Terminal realizes the method for service authorization in the conditional access system
Technical field
The present invention relates to the Conditional Access technology, relate in particular to the method that realizes the terminal traffic mandate in the conditional access system of broadcast world.
Background technology
Conditional Access (CA, Conditional Access) system is the core technology of carrying out pay TV, broadcast service, guarantee that exactly legal users (being referred to as the authorized person) can receive sound, video frequency program and data service business, then can't obtain coherent signal for the disabled user.The paid service Conditional Access is by two separate key components, promptly add descrambling and the receiving control information encryption and decryption of signal is formed, wherein descrambling, deciphering information process very high to security requirement beyond doubt.
Conditional Access has experienced the development in two generations, and the feature of the first generation is based on equipment, generally is used for analogue system.In order to realize effective charge of cable TV, at transmitting terminal analog signal is carried out scrambling, general television set can't be watched, have only user's receiving terminal that descrambler has been installed normally to watch.Such system can control the descrambler switch of unique user by the addressing of transmitting terminal.System can realize full frequency band scrambling and channel scrambling, and technology such as the method for realization normally adopts the video paraphase, horizontal synchronization is overlapping, vertical synchronization is overlapping, the shake of digital random video line can produce loss to signal under this kind mode usually.
The basic principle of the second generation is to adopt the method for scrambling control word (CW, Control Word) encrypted transmission, and user's receiving terminal utilizes the smart card deciphering.Because what adopt is digital technology, and signal is not had loss, the confidentiality of system, reliability all improve greatly.To the scrambling of transport stream, some system such as digital television broadcasting (DVB, Digital Video Broadcasting) have standard; Cryptographic algorithm to control word generally adopts RSA (being proposed by Rivest, Shamir, Adleman) and 3DES (data encryption standard; Data Encryption Standard) algorithm; to encryption system; the different system difference is very big; its technology has two kinds substantially: a kind of is liking that the German system of enlightening is the password circulation system of representative, and another kind is to be that the proprietary algorithm of utilizing of representative is protected with the NDS system.
In first generation conditional access system, because the key code system of system depends on equipment and descrambler, the signal ratio is easier to crack and duplicate.And the second generation, owing to encryption system, key code system are what to separate with equipment, the safety that relies on smart card to provide the fail safe that adds, deciphers to come safeguards system cracks difficulty and increases.
Simultaneously, in the key code system design of second generation conditional access system, different receiving terminals uses different keys, and because the program of different receiving terminal customization has nothing in common with each other, so transmitting terminal need be each receiving terminal, generates different Entitlement Control Messages.Though such design is strengthened on security of system to some extent, the cost of paying is that Entitlement Control Message significantly rises along with user's increase, has increased the weight of the load of transmitting terminal, has taken a large amount of bandwidth, has reduced the efficient of system.Huge at number of users, under the band-limited condition of simultaneity factor, as wireless broadcast system, the scheme of second generation conditional access system is this type of system requirements of incompatibility.In addition, watch that at present each program need obtain the authorization in advance, can not open corresponding program at once, give user's the use profit of making troubles according to user's needs.
Summary of the invention
The invention provides the method that realizes the terminal traffic mandate in a kind of conditional access system, in order to solve in the prior art because of not overcoming in the management process of Entitlement Control Message, increase the weight of significantly along with the increase of number of users transmitting terminal load, take the difficulty of a large amount of bandwidth, can not realize in Narrowcasting that conditional acceptance is professional and can not in time open the problem of corresponding service.
The invention provides the method that realizes the terminal traffic mandate in a kind of conditional access system, comprise the steps:
Steps A: transmitting terminal sends scrambled signals, to the enciphered message of scrambling control word, no longer sends authorization terminal information;
Step B: receiving terminal is before decryption information and descramble signal, and whether the checking receiving terminal has the authorization message of corresponding service, does not have and authorizes, and then enters step C; Mandate is arranged, then enter step D;
Step C: receiving terminal deduct this business to behind the valency, generate authorization message;
Step D: receiving terminal is deciphered described enciphered message according to authorization message, obtains described scrambling control word, and the scrambled signals of authorized business is carried out descrambling.
Preferable, described steps A: transmitting terminal also sends the miscellaneous service corresponding with signal and the information of professional rate; Step C is specially: the user orders corresponding business by receiving terminal; Receiving terminal is bought professional rate information computational costs according to the user, and after this expense of deduction, generates authorization message from the stored value card of receiving terminal.
Preferable, step C is specially: receiving terminal generates authorization message after deducting the mandate sign of this business.
Preferable, described enciphered message to the scrambling control word comprises:
Entitlement Control Message comprises and utilizes the ciphertext of business cipher key SK to the encryption of scrambling control word;
Entitlement Management Message comprises and utilizes the ciphertext of individual subscriber distributing key to business cipher key SK encryption, does not comprise authorization terminal information.
Preferable, the miscellaneous service that described and signal are corresponding and the information of professional rate are identical to all receiving terminals.
Preferable, the miscellaneous service that the described and signal that receiving terminal will receive is corresponding and the information stores of professional rate are in receiving terminal, and the rate information that calls storage in step C calculates; Or the rate information that in step C, issues among the invocation step A.
Preferable, described authorization message comprises that the user uses professional mode information, can also comprise that the user uses price, the subscriber identity information of trafficwise correspondence; Described user uses professional mode to use professional authority or user to use professional duration or number of times as user in a period of time.
Preferable, described business and/or professional rate information pass through
The a transmitting terminal passes the ciphertext of professional and/or professional rate information down, and receiving terminal is decrypted, or
The b transmitting terminal is with the plaintext and the Message Authentication Code that pass professional and/or professional rate information at present, and receiving terminal carries out the Message Authentication Code checking, or
The c transmitting terminal is with the ciphertext and the Message Authentication Code that pass professional and/or professional rate information at present, and receiving terminal is decrypted and the Message Authentication Code checking, guarantees the rate information integrity.
Preferable, described business and/or professional rate information are by logic broadcast channel a electronic service guidebooks, or the b Entitlement Control Message, or the c Entitlement Management Message, following biography.
Preferable, the described miscellaneous service corresponding with signal and the information of professional rate issue together as a Global Information, perhaps business information and professional rate information are issued as a Global Information respectively.
Transmitting terminal no longer sends and user-dependent Entitlement Control Message, has reduced the problem that massive band width takies and has originally made the present invention to make a new start in realize Conditional Access in the Narrowcasting system; The service signal that subscribe to need by terminal use oneself simultaneously is controlled by no longer that transmitting terminal is unified to be controlled, and helps the user and receives more flexibly and order the Narrowcasting business, enjoys favorable user experience and service quality more; Also help simultaneously the wider popularization broadcasting service of service provider, the ownership's quantity and the large tracts of land of receiving terminal that promotes are popularized.
Beneficial effect of the present invention is as follows:
Because there is band-limited deficiency in the Narrowcasting system, though so potential user's enormous amount, but prior art can not overcome in the management process of Entitlement Control Message, increase the weight of significantly along with user's increase transmitting terminal load, take a large amount of bandwidth, the fact that system effectiveness is low.
Because in the present invention, use stored value card to carry out business purchase and terminal mandate certainly, thereby having solved prior art adopts different information managements to send required bandwidth to each user, to bring in the mode that the user is managed by transmission in the prior art simultaneously, the management that is changed to the user mainly is based upon receiving terminal one side, satisfy the security requirement of Conditional Access from the raising of receiving terminal one side fail safe, thereby solved the bandwidth occupancy problem that causes because of management, realized Conditional Access service the Narrowcasting user of enormous amount to the user.Simultaneously, the present invention is transferred to receiving terminal one side with the management of fail safe, therefore in fact not only still can satisfy the security requirement of conditional acceptance, and the management to terminal is more flexible among the present invention, also more convenient when the user uses related service.In addition, the development of technology of utilizing that also can be convenient improves constantly fail safe to Conditional Access.
Description of drawings
Fig. 1 be among the embodiment in the conditional access system terminal realize the method schematic diagram of service authorization;
Fig. 2 uses stored value card to buy the business realizing terminal from the authorization flow schematic diagram by user interactions described in the embodiment;
Embodiment
Below in conjunction with accompanying drawing the specific embodiment of the present invention is described.
Fig. 1 is the method schematic diagram that terminal realizes service authorization in the conditional access system, and as shown in the figure, implementation step is:
Step 101, transmitting terminal send scrambled signals, to the enciphered message of scrambling control word, no longer send authorization terminal information, wherein, enciphered message comprises Entitlement Control Message (Entitlement Control Message, ECM) and Entitlement Management Message (Entitlement Management Message, EMM);
Step 102, receiving terminal are before decryption information and descramble signal, and whether the checking receiving terminal has the authorization message of corresponding service, does not have and authorizes, and then enters step 103; Mandate is arranged, then enter step 104;
Step 103, receiving terminal deduct this business to behind the valency, generate authorization message;
Step 104, receiving terminal judge whether to satisfy according to authorization message and authorize, and satisfy, and then decipher described enciphered message, obtain described scrambling control word, and the scrambled signals of authorized business is carried out descrambling; Otherwise prompting is bought and is authorized.
By in implementing as seen, must realize that terminal from mandate, just can watch corresponding service.
In the data that transmitting terminal sends, relate to three kinds of data altogether, the one, the code stream after the scrambling, the 2nd, enciphered message comprises Entitlement Control Message (ECM) and Entitlement Management Message (EMM), the 3rd, the miscellaneous service corresponding with signal and the information of professional rate no longer send authorization terminal information.Wherein the code stream after the scrambling is exactly to utilize the scrambling control word that the code stream that transmits is carried out scrambling; Entitlement Control Message (ECM) comprises and utilizes the ciphertext of business cipher key SK to the encryption of scrambling control word, and is irrelevant with user profile, all is identical to all receiving terminals, and the following biography bandwidth that ECM takies does not change with the increase of number of users; Entitlement Management Message (EMM) comprises and utilizes the ciphertext of individual subscriber distributing key to business cipher key SK encryption, does not comprise authorization terminal information, and relevant with user profile, the following biography bandwidth that EMM takies increases with the increase of number of users; Is identical with the corresponding miscellaneous service of signal and the information of professional rate to all receiving terminals, irrelevant with user profile, its following biography bandwidth that takies does not change with the increase of number of users, business can be channel or its combination, also can be program or its combination of one section broadcast, it can certainly be the combination of channel and program, professional rate information is the rate of professional occupation mode, it for example can be the expense in each channel a period of time, as exclusive monthly fee, season is taken, annual fee etc., also can be to use each channel once expense or use this business per minute/hour etc. expense, for conveniently commencing business also can be with several combinations of channels, for example the rate of sports channel and the various occupation modes of channel for TV plays and movies is not enumerated one by one at this.The data and the user information correlation that send by above-mentioned variation transmitting terminal reduce significantly, and the following biography bandwidth that takies also can reduce significantly.
(Electronic Service Guide ESG) or Entitlement Control Message ECM or Entitlement Management Message EMM, passes down to receiving terminal by logic broadcast channel electronic service guidebooks for the miscellaneous service corresponding with signal and the information of professional rate.Certainly, business information and professional rate information can be issued together as a Global Information, also business information and professional rate information can be issued by the logic broadcast channel respectively separately as a Global Information respectively.
The following biography of the miscellaneous service corresponding with signal and/or the information of professional rate need guarantee the integrality of data.Three kinds of mode guarantee information integralities are arranged, the one, the ciphertext of the breath of only delivering a letter is down carried out corresponding deciphering after receiving terminal is received; The 2nd, with the plaintext and the Message Authentication Code (MAC) of the breath of delivering a letter at present, after receiving, receiving terminal carries out the message code checking; The 3rd, ciphertext and Message Authentication Code (MAC) with the breath of delivering a letter at present are decrypted after receiving terminal is received with message code and verify.
Receiving terminal receives above-mentioned data, can be with the information stores of the miscellaneous service corresponding that receive and professional rate in receiving terminal with signal, when deducting business, directly call valency, so that reduce the information processing capacity of receiving terminal, certainly, can not store yet, when needs call, directly from the data that pass down, parse, still can increase the information processing capacity of receiving terminal like this.
Receiving terminal is before decryption information and descramble signal, and whether the checking receiving terminal has the authorization message of corresponding service, if do not have, receiving terminal deduct this business to behind the valency, generate authorization message.Receiving terminal by with user interactions, determine the business of its purchase and use trafficwise by the user, and determine pair valency of needs deduction according to the rate information of business, deduction can be the electronic money form to valency, from the stored value card of receiving terminal, deduct; What deduct also can be the mandate sign of this business to valency, and for example sign can be watched the authorization code of 2 hours video display.After deduction is to valency, generate this professional authorization message.Authorization message can comprise that the user uses professional mode information, specifically buys professional occupation mode according to the user and determines, can also comprise that the user uses price, the subscriber identity information of trafficwise correspondence; The user uses professional mode to use professional authority (in some moons, season, year) or user to use professional duration or number of times as user in a period of time.
Receiving terminal judges whether to satisfy according to authorization message and authorizes, and satisfies, and then deciphers described enciphered message, obtains described scrambling control word, and the scrambled signals of authorized business is carried out descrambling; Otherwise prompting is bought and is authorized.Authorization message as generation is a certain section authority in the time, then judges whether to exceed this time range; Authorization message as generation is duration or access times, judges then whether duration or access times use up, and specific implementation can be duration or the access times that record uses, and compare with authorization message, certainly, also can be according to operating position, upgrade authorization message.Concrete determination methods is not enumerated one by one at this, all can as long as can judge whether mandate is satisfied.
Describe in detail by user interactions below in conjunction with Fig. 2 and to determine to buy professional and use the stored value card realization authorization terminal that deducts the fee, when the user buys business, multiple purchase Starting mode can be provided, as: initiatively buy, the user enters and buys the interface, need to select the business and the occupation mode of purchase, buy mandate; Or when checking a certain channel, whether checking has mandate, does not have to authorize then to provide and buys the interface, is selected to buy by the user.Concrete implementation step is:
Step 401, receiving terminal are initiated user interactions and are bought the service authorization process after authorization message failure professional under checking deciphering, the descrambling data;
Step 402, terminal applies are obtained professional and professional rate information, by the content that user interface comprises to user's display business, data such as occupation mode and toll rate;
Step 403, the user selects to order the business and the occupation mode of likeing by user interface, and terminal applies can pass to terminal with user's selection situation;
Step 404, according to user's selection situation and corresponding rate information, calculate the user and buy professional required expense, and send the order of the expense of reducing to the stored value card module;
Step 405, the order of stored value card module responds implement to reduce expense action and return messages, if reduce failure, return failure cause simultaneously;
Step 406, receive reduce success message after, generate this professional authorization message; Receive reduce failed message after, by user interface prompt user failure cause.
Authorization message comprises that the user uses one or more professional authorities or user to use professional duration or number of times and user to buy professional price and/or subscriber identity information, the specifically business and the decision of professional rate information that send of the transmitting terminal of selecting according to the user.
The expense that the professional authorization message of generation is reduced is deducted from the stored value card of receiving terminal, can better guarantee fail safe like this.
Can buy the business that oneself needs easily by the user by user interactions, oneself like the sports cast or movie and video programs of watching such as buying respectively, at this moment it is professional and pay corresponding cost and can the information of obtaining the authorization watch only to need the user to buy this two class, and needn't pay the expense of other programs of oneself disliking watching.
By above-mentioned enforcement as can be known, the present invention can realize Conditional Access in the Narrowcasting system, has solved the relevant problem that need take massive band width with the user of Entitlement Control Message under the present Conditional Access mode; And further by realize in terminal professional buy and terminal from mandate, for the operation of Narrowcasting system brings convenience; Help the user and receive more flexibly and order the Narrowcasting business, enjoy favorable user experience and service quality more; Also help simultaneously the wider popularization broadcasting service of service provider, the ownership's quantity and the large tracts of land of receiving terminal that promotes are popularized.
Spirit of the present invention is, on the security system of Conditional Access, realize the business purchase and the terminal mandate certainly of terminal, no longer rely on and control by transmitting terminal, satisfy the authorizing secure requirement of Conditional Access, thereby saved the enormous bandwidth consumption that control is brought to terminal, also therefore made Conditional Access in the Narrowcasting system, to use.Obviously, those skilled in the art can carry out various changes and modification to the present invention and not break away from the spirit and scope of the present invention.Like this, if of the present invention these are revised and modification belongs within the scope of claim of the present invention and equivalent technologies thereof, then the present invention also is intended to comprise these changes and modification interior.