Time validation system

Background of the Invention

The Invention relates to a system for time validation, the terminal with a means terminating on a number of different carrier frequencies which an authorization means, for. example, a smart card, which is capable of to the terminal to communicate, and means to timestamp using a modulated signal, the carrier frequency of a has, to the terminal transferred to. The invention also relates to a terminal and an authorization device in such a system. The invention also relates to a computer program for loading on a programmable device, such. as a smart card, in order to use it as an authorization device in such a system.

If a user of a terminal is entitled in such a system only used it to certain use periods, must contain a representation of the current time in the terminal be validated to check whether the current Time is such a certain time. Some systems keep the time by using only the timestamp. Others may in terminal have a watch to display the time. The time of the clock and the time stamps can be validated, that the two Values ​​checked against each other will.

Existing However, systems for time validation are not generally reliable. Around complexity and the cost of such systems to be kept low, usually only the authorization device against sabotage secured. Devices are usually of a standard type which is not secured against hacking. A Clock in the terminal could be found on another time can be set or may slow down or be accelerated. Timestamps, which are transmitted to the terminal, can be recorded and later are shown in a tamper attack.

<patcit><text>WO 97/28649</text></patcit> discloses a A method of jamming, having a time control, wherein the transmitted articles having be provided a time stamp, that is equipped with data be, the transmission timing of the represent. The timing is based on an electrical storage medium, which is advantageously a smart card. The real time clock is advantageously on the smart card because then an unauthorized change can be prevented in the same known way as a change other Data on the smart card. For continuous operation of the real time clock the smart card has to be provided with a power supply. An operation by a authorized dealer is required if the real time clock in the smart card to a new time must be set, z. B. if time zones crossed , provided the system is not a specific standard time during his entire operation used.

<patcit><text>US 6,145,206</text></patcit> discloses a receiver unit for receiving a digital broadcasting signal and band-external Data from an external source, wherein the digital transmission signal band and external Data from the external source to the receiver unit at different transmitted transmission frequencies will. The receiver unit is capable of simultaneously both the digital transmit signal and the band-external data and to receive the two data streams for a further Processing by an access authorization subsystem available for put.

Summary of the Invention

Around to obtain a system which validates the time in a reliable manner, is a system according to the invention characterized in that the authorization device comprises means to choose a carrier frequency which the adjustment is made to a timestamp to obtain. It is therefore impossible, the terminal provide an incorrect time stamp, as you know in advance takes, wherein carrier frequency to render is. Such knowledge can only come from the authorization means are obtained, which is safe.

In a preferred embodiment, the system according to the present Invention are timestamp on a number of different transmitted carrier frequencies, which exceeds the number of carrier frequencies, to a terminal can adjust simultaneously. This makes a transfer incorrect time stamp on different carrier frequencies unfeasible.

In a further preferred embodiment the system according to the present Invention, each time stamp field, the carrier frequency of the identifying a field that maps the date, a field that contains the maps time and an encrypted Signature. This signature is for the smart card further opportunity ready to verify that an authentic time stamp on transmitted the terminal has been.

In a preferred embodiment, the system according to the present Invention, the authorization device comprises means to a Carrier frequency, to an adjustment is made to retrieve a timestamp, accidentally select. Thus, it is not even theoretically possible to predict in advance, which carrier frequency selected will be to retrieve the timestamp.

BRIEF DESCRIPTION OF DRAWINGS

The Invention will now be with reference to the accompanying Pictures described.

<figref idrefs="S15">1</figref> shows a schematic example of a subscription television (pay-TV) system with features of a system according to the present Invention.

<figref idrefs="S16">2</figref> shows a schematic diagram of an embodiment of a system according to the present Invention.

<figref idrefs="S16">3</figref> shows an example of a time stamp.

<figref idrefs="S17">4</figref> shows a flowchart of a process of the present in a system according to the invention accomplished is.

Detailed Description of Preferred embodiments

On A subscription television system such as that in <figref idrefs="S15">1</figref> is a typical example of a system in which reliable time validation is required. Each subscriber has a terminal<figref>1</figref> for receiving the Signals which are transmitted to it. The terminal<figref>1</figref> can be generic, ie for use in a number of different subscription television systems be suitable. An owner of a terminal<figref>1</figref> Subscription may be change or subscribe different services, without the terminal <figref>1</figref> to change. In this case, some means, which allow the terminal <figref>1</figref> in the employ subscribed subscription television system of the operator Sending organization available provided, for example, a code or a smart card for insertion in the terminal <figref>1</figref>, The terminal <figref>1</figref> could also specifically for be the TV channel. In this case, it is usually a part of the subscription. It could necessary as before be a smart card with the terminal <figref>1</figref> employ, depending after the relevant subscription television system that the TV station uses.

the terminal <figref>1</figref> in <figref idrefs="S15">1</figref> is with a satellite dish <figref>2</figref> connected. The terminal <figref>1</figref> becomes for setting a carrier frequency and used transmitted on that frequency data on a TV <figref>3</figref> available to make. The data are from the transmitting station<figref>4</figref> on the satellite <figref>6</figref> transferred to the receiver. The transmitting station<figref>4</figref> transmits data on a number of different carrier frequencies. The transmitting station<figref>4</figref> can Data to the terminal <figref>1</figref> in transmit digital or analog form. The signal may be compressed or encrypted, to prevent that its contents for Non subscribers is.

Although <figref idrefs="S15">1</figref> on A subscription television system displays that uses satellite communications, is the invention is not restricted to transfers limited via satellite. Other pay-TV systems use networks of optical fibers or electrically conductive cables a. Subscription television systems terrestrial transmission, use the antenna for transmitting and receiving the signals to the also use the invention. A recorded signal, z. B. from a video or a DVD, may also be played through the receiver will. In this case, the video signal is processed by the reproducing apparatus, For example, the VCR is used, which then as a transmitting station <figref>4</figref> viewed can be to produce a modulated signal having a carrier frequency. In either case, the terminal <figref>1</figref> the appropriate means for tuning to the carrier frequency, and for receiving transmitted Data on or is connected to such.

Around to prevent someone with a terminal <figref>1</figref>, But without subscription receiving data are the television authorization Facilities <figref>6</figref> as the smart card in <figref idrefs="S15">1</figref> out. Also, means, which a smart card is similar, For example, a playback key transmitter could be used. As mentioned above, can the data that the terminal <figref>1</figref> transmitted are encrypted before transmission be or compressed. The authorization means<figref>6</figref> can then a key to enable decompressing or descrambling by the terminal <figref>1</figref> contain. A combination of encryption, Compression and troublemakers could also in the eye are taken, in which case the authorization means <figref>6</figref> and the terminal <figref>1</figref> a Number of operations must perform to the transmission data to the end user to make available.

Around the various components of the system to explain more fully, on <figref idrefs="S16">2</figref> Referring. Here, the terminal<figref>1</figref> medium <figref>7</figref>. <figref>7 '</figref> for setting to a carrier frequency on. In the embodiment shown the terminal can <figref>1</figref> themselves Set at a particular time on two different frequencies. This is by the two means <figref>7</figref>. <figref>7 '</figref> symbolizes, although they also subordinate circuits in a single shot circuit could be. The transmitting station <figref>4</figref> transmits data to the terminal <figref>1</figref> on one or more carrier frequencies a to e. As the transmission reaches is, is again immaterial as long as the signals are used modulated signals to generate with defined carrier frequencies.

time stamp are transmitted with the data, to which the end user is interested. So the data with the date on which it the end user of the terminal <figref>1</figref> to disposal gebe assumed linked. This is a restriction access to the data on a certain time interval possible. In addition, a recording and a reproduction of the signal at a later time prevented. The terminal<figref>1</figref> have to be the time stamps obtained also in one or more modulated includes signals generated by one of a number of available carrier frequencies a marked up e. A time-related access restriction will provided by the fact that only an authorized terminal <figref>1</figref> themselves the right moment for obtaining the time stamp on the correct carrier frequency can adjust, as will be described hereinafter.

There the terminal <figref>1</figref> in the example of <figref idrefs="S16">2</figref> simultaneously on two different carrier frequencies can adjust, it is advantageous timestamp by at least three different carrier frequencies radiate. If timestamp not transmitted simultaneously on all carrier frequencies be, but transmitted via different carrier frequencies be, is a repeated switching between carrier frequencies ae by means <figref>7</figref>. <figref>7 '</figref> the terminal for adjustment may be necessary.

The authorization means <figref>6</figref>Associated with the terminal <figref>1</figref> connected is, has a microcontroller <figref>8th</figref> with attached Data memory to which selects the frequency to be adjusted need to obtain a timestamp. The authorization means<figref>6</figref> becomes with rules for selecting a frequency equipped. These rules are kept secret. It is also possible, the establishment <figref>6</figref> be provided with a random generator, what it theoretically impossible makes to guess which of the carrier frequencies ae next selected will be.

the terminal <figref>1</figref> or possibly the authorization means <figref>6</figref> has a real time clock <figref>9</figref> on. This clock <figref>9</figref> displays the time, by the same format and the same reference period used as the television channel for the timestamp uses. The first sustaining timestamp is to start Clock <figref>9</figref> used at the correct time. The purpose of the real-time clock<figref>9</figref> consists is to be able to provide the user of the terminal <figref>1</figref> to certain times or during certain time intervals to allow access. This depends on the conditions of the subscription, which is the television. The time according to the real-time clock <figref>9</figref> becomes is compared with the time, permitted to access. In this way can someone who for has paid to watch a TV program only once, the signal is not record to make it later at a play time.

Around a sabotage of the real-time clock <figref>9</figref> after its discontinuation to prevent, it is advantageous to check them regularly. This can easily be further received timestamp done. The time in accordance with these Timestamps is then with that of the real-time clock <figref>9</figref> compared. If the time difference is outside a certain time window falls, will the terminal <figref>1</figref> Out of service set. The time window allowed inaccuracies when comparing and any unavoidable delays by signal processing and transmission. The validation of the time according to the real-time clock <figref>9</figref> provides Ensure that a spectator not the clock <figref>9</figref> may postpone, to a recorded signal a second time to see.

In usual Case that the user requires access to data stored in a or more of the modulated signals are included, on the one carrier frequency have, has the terminal <figref>1</figref> on medium <figref>10</figref> on which the use of the terminal <figref>1</figref> allows the data selective for an authorized user provides. This means<figref>10</figref> becomes usually in the form of a microcontroller with attached have data storage.

On selective data access can by this means <figref>10</figref> on various ways are permitted, depending on the particular system. In a simple embodiment, is the terminal completely switched off when the end user has no authorization, and turned on, when the end user is authorized. Alternatively, access to specific channels be prevented or released, depending on the result of the user authorization process. As a further alternative data on the transmitting station <figref>4</figref> be encrypted, encoded or disturbed. The middle <figref>10</figref>Which permits the use of the terminal comprises then modules for decrypting, Decoding or anti-jamming the data if it has been determined that the end user is authorized to access the data.

in the example of <figref idrefs="S16">2</figref> , the means <figref>10</figref>, the the use of the terminal allows a decoder <figref>11</figref> , by means of a key which the authorization means <figref>6</figref> is stored. If the authorization means <figref>6</figref> Notes that the use the terminal <figref>1</figref> blocked should be completed to decipher. This can occur when the time interval for the the use is released, has expired or if the system was sabotaged.

It is advantageous, the key to decipher the data often to change. This can by sending new key encrypted Form done. Means for decrypting the keys are by authorization control messages to disposal provided that the user to longer Time intervals available be provided. A calculationcan account for a particular control embassies Time interval validity have. Accordingly, it is advantageous to provide authorization control messages with a time stamp, to ensure that they can only be used during a specific time interval are, are just as the data time-stamped to ensure only during a certain time interval can be accessed. An embodiment the present invention may comprise this feature easily for example, by the time stamp, the authorization control message is attached or by the message is transmitted to the transmission data with a Timestamps are provided.

the in <figref idrefs="S16">2</figref> terminal shown <figref>1</figref> can simultaneously on two carrier frequencies set to. This can be advantageously employed. One of the means<figref>7</figref>. <figref>7 '</figref> can to set on the carrier frequency be used, from which a time stamp is obtained while the other set to the carrier frequency remains on the transfer data will. This would an interruption of the signal transmission for the connected device <figref>3</figref> prevent, when the not transmit timestamp on the same carrier frequency as the data is. Alternatively or additionally, the terminal can <figref>1</figref> a Speichermediumart <figref>12</figref> to the who save demodulated signals before decoding to an interruption spectatorship during to prevent the short time interval is needed to the time stamp to obtain.

<figref idrefs="S16">3</figref> shows an example of a time stamp with four fields. A data field contains the data <figref>31</figref>, Another contains the time <figref>32</figref>, These two fields Naturally are combined into one. A third data field contains the carrier identification<figref>33</figref>, D. h. a statement indicating which carrier frequency is used to transmit this specific timestamp. The last field of the time stamp is an encrypted signature <figref>34</figref>, The signature is each carrier frequency specific. decryption encrypted signature <figref>34</figref> gives information on one or all of the other data <figref>31</figref>. <figref>32</figref>. <figref>33</figref> in the signature. This is a protective measure against incorrect time stamp in order to further the reliability of the system to increase. In cases where an entitlement control message in a time stamp is included, it may in a further field of the time stamp be included in <figref idrefs="S16">3</figref> Not shown.

Around the essential abovementioned Aspects summarize shows <figref idrefs="S17">4</figref> an example of a Time validation process that is performed by the system. After the terminal <figref>1</figref> switched on was selected the authorization means <figref>6</figref> a carrier frequency of, adjusted to the is to obtain a timestamp. Ideally, this is done by means of a random generator. A request for a time stamp is, together with the carrier frequency, on receiving this time stamp to be set, to the terminal <figref>1</figref> Posted. The authorization means <figref>6</figref> reserves the requested frequency in the eye, leaving them with the carrier identification <figref>33</figref> and encrypted signature <figref>34</figref>That are included in the obtained time stamp, can be compared. These should match course if the authorization means<figref>6</figref> authentic is.

the terminal <figref>1</figref> receives the Request for a time stamp and the relevant carrier frequency, to be used to obtain it. One of the means<figref>7</figref>. <figref>7 '</figref> for setting arises on the carrier frequency and the time stamp is obtained. Either the timestamp directly to the authorization means <figref>6</figref> sent or Signature is only in the terminal <figref>1</figref> by means of a key deciphered, and the authorization device <figref>6</figref> supplied is. In any case proves the decrypted signature<figref>34</figref>. that the time stamp is actually obtained from the signal with the requested carrier frequency is. The time<figref>32</figref> then obtained from the carrier frequency is. The time<figref>32</figref> then obtained from the timestamp will.

If this is the first received time stamp, it is used to RTC <figref>9</figref> to initialize. The entire process may then be repeated to obtain a second timestamp. Each Time stamp, which is not the first received time stamp, can be used to validate the time, ie to check that RTC <figref>9</figref> still set to the correct time is. The magnitude of the difference between the time according to the real-time clock <figref>9</figref> and in accordance with the last Timestamp is determined. If this size is less than a certain permissible Window, the time is correct. On condition that the user of the terminal device <figref>1</figref> authorized is to obtain the data at this time, the data received in the decoder <figref>11</figref> decrypts and to the device, for example, TV <figref>3</figref>That to the terminal <figref>1</figref> affiliated will be forwarded. After a certain time delay is the process of time validation is repeated again.

It is clear that the invention is not limited to the above described exemplary embodiments limited is. The invention can be varied within the scope of the claims will. All communication methods that use modulated Signals having a carrier frequency allow to Thus, in the system according to the invention be used. Whether and, if so, what kind of data the transmitted timestamps is, is also irrelevant.