CN100384251C - User Authorization Method and Its Authorization System - Google Patents

Abstract

The invention provides a user authorization method, including setting a dynamic personal key with a lifetime shared by the front end and the user end; checking whether the lifetime of the dynamic personal key has reached, and if so, updating the dynamic personal key whose lifetime has reached Then return to continue to check the lifetime of the dynamic personal key; otherwise, the front end encrypts, scrambles and authorizes the transmission stream based on the dynamic personal key, and the client performs decryption and descrambling processing on the scrambled transmission stream based on the dynamic personal key. Correspondingly, the invention also provides a user authorization system. The invention can reduce the probability of illegal users using cloned smart cards to watch TV programs, and at the same time reduce the economic losses caused by operators for maintaining the smart cards.

Description

User Authorization Method and Its Authorization System

technical field

The invention relates to the cable television technology in the field of broadcasting and television, in particular to a user authorization method and an authorization system thereof.

Background technique

At present, with the digitalization and industrialization of the radio and television system, it has become inevitable for users to pay for the content of the TV programs they watch. The technical problem to be solved is that users who watch TV programs should be effectively managed.

Conditional Access System (CAS, Conditional Access System) is one of the ways to effectively manage users implemented in the existing broadcasting television network, and the main process of user management realized by CAS technology is as follows:

The front-end (HE, Head End) of the radio and television network performs scrambling processing on the TV program data to be sent to the user, and then authorizes the programs that the user can watch, and the authorized data after authorization processing must be encrypted before being processed. transmitted to the end user;

After the client receives the TV program, only the legal user can decrypt the encrypted authorization data to obtain the corresponding authorization data, and then use the authorization data to descramble the scrambled TV program to watch the TV program normally; Illegal users or users who have not normally received their own authorized data cannot descramble the scrambled TV programs, so they cannot watch TV programs normally, thus achieving the purpose of controlling and managing the content of TV programs watched by users , and then drive users to pay for the content of the TV programs they watch.

With reference to Fig. 1, this figure is the principle schematic diagram that prior art realizes adding and descrambling and encrypting and decrypting processing to TV program in the radio television network; It carries out adding and descrambling processing and the process of encrypting and decrypting processing to TV program data as follows:

Perform the following operations in HE 10, the front end of the broadcast television network:

1) Before the TV program is broadcast, the scrambler uses the control word (CW, Control Words) to scramble the transport stream (TS, Transport Stream) after the TV program data is multiplexed, which can be expressed as:

TS+CW->TS';

2) The core of CAS technology is actually to control the transmission of the control word CW, so in the front-end HE 10, the service key (SK, Service Key) is also used to encrypt the control word CW to form authorization control information (ECM , Entitlement Control Message), can be expressed as:

CW+SK->ECM;

The control word CW encrypted by the service key SK is encapsulated in the ECM for transmission, and the ECM also includes information such as the source of the program, the classification of the content, and the charging price of the program;

3) The front-end HE 10 uses the user's personal distribution key (PDK, Personal Distribute Keyword) to encrypt the service key SK according to the authorization information at the time of user registration to form an entitlement management message (EMM, Entitlement Management Message). Expressed as:

SK+PDK->EMM;

The service key SK encrypted by the personal distribution key PDK is encapsulated and transmitted in the EMM, and the EMM also includes address information of the receiver, user authorization information, and time period information of TV programs that the user can watch.

The above-mentioned EMM data is mainly generated for users, and the ECM data is mainly generated for TV program data. The generated EMM data and ECM data are multiplexed together with the TV program data in the transport stream TS through the fiber-coaxial hybrid cable TV network (HFC , Hybrid Fiber-Coaxial) to the client.

After the set-top box (STB, Set-Top Box) 20 at the user end receives the transport stream TS sent by the front-end HE 10 of the broadcast television network, it uses the user registration authorization data stored in the smart card (Smart Card) to perform the following operations on the transport stream TS Decryption and descrambling processing:

4) STB 20 filters out ECM data and EMM data from transport stream TS;

5) Send the ECM data and EMM data to the inside of the smart card through the interface of the smart card;

6) The smart card reads the personal distribution key PDK in its own authorized data, uses the PDK to decrypt the EMM data, and obtains the service key SK, which can be expressed as:

EMM+PDK->SK;

7) The smart card uses the obtained service key SK to decode the ECM data to obtain the control word CW, which can be expressed as:

ECM+SK->CW;

The smart card sends the obtained CW to the descrambling engine of the STB through the corresponding interface;

8) The descrambling engine of the set-top box STB 20 uses the control word CW to descramble the scrambled transport stream TS to obtain the plain text form of the TV program data, which can be expressed as:

TS'+CW->TS;

After the descrambled program data is processed by demultiplexing and demodulation, the original audio and video image information can be restored to be played for users to watch.

It can be seen that the above-mentioned use of CAS technology can implement encryption, decryption, scrambling and descrambling of TV program data, so as to drive users to pay for the TV programs they watch, thus enabling broadcast and TV operators to provide services for themselves. Reasonable Fee Purposes.

However, because at the user end, the user's authorization data (the most important is the personal distribution key PDK) is stored in the smart card held by the user, it is easy to lead to the drive of economic interests, criminals can use various methods to attack legal Clone the smart card held by the user (including the copy of the personal distribution key PDK), and then sell a large number of cloned smart cards through illegal channels to make huge profits, which leads to the loss of a large number of customers of radio and television operators, resulting in immeasurable economic losses .

Because the traditional radio and television system is a one-way transmission broadcast network, radio and television operators have no way of knowing whether users are online, so they cannot authenticate the legitimacy and uniqueness of user identities, so even if a large number of illegal Users with the same identity information on the smart card watch TV programs online at the same time, and the operator is helpless.

At present, radio and television operators provide two processing measures to prevent illegal users from cloning smart cards:

First, strengthen the physical security of the smart card itself to reduce the possibility of the smart card being cloned, but this method will definitely increase the burning cost of the smart card;

Second, after the smart card is found to be cloned, the smart card upgrade process is carried out in time, that is, the user authorization data stored in the smart card is replaced (the most important thing is to replace the personal distribution key PDK), so that the smart card cloned by the illegal user can be processed after the smart card upgrade process. , can no longer be used normally. However, this processing method faces the problem that even if a smart card is cloned, the broadcasting and television operators have to upgrade all the smart cards in the entire system and replace all the smart cards at the user end. The main reason is that it is not easy for the operator Know which smart cards have been cloned and which smart cards have not been cloned; secondly, even if only one smart card is cloned, other smart cards may also be cloned, so the entire smart card system must be replaced to avoid this risk. However, if all the smart cards in the whole system are replaced, it will also increase the operator's economic loss for upgrading all the smart cards.

Contents of the invention

The invention proposes a user authorization method and its authorization system to solve the problem that a large number of illegal users use cloned smart cards to watch TV programs due to imperfect authorization technology in the existing broadcasting TV system.

In order to solve the above problems, the present invention proposes a user authorization method, comprising steps:

(1) Set a dynamic personal key with a lifetime shared by the front end and the user end;

(2) Check whether the lifetime of the dynamic personal key arrives, if it is to continue step (3); otherwise go to step (4);

(3) Return to step (2) after updating the dynamic personal key whose lifetime has arrived;

(4) The front end encrypts, scrambles, and authorizes the transmission stream based on the dynamic personal key, and the user end performs decryption and descrambling processing on the scrambled transmission stream based on the dynamic personal key.

In the step (2), the lifetime of the dynamic personal key is checked periodically.

Described step (2) specifically comprises the following steps:

(21) set a fixed duration value;

(22) Whether the duration value between the current detection time point and the arrival time point of the dynamic personal key lifetime is less than the fixed duration value, if yes, the lifetime of the dynamic personal key is determined to have arrived;

Otherwise the decision is not reached.

The step (3) also includes the step of authenticating the user whose lifetime of the dynamic personal key has reached before updating the dynamic personal key. If the authentication is passed, continue to update the dynamic personal key, otherwise end.

Checking the lifetime of the dynamic personal key in the step (2) is completed by the front end.

Described step (3) carries out the process of identity authentication to the user end that dynamic personal key lifetime arrives specifically comprises steps:

(31) The front end sends an authentication instruction command to the user end whose dynamic personal key lifetime has arrived, and instructs the user end to perform identity authentication to the front end;

(32) The client uploads its own identification information to the front end;

(33) The front end performs identity authentication on the user terminal according to the identification information of the user terminal.

Before the step (31), the front end also includes a step of judging whether the user end whose lifetime of the dynamic personal key has reached is online.

In the step (2), checking the lifetime of the dynamic personal key is completed by the user end.

Described step (3) carries out the process of identity authentication to the user end that dynamic personal key lifetime arrives specifically comprises steps:

(3a) The user terminal whose lifetime of the dynamic personal key has reached uploads its own identification information to the front end of the radio and television network;

(3b) The front end performs identity authentication on the user terminal according to the identification information of the user terminal.

The process of said step (3) updating the dynamic personal key specifically includes:

(3-1) The front end uses the personal distribution key shared with the client to encrypt the updated dynamic personal key and then sends it to the client;

(3-2) The user terminal uses the personal distribution key stored in the user identity recognition module to decrypt the encrypted dynamic personal key data to obtain an updated dynamic personal key.

In the step (3-1), the front end of the radio and television network sends the encrypted dynamic personal key data to the user terminal through the wired transmission line of the wired communication network or the wireless transmission line of the wireless communication network.

The client identification information includes:

ID identification information of the set-top box at the user end; or

User identification information stored in the user identification module of the client terminal; or

The binding relationship between the set-top box ID information of the user end and the user identity information stored in the user identity identification module of the user end.

Wherein the process of implementing encryption, scrambling and authorization processing on the transmission stream based on the dynamic personal key described in step (4) specifically includes:

(41) The front end uses the control word to scramble the transport stream;

(42) Encrypting the control word with the service key to obtain authorization control information;

(43) Use the dynamic personal key to encrypt the service key to obtain authorization management information;

(44) multiplexing the authorization control information and authorization management information into the transport stream and sending it to the client;

The process of decrypting and descrambling the scrambled transport stream based on the dynamic personal key specifically includes:

(45) The client uses a dynamic personal key to decrypt the authorization management information to obtain a service key;

(46) Use the service key to decrypt the authorization control information to obtain the control word;

(47) Descrambling the scrambled transport stream by using the control word.

Correspondingly, the present invention also proposes a user authorization system, including a front end for broadcasting program streams and a user end for receiving program streams, the user end including a set-top box for processing program stream information and storing user The user identity identification module of authorization data, the system also includes:

A two-way communication module connected to a set-top box is provided at the user end, which is used to detect whether the dynamic personal key with a lifetime that is preset for each user end expires; and is used to upload the user end identification information to the set-top box. The above-mentioned front-end is used to receive the updated user authorization data sent by the front-end;

An authentication server is provided at the front end, which is connected to the two-way communication module through a two-way transmission line, and is used to detect whether the dynamic personal key with a lifetime that is preset for each client end expires, and is used to The identification information uploaded by the terminal performs identity authentication processing on the user terminal, and updates the user authorization data of the user terminal after the authentication is passed, and sends the updated user authorization data to the two-way communication module of the user terminal;

An encryption and scrambling module connected to the two-way communication module is provided at the front end, and is used to encrypt, scramble and authorize the transmission stream based on the dynamic personal key;

A decryption and descrambling module connected to the set-top box is arranged at the user end, and is used for performing decryption and descrambling processing on the scrambled transmission stream based on the dynamic personal key.

The two-way communication module realizes the connection with the set-top box by being arranged inside the set-top box.

The two-way communication module is a wireless communication module, which is connected to the authentication server through a wireless transmission line of a wireless communication network; or

The two-way communication module is a wired communication module, which is connected to the authentication server through a wired transmission line of a wired communication network.

The present invention can reach following beneficial effect:

Because the user authorization method based on the broadcast television network of the present invention sets dynamic personal keys respectively at the front end and the user end, the front end and the user end implement encryption, decryption, and descrambling processing on the transmission stream based on the dynamic personal key, and the dynamic personal key When the lifetime of the key is reached, the dynamic personal key is updated in time, so that the regular update of the dynamic personal key can limit the valid time for the illegal user to clone the smart card, which brings operational difficulty for the illegal user to clone the smart card, thereby reducing the Illegal users use cloned smart cards to watch TV programs, and at the same time reduce the economic losses caused by operators to maintain smart cards.

Simultaneously, because the user authorization system based on the radio and television network of the present invention is provided with a two-way communication module at the user end, is provided with an authentication server at the front end simultaneously, is connected by a two-way transmission line between the authentication server and the two-way communication module, can realize broadcast television network like this Both the front end and the user end transmit the user end identification information and dynamically updated user authorization data to each other, thus providing a platform for the front end to dynamically update the user end user authorization data, thereby reducing the probability of illegal users using cloned smart cards to watch TV programs, and The economic loss caused by the operator to maintain the smart card is reduced.

Description of drawings

Fig. 1 is the schematic diagram of the principle of implementing scrambling, descrambling and encryption and decryption of TV programs in the broadcast television network in the prior art;

Fig. 2 is the basic composition structural block diagram of the user authorization system based on broadcasting television network of the present invention;

Fig. 3 is the flow chart of the basic realization principle of the user authorization method based on the radio and television network of the present invention;

4 is a schematic diagram of the process of identity authentication processing initiated by the front end for the user terminal in the user authorization method based on the broadcast television network of the present invention;

FIG. 5 is a schematic diagram of the identity authentication process initiated by the user terminal in the broadcast television network-based user authorization method of the present invention.

Detailed ways

The present invention is based on the user authorization method of the radio and television network and the design idea of the authorization system thereof is: the smart card can be replaced in a way that the user cannot perceive during the normal operation of the radio and television network (the smart card is only one of the user identification modules) As a special case, in order to illustrate the scope of protection required by the present invention, the user identification module will be described below, wherein the existing smart card in the prior art is a typical example of the user identification module described here). Authorized data, thereby reducing the illegal economic benefits brought by illegal elements cloning the user identification module, and reducing the economic losses caused by the radio and television network operators to maintain the entire user identification module system. However, the present invention's user authorization method and authorization system based on the radio and television network can only reduce the probability of illegal users cloning the user identification module compared with the prior art, but cannot fundamentally prevent the user identification module from being illegally cloned. possibility.

Firstly, the basic principles of the broadcast television network-based user authorization system proposed by the present invention will be described in detail below with reference to the accompanying drawings. With reference to Fig. 2, this figure is the basic composition structural block diagram of the user authorization system based on broadcast television network of the present invention, and wherein the operating principle of user authorization system is as follows:

Since the current broadcast television network is composed of a front-end HE 2 for broadcasting program streams and a user end for receiving program streams, wherein the user end generally includes a set-top box 4 for processing program stream information and for storing user authorization The user identification module 5 for data and user identification information, and the current working mode of the broadcast television network is that the front-end HE 2 broadcasts program stream information to all user terminals unidirectionally through the broadcast channel, and the user terminals cannot pass The broadcast channel sends reverse communication information to the front-end HE 2, so in order to increase the two-way authentication function between the front-end HE 2 of the broadcasting network and the client, the following settings are required:

A two-way communication module 3 connected to the set-top box 4 is set at the user end, for uploading the user end identification information to the front-end HE 2, and also for receiving the updated user authorization data sent by the front-end HE 2; wherein the two-way communication module 3 can realize the connection with the set-top box 4 by being arranged on the inside of the set-top box 4, so that a set-top box with an interactive communication module function will be formed; External connection;

At the same time, an authentication server 1 is set at the front end HE 2 of the broadcast television network, and the authentication server 1 of the setting is connected with the two-way communication module 3 on the client side by a two-way transmission line, which is used for identifying information uploaded by the client according to the identity information uploaded by the client. The user end performs identity authentication processing, and updates the user authorization data of the user end after passing the authentication, and sends the updated user authorization data to the two-way communication module 3 of the user end.

Wherein the physical form of the two-way transmission line that is used to connect the certification server 1 that the front end of the radio and television network is provided with and the two-way communication module 3 that the client set-top box 4 places are provided with can be a wireless transmission line, such as a wireless transmission channel in a GSM communication network or for The wireless transmission channel in the 3G communication network etc., at this moment two-way communication module 3 is the wireless communication module with wireless communication function; Wired transmission channel (ie Cable channel), etc., at this moment, the two-way communication module 3 is a wired communication module.

Based on the above-mentioned user authorization system established on the radio and television network, the front-end HE 2 of the radio and television network can unidirectionally broadcast the transmission stream TS to all user-end set-top boxes 4 through a unidirectional broadcast channel, and when the user-end needs to go to the front-end HE 2 for identity authentication , you can upload your own identification information to the authentication server 1 on the front-end HE 2 side through the bidirectional communication module 3 provided through the bidirectional transmission line. Afterwards, the updated user authorization data will be sent to the two-way communication module 3 on the client side through the dual transmission line between the authentication server 1 and the two-way communication module 3. User authorization data to update its own user authorization data.

Correspondingly, the present invention also proposes a user authorization method based on the broadcast television network. The basic realization principle of the user authorization method based on the broadcast television network of the present invention will be described in detail below in conjunction with the accompanying drawings. With reference to Fig. 3, this figure is the basic realization principle flow chart of the present invention based on the user authorization method of broadcast television network; Its basic realization process is as follows:

Step S10, setting has the dynamic individual key (DPK, Dynamic PersonalKey) of lifetime, promptly the front-end of broadcasting television network sets up a DPK respectively for each user, and wherein DPK has lifetime, needs after it lives for a period of time. It performs update processing; the DPK set for each user is shared by the front end and the user end, that is, for each user, the front end stores the DPK set for the user, and the user end also stores the set DPK. The user terminal will store the set DPK in the user identification module carried by itself.

Step S20, detect whether the DPK of each user has reached its lifetime, wherein the DPK lifetime of each user can be checked by adopting a periodic law, if the DPK of a certain user has reached its lifetime, perform step S30; otherwise, perform step S20 S60; the method for judging whether each DPK has reached its lifetime may be as follows:

1) Preset a fixed duration value (such as 1 hour);

2) Judging whether the duration value between the current detection time point and the arrival time point of the dynamic personal key DPK lifetime is less than the fixed duration value set in 1), if yes, it can be determined that the lifetime of the dynamic personal key DPK has arrived; otherwise It can be determined that the lifetime of the DPK has not been reached (the current detection time point can be before or after the arrival time point of the DPK lifetime, that is, when the DPK lifetime is detected, its DPK may be about to reach the lifetime or has reached the lifetime).

In addition, according to specific conditions, the front-end of the broadcasting network may choose to check the lifetime of each DPK; or the user end of the broadcasting network may choose to check the lifetime of each DPK.

In step S30, the front-end of the broadcast television network performs identity authentication on the user terminal whose DPK lifetime has arrived. Generally, the front-end can judge whether the identity of the user terminal is legal by authenticating the ID identification information of the user terminal. The ID identification information of terminal set-top box is authenticated to determine whether the user terminal is a legal user; it is also possible to determine whether the user terminal is a legal user by authenticating the user identity information stored in the user identification module of the user terminal; certainly more The safe authentication method is that the front end judges whether the user end is a legal user by authenticating the binding relationship between the set-top box ID information of the user end and the user identity information stored in the user identification module.

Step S40, if the front end passes the identity authentication of the user end, execute step S50, otherwise end, and execute the next DPK lifetime detection.

In step S50, after the front-end of the radio and television network updates the DPK whose lifetime has been reached, it reaches the end procedure and waits for the next DPK lifetime detection to be performed. The front-end of the radio and television network updates the DPK that has reached the lifetime as follows:

a. The front-end uses the personal distribution key PDK shared with the user end (the PDK is the static personal authorization data assigned by the network operator when the user registers on the network, and the PDK is also stored in the front-end and the user identity held by the user end respectively. In the identification module), the updated dynamic personal key DPK is encrypted and then sent to the client;

b. After receiving the encrypted data in a, the user terminal uses the personal distribution key PDK stored in its own user identification module to decrypt the encrypted dynamic personal key data to obtain the updated dynamic personal key DPK.

Using this method to transmit the updated DPK can ensure the security of the updated DPK, wherein the encrypted DPK data can be transmitted to the client through the wired transmission line of the wired communication network or the wireless transmission line of the wireless communication network. In this way, its security will be better guaranteed; of course, you can also choose to use the broadcast channel (Cable channel) to transmit the encrypted DPK data to the client, but the security guarantee of the transmitted data will be slightly worse.

Step S60, the front-end of the radio and television network encrypts, scrambles, and authorizes the transport stream TS based on the dynamic personal key DPK, and correspondingly, the user end scrambles the transmission sent by the front-end through the broadcast channel based on the shared dynamic personal key DPK The stream TS is decrypted and descrambled to obtain the descrambled TS, and then the set-top box at the user end performs demultiplexing and decoding processing on the descrambled TS to display to the user, and then reaches the end of the program, waiting for the next execution. One-time DPK lifetime detection.

The front end of the radio and television network encrypts, scrambles, and authorizes the transport stream TS to be sent to the user's set-top box based on the dynamic personal key DPK as follows:

A. The front end of the radio and television network uses the control word CW to scramble the transport stream TS to obtain the scrambled transport stream TS'; it can be expressed as: TS+CW->TS';

B. The front end uses the service key SK to encrypt the control word CW to obtain the authorization control information ECM, which can be expressed as: CW+SK->ECM;

C. The front end uses the dynamic personal key DPK to encrypt the service key SK to obtain the authorization management information EMM, which can be expressed as: SK+DPK->EMM;

Step S70, correspondingly, the process of decrypting and descrambling the received scrambled transport stream TS' based on the dynamic personal key DPK at the client end of the broadcasting television network is as follows:

D. The client sends the received ECM and EMM data to the user identification module, and the user identification module decrypts the EMM through its own stored DPK to obtain SK, which can be expressed as: EMM+DPK->SK;

E. The user identification module at the user end uses the obtained SK to decrypt the ECM to obtain the CW, which can be expressed as: ECM+SK->CW;

F. The user identification module at the user end feeds back the obtained CW to the set-top box at the user end, and the descrambling engine in the set-top box uses the obtained CW to perform descrambling processing on the scrambled transport stream TS' to obtain the transport stream TS, which can be expressed as: TS '+CW->TS.

As can be seen from the above, the user authorization method based on the broadcast television network of the present invention is to add a layer of dynamic personal key (DPK) as a working key under the system of traditional CAS three-layer encryption, and simultaneously limit and update the policy according to a certain period of validity This working key is updated, thereby completing the update of the user authorization data stored in the user identification module; when the two-way transmission line transmits the DPK, it is encrypted with the user's personal distribution key (PDK), that is The key system becomes four layers, as follows:

TS+CW->TS'

CW+SK->ECM

SK+DPK->EMM

The three-layer encryption system is used for encryption and scrambling of transmission streams;

DPK+PDK->EMM2

This layer of encryption system is used for encryption processing when the dynamic personal key DPK is updated and transmitted, and EMM2 preferably uses a bidirectional transmission line for transmission.

The identity authentication process of the user terminal by the front end of the broadcast television network may be initiated by the front end or by the user end, and the two cases will be described in detail below.

With reference to Fig. 4, this figure is in the user authorization method based on broadcast television network of the present invention, the process schematic diagram that is initiated by the front end and carries out identity authentication process to the client; Its processing process is as follows:

Step S100, the front end of the broadcasting network detects the lifetime of the DPK of the next user, wherein for the initial state, the next user is the first user, and then performs lifetime check processing on the DPK of each client one by one. The DPK of each client is checked periodically;

Step S110, the front end judges whether the DPK lifetime of the detected user has reached, if yes, execute step S130, otherwise execute step S120;

Step S120, the front end again judges whether the detected DPK of the user is less than 1 hour away from the arrival of its lifetime, if so, execute step S130, otherwise go to execute step S195;

Step S130, the front end judges whether the user whose DPK has reached its lifetime is online, if online, execute step S140; otherwise, go to step S195; wherein the implementation of judging whether the user whose DPK has reached the lifetime is online is as follows:

For the user who passed the last authentication, the front-end will default the user as an online user, and save a state variable about whether it is online for each user. Until the next authentication process, the user end does not respond or the authentication fails, the front-end will identify the current user as Offline status.

Step S140, the front end sends an authentication indication command to the client whose DPK lifetime has reached;

Step S150, after receiving the authentication instruction command sent by the front end, the client uploads its own identification information to the front end through the bidirectional transmission line, wherein the identification information uploaded by the user end can be the ID identification information of the set-top box of the user end, or can be The user identification information stored in the user identification module at the user end may also be the binding relationship between the set-top box ID identification information and the user identification information stored in the user identification module;

Step S160, the front end uses the authentication server to authenticate its identity according to the identification information sent by the client;

Step S170, the front end judges whether the identity authentication of the client is passed according to the authentication result of step S160, if the authentication is passed, execute step S180, otherwise go to execute step S195;

Step S180, the front-end updates the DPK that has reached the lifetime, and encrypts the updated DPK with the PDK shared by the front-end and the client, that is, DPK+PDK->EMM2, obtains encrypted data EMM2, and then sends EMM2 to the corresponding user terminal;

Step S190, after receiving the encrypted data EMM2 sent by the front end, the client set-top box sends it to the user identification module, and the user identification module uses the PDK stored by itself to decrypt the EMM2 data, obtains the updated DPK, and sends it storage, the decryption process can be expressed as: EMM2+PDK->DPK;

Step S195, the front end judges whether the operation of detecting whether the DPK of each user has reached its lifetime in this cycle is completed, that is, judges whether the DPK of each user has been detected, and if so, ends and waits for the next round of DPK for each user. The operation of detecting the DPK lifetime of a client; otherwise, return to step S100, and continue to detect whether the lifetime of the DPK of the next user is reached.

With reference to Fig. 5, this figure is in the user authorization method based on broadcast television network of the present invention, the process schematic diagram that the user terminal is carried out identity authentication process initiated by the user terminal; Its processing process is as follows:

Step S200, after the user end starts its own set-top box STB, the user end will automatically check its own DPK lifetime; the user end can check its own DPK lifetime by using a periodic rule;

Step S210, the client judges whether its own DPK has reached its lifetime, if yes, execute step S230; otherwise execute step S220;

Step S220, the user terminal judges again whether the duration of the DPK from its lifetime is less than 1 hour, if yes, execute step S230; otherwise end, to wait for the next detection of whether the lifetime of the DPK is reached;

Step S230, in order to prevent the front-end authentication server from being overloaded when a large number of STBs with DPKs reaching the lifetime simultaneously initiate the authentication process, so the client will take a back-off method here for a period of time;

Step S240, after the back-off time has elapsed, the user end uploads its own identification information to the front end through a two-way transmission line, wherein the identification information uploaded by the user end can be the ID identification information of the user end set-top box, or can be the ID information stored in the user identification module of the user end. The user identification information, of course, can also be the binding relationship between the set-top box ID identification information and the user identification information stored in the user identification module;

Step S250, the front end uses the authentication server to authenticate its identity according to the identification information sent by the client;

Step S260, the front end judges whether the identity authentication of the user terminal is passed according to the authentication result of step S250, if the authentication is passed, execute step S270, otherwise end, to wait for the detection of whether the next DPK lifetime arrives;

Step S270, the front-end updates the DPK that has reached the lifetime, and encrypts the updated DPK with the PDK shared by the front-end and the client, that is, DPK+PDK->EMM2, obtains the encrypted data EMM2, and then sends EMM2 to the initiating authentication client side;

Step S280, after receiving the encrypted data EMM2 sent by the front end, the user terminal set-top box sends it to the user identification module, and the user identification module uses the PDK stored by itself to decrypt the EMM2 data, obtains an updated DPK, and sends it storage, the decryption process can be expressed as: EMM2+PDK->DPK; and then end, to wait for the detection of whether the next DPK lifetime is reached.

To sum up, the basic idea of the present invention based on the user authorization method of the broadcast television network and its authorization system is that the front end of the broadcast television network still uses the one-way broadcast channel (Cable channel) to broadcast the TV program transport stream TS, and uses it separately in The two-way communication module set in the set-top box of the user end and the two-way transmission line set between the front end and the user end complete the identity authentication processing of the user end and the update processing of the dynamic personal key DPK; thus, it is possible to realize the periodic change of the dynamic personal key DPK To reduce the purpose of illegal users to obtain illegal economic benefits by cloning the user identification module, that is, as long as the update cycle of the DPK is controlled, the effective time for the illegal user to clone the user identification module can be effectively limited, so that the illegal user can clone the user identification module. The coefficient of difficulty of operation increases. At the same time, it also reduces the cost loss caused by the operator to maintain the entire user identification module system, because as long as the DPK of each user identification module is updated periodically, it is no longer necessary to clone part of the user identification module. All the actual physical Subscriber Modules will also be replaced, so the economic cost must be reduced.

The above is only a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications should also be It is regarded as the protection scope of the present invention.

Claims (16)

1. a subscriber entitlement method is characterized in that, comprises step:

(1) at each user side front end and the shared dynamic personal key with life cycle of user side are set respectively;

(2) whether arrive the life cycle of the described dynamic personal key of inspection, if continue step (3); Otherwise go to step (4);

(3) return step (2) behind the described dynamic personal key of renewal arrival life cycle;

(4) front end is implemented encryption, scrambling and authorisation process based on described dynamic personal key to transport stream, and user side is implemented deciphering and scramble process based on described dynamic personal key to the scrambling transport stream.

2. subscriber entitlement method according to claim 1 is characterized in that, in the described step (2) with life cycle of the dynamic personal key of periodic law inspection.

3. subscriber entitlement method according to claim 1 is characterized in that, described step (2) specifically comprises the steps:

(21) a fixing duration value is set;

(22) judge that whether the duration value of the dynamic personal key of current detection time point distance point time of advent life cycle is less than described fixedly duration value, if judge that arrived the life cycle of dynamic personal key; Otherwise judgement no show.

4. subscriber entitlement method according to claim 1, it is characterized in that, described step (3) also comprised the step that user side that dynamic personal key is arrived life cycle carries out authentication before upgrading dynamic personal key, if authentication is handled by continuing to upgrade dynamic personal key, otherwise finishes.

5. subscriber entitlement method according to claim 4 is characterized in that, checks in the described step (2) that be to be finished by front end the life cycle of dynamic personal key.

6. subscriber entitlement method according to claim 5 is characterized in that, described step (3) specifically comprises step to the process that the user side that arrives dynamic personal key life cycle carries out authentication:

(31) described front end sends the user side of authentication directive command to arrival life cycle of dynamic personal key, and the indication user side carries out authentication to front end;

(32) user side with the self identification information uploading to front end;

(33) front end carries out authentication according to the identification information of user side to user side.

7. subscriber entitlement method according to claim 6 is characterized in that, described step (31) also comprises the step that user side that front end judges that dynamic personal key arrives life cycle is whether online before.

8. subscriber entitlement method according to claim 4 is characterized in that, checks in the described step (2) that finished by user side the life cycle of dynamic personal key.

9. subscriber entitlement method according to claim 8 is characterized in that, described step (3) specifically comprises step to the process that the user side that arrives dynamic personal key life cycle carries out authentication:

(3a) dynamically the user side that arrives life cycle of personal key with the self identification information uploading to the broadcasting and television network front end;

(3b) front end carries out authentication according to the identification information of user side to user side.

10. subscriber entitlement method according to claim 1 is characterized in that, the process that described step (3) is upgraded dynamic personal key specifically comprises:

Be handed down to user side after (3-1) the shared individual distributing key of front end utilization and user side is encrypted the dynamic personal key that upgrades;

(3-2) user side utilizes the individual distributing key of storing in the user identification module that the dynamic personal key data of encrypting are decrypted the dynamic personal key that obtains upgrading.

11. subscriber entitlement method according to claim 10, it is characterized in that the dynamic personal key data after the broadcasting and television network front end will be encrypted in the described step (3-1) are issued to user side by the wire transmission circuit of wire net or the wireless transmission link of wireless communication networks.

12., it is characterized in that described user side identification information comprises according to claim 6 or 9 described subscriber entitlement methods:

The ID identification information of user side set-top box; Or

The User Identity information of storing in the user side user identification module; Or

The binding relationship of the User Identity information of storing in user side set-top box ID identification information and the user side user identification module.

13. subscriber entitlement method according to claim 1 is characterized in that,

The process of based on dynamic personal key transport stream being implemented encryption, scrambling and authorisation process described in the step (4) specifically comprises:

(41) described front end uses control word that transport stream is carried out the scrambling processing;

(42) use business cipher key control word to be carried out encryption, authorized control information;

(43) use dynamic personal key business cipher key to be carried out encryption, authorized management information;

(44) Entitlement Control Message and Entitlement Management Message are multiplexed into are issued to user side in the transport stream;

The described process of the scrambling transport stream being implemented deciphering and scramble process based on dynamic personal key specifically comprises:

(45) described user side uses dynamic personal key that Entitlement Management Message is decrypted processing, obtains business cipher key;

(46) use business cipher key Entitlement Control Message to be decrypted processing, controlled word;

(47) use control word that the scrambling transport stream is carried out scramble process.

14. SAS Subscriber Authorization System, comprise the front end that is used for broadcast program stream and be used for the user side that program receiving flows, described user side comprises and is used to handle the set-top box of program stream information and be used to store the user identification module of user authorization data, it is characterized in that described system also comprises:

Be provided with the bi-directional communication modules that is connected with set-top box at described user side, be used to detect at each user side dynamic personal key that preset respectively, that have life cycle and whether expire; Be used for the user side identification information is uploaded to described front end, and be used for the user authorization data of the renewal that receiving front-end sends;

Be provided with certificate server at described front end, be connected by reversible link with described bi-directional communication modules, be used to detect at each user side dynamic personal key that preset respectively, that have life cycle and whether expire, the identification information of uploading according to user side carries out the authentication processing to user side, and authenticating the user authorization data of upgrading user side by the back, and the user authorization data of upgrading is sent to the bi-directional communication modules of user side;

Be provided with the encryption scrambling module that is connected with bi-directional communication modules at described front end, be used for transport stream being implemented encryption, scrambling and authorisation process based on described dynamic personal key;

Be provided with the deciphering and descrambling module that is connected with set-top box at described user side, be used for the scrambling transport stream being implemented deciphering and scramble process based on described dynamic personal key.

15. SAS Subscriber Authorization System according to claim 14 is characterized in that, set-top box is inner to be realized and being connected of set-top box described bi-directional communication modules by being arranged on.

16. SAS Subscriber Authorization System according to claim 14 is characterized in that,

Described bi-directional communication modules is a wireless communication module, and the wireless transmission link by wireless communication networks is connected with described certificate server; Or

Described bi-directional communication modules is a wire communication module, and the wire transmission circuit by wire net is connected with described certificate server.

Images