Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F8/00—Arrangements for software engineering
  • G06F8/60—Software deployment
  • G06F8/61—Installation
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
  • H04L2463/101—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying security measures for digital rights management
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W76/00—Connection management
  • H04W76/10—Connection setup
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W8/00—Network data management
  • H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
  • H04W8/24—Transfer of terminal data
  • H04W8/245—Transfer of terminal data from a network towards a terminal

Definitions

• the present invention relates to the field of mobile equipment comprising one or more software applications intended to protect and secure digital services broadcast such as for example interactive pay television, audio content, games, software or services. continuous information such as weather forecasts, stock quotes, sports scores or other.
• the concept of mobile equipment is taken broadly and refers to a device such as, for example, a mobile phone, a personal PDA (personal digital assistant), a portable digital television receiver, a laptop, etc.
• a device such as, for example, a mobile phone, a personal PDA (personal digital assistant), a portable digital television receiver, a laptop, etc.
• Mobile equipment generally comprises at least one removable security module serving on the one hand to identify the equipment when connecting to a network and on the other hand to control access to the services broadcast by the network.
• This security module is known as SIM (Subscriber Identity Module) or USIM (Universal Subscriber Identity Module) for 3rd generation equipment able to connect to UMTS (Universal Mobile Telecommunications System) or RUIM (Re -Usable Identification Module) for equipment designed to access a Code Division Multiple Access (CDMA) network.
• SIM Subscriber Identity Module
• USIM Universal Subscriber Identity Module
• UMTS Universal Mobile Telecommunications System
• RUIM Re -Usable Identification Module
• the operator managing the network and the services broadcast introduces an identifier of the IMSI (International Mobile Subscriber Identification) type used to identify in a safe and unique manner each subscriber wishing to connect to a mobile network.
• IMSI International Mobile Subscriber Identification
• each mobile device is physically identified by a number stored in a nonvolatile memory of the equipment.
• This number called IMEI (International Mobile Equipment Identifier) contains an identification of the type of mobile equipment and a serial number to uniquely identify a given mobile device on a GSM (Global System for Mobile Communications) network, UMTS Universal Packet Radio System (GPRS), 3GPP (3rd Generation Partnership Project) or other.
• Mobile equipment is also characterized by a software version SVN (Software Version Number) indicating the update status of the basic software installed on the mobile equipment. Combining the type and serial number identification of the mobile device with the software version (SVN) gives a new identification, called IMEISV (International Mobile Equipment Identifier and Software Version Number).
• the physical identifier may be a Media Access Control (MAC) address corresponding to the address Unique identifier of a user's hardware configuration on the network and software version can be transmitted by IP-based higher layer protocols.
• MAC Media Access Control
• WO98 / 57474 discloses a wireless telephone handset with a smart card in which is stored an address of an Internet provider.
• the card is read by the handset equipped with browser software using the stored address to connect the handset to the Internet.
• the card further comprises one or more microservers each having an address for exchanging data with the Internet and a memory for storing various user data.
• the functions or applications stored by the micro-servers of the card such as a program for access to a bank account or an electronic wallet, can be downloaded and updated from the Internet.
• the document US2003 / 0041127 describes a system and a method for updating a firmware in a device via a communication network. The method includes steps for determining the current version of a firmware installed in the device, searching for predetermined update sites, comparing the current version of the firmware with the available version and sending e-mail. (e-mail) notification when a firmware update is required.
• IP Datacast over DVB-H: Service Purchase and Protection (SPP) involve the use of a proprietary security application in mobile equipment.
• this application can be defined as a Java application loaded into the device to run on a Java Virtual Machine.
• the application communicates with the elements of the mobile equipment (IP stack, SIM card, screen, keyboard, etc.) via APIs (Application Programming Interface) standardized by the JAVA environment.
• APIs Application Programming Interface
• the ETSI TS 102 474 standard does not provide any means of loading this application into the equipment, for example when it is first put into service or connected to the network.
• applications installed in a mobile device do not necessarily work in a JAVA-based framework. They can also be loaded, for example, in the form of binary code using resources provided by an operating system such as MS-Windows-CE, Linux etc.
• the object of the present invention is to provide the possibility of loading a security application for television services broadcast in generic configuration mobile equipment while respecting the standardized specifications.
• This goal is achieved by a method of loading and managing a software application in mobile equipment for receiving digital data from mobile TV services broadcast over a unidirectional mobile network comprising basic software stored in a memory and at least a security module (SM), said application being associated with the broadcast mobile TV services, the method comprising a prior step of transmission to the management center via a bidirectional mobile data network, distinct from the unidirectional mobile network, identification of the mobile equipment and the security module when connecting the equipment to said bidirectional mobile network, is characterized in that the basic software of the mobile equipment reads a descriptor stored in the security module designating a server of the center management system capable of providing the mobile equipment with the application or an update of said download application in said mobile equipment via the bidirectional mobile network.
• SM security module
• the subject of the invention also relates to a security module for mobile equipment intended to receive digital data of broadcast mobile television services, characterized in that it comprises a memory in which is stored at least one descriptor designating a data server. a management center capable of providing the mobile equipment with an application or an update of said application by downloading in said mobile equipment.
• the security module of the mobile equipment contains an IP address of a server capable of providing at least one security application for protecting the data of the mobile TV services broadcast.
• a server capable of providing at least one security application for protecting the data of the mobile TV services broadcast.
• the server designated by the IP address can also provide complete applications including security means, such as a mobile pay TV application that a user can download in the mobile equipment.
• security means such as a mobile pay TV application that a user can download in the mobile equipment.
• To this mobile TV application can be added applications operator-specific commercial operations with appropriate controls allowing the user to purchase programs in PPV (Pay-Per-View) mode and / or PPT (Pay-Per-Time) mode or subscribe to one or more services provided by the operator.
• PPV Payment-Per-View
• PPT Payment-Per-Time
• This IP address is stored in the security module during an initialization phase of the generic mobile equipment performed for example when the mobile device connects to the network for the first time. It can also be recorded during the manufacture of the security module or rather during the personalization steps during which identifiers such as I 1 IMSI are registered.
• FIG. 1 illustrates a general block diagram of the system architecture comprising a management center and at least one mobile equipment connected to a mobile broadcasting network of the DVB-H type and to a bidirectional mobile network of the UMTS type.
• FIG. 2 illustrates a block diagram of the applications and units implemented to secure communications between the management center and mobile equipment equipped with a security module.
• the invention applies more particularly in a system called IP Datacast used by DVB (Digital Video Broadcasting) to create DVB-H services (Digital Video Broadcasting - Handheld or Digital Video Broadcasting - Portable).
• DVB Digital Video Broadcasting
• DVB-H Digital Video Broadcasting - Handheld or Digital Video Broadcasting - Portable
• the management center includes a content control unit (CP) for coding, storing and preparing the content to be broadcast via the unidirectional network (N1), a processing unit (DVB-H) responsible for creating the content.
• CP content control unit
• DVB-H processing unit responsible for creating the content.
• SP Content and Services Protection Unit
• the latter encrypts the content, manages the access rights to the content and communicates with the mobile equipment (EM) via the bidirectional network (N2).
• These interconnected units are controlled by a broadcast control unit (BC) controlling which content is broadcast at a given time with which access criteria.
• SM security module
• the mobile device upon engagement, identifies the services available through an Electronic Services Guide (ESG).
• ESG Electronic Services Guide
• the user controls one of the available services through a secure transaction with the service provider that determines whether the service will be broadcast unidirectionally through a portion of the DVB-H stream or whether the service will be provided by the interactive two-way mobile network. This choice is made on the basis of service audience measurements and allows an optimal distribution of the capacity of the DVB-H stream according to the number of active users in a given area. Access to broadcast content is controlled based on the rights acquired by users.
• the security system of mobile equipment intended to receive pay television services is based on a structure called Open Security Framework allowing compatibility with different key management system (KMS) key management system solutions.
• KMS key management system
• CG management center
• ECMs Enltlement Management Messages
• ECM control messages Entitlement Control Message
• FIG 2 shows a block diagram of the applications used for the protection of data exchanged between the management center (CG) and the mobile equipment (EM).
• the management center comprises a key management system (KMS) controlled by session information (S) relating to the selected service transmitting EMM and ECM messages to mobile equipment.
• KMS key management system
• S session information
• This system is also responsible for encrypting the stream with encryption unit (ENC) before it is broadcast with keys included in the transmitted ECM messages.
• KDA Key Management System Device Agent
• the KDA security application contains settings specific to an operator or security provider necessary to control the decryption of data and adapted to a particular key management system (KMS). It provides the following security functions:
• receiving ECM message flows corresponding to a selected service on the broadcast network.
• the KDA application communicates with the security module of the equipment during each security operation such as the management of the access rights resulting from the EMM messages or the extraction of the decryption keys from the ECM messages.
• An advantage of the present invention is the possibility of providing generic configuration mobile equipment comprising basic software and a suitable security module.
• the generic mobile equipment connects to the bidirectional mobile network (N2) according to a known method comprising the identification of the mobile equipment and the security module carried out by the management center (CG). .
• the latter transmits, after acceptance of the mobile equipment, information relating to mobile TV operators DVB-H or other service providers and their services to enable the user to make a choice according to his wishes.
• the selection of a given provider causes the transmission of an IP address by the management center (CG) via the bidirectional mobile network (N2) to the security module where this address will be stored.
• the mobile equipment can thus be "customized” by downloading and installing specific applications through a server designated by the stored IP address.
• the updates and additional services of the selected provider are preferably also loaded into the mobile equipment via this bidirectional mobile network server (N2).
• the security application (KDA) or any other application to be downloaded into the mobile equipment (EM) via the IP address of the security module may be specific to either the type and / or the version of the security module (SM), either the model and / or the version of the mobile equipment or both characteristics at the same time. These are transmitted to the management center via the IMSI and NMEISV, either when connecting the mobile equipment to the bidirectional mobile network (N2), or in a download request or after identification of the mobile device. configuration of the mobile equipment and / or the security module by the management center (CG) via the bidirectional network (N2) during updates of the application. Such identification can be performed regularly when rigorous maintenance of the application is requested by the service providers.
• the application installed in the mobile equipment can automatically check, at predetermined times, the availability of updates, via the server designated by the IP address stored in the security module, in order to download them the case. applicable.
• the IP address may be dependent on the manufacturer and / or the model and / or the version of the security module, etc.
• An update may be either optional or mandatory and in this case the security module may block or restrict certain services access features broadcast services until the update.
• the update can be initialized by an encrypted message with a known key of the security module transmitted by the management center.
• the security module can thus compare and check the version of the application installed in the mobile equipment with that available on the management center server with the information contained in the message. When the available version is greater than the installed version, the security module transmits to the application a download command via the IP address.
• the module can also restrict or block functions of mobile equipment.
• This security measure allows the management center or the operator to detect attempts to hack the application.
• the security module can generate a short message of the SMS (Short Message Service) type to the operator announcing an attempt of fraud on the part of the user.
• SMS Short Message Service
• the operator can either suspend all access rights or the subscription to broadcast services, or send warning messages indicating that the operator has identified the security module identifier. user who has hacked his mobile equipment.

Landscapes

• Engineering & Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• Software Systems (AREA)
• Signal Processing (AREA)
• Computer Networks & Wireless Communication (AREA)
• Computing Systems (AREA)
• Computer Security & Cryptography (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• Mobile Radio Communication Systems (AREA)
• Two-Way Televisions, Distribution Of Moving Picture Or The Like (AREA)

Priority Applications (1)

Applications Claiming Priority (3)

Publications (1)

Family

ID=37817370

Family Applications (2)

Family Applications Before (1)

Country Status (4)

Families Citing this family (21)

Citations (1)

Family Cites Families (26)

• 2006
  • 2006-10-23 EP EP06291665A patent/EP1916598A1/de not_active Withdrawn
• 2007
  • 2007-10-19 CN CNA2007800393723A patent/CN101529380A/zh active Pending
  • 2007-10-19 EP EP07821585A patent/EP2084604A2/de not_active Withdrawn
  • 2007-10-19 WO PCT/EP2007/061221 patent/WO2008049792A2/fr not_active Ceased
  • 2007-10-23 US US11/877,141 patent/US8135825B2/en not_active Expired - Fee Related

Patent Citations (1)

Also Published As

Similar Documents

Legal Events