KR101004886B1 - Method for group key distribution, and conditional access system using the method - Google Patents

Abstract

The present invention, a group key distribution method and a reception restriction system using the same, relates to a method for distributing a group key in a reception system including a reception server and at least one terminal, each of the at least one terminal, except for itself Store the manufacturing secret value for all the terminals, and when joining or leaving the group of a specific terminal, the reception restriction server updates the group key by generating a new group key using the existing group key and the manufacturing secret value of the specific terminal. This ensures forward and backward security while enabling very fast group key distribution at low cost.

Description

Group key distribution method and reception restriction system using the same {METHOD FOR GROUP KEY DISTRIBUTION, AND CONDITIONAL ACCESS SYSTEM USING THE METHOD}

The present invention relates to a group key distribution method and a reception restriction system using the same. More particularly, in providing services such as a multi-party call, mobile TV, and IP-TV, the computing efficiency and communication efficiency are maximized instead of consuming storage space. The present invention relates to a group key distribution method for realizing a very fast group key distribution at low cost, and a reception restriction system using the same.

Recently, various broadcasting media are changing from the conventional analog form to digital. Compared with the conventional analog broadcasting, digital broadcasting has an advantage in that it can send various computer files and documents as digital data in addition to video and audio necessary for TV broadcasting.

The biggest problem in such digital broadcasting is the security between the transmitter and the receiver. If the mutual security is not established, the commercial structure of the broadcast is collapsed and the reality is lost. Developed for security, the conditional access system is a key technology of digital broadcasting.

Restricted reception refers to a series of processes that allow each digital receiver to determine whether a particular broadcast program can be received by an end user. Restricted reception technology includes a scrambling key (SK) key to protect a commercial service from unauthorized reception, an authentication key (AK), a key that only a specific receiver can decrypt, a master key (Master Private Key) Use a three-level key system consisting of MPK).

The scrambling key is used when the CAS server scrambles the media content. Scrambling refers to shuffling data. In this case, CW is used to scramble by a certain rule, and CW is a result value calculated by a pseudo random number generator (PRNG). The CW is typically updated by the CA server at intervals of about 5 to 20 seconds, to reduce the risk of known-plaintext attacks by attackers. In addition, AK is a group key used when transmitting CW to a group (each broadcast channel) and MPK is a key used when transmitting AK after encrypting AK, and each terminal has a different MPK. In general mobile-TV and IP-TV security systems, when transmitting the CW encrypted with AK, by transmitting the electronic signature of the server to the CW, it prevents the CW tampering and ensures that the CW is generated from a normal server.

Meanwhile, in order to satisfy the security required for group key distribution in an IP-based Pay-TV system, the following requirements must be satisfied.

First, backward security means that the terminal leaving the group cannot decrypt the current ciphertext and the future ciphertext using the group key of the past. Backward security in an IP-based Pay-TV system means that an encrypted content of a corresponding channel cannot be decrypted using a group key AK in the past after a certain subscriber leaves the specific channel.

The second is omnidirectional security, meaning that the terminal joined to the group cannot decrypt the past cipher text using the current group key and the future group key. Omni-directional security in an IP-based Pay-TV system means that after a subscriber subscribes to a particular channel, it cannot decrypt the content that was transmitted in the past using the current group key and the future group key AK. do.

Third, in the prevention of insider / outsider attacks, the IP-based Pay-TV system should be protected from external attackers, and furthermore, it should be able to block attacks by internal attackers. That is, a user who does not subscribe to a specific channel may attempt to obtain a group key to illegally watch the media content. In addition, even after a subscriber withdraws from the channel, it may attempt to collect subscription information of another subscriber in order to continuously watch the media content. In spite of various attempts by these attackers, CAS should protect the system safely so that all subscribers are not harmed.

1 is a block diagram showing a key structure and a key delivery process of a general conditional access system.

An Entitlement Control Message (ECM) is a value that exists for each broadcast channel, and includes information on the channel and CW encrypted with AK. The CAS server 10 signs the ECM and transmits it to the subscribers through multicast with the media content. An Entitlement Management Message (ECM) is a value that exists for each subscriber, and includes information about each subscriber and an AK encrypted with an MPK. The CAS server 10 signs the EMM and transmits it to each subscriber through unicast.

Based on such a system, when a certain terminal joins a group, a general process of distributing a group key by the CAS server 10 is as follows.

When C _{n + 1, which} is the (n + 1) th terminal, joins the current group with n terminals, the server encrypts AK with MPK i (1 ≤ i ≤ n + 1) and sends it to each terminal. do. Similarly, when C j leaves, the server encrypts AK with MPK i (1 ≦ i ≦ n, i ≠ j ) and transmits it to all terminals except C j . Such a system can cause severe delays when applied to large group communications where changes in group membership, such as IP-TV, are frequent. Since the delay time is a very sensitive factor in the real-time broadcasting service and is directly related to the quality of the service, research on efficient group key distribution is very important. In particular, broadcast services in a mobile environment are essential to minimize computational overhead due to limited battery life and limited performance of the terminal.

In order to solve the problems described above, a number of group key distribution schemes have been proposed that have excellent computational efficiency and communication efficiency. However, because the proposed group key distribution scheme does not provide omni-directional security, group subscribers can view all past information without additional charges. In addition, it is pointed out that there is a problem that group subscribers can receive illegal services with minimal billing because, unlike the claims of the prior arts, even backward safety is not satisfied.

Accordingly, an object of the present invention is to provide a group key distribution method for updating a group key by a simple operation using a manufacturing secret value for all manufactured terminals, and a reception restriction system using the same.

A group key distribution method according to an aspect of the present invention for achieving the above object of the present invention relates to a method for distributing a group key in a conditional access system comprising a conditional access server and at least one terminal. Each one terminal stores a manufacturing secret value for all terminals except itself, and when joining or leaving a group of a specific terminal, the reception restriction server sets an existing group key and a manufacturing secret value of the specific terminal. Generating a new group key to update the group key.

All of the terminals include at least one existing terminal and all terminals expected to be manufactured in the future.

In the group key distribution method, when a group joins or withdraws a group from a specific terminal, all other terminals included in the reception control system except for the specific terminal use the existing group key and a manufacturing secret value of the specific terminal. Generating a key to update the group key.

At least one of a new group key generated by the conditional access server and a new group key generated by all other terminals included in the conditional access system except for the specific terminal is a manufacturing secret value of the specific terminal and an existing group key. XOR operation on, and generates a hash function for the operation result.

In the group key update step of the conditional access server, when the specific terminal wants to newly join a group, the group key renewal step includes: the conditional access server encrypting the new group key; The new group key may be transmitted to the specific terminal.

Encryption for the new group key is performed using a pre-shared key shared only between the specific terminal and the conditional access server.

The group key distribution method further includes the step of decrypting the new group key by the specific terminal receiving the encrypted new group key using the pre-shared key.

A conditional access server according to another aspect of the present invention provides a conditional access service to at least one terminal, shares a different pre-shared key with each of the at least one terminal, and all terminals that can be associated with the conditional access server. It stores the manufacturing secret value for and, if there is a request to join or leave the group from a specific terminal, a new group key is generated using the existing group key and the manufacturing secret value of the specific terminal to update the group key.

A conditional access terminal according to another aspect of the present invention shares a pre-shared key with a conditional access server and stores it, and stores a secret value for all other terminals except itself. When a group join message or a group leave message is received, a new group key is generated by using an existing group key and a manufacturing secret value of the specific terminal to update the group key.

According to another aspect of the present invention, a conditional access system shares a different pre-shared key with each of at least one terminal, stores a manufacturing secret value for all relevant terminals, and requests to join or leave the group from a specific terminal. If there is, share a pre-shared key with the reception limit server and the reception limit server to generate a new group key to update the group key by using the existing group key and the manufacturing secret value of the specific terminal, and store itself If the manufacturing secret value for all other terminals is stored, and a group join message or a group leave message of a specific terminal is received from the restriction server, the existing group key and the manufacturing secret value of the specific terminal are used. At least one receiving conditional terminal for generating a new group key to update the group key.

According to the present invention, a group key distribution method and a reception restriction system using the same, a very fast group key distribution is possible at a low cost by maximizing a computational efficiency and a communication efficiency instead of consuming storage space, and when a subscriber joins or leaves a group. Regardless of the number of subscribers, the server and each terminal can update the group key only by the same number of operations and the same number of transmission and reception of messages.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the present invention. Like reference numerals are used for like elements in describing each drawing.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and are not construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, with reference to the accompanying drawings, it will be described in detail a preferred embodiment of the present invention. Hereinafter, the same reference numerals are used for the same components in the drawings, and duplicate descriptions of the same components are omitted.

2 is a view for explaining the operation of the terminal and the server at the time of shipment of the terminal, according to an embodiment of the group key distribution method of the present invention.

In the present invention, it is assumed that only a pre-shared key exists between the reception limiting server 10 and each terminal 20. That is, the server and the i-th terminal C _i share the pre-shared key PK _i (S101). Thus, the pre-shared key that each terminal shares with the server is set differently, and is shared only between the server and each terminal to keep the secret to the other terminal or the outside. Indeed, these pre-shared keys are used by many group services including IP-TV.

In addition, each terminal C _i according to the present invention before the sale to the general user (that is, at the time of factory shipment) manufacturing secret value for all other terminals except itself, that is, R ₁ , R ₂ , ..., R _i-1 , R _{i + 1} , R _{i + 2} , ..., R _z (where z is the total number of terminals, the total terminal is at least one existing terminal and is expected to be manufactured in the future And all terminals) (S103). For example, if any IP-TV service provider produced z terminals in a plan to spread a total of z terminals, (z-1) manufacturing secrets are stored in each terminal. The server stores all z manufacturing secrets R ₁ , R ₂ , ..., R _z (S102).

Each of these manufacturing secrets has the same size as the group key and can generally be assumed to be 128 bits in size. If the IP-TV service provider produced a total of 100 million (100,000,000) terminals, each terminal stores about 1.5 GB (GigaByte) of secrets. Given the capacity and cost of hard disks, the 1.5GB can be installed at a very low cost. Each terminal stores the above-mentioned secret key and manufacturing secret value at the time of factory shipment, and is then sold to the user.

Subsequently, the reception limiting server 10 generates a random value having a size of a bit and uses it as the first group key GK (S104). The production secret R _i (1 ≦ i ≦ z) is also composed of α bits, respectively.

3 illustrates an embodiment of an operation flow of a terminal and a server when a group is joined to a new terminal according to the group key distribution method of the present invention.

If the new terminal C _{n + 1} (20-2) (where n is the number of subscribers currently in the group) transmits a JOIN request to the reception restriction server 10 to join the group ( S301), and the server 10 receiving the same includes all IDs of the existing terminals 20-1 by putting ID _{n + 1} , which is an ID of the subscribed terminal C _{n + 1} , in a message indicating that the new terminal has subscribed. (S302). Meanwhile, the server 100 updates the group key by generating a new group key GK 'by applying a hash function to the result of performing XOR operation on the manufacturing secret value R _{n + 1} of the newly subscribed terminal and the existing group key GK. (S303). More specifically, the group key GK is updated using Equation 1 below.

[Equation 1]

는 XOR 연산을 의미한다. 또한, R_n+1은 신규가입 단말의 제조 비밀값, GK는 갱신 전의 그룹 키이다. Where H () is the hash function,

Means XOR operation. R _{n + 1} is a manufacturing secret value of the newly subscribed terminal, and GK is a group key before updating.

Not only the server 10 but also all other existing terminals 20-1 notified that the new terminal has joined, update the group key GK in the same manner as the server 10 used above. That is, a new group key GK 'is generated by applying a hash function to the result of performing the XOR operation on the manufacturing secret value R _{n + 1} of the new subscriber station and the existing group key GK (S304). Since all of the existing subscriber stations except for the terminal C _{n + 1} already know the group key GK and the manufacturing secret value R _{n + 1} in the past, a new group key GK ′ can be obtained in the same manner as in Equation (1). .

In addition, the server 10 generates an E _PKi (GK ') by encrypting the updated group key GK ′ using the pre-shared key PK _{n + 1} previously shared with the newly-subscribed terminal C _{n + 1} . (S305), it transmits this to the terminal C _{n + 1} (20-2) (S306). _Upon receiving the E _PKi (GK ') from the server 10, the terminal 20-2 decodes the E _PKi (GK') using the _PKi and obtains the GK '(S307).

R_n+1 를 계산할 수 없다. 또한, 이를 계산해낸다고 하더라도, 단말 C_n+1은 제조 비밀값 R_n+1를 모르기 때문에 과거의 그룹 키인 GK를 획득할 수 없다. 따라서 본 발명은 전방향 안전성(forward secrecy)을 보장한다. 전방향 안전성이란, 임의의 단말이 현재 혹은 미래의 그룹 키를 이용하여 과거의 그룹 키를 획득하거나 과거의 암호문을 복호화 할 수 없는 것을 의미함을 이미 살펴본 바 있다. 전방향 안전성이 보장되지 않으면, 임의의 단말은 과거의 정보를 과금없이 모두 수신할 수 있게 되므로, 이는 서비스 제공자의 입장에서 매우 중요한 보안요소이다.Terminal C _{n + 1} is from GK ′ to GK because of the one-wayness of the hash function.

R _{n + 1} cannot be calculated. Also, even if this is calculated, the terminal C _{n + 1} does not know the production secret value R _{n + 1} and thus cannot obtain the past group key GK. The present invention thus ensures forward secrecy. The omni-directional security has already been described as meaning that an arbitrary terminal cannot use the current or future group key to acquire a past group key or decrypt a past cipher text. If the omni-directional safety is not guaranteed, any terminal can receive all the information of the past without being charged, which is a very important security element from the service provider's point of view.

4 illustrates an operation flow of the remaining terminals and the server when any terminal leaves the group according to the group key distribution method of the present invention.

When the terminal C _i 20-3 of the group subscribers wants to leave the group, the terminal C _i 20-3 transmits a withdrawal request message to the reception restriction server 10 (S401). The server 10 broadcasts ID _i , which is an ID of the terminal C _i , to leave in a message indicating that C _i has been withdrawn from the existing terminals, and broadcasts it to all other terminals 20-4 (S402). . Receiving this, each terminal and server update the existing group key GK as shown in Equation 2 below (S403). That is, a new group key GK ″ is generated by applying a hash function to the result of performing the XOR operation on the manufacturing secret R _i of the withdrawal terminal and the existing group key GK.

[Equation 2]

는 XOR 연산을 의미한다. 또한, R_i 는 탈퇴하고자 하는 단말의 제조 비밀값, GK는 갱신 전의 그룹 키, GK″는 갱신된 그룹 키이다.Where H () is the hash function,

Means XOR operation. R _i is a manufacturing secret value of the terminal to be withdrawn, GK is a group key before updating, and GK ″ is an updated group key.

Since all the subscribed terminals except the terminal C _{i know the} past group key GK and the manufacturing secret value R _i , a new group key GK ″ can be obtained using Equation 2.

However, since the terminal C _i 20-3 does not know the production secret value R _i , even if it knows the old group key GK, it cannot obtain a new group key GK ″. The present invention thus ensures backward safety.

Backward security means that an arbitrary terminal cannot acquire a future group key or decrypt a future cipher text using a past or current group key. If the backward safety is not guaranteed, any terminal can receive the service without charging even after leaving the group, which is a very important security element from the service provider's point of view.

As described above, the present invention can perform a very fast operation using only HASH and XOR, and there is only one message transmitted and received by the server and the terminal when updating a group key according to the joining or withdrawing of the terminal. In particular, both the terminal and the server can update the group key with only one XOR operation and one HASH operation regardless of the number of subscribers in the group.

As described above, the present invention greatly reduces the number of operations and the number of messages required to update the group key instead of consuming storage space, thereby ultimately enabling a very fast and efficient group key update. In the case of storage devices in recent years, capacity is gradually increasing while prices are gradually decreasing. Therefore, the storage space consumed in the present invention can be secured at a very realistic cost. The present invention satisfies both the backward security and the forward safety, which are security requirements essential for various applications such as Mobile-TV, IP-TV, and multi-party conferencing. That is, the present invention enables secure, very fast and efficient group key distribution.

Although described with reference to the above embodiments, those skilled in the art will understand that the present invention can be variously modified and changed without departing from the spirit and scope of the invention described in the claims below. Could be.

1 is a block diagram showing a key structure and a key delivery process of a general conditional access system.

2 is a view for explaining the operation of the terminal and the server at the time of shipment of the terminal in accordance with an embodiment of the group key distribution method of the present invention.

3 is a diagram illustrating an embodiment of an operation flow of a terminal and a server when a group is joined to a new terminal according to the group key distribution method of the present invention.

4 is a diagram illustrating an operation flow of remaining terminals and a server when any terminal leaves the group according to the group key distribution method of the present invention.

Explanation of symbols on the main parts of the drawings

10: restriction server 20: terminal

Claims (19)

Claims [1] A method for distributing a group key in a conditional access system including a conditional access server and at least one terminal. Storing, by each of the at least one terminal, a manufacturing secret for all terminals except themselves; Wow When joining or leaving a group of a specific terminal, an XOR operation is performed on a previously used group key and a manufacturing secret value of the specific terminal, and a new group key is generated by applying a hash function to the result of the operation. Updating the key. The method according to claim 1, All the terminals as a whole, A group key distribution method comprising at least one existing terminal and all terminals expected to be manufactured in the future. The method according to claim 1, When joining or leaving a group of a specific terminal, All other terminals included in the access control system except for the specific terminal further include generating a new group key using the existing group key and the manufacturing secret value of the specific terminal to update the group key. Distribution method. The method according to claim 1 or 3, The new group key generated by all other terminals included in the reception control system except for the specific terminal, And generating an XOR operation on the manufacturing secret value of the specific terminal and the group key used previously and applying a hash function to the operation result. The method according to claim 1, In the group key update step of the reception restriction server, when the specific terminal wants to newly join a group, the group key update step may include: Encrypting the new group key by the conditional access server; Wow And by the conditional access server, transmitting the encrypted new group key to the specific terminal. The method according to claim 5, Encryption for the new group key, And a pre-shared key shared only between the specific terminal and the conditional access server. The method according to claim 6, And decrypting, by the specific terminal receiving the encrypted new group key, the new group key using the pre-shared key. A reception limitation server providing a reception restriction service to at least one terminal, Sharing different pre-shared keys with each of the at least one terminal, Store a manufacturing secret value for all terminals associated with the reception restriction server; When there is a request for joining a group or leaving a group from a specific terminal, an XOR operation is performed on a previously used group key and a manufacturing secret value of the specific terminal, and a new group key is generated by applying a hash function to the operation result. Unsubscribe server that updates the group key. delete The method according to claim 8, All terminals that can be associated with the reception restriction server, Restriction server, including at least one terminal existing and all terminals expected to be manufactured in the future. The method according to claim 8, When the specific terminal requests to newly join the group, And encrypting the new group key and transmitting the encrypted new group key to the specific terminal. The method of claim 11, Encryption for the new group key, Restriction server, characterized in that performed using a pre-shared key shared only between the specific terminal and the reception restriction server. After sharing the pre-shared key with the reception restriction server and storing the manufacturing secret value for all other terminals except itself, When the group join message or the group leave message of the specific terminal is received from the reception restriction server, an XOR operation is performed on a group key and a manufacturing secret value of the specific terminal, and a hash function is applied to the operation result. A conditional access terminal, generating a new group key to update the group key. delete 14. The method of claim 13, All other terminals except the self, Restriction-terminals, including at least one terminal existing and all terminals expected to be manufactured in the future. Share a different pre-shared key with each of the at least one terminal, store the manufacturing secret value for all relevant terminals, and if the request to join or leave the group from a specific terminal, request to join or leave the group from the specific terminal If there is, the XOR operation is performed on the existing group key and the manufacturing secret value of the specific terminal, and a new group key is generated by applying a hash function to the operation result to update the group key. server; Wow When sharing the pre-shared key with the reception restriction server and storing the manufacturing secret value for all other terminals except itself, when receiving the group subscription message or the group withdrawal message of a specific terminal from the reception restriction server, And a conditional access terminal that performs an XOR operation on a previously used group key and a manufacturing secret value of the specific terminal, generates a new group key by applying a hash function to the operation result, and updates the group key. Restriction system. delete 18. The method of claim 16, If a specific terminal among the at least one reception restriction terminal wants to newly join a group, the reception restriction server may include: And encrypting the new group key using a pre-shared key shared with the specific terminal, and transmitting the encrypted new group key to the specific terminal. 19. The method of claim 18, The specific terminal that receives the encrypted new group key, And decrypting the encrypted new group key using the pre-shared key to obtain a new group key.

Images