JPH0580184B2 - - Google Patents

Description

[Detailed description of the invention]

[Field of Industrial Application] The present invention relates to an improvement in a pay broadcasting system that consists of a large number of contract recipients (for example, 1 million or more), such as a pay system for television using broadcasting satellites, and particularly relates to this type of pay broadcasting system. The present invention relates to a method of delivering a work key necessary for descrambling program data scrambled with a scramble key on a receiving side in a paid system. [Conventional technology and its problems] CATV in Japan has been developed as a means of solving problems such as difficult viewing in mountainous areas and reception problems in large cities.
In recent years, this has often been realized in the form of large-scale, multi-channel, multi-purpose urban CATV. It goes without saying that the establishment of CATV is predicated on the existence of a large number of subscriber subscribers, but there is a limit to the expansion of its scale, and it is still necessary to use it as a countermeasure for difficult viewing and reception problems in large cities. It is said to demonstrate its true value. On the other hand, as part of the trend towards the sophistication and diversification of communication media in line with the development of advanced information technology in society, full-scale satellite broadcasting will finally be implemented with the broadcasting satellite BS-3 scheduled to be launched soon. It is said that B.S.
-3 is launched, in order to contribute to the diversity of people's information needs and the enrichment and development of broadcasting services, broadcasting services such as paid television will be implemented targeting an extremely large number of viewers. become. Therefore, we will work to further popularize and develop the paid system for satellite broadcasting, make it possible to provide viewers with high-performance and inexpensive receiving terminal equipment, establish a domestic standard system, and create uniform standards. Therefore, by the Telecommunications Technology Council,
The technical conditions for the paid system were studied, and the culmination of these efforts was the completion of the ``Telecommunications Technology Council Report for 1988'' on November 28, 1985. According to the definition shown in this report, the paid system for television using broadcasting satellites involves scrambling and broadcasting television video, audio, etc. signals from the broadcasting program provider, and transmitting the scrambled signals via the broadcasting satellite. This can be said to be a technical method in which a subscriber who receives the video uses a decoder to unscramble the video and listen to it. This paid method uses a scrambling subsystem that electrically scrambles video and audio signals to provide confidentiality, and instructs the decoder to perform descrambling to restore the scrambled video and audio signals. It consists of two subsystems: a related information subsystem that allows subscribers to receive pay-TV services and collect fees. A typical system configuration of all the pay television systems proposed so far, including the above report, is as shown in FIG. 2, for example. Therefore, with reference to FIG. 2, a conventional technique of this type of scrambling encryption key distribution method will be described. Transmitting side In the conventional technology, the transmitting side device is, for example, a second
It has a configuration as shown on the left side of the figure. That is, in the figure, 1 is the scrambler (SCR), 2 is the first
3 is the second encoder (ENC1), 3 is the second encoder (ENC2),
4 is a combiner (MUX), 5 is an individual information group generator (KJ-G), and 6 is a receiver-specific master key group generator (Km-G). Program data [BD] is data obtained by digitizing video or audio signals such as television signals, and is converted into a scrambled signal [eBD] by being scrambled with a scramble key [Ks] in the scrambler 1. Ru.
Program data [BD] is data common to recipients. Program information [BJ] is information attached to program data [BD], and includes viewing permission conditions (program price,
viewing conditions code, etc.) and scramble key [Ks]
etc., and is converted into an encrypted signal [eBJ] by being encrypted with the work key [Kw] in the first encoder 2. Here, the scramble key [Ks] is a short-cycle key that is usually updated in about 1 second, and the program information [BJ]
is information common to all recipients, and includes contract conditions (payment price, number of valid months, code for viewing conditions, etc.) and the above-mentioned scramble key [Ks]. The individual information [KJ1, KJ2, ...KJp, ...KJn] that constitutes the individual information group [KJ-G] is transmitted from the sending side because the encrypted program information [eBJ] is decrypted on the receiving side. Information delivered in addition to the broadcast signal, including contract conditions (payment amount, number of valid months, code for viewing conditions, etc.) and work key [Kw]
etc., and is converted into encrypted individual information [eKJp] of Mr. p by being encrypted with a master key [Kmp] unique to the recipient (Mr. p) in the second encoder 3, for example. Ru. Note that the work key [Kw] is a long-cycle key that is usually updated on a monthly basis. In addition, the individual information group [KJ-G] is composed of individual information [KJ1], [KJ2], ..., [KJn] for each recipient, and the suffixes 1 to n are assigned to each recipient. indicates the recipient number received. For example, if we look at individual information [KJp],
It is one of the individual information group [KJ-G],
This is individual information unique to the recipient (Mr. P). Here, p is the number assigned to recipient Mr. p,
Indicates one integer in the integer sequence 1 to n. The recipient-specific master key group [Km-G] is a master key that each recipient owns.
It consists of Km1, Km2, ...Kmp..., Kmn. 1 to n are the aforementioned recipient numbers, and therefore, the master key [Kmp] is one of the master keys in the master key group [Km-G] and indicates the master key for Mr. p. Receiver p's individual information [KJp] is encrypted with receiver p's master key [Kmp] in the second encryptor [ENC2], and becomes encrypted Mr. p's individual information [eKJp]. ]. These signals, namely, encrypted program data [eBD], encrypted program information [eBJ], and a large number of encrypted individual information groups [eKJ-G],
After being combined by a combiner (MUX) 4, the signals are delivered to each recipient via a broadcasting satellite or the like. In addition, the encoder (ENC1) and encoder (ENC2) are
In some cases, the same encoder is used in a time-sharing manner. Receiving Side A receiving side device, that is, a receiving terminal device in the prior art has a configuration as shown on the right side of FIG. 2, for example. In the figure, 10 is a separator (DMUX), 11
is the descrambler (DSCR), 12 is the first compounder (DEC1), 13 is the second compounder (DEC2), 1
4 is a comparator and 15 is a master key generator unique to each recipient, for example Mr. p. The signals delivered from the transmitter to each receiver as described above, namely scrambled program data [eBD] and encrypted program information [eBJ]
and a large number of encrypted individual information groups [eKJ-G]
The separator (DMUX) 10 performs selective separation to separate [eBD], [eBJ], and [eKJ-G] groups, and then the message addressed to Mr. p himself in the [eKJ-G] group is Extract only individual information [eKJp]. First, the encrypted individual information [eKJp] is
It is decrypted by the second decryptor (DEC2) 13 using the master key [Kmp] unique to the recipient (p), and becomes the original individual information [KJp] of Mr. p. As mentioned above, this [KJp] includes contract conditions (payment price, valid months, viewing conditions code, etc.)
and work key [Kw]. Next, the encrypted program information [eBJ] is decrypted by the first decoder (DEC1) 12 using the work key [Kw] common to the recipients and becomes the original program information [BJ]. Become. As mentioned above, this program information [BJ] includes:
It includes viewing permission conditions (program price, viewing condition code, etc.) and a scramble key [Ks]. Finally, the scrambled program data [eBD] is compared with Mr. p's individual information [KJp] by the comparator 14, and as a result,
The contract conditions (payment price, number of valid months, viewing conditions code, etc.) that [eBD] is included in [KJp],
Only when the viewing permission conditions (program price, viewing condition code, etc.) included in the program information [BJ] match, the switch (SW) 17 becomes conductive and the descrambler (DSCR) 11 The data is then descrambled using a scramble key [Ks] to become the original program data [BD]. In addition, the decoder (DEC1) and the decoder (DEC2)
In some cases, the same decoder is used in a time-division manner. [Problems to be solved by the invention and characteristics of the solution] In the conventional key distribution method described above, even in the case of a long-term contract that spans several months, the work key [Kw] cannot be distributed on a monthly basis. Each time an update is made, an individual information group [KJ-G] containing the work key [Kw] is sent, so
When there are a large number of recipients, the time required to send the individual information group [KJ-G] becomes enormous, and with only a single transmission path, it is not possible to send the work key [Kw] to all recipients in a short time. There was a drawback that it could not be delivered by . For example, if there are 10 million recipients,
Individual information group [KJ-G] including work key [Kw]
Even if the delivery capacity of is 1 million people per hour, the individual information [KJp] of recipient p, including the work key [Kw], is encrypted with the master key [Kmp] unique to recipient p. Since the work key [Kw] is delivered to each recipient individually, it takes at least
Requires 10 hours. Furthermore, if the recipient cannot always wait for reception,
If the individual information [KJp] is to be sent several times in consideration of errors on the transmission path, it will take several tens of hours or more to deliver the work key [Kw]. As described above, the conventional encryption key distribution method has a problem in that the delivery efficiency is low, and the time required for delivery increases, especially when there are an extremely large number of recipients. Attempting to do so not only required extra equipment and operational costs, such as increasing the number of transmission lines, but also required overcoming various difficult technical conditions, which inevitably led to higher system costs. Thus, the present invention is directed to solving the above-mentioned problems in the prior art, and particularly aims to improve the efficiency of encryption key delivery by shortening the work key [Kw] delivery time. It is said that Therefore, in the present invention, the conditions for decrypting the scramble key [Ks] are
Since it is assumed that the contract conditions for his individual information [KJp] match the viewing permission contract conditions for the program information [BJ], the work key [Kw] included in the individual information group [KJ-G] is sent to the recipient. Even if the work key [Kw] is given to everyone, there is no problem in giving it to everyone, for example, the contract conditions for Mr. P's individual information [KJp] and the viewing permission contract conditions for program information [BJ]. Taking note of the fact that if there is a difference, the scramble key [Ks] cannot be decrypted, a technical means has been devised to achieve the above objective. That is, based on the recognition of the above facts, in the present invention, a group key is set by dividing a large number of recipients into multiple groups, and designating a designated recipient to represent each group. However, by using this group key to encrypt and deliver the long-period encryption key [KW], we have made it possible to significantly shorten the time it takes to deliver the long-period encryption key. It is. [Example] In order to clarify the specific structure and operation of the scrambling encryption key distribution method of the present invention, FIG. Examples of the method of the present invention will be described with reference to . In FIG. 1, as in the prior art shown in FIG. 2, the transmitting side device is shown on the left side, and the receiving side device is shown on the right side. On the transmitting side in FIG. 1, 21 is a scrambler (SCR), 22 and 2
3 are the first and second encoders (ENC1,
ENC2), 24 is a synthesizer (MUX), 25 is an individual information group generator (KJ-G), and 26 is a receiver-specific master key group generator (Km-G), and each of these technical means will be described later. There is no particular difference from each of the corresponding technical means in Figure 2, except for the following points. Also, on the receiving side in Fig. 1, 30 is a separator (DMUX), 31 is a descrambler (DSCR), 3
2 and 33 are first and second decryptors (DEC1, DEC2), 34 is a comparison collation device, 35 is a master key generator (Kmp) unique to the recipient (Mr. P),
37 is a switch (SW), and each of these technical means is not particularly different from the corresponding technical means in FIG. 2 except for the points described later. However, in addition to the fact that the system shown in FIG. 1 differs from the system shown in FIG. 2. Information, keys, etc. that are not shown in Figure 2 are required to implement the method. Therefore, in order to avoid the hole length, we purposely omit the explanation of the matters common to the conventional method realized by the system configuration shown in the second diagram, and focus on the characteristic matters of the method of the present invention. I will reveal the details of it below. As mentioned earlier, a gate circuit 28 is provided on the transmission side of the pay television system in which the method of the invention is implemented. In the present invention, the condition for decrypting the system scramble key [Ks] is, for example, that the contract conditions in the individual information [KJp] of a certain receiver p match the viewing permission contract conditions in the program information [BJ]. Therefore, even if the work key [Kw] is given to all recipients, there will be no problem.
We recognize that there is no risk of problems such as unauthorized viewing. Therefore, all recipients are divided into multiple groups, and a group key is set for each group to form a group key group (Kg-G) that includes all recipients.
It is created from a master key group (Km-G) unique to the designated recipient representing each group that passed through. For example, if recipient p is designated as the designated recipient representing the group for a certain group, the group key [Kgp] of that group P is the designated recipient p.
One of the group keys (Kg-G) created from his unique master key [Kmp] and encompassing all recipients.
It becomes one. For example, a master key unique to each recipient [Km ₁ ,
Km ₂ , ..., Kmp, ...Kmn] are set to 10 bits, and Mr. p's master key [Kmp] is (1010110100) as shown in the first table below.
Suppose that Further, it is assumed that the mask information has the specified number of bits as the lower 2 bits, and that the specific pattern of the upper 8 bits to be masked are all set to 1. In this way, the group key [Kgp] for the master key [Kmp] unique to the designated recipient Mr. p has mask bits, that is,
The upper 8 bits (10101101) of [Kmp] are all
Since it is masked with a specific pattern (for example, 11111111) inputted to the gate circuit 28 as mask information, it becomes (1111111100) as shown in column 1 of Table 1. Similarly, group keys [Kgp2] for groups represented by designated recipients p2, p3, and p4, respectively, having unique master keys [Kmp2], [Kmp3], and [Kmp4];
[Kgp3] and [Kgp4] are shown in Table 1-2, respectively.
Created as shown in columns -3 and -4. Therefore, for one group key [Kgp] of the group represented by designated recipient Mr. p, if only the specified lower 2 bits are (00), the masked upper 8 bits of data 1 are ignored. Therefore, in the end, it corresponds to 2 ⁸ = 256 people. Similarly, if the lower two bits of the group keys [Kgp2], [Kgp3], and [Kgp4] are (01), (10), and (11), each one will be enough for 256 recipients belonging to that group. handle. Therefore, if you use the four types of group keys [Kgp], [Kg2], [Kg3] and [Kgp4] shown in columns -1 to -4 of Table 1, you can create a 10-bit recipient-specific master key. This means that the work keys [Kw] for all owners (1024 people) can be delivered in just 4 times.

[Table] Note that the group key group [Kg-G] is
As described above, half of the mask information necessary to create the above is input to the gate circuit 28, while the other half is synthesized with the encrypted group information [eKJ] without being encrypted. Vessel 2
4 and then sent out. On the other hand, on the receiving side, for example, the designated recipient p
The group key [Kgp] for the group that Mr. Mr. represents is obtained by separating mask information from the signal delivered from the transmitting side using the separator 30 of the receiving terminal of Mr. receiver h, and based on the mask information, the group key [Kgp] for the group that Mr. Created using a unique master key [Kmh],
It will be used to extract the original group information [KJφ] from the encrypted group information [eKJφ]. The process at the receiving end can be ascertained by those skilled in the art by retracing the process at the transmitting end of the present invention described above while referring to the previous detailed description of the prior art receiving end in FIG. I think it's easy to guess, but just to be sure, I'll give a brief explanation below. In the above explanation, due to the example used, the upper bits of the master key [Kmp] unique to the recipient are used as mask information for creating the group key [Kgp] of the group represented by the designated recipient p. Although only the specified lower bits may be masked, it goes without saying that only the specified intermediate bits may be masked. Furthermore, in the above description, the masked bits are replaced with a fixed pattern of 0 or 1; however,
It is also possible to use any special pattern agreed upon in advance between the sending side and the receiving side, and it is clear that the present invention can be applied even when the mask information includes a special pattern that allows any pattern to be used. . [Effects of the Invention] As explained above, the present invention achieves a
Since the work key [Kw] can be delivered to all recipients in the following short time, it is possible to significantly shorten the delivery time of long-cycle work keys Kw, especially if the recipient is on a short-term contract of one month. However, it has the advantage of being able to change the work key [Kw] whenever necessary. In addition, the group key [Kgp] used in the method of the present invention
is created from a master key [Kmp] unique to the recipient, so there is no need to store it together with the master key [Kmp] unique to the recipient from the beginning on the receiving side, and therefore the system configuration does not become complicated. This will improve its flexibility and efficiency of use.

[Brief explanation of the drawing]

FIG. 1 shows a system diagram of the method according to the invention, and FIG. 2 shows a system diagram according to the prior art. BJ...Program information including scramble key Ks,
BD...Program data, 21...Scrambler, 2
2, 23...Encryptor, 24...Synthesizer, 25...
Individual information group generator, 26...master key group generator,
28...gate circuit, 30...separator, 31...
Descrambler, 32, 33...Decoder, 34...
... Comparison verifier, 35 ... Master key generator unique to the recipient (Mr. a master key (group key) specific to the group to which the designated recipient (p) belongs and represents;
KJ-G...Individual information group for all recipients, KJφ...Information that includes information common to all recipients and the work key [Kw], KJp...One of the individual information groups [KJ],
Individual information including the contract terms between [Kw] and the recipient (Mr.
G] is one of the master keys held by the recipient (Mr. P).

Claims (1)

[Claims] 1 Decryption is performed using the work key only when the viewing permission conditions in the program information decrypted with the work key match the reception contract conditions in the recipient's individual information decrypted with the recipient's unique master key. In the encryption key distribution method in the paid broadcasting system, which extracts the encryption key from the program information that has been received, when dividing the entire large number of recipients who have made a viewing contract with the broadcaster, each recipient receives an appropriate number. In order to organize the group into multiple groups containing recipients, each of these multiple groups has a designated recipient who is representative of the recipients belonging to that group, and each group has a designated recipient that is unique to that designated recipient. A group key is generated in which only a specified number of bits are selected from the master key based on mask information and other bits are fixed in a specific pattern, and the group information including the work key is encrypted using the group key. is delivered from the broadcaster to all the recipients, while the recipients belonging to each group among the plurality of groups decrypt the encrypted data containing the work key with the group key. An encryption key distribution method characterized by instantaneously extracting a work key regardless of contract conditions.