Method for checking the integrity and authenticity of data (variants)

The invention relates to the field of control of the integrity and authenticity of data, and in particular with

downloading software.

The invention can be applied to all devices that contain at least one central unit as in

Currently used in information technology, say, a processor, at least part of the program

which is contained within the memory with the possibility of rewriting.

It is well known that the replacement or damage of data leaves its traces in certain parts of the information that was processed and stored in memory, whether before or after processing. It is also known that in order to determine whether the changes in the data under consideration, a simple mathematical method, such as a "checksum" check, is used through the creation of a reference checksum.

However, it is likely that the control system has also undergone a change, and in the future it can not check the contents of its memory. Therefore, during the conduct of mathematical operations, there may be a spread of compensatingadditional errors, which gives a result identical to the expected. Consequently, in certain cases, verification by known methods may prove ineffective.

Thus, there is a problem that does not have a satisfactory solution, which consists in the need to improve the level of reliability and protection achieved through known verification methods, especially when one and the same block is used to calculate its checksum and compare it with the reference value .

It is well known that in order to make all data changes visible, data is used for unidirectional operations, that is, an operation that is easy to execute in one direction, but is almost impossible to execute in another

direction. For example, operation Xⁱⁿ performed easily, and at the same time operation V^x Perform a lot more complicated.

The term "conflict-free operation" means an operation whereby any other combination of incoming data yields a similar result.

In the context of the present invention, this unidirectional operation is a mathematical application of H from the source group to the object group in which each element x of the source group is assigned the Hdo symbol. These functions are especially useful when they are functions known as hash functions according to their definition on page 27 of the publication H5Λ BogoGiogiee "Questions about current cryptography, which often occur, v.4.0." Element x can have any length, but H (x) always consists of a number of symbols of a fixed length (a string of fixed size). It is difficult to invert this function, that is, the knowledge of H (x) does not at all mean that we can find x. It is said that it is more free of conflicts if it is injective, that is, when H (γ) = H (x) leads to = x or Η (γ) ^ Η (χ) leads to y * x.

The object of the present invention is to ensure that the information contained in the decoder of the pay-TV receiver is, on the one hand, the one handed over to the control center and, on the other hand, has not been changed.

This goal is achieved by applying a method for verifying the integrity and authenticity of the data set (from M1 to Mp) stored in the memory of the decoding unit of the pay TV receiver, which includes the actual decoding unit and the security block, as well as communication means (NEC, UES ) with the control center.

The method is:

transmission of data (from M1 to Mp) to the security block;

calculation of control information (Hx), which is a reflection of the result of the use of the function known well-directed and free of conflicts, to all or only to a part of the data (from M1 to Mp);

encryption of control information (Nh) with the help of the first encryption switch (k1); establishingconformity of control information (Nh) by communicating with the control center with one ofthe means of communication.

Thus, the integrity of the data is not further verified by the decoding unit alone, in which the data is stored, but is guaranteed by an external device that is considered to be impenetrable - the security block.

According to the present invention, the decoder itself can perform calculations and transmit the results to the block of protection or transfer to the block of protection the data from M1 to Mp, which then performs the calculation of hash information.

Encryption keys used to encrypt information from the control center are contained exclusively in the security block. The decoder does not have the means to decrypt these messages, and thus to modify the data transmitted by the control center when the same messages pass through the decoder.

These security units are usually executed in the form of a smart card and contain memory, microprocessor and communication means.

By means of communication we understand either bidirectional communication through cable, modem or communication in the range of radio waves. This term covers the main means of data transfer and the means by which messages are forwarded to the security module.

A verification of the conformity of control information (Hx) can be performed in several ways.

The security module sends encrypted control information to the control center, and this latter is responsible for conducting the verification. In response, the control center can send either a simple resultcomparation of the OK / NOK, or the reference value. All these messages are encrypted using the encryption switch module.

The control center enters the result in memory with reference to each subscriber device, as proof of the correctness of the operation of loading, or, conversely, as proof of the change of data, for example, considering retorts.

According to one embodiment of the invention, the control center may first send a reference value directly to the security units. Thus, there is no need to request a central management to verify the compliance of the calculated control information, Nh.

According to another way of conducting operations, and in the case when a request for verification is received from the security block, the control center sends to the security block, as a result of comparison, the reference value (Well) in the encrypted form k2 (Well). As soon as this happens, the control center not only informs the security unit whether it is correct or not, but sends this reference value to the security block. It will be done

mainly when the comparison yields a positive result, so that the security unit could remember the reference

meaning Well

Forwarding this information may be done by auxiliary means, for example, by modem

or using the main data path.

In the case where data from M1 to Mp are already accompanied by verification tools, such as cyclic excess code, checksum or hash function, the decoding block can perform initial testing using the tools contained therein. However, the reliability of this test should call into question, andindepend, if the data will be changed by a third person, it is likely that this third person in the same way will change the means of verification. That is why in the method of the present invention, the security unit can inform block decoding so that it does not accept the test result as a guarantee of the authenticity of the data, and this authenticity is determined in accordance with the method described below.

This option is important in the case of updating a number of decoders, some of which have an older version of the operating system and need verification in the checksum, or belong to those that are already equipped for the system according to the method stated here.

When you download updated software, it is common practice to send only the part that has been changed. Data from M1 to Mp do not represent the whole newly updated program. The reason is that in order to support the reliability of the means of verification of the entire program, it is important to have a reference value N'u, which is a reflection of the hash function in the newly created program.

This is the first way, which is to establish the initial integrity of the program P0, that is, before its updating. To do this, the initial results of the H0 hash functions in the program P0 or initialized at the program installation, or determined according to the method of the present invention.

When the authenticity of the updated revision data is installed and inserted into the memory program, the security unit can command the command so that the hash function is applied to the entire new program P1, which will result in N1.This result will be necessary for subsequent checks or subsequent updates.

One of the options of this method is to obtain from the control center a new value H'u, which is a reflection of the action of the hash function on the whole new program P1, and which is shown here from the sequence from M0 to Mt.

The control data P sent by the control center may contain a service descriptor of the data, indicating the decoding block (NSF) how to use this data. The descriptor can be executed in the form of a table, which contains all addresses and recipients of data. Therefore, this data can not be used without a descriptor, and the latter will be returned to the decoding block (III) only when the comparison gives a positive result.

In accordance with an embodiment of the invention, the control center includes confirmation of the control data P, in order to certify the transmitter.

This verification function is related not only to the loading of new data into the decoder, but also allows to carry out testing of the authenticity and authenticity of data at any time. In this case, the operation is in the calculation, periodically or upon request, the values ​​of the display of Hx the result of the application of the so-called unidirectional and free of conflict functions to all or only to a portion of the data (from m0 to Mt) in the operational memory of the decoder and in the transmission of this information (H ' x) to the protection block for comparison with the reference value (N'u).

To perform this operation there is a first way, which consists in the fact that the calculations are made by the decoder, and their result is transmitted to the security block. According to the option of this method, calculations are carried out by the protection block, and data (from M0 to Mt) is transmitted from the decoder to the security block (AP).

The request for verification of these operations may come from the control center, from the block of protection, from the test block, or from one of the means of communication, only if they are under stress.

Since the security unit compares the calculated values ​​of H'x with the reference value H'u, the latter may bepresented either to a value calculated by the decoder I / v after confirmation of its reliability control center, or the reference value provided by the control center.

One of the ways that commonly used by dishonest people in an attempt to understand how a pay-TV system is, is to monitor the response that follows the attempt to modify the system. That is why this invention is equally open to the method of transmitting a comparison result, executed in another way, for example, when the subscriber decides to accept event information, and created subscriber of the message sent to the control center.

In this message, it is useful to put information that the data from M1 to Mp have been changed, otherwise it will be very difficult to link this modification of data with decoder blocking, which may occur much later.

According to an embodiment of the invention, the value of the result of calculations Hx is transmitted to the center of management. In order to do this and leave it hidden, the result is divided into parts and placed, partly in part, inside the administrative messages used by the system.

The control center again forms the value of Hx, part by part, and when its value becomes complete, determines whether these values ​​have changed.

One of the problems encountered when updating a large number of decoders is the number of requests to the control center to get verified.

One of the proposed solutions within the scope of the present invention is to subdivide the pseudo-random method of this request into a verification center for verification.

Another solution described earlier is the reference of the previous reference value. Therefore, if the data is received correctly, which happens in most cases, the update may take effect without waiting for the request to the control center. In any case, this request will be made to confirm that the upgrade has been completed correctly.

In a particular method of operation, the group under consideration contains a transmitter node located inside the control center, and a receiver that can be executed in the form of a sufficiently large number of peripheral blocks that operate in a similar manner. The purpose of the method is to ensure that the software sent by the node

transmitter, are obtained in the authentic form and in full by each of the peripheral blocks. In accordance with the terminology used in pay-per-view television, which is an important but non-exclusive, in the scope of the present invention, in the remainder of this document, peripheral blocks will be called a combined decoder receiver (ΙΕώ), which includes a receiver, a decoder for processing adopted by it a signal and a central processor, or a CP, which operates predominantly with a non-energy storage device, as is the case with a variety of peripherals.

The non-volatile storage device is a memory whose contents, even if the main source of power is excluded, is maintained intact, for example, by using at least one such independent source of energy as electric batteries. Other types of non-volatile memory devices can be used, for example, programmable permanent memory with electric eraser (EERY) and flash programmable permanent storage device (GERM). It is these non-volatile memory devices that store data intact in the event of an interruption of the supply of current, but it is important for the normal organization of the CPU block III.

Information coming from the control center is obtained by the IIS in the form of a data stream that arrives at the I / O block receiver. In the case of encoded television, or more generally interactive television, this data stream contains video information, audio information, data in the form of data, executable applications, and, finally, different types of control data.

In this case, the problem is to ensure that the information is accepted without errors and was interpreted ΙΕû before being written to RAM, especially in the case of executable data, that is, software.

The receiver of the ΙΕώ unit transmits them to the decoder, which then launches them into the circuit through ΙΕώ with the help of a bus. A special multimedia processor is connected to the bus, which in turn is connected to the monitor and one or more speakers, the nonvolatile memory device mentioned above and one or more required subordinate devices. The processor (SR) organizes the correct operation of the ΙΕû and controls it, as well as various subordinate devices, such as the interface, auxiliary memory device, other processors, or a modem. Moreover, the control center can accept exchange information, for example, via a modem connected to a public data network.

These subordinate devices themselves can be a source of errors, which then need to be detected and corrected, especially in the case of downloading a new version of the current software ΙΕώ, and its special SR, or certain executive programs for ΙΕό or its components.

Software and data for which the authenticity and integrity of the software must be guaranteed may be downloaded by various means. One of these means, as already mentioned, is to send the above-mentioned reciever of the updated memory redundancy together with a data stream that contains a series of data blocks M1, M2, ... Mp, similar to the headers, in order for the central unit to be readily recognizable these data from M1 to Dmp.

Alternatively, or as an add-on, data blocks can reach ΙΕό through one of its optional subordinate devices, for example, via a modem.

In the context of this invention, data blocks M1, M2, ... Mp without any interference can be sent in unciphered form, that is, without being encrypted.

In the present form, the method according to the present invention consists in the first application, during the transmission stage, of the unidirectional or hash function to a part, or to all data blocks M1, M2, ... Mn, in order to result in the mapping of Hx of the group from M1 to Mn. Data blocks M1, M2, ... Mn can be processed separately in a completely similar manner and as a result give H1h, which corresponds to M1, Nh2, which corresponds to M2 and Nhp, which corresponds to Mn. This result or these Hx are stored in the memory of the control center for further verification.

When verifying the authenticity of data, the particular criticism is caused by the system by which these data transmitted through public communication channels, such as radio channels, telephones, or the Internet. In this case, the attacker may take the place of the control center and send data for changes in the system's operation, selected target.

A well-known cryptographic attachment during data transfer to verify their authenticity. However, this cryptogram meets only the needs of the author's data identification, but it does not affect the decoder that lost the benchmark criteria.

The efficiency of the method depends in part on the quality of the unidirectional function of H and on the approval of these signals by a block of protection that is considered impenetrable. Thus, a simple checksum does not allow to find the permutation of two blocks of characters in the data, because the addition in mathematics is consideredcommutative and associative action. On the other hand, the result of using the hash function, Hx, is a dualistic image of x, even if it is much longer than Hx. If the permutation of symbols is carried out in a group of characters x, the function H (x) will find it immediately, and then the system will not be able to further operate. The result will be a refusal caused by the protection.

An important aspect of the invention is that it allows at any time to verify the reliability of data in the memory of peripheral blocks. In fact, the presence of this control information in the security module allows the decoder to perform auto-verification. This verification gives the result without its comparison with the control amount that is commonly used in the program memory. If this verification yields a result similar to the standard, the block has different means (modem connection, cable communication) to inform the external block, for example, the central administration, the program mismatch.

If in the present invention, the advantage of creating and transmitting control information is given to the control center, then the invention also provides a peripheral block in which all or part of the program is preloaded together with the control information as described above. This can be done during production at the moment of initialization before a trading operation using the processor, or by loading this control information through one of the peripheral devices at the stage of initialization.

The invention is illustrated by a block diagram of a combined receiver-decoder.

The I / R or the combined receiver decoder shown in this flowchart is a peripheral part of the system before

which method of the invention is used in the order described below. This IIS contains a central tire

U, to which all other modules are attached. The central module of the III block is executed in the form of a central one

CPU processor, whose task is to perform various processes.

The REC receiver receives a stream of data that contains video and audio information, data in the form of data and executable applications, through various service channels, such as cable, Hertz dipole, satellite parabolic antenna, Internet or other known technology. This REC receiver is connected to the interface of the UC channel data transmission, which is also connected to the bus (UB).

To the bus (ВВ) the following blocks are also attached:

multimedia processor MR, designed for processing video and audio information, which sends it in accordance with the monitor νû and loudspeakers Áû;

test channel TC, which can be connected to the TEEST for factory setting and service;

nonvolatile storage device NνM, which is independent of the main source of energy and has its own power supply;

ΙΝΤ interface for a smart card that physically perceives a smart card; auxiliary storage device or TMEM memory block;

Modem MW, connected to the public network NEC, which uses widely known technical and service means;

other processors OR, PC with different functions in accordance with the needs of the user, in particular those related to data processing.

It is the CR that manages the software update, an example of which will be described. He accepts them or discards depending on the results of testing, conducted using the method that is the subject of thisproduct.

These versions of the software for the CII of the III block can be accessed through the IR receiver via the TEZT tester, via the smart card of the AP or via the NTE network. An example will be described below of how streaming video and audio information arrives in the IR through the receiver of the RE.

A dataset representing a new version of the software that arrives in the IPO is written to the timely memory of the TMEM block of the ITU together with the service information after verifying that it is authentic and integral. This allows the control center to download this version of the software in a large number of peripherals and to carry out an error-free installation through IP.

As soon as the message was received by the III block, the data is split into pieces, and these various items are recorded in the temporary memory of TMEM. ΙΡû handles blocks from M1 to Mp in the same state in which they were transmitted, but in reverse order. It is clear that in the case when these blocks are taken in an encrypted form, the first operation is to decrypt the data using the public key of the RIC to have the data unciphered.

The next step is to apply the unidirectional function H to the data blocks from M1 to Mn, so that the result is a value from Nu1 to Nup. In the case when an error occurred in memory blocks M1, M2, ... Mn, during the transmission of the message, this error will manifest itself to Well, which will be different from Nh contained in the control block, and data from M1 to Mp will be rejected. .

These results are transmitted to the smart card of the Armed Forces, which is responsible for verifying their authenticity. As a descriptive note, this operation is carried out by way of communication with the control center, either immediately or later.

An example of functions H is the functions M2, M5, and CNA-1.

According to another embodiment of the invention, the block containing the data does not have a communication channel with the central control. Data comes to the storage device, together with the control information (P1), which is the result of the application of a unidirectional or non-conflict function called the hash function to all or to a portion of the data (from M1 to Mn). The peculiarity of this control information (P1) lies in the fact that, on the one hand, it contains a hash function for the considered data set, and on the other hand, these data are written in encrypted form k2 (Well). The memory device can not recognize or modify them.

During the verification phase, the storage device transmits control information in the encrypted view to the security block. The security block contains means for decrypting this information, especially for creating a result from the use of a hash function (Well).

In addition, in accordance with a first embodiment of the invention, the storage device uses a hash function for data from M1 to Mn, calculates control information Nh and passes it to the security block for comparison. In response, the security unit sends back data to the storage device (P2), including the result of the comparison.

Further, if the data is not authentic, the storage device provides the adoption of the necessary measures.

According to a second embodiment of the invention, the calculation of control information Nh is carried out by a security block, which in this case receives data from the storage device from M1 to Mn.

According to an embodiment of the invention, which provides a higher level of assurance regarding the use of data, the supervising data (P1) appends a key encryption key for encryption of data from M1 to Mn.

These data are pre-recorded in encrypted form, and the hash function is created in these encrypted data. When the data integrity verification for the security block is performed and the result is positive, the security unit inserts a response encryption key k3 into the data (P2) sent to the storage device, which allows the data to be decrypted from M1 to Mp.

According to the variant of the method described above, the block protection does not send the encryption key k3, but the memory device sends the encrypted data from M1 to Mp to the AP protection block for decryption.

As in the previous method, this control can be carried out at any time during the work

storage device.

The control data (E1) contains a D data descriptor that specifies the storage device how to use

these data. This descriptor can be executed in the form of a table containing addresses and recipients of the data.

Therefore, this data can not be used without a descriptor, and the latter will be returned to

a storage device only when the comparison yields a positive result.

You can also provide that a confirmation that the data transmitter certifies to the management data (E1) is added in order to keep it in the security block.