KR20110101784A - Apparatus and method for content security in IPTV service environment - Google Patents

Abstract

The present invention relates to a content security device and method, and more particularly, to a content security device and method in an IPTV (Interent Protocol Television) service environment.
In the IPTV service environment according to an embodiment of the present invention, the content security system registers terminals existing in a home in a set-top box, transmits a registration request message of the terminals to a server of the IPTV service provider, The included distribution key is divided into a first distribution key and a second distribution key by using a predetermined method, the first distribution key is transmitted to the set-top box, the second distribution key is transmitted to the message generator, and 2 generates a message using a distribution key, transmits the generated message to the set-top box, restores the service key by decrypting the transmitted message using the first distribution key, and restores the restored service key The control word is restored using the control word, and the encrypted broadcast content is decoded using the restored control word.

Description

 TECHNICAL APPARATUS AND METHOD FOR CONTENT SECURITY IN IPTV SERVICE ENVIRONMENT}

The present invention relates to a content security device and method, and more particularly, to a content security device and method in an IPTV (Interent Protocol Television) service environment.

The present invention is derived from the research conducted as part of the IT growth engine core technology development project of the Ministry of Knowledge Economy [Task No. 2006-S-058-04, Task name: Development of integrated network service control technology based on ALL-IP] .

FG-IPTV (Focus Group IPTV: FG-IPTV, hereinafter referred to as 'FG-IPTV') of ITU-T (International Telecommunication Union Telecommunication Standardization Sector: ITU-T) .) Released a draft recommendation, X.iptvsec-1, for standardization of content security in IPTV service environments. In X.iptvsec-1, a security technology for controlling broadcast reception in an IPTV service environment is largely divided into content security and service security.

The content security is defined as a technology for ensuring copy protection, redistribution management, and tracking of illegal content for the provided content. In addition, the service security is a security technology for service access control, which is defined as a technology that allows a legitimate user to access the authorized service and use contents included in the service provided. In general, IPTV service currently provided is provided by combining these two security technologies. In the IPTV service environment, by using the above security technology, it is possible to securely protect the content delivered between the service provider and the set-top box.

However, the encrypted content delivered to the set-top box cannot be used in various IPTV service available terminals in the home, and redistribution of the decrypted content causes security problems.

Accordingly, an object of the present invention is to provide a content security apparatus and method for transmitting and receiving encrypted content between a service provider and a legitimate user's set-top box in an IPTV service environment.

In addition, another object of the present invention is to provide an apparatus and method for content security that can be used by an existing terminal to restore encrypted content transmitted from a service provider in an IPTV service environment using the same key.

In order to solve the above objects, the content security system in an IPTV service environment according to an embodiment of the present invention registers terminals existing in a home in a set-top box, and transmits a registration request message of the terminals to a server of the IPTV service provider. Making; The distribution key included in the registration request message is divided into a first distribution key and a second distribution key by using a predetermined method, the first distribution key is transmitted to the set-top box, and the second distribution key is transmitted to the message generator. Transmitting; Generating a message using the second distribution key and transmitting the generated message to the set-top box; Restoring the service key by decrypting the transmitted message using the first distribution key; Restoring a control word using the restored service key and decrypting the encrypted broadcast content using the restored control word.

The present invention can transmit and receive encrypted content between a service provider and a set-top box of a legitimate user in an IPTV service environment. In addition, the present invention can be used to recover the encrypted content transmitted from the service provider in the IPTV service environment by using the same terminal in the home.

1 is an overall structure diagram of an IPTV service environment for applying a content security device in an IPTV service environment according to an embodiment of the present invention;
2 is a diagram illustrating an RSA key distribution process used for a content redistribution process in an IPTV service environment according to an embodiment of the present invention;
3 is a diagram illustrating a content security process in an IPTV service environment according to an embodiment of the present invention with reference to FIG.

The above objects, features, and advantages will be described in detail with reference to the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. In describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. In addition, it is to be noted that each of the terms described below are only used to help the understanding of the present invention, and may be used in different terms despite the same purpose in each manufacturing company or research group. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Before describing the present invention, a security system applied to an IPTV service environment will be described. A security system applied to an IPTV service environment includes a CAS system 101. The CAS system is a broadcast reception restriction system that is used for broadcast reception restriction in an existing cable TV environment. The CAS system 101 encrypts and delivers broadcast content with an encryption key so that only a legitimate user can access the service environment and use the content included in the service.

In the IPTV service environment, the CAS system 101 is used to protect broadcast contents delivered between a service provider and a set-top box of a legitimate subscriber. The operation of the CAS security technology will now be briefly described. The CAS system includes an ECM (Entitlement Control Message (ECM), hereinafter referred to as 'ECM') and an EMM (Entitlement Management Message: EMM, hereinafter referred to as 'EMM'). Use to distribute the keys.

 The ECM includes a control word (CW, hereinafter referred to as CW), and the ECM is encrypted by a service key (SK, hereinafter referred to as SK). Is sent. In this case, the CW included in the ECM and transmitted is used to scramble media content generated and transmitted for each program or channel.

The EMM includes a distribution key (DK), hereinafter referred to as 'DK'. The DK is used to decrypt subscriber's eligibility information and the SK. The DK is generally stored on a smart card. As described above, in the IPTV service environment, by using the CAS system, contents delivered between a service provider and a set-top box may be securely protected.

However, the encrypted contents delivered to the set-top box cannot be used in various IPTV service available terminals in the home, and redistribution of the decrypted contents causes security problems of the existing CAS system. Next, an overall structure of an IPTV service environment for applying a content security device in an IPTV service environment according to an embodiment of the present invention will be described with reference to FIG. 1.

1 is an overall structure diagram of an IPTV service environment for applying a content security device in an IPTV service environment according to an embodiment of the present invention.

Referring to FIG. 1, the IPTV service environment includes a home domain 106 to which the CAS system 101 is applied. The home domain 106 includes a set-top box 105 for receiving encrypted broadcast content and various devices for providing IPTV services, such as IPTV service-enabled terminals 107, 108, and 109. . The CAS system 101 includes a TA server 102, an EMM generator 103, and a video streaming server 104. The IPTV service is delivered to subscribers whose broadcast contents are provided by service providers through the Internet.

The subscriber registers IPTV service available terminals 107, 108, and 109 existing in the home in the set top box 105. At this time, the subscriber registers the IPTV service available terminals 107, 108, and 109 to the set top box 105 using a security technology provided from a service provider or a set top box 105 provider existing in the home.

The set-top box 105 transmits a terminal registration request and set-top box 105 information to the TA server 101 in order to register the IPTV service-enabled terminals 107 with the service provider's TA server 101. Here, a process of registering the IPTV service available terminal 107 among the IPTV service available terminals 107, 108, and 109 to the TA server 101 will be described. The IPTV service available terminals 108 and 109 are also registered in the TA server 101 through the following process.

The TA server 101 receives an ECM and an EMM including a terminal registration request and set-top box 105 information from the set-top box 105. The CAS system 101 divides the DK using Equation 1 below.

을

와

로 분할한다.
Referring to Equation 1, the DK is a key used when encrypting and transmitting SK, which encrypts and transmits CW. DK ^{- 1} is calculated by the CAS system 101 to divide DK through multiplication. The CAS system 101 is calculated using Equation 1 using Equation 2 below.

of

Wow

Split into

을 IPTV 서비스 가용 단말(107)로 전송하고,

을 EMM 생성기(102)로 전송한다. 그리고 상기 키 정보들을 TA 서버(101)에 보관한다. 이하, 상기

을'토근'이라 칭하기로 한다. The CAS system 101 is one of the partitioned keys

To the IPTV service available terminal 107,

Is sent to the EMM generator 102. The key information is stored in the TA server 101. Or less

This will be called 'token'.

과

을 각각 암호화하여 EMM과 EMM_X를 생성한다. 상기 EMM은

와 같이 생성되고, EMM_X는

와 같이 생성된다. 상기 EMM 생성기(102)는 상기 생성된 EMM과 EMM_X를 상기 셋탑박스(105)로 전송한다. 상기 셋탑박스(105)는 EMM 생성기(102)로부터 EMM과 EMM_X를 수신하고, 상기 수신한 EMM과 EMM_X를 각각 복호화한다. The EMM generator 102

and

Are encrypted respectively to generate EMM and EMM _X. The EMM is

And EMM _X is

Is generated as: The EMM generator 102 transmits the generated EMM and EMM _X to the set top box 105. The set top box 105 receives the EMM and the EMM _X from the EMM generator 102 and decodes the received EMM and the EMM _X , respectively.

와 같은 형태로 복호화되고, 상기 EMM_X는

와 같은 형태로 복호화된다. 상기 셋탑박스(105)는 상기 복호화된 SK_X를 IPTV 서비스 가용 단말(107)로 전송한다. 상기 복호화된 SK는 상기 컨텐츠 제공자로부터 암호화되어 전송되는 컨텐츠의 복호화를 위해 필요한 CW를 복호화 하는데 사용된다.The set top box 105 decodes the EMM and the EMM _X using a DK. The EMM is

Decoded in the form of, EMM _X is

It is decrypted in the form The set top box 105 transmits the decrypted SK _X to the IPTV service available terminal 107. The decrypted SK is used to decrypt the CW necessary for decrypting the content transmitted encrypted from the content provider.

을 이용하여 상기 셋탑박스(105)로부터 수신한 SK_X를 복원한다. 여기서, 상기 SK_X는

형태로 복원된다. The IPTV service available terminal 107 is a partitioned key received from the CAS system 101

Using to restore the SK _X received from the set-top box 105. Here, SK _X is

Restored to form.

That is, the IPTV service available terminal 107 may decrypt and view the encrypted broadcast content transmitted from the CAS system 101 using SK obtained through the above process. In this case, the set-top box 105 redistributes the broadcast content transmitted through encryption. In this case, the broadcast content redistributed by the set-top box 105 redistributes the broadcast content encrypted by the service provider through the CAS system 101.

Therefore, in the IPTV service environment proposed by the present invention, the security device for redistribution of content in the home supports the redistribution of encrypted broadcast content through the general CAS system without additional encryption or decryption. Next, the RSA key distribution process used for the content redistribution process in the IPTV service environment according to an embodiment of the present invention will be described in more detail with reference to FIG. 2.

2 is a diagram illustrating an RSA key distribution process used for a content redistribution process in an IPTV service environment according to an exemplary embodiment of the present invention.

In the present invention, to overcome the limitations of the CAS system, in order to secure content that is redistributed in the home, a technique of separating and applying a key used in an existing RSA encryption algorithm is used. One such technique is the previously proposed mRSA (Mediated RSA: mRSA, hereinafter referred to as "mRSA").

mRSA technology is a variation of the RSA signing technique, which uses a public or private key divided by addition, and defines a SEM (Security Mediator: SEM, hereinafter referred to as "SEM"), which is a trusted server. Is defined as The mRSA first stores each half of the private key generated by the CA (Certification Authorities, CA, or "CA"), and then sends a message to the SEM when the user signs a message M. After the transmission, the signature is sent by the SEM and transmitted, and the signature value generated by the SEM is used to generate a complete signature. For this purpose, it is assumed that mRSA uses CA, user, and SEM uses RSA encryption algorithm.

에서 임의로 선택하고 개인 키 d를

로 계산하여 구한다. d는 비밀 키로 사용하고, n, e는 공개 키로 사용한다. d가 구해진 다음 CA는 사용자 A에게 전달할 개인 키 d_A를 임의로 선택한다. 이후 d와 d_A를 이용하여 SEM에게 전달한 개인키 d_SEM을 (d - d_A) mod

같이 구한다. 이렇게 CA에서 생성된 개인 키 d_A,d_SEM 은 안전한 방법으로 사용자 A와 SEM에게 분배된다. First, CA randomly generates the prime numbers p, q of k / 2-bit, and then calculates n = p × q. Then e

Randomly select from and select private key d

Calculate as d is used as a secret key, and n and e are used as public keys. After d is found, the CA randomly selects the private key d _A to be passed to user A. Afterwards, the private key d _SEM delivered to the SEM using d and d _A is (d-d _A ) mod.

Get together. Private key generated by CA d _A , d _SEM Is distributed to users A and SEM in a secure manner.

As above, when the private key has been split and distributed, user A signs a message M. User A generates h (M) from message M and then sends this value to SEM. The SEM generates the signature PS _SEM = h (M) ^dSEM mod n from the received hash value using its private key. The signature thus generated is sent back to user A. A uses the received signature and the signature PS _A = h (M) ^dA mod n that it has created and completes the complete signature S = (PS _SEM * PS _A ) mode n. Calculate and generate

= (p - 1)(q - 1) 로 정의한다. 그리고 상기 CAS 시스템(101)은 임의의 수 e를 선택하면

에 대한 e의 역수 d를 구하고, 서명을 위해 사용하는 개인 키(301)로 사용한다. e 는 d로 서명된 정보를 검증 및 복호화하는데 사용되는 공개 키로 사용한다. Referring to FIG. 2, the CAS system 101 may divide the private key 301 into several keys. First, arbitrary prime numbers p and q are selected and defined as n = p × q. And

= (p-1) (q-1) And the CAS system 101 selects any number e

Find the inverse d of e for, and use it as the private key 301 used for signing. e is used as the public key used to verify and decrypt information signed with d.

Here, the CAS system 101 may divide the private key d for signature into d ₁ 304 and d ₂ 305 through multiplication. The divided private key may then be restored (M ^d1 ) ^d2 = M ^d and verified 303 through the public key e. In the IPTV service environment according to an embodiment of the present invention, the content security apparatus is used to divide the DK in the CAS system 101 using the concept of dRSA. The DK is a key used when encrypting and transmitting SK, which encrypts and transmits CW.

을 계산하고, 상기 계산한 다음

를

과

로 분할한다. 그리고 상기 CAS 시스템(101)은

을 댁내에 존재하는 상기 IPTV 서비스 가용 단말(107)에게 전송한다. 상기 IPTV 서비스 가용 단말(107)은 CAS 시스템(101)을 통해 암호화하여 전송된 방송 컨텐츠를 복호화하여 시청할 수 있다. 그러면 여기서, 도 3을 참조하여 본 발명의 실시 예에 따른 IPTV 서비스 환경에서 컨텐츠 보안 과정을 보다 구체적으로 설명하기로 한다.As described above, the CAS system 101

Then calculate the above

To

and

Split into And the CAS system 101 is

To the IPTV service available terminal 107 existing in the home. The IPTV service available terminal 107 may decrypt and watch the broadcast content transmitted through encryption through the CAS system 101. Next, the content security process in the IPTV service environment according to an embodiment of the present invention will be described in more detail with reference to FIG. 3.

3 is a diagram illustrating a content security process in an IPTV service environment according to an embodiment of the present invention with reference to FIG.

Referring to FIG. 3, the content security process includes an initial authentication step 201, a token issuing step 202, an EMM message sending step 203, a broadcasting viewing step 204, and the like based on the IPTV service available terminal 107. Includes four steps.

In the initial authentication step 201, the subscriber registers the IPTV service available terminals 107, 108, and 109 existing in the home in the set top box 105, and the set top box 105 and the IPTV service available terminals 107. (108), mutual authentication between the two (109). The set-top box 105 transmits a terminal registration request and set-top box 105 information to the TA server 101 in order to register the IPTV service-enabled terminals 107, 108, and 109 with the service provider's TA server 101. (212). Here, a process of registering the IPTV service available terminal 107 among the IPTV service available terminals 107, 108, and 109 to the TA server 101 will be described. The IPTV service available terminals 108 and 109 are also registered in the TA server 101 through the following process.

와

로 분할한다(213). In the token issuing step 202, the set-top box 105 registers the terminal registration request and the set-top box 105 information in order to register the IPTV service-enabled terminals 107 with the TA server 101 of the service provider. 101). The TA server 101 receives the ECM and the EMM including the terminal registration request and the set-top box 105 information from the set-top box 105. The CAS system 101 calculates DK using Equation 1 and Equation 2.

Wow

It is divided into (213).

를 셋탑박스(105)로 전송하고(214),

을 EMM 생성기(102)로 전송한다(215). 그리고 셋탑박스(105)는 상기

을 IPTV 서비스 가용 단말들(107)로 전송하고(216), 상기 키 정보들을 TA 서버(101)에 보관한다. The CAS system 101 is one of the partitioned keys

To the set-top box 105 (214),

Is sent to the EMM generator 102 (215). And the set top box 105 is

To the IPTV service enabled terminals 107 and store the key information in the TA server 101.

The EMM message transmission step 203 is a step for receiving a service key SK required for decrypting and viewing the encrypted broadcast content. The SK of the CAS system 101 is limited to IPTV service-enabled terminals 107 that have normally issued tokens. It is executed once when is renewed or when accessing service.

과

을 각각 암호화하여 EMM과 EMM_X를 생성한다. 상기 EMM은

와 같이 생성되고, EMM_X는

와 같이 생성된다(217). 상기 EMM 생성기(102)는 상기 생성된 EMM과 EMM_X를 상기 셋탑박스(105)로 전송한다(218). 상기 셋탑박스(105)는 EMM 생성기(102)로부터 EMM과 EMM_X를 수신하고, 상기 수신한 EMM과 EMM_X를 각각 복호화한다. The EMM generator 102

and

Are encrypted respectively to generate EMM and EMM _X. The EMM is

And EMM _X is

Is generated as (217). The EMM generator 102 transmits the generated EMM and EMM _X to the set top box 105 (218). The set top box 105 receives the EMM and the EMM _X from the EMM generator 102 and decodes the received EMM and the EMM _X , respectively.

와 같은 형태로 복호화되고, 상기 EMM_X는

와 같은 형태로 복호화된다. 상기 셋탑박스(105)는 상기 복호화된 SK_X를 IPTV 서비스 가용 단말(107)로 전송한다. 상기 복호화된 SK는 상기 컨텐츠 제공자로부터 암호화되어 전송되는 컨텐츠의 복호화를 위해 필요한 CW를 복호화 하는데 사용된다.The set top box 105 decodes the EMM and the EMM _X using a DK (219). The EMM is

Decoded in the form of, EMM _X is

It is decrypted in the form The set top box 105 transmits the decrypted SK _X to the IPTV service available terminal 107. The decrypted SK is used to decrypt the CW necessary for decrypting the content transmitted encrypted from the content provider.

을 이용하여 상기 셋탑박스(105)로부터 수신한 SK_X를 복원한다. 여기서, 상기 SK_X는

형태로 복원된다(220). The IPTV service available terminal 107 is a partitioned key received from the CAS system 101

Using to restore the SK _X received from the set-top box 105. Here, the SK _X is

The form is restored (220).

That is, the IPTV service available terminal 107 may decrypt and view the encrypted broadcast content transmitted from the CAS system 101 using SK obtained through the above process. In this case, the set-top box 105 redistributes the broadcast content transmitted through encryption. In this case, the broadcast content redistributed by the set-top box 105 redistributes the broadcast content encrypted by the service provider through the CAS system 101.

In the broadcast viewing step 204, the IPTV service available terminal 107 may decrypt and watch the broadcast content 221 encrypted through the CAS system 101 (221).

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by the equivalents of the claims.

101: CAS (Conditional Access System)
102: Trust Authority Server
103: Entitlement Management Message (EMM) generator
104: Video Streaming Server
105: Set Top Box
107: UD (User Device)

Claims (6)

In the content security system in the IPTV service environment,
Registering terminals existing in the home in the set-top box, and transmitting registration request messages of the terminals to the server of the IPTV service provider;
The distribution key included in the registration request message is divided into a first distribution key and a second distribution key by using a predetermined method, the first distribution key is transmitted to the set-top box, and the second distribution key is transmitted to the message generator. Transmitting;
Generating a message using the second distribution key and transmitting the generated message to the set-top box;
Restoring the service key by decrypting the transmitted message using the first distribution key;
Restoring a control word using the restored service key and decrypting the encrypted broadcast content using the restored control word;
Content security system comprising a.
The method of claim 1,
And redistributing the encrypted broadcast contents to terminals existing in the home. The method of claim 2,
And the terminals present in the home decrypt the encrypted broadcast content by recovering a control word using the restored service key.
The method of claim 1, wherein generating the token comprises:
The distribution key included in the registration request message is divided into a first distribution key and a second distribution key, and the content distribution system uses the second distribution key as a token.
The method of claim 1, wherein the service key,
And a key used to decrypt and view the encrypted broadcast content.
The method of claim 1, wherein the dividing into a first distribution key and a second distribution key comprises:
and dividing the distribution key into a first distribution key and a second secretary cache using a dRSA method.

Images