination of hardware and software is a general-purpose computer system, which has a computer program that can control the computer system to implement the method when it is loaded and executed.

[0124] The present invention can also be embedded in a computer program product, which should include all the features that can implement the above methods, and can implement these methods when loaded into a computer system. The computer program in this article refers to a set of instructions expressed in any language, code or symbol to enable a system with information processing capabilities to directly or later implement one or two of the following specific functions: a) Convert to another What kind of language, code or symbol; b) reproduced in different substantive forms.

[0125] Although the present invention has been described with reference to certain embodiments, those skilled in the industry should understand that various changes can be made and equivalents can be substituted, which are not beyond the scope of the present invention. In addition, many changes can be made to adapt specific conditions and materials to the content of the present invention, and these are not beyond the scope of the present invention. Therefore, the present invention should not be limited to the disclosed specific embodiments, but the present invention will include all embodiments within the scope of the claims.

CN 1655495 Β