WO2009034106A1

WO2009034106A1 - Method of securing a data stream

Info

Publication number: WO2009034106A1
Application number: PCT/EP2008/062002
Authority: WO
Inventors: Fabien Venries
Original assignee: Viaccess
Priority date: 2007-09-13
Filing date: 2008-09-10
Publication date: 2009-03-19
Also published as: FR2921173B1; TW200922158A; FR2921173A1

Abstract

The invention relates to a method of securing a communication interface (4) between a first sender/receiver device (2) and a second sender/receiver device (6) exchanging data via said interface (4). This method comprises the following steps:- defining an integer number N of distinct communication channels Ci, i=1 to N, between said first and second terminals (2, 6), - splitting said data into a number M of data segments Dj, j=1 to M, - assigning each data segment Dj at least one communication channel Ci and a rank rj of transmission of said segment via said channel according to a distribution procedure programmed so as to execute in the first device (2) and in the second device (6), - transferring each data segment Dj from the first (2) (respectively second (6)) device to the second (6) (respectively first (2)) device via said channel Ci and according to said rank rj .

Description

METHOD FOR SECURING A DATA STREAM

DESCRIPTION

TECHNICAL AREA

The invention relates to the protection of a communication interface between two devices exchanging data and relates more specifically to a method for securing a communication interface between a first transmitter / receiver device and a second transmitter / receiver device exchanging data. data via said interface.

The invention also relates to an emitter device transmitting data to a receiving device via the secure communication interface by the method according to the invention.

The invention also relates to a receiving device receiving data from a transmitting device via the secure communication interface by the method according to the invention. The invention also relates to a computer program recorded on a medium and intended to implement the method according to the invention when it is executed in a transmitting device or in a receiving device. The invention also relates to a proxy module or transmitter proxy for implementing the method according to the invention in a transmitting device transmitting data to a receiving device via the secure communication interface by the method according to the invention. The invention further relates to a proxy module or proxy receiver for implementing the method according to the invention in a receiving device receiving data from a transmitting device via the secure communication interface by the method according to the invention.

STATE OF THE PRIOR ART

Increasingly, the communication terminals (mobile phone, laptop, home gateway, TV decoder, PDA, ...) are equipped with applications capable of reading on the fly or from a local or remote recording medium , record or redistribute, digital contents of different types, such as for example audio data or video data previously scrambled with one or more secret keys before being provided to the terminal.

To use scrambled content, a terminal must have a right of access authorizing it to receive the key or descrambling of this content.

The terminal is for this purpose generally composed of a decoder, in particular device responsible for the reception, descrambling and the intended use of the content, and a security processor, device responsible for verifying, when a request is made. use of the content, the satisfaction, by the terminal, of one or more access conditions to the content, in order, if necessary, to provide the decoder with the keys and the information necessary for descrambling said content. This processor security may be an external device associated with the decoder, typically a smart card, or a device integrated in the terminal, typically a hardware and / or software module. Generally, the decoder and the security processor communicate via a dedicated interface according to a particular communication protocol.

A technical problem stems from the fact that the information exchanged via this interface, including keys and information useful for descrambling the content, can be intercepted and redistributed fraudulently to users who do not have access rights to these contents. This form of hacking is known as MacCormac Hack in the field of conditional access.

The solutions of the prior art, such as, for example, the pairing of the decoder with the security processor or the partitioning of the sets of decoders, described respectively in the documents FR 2 866 772, FR 2 866 673, and FR 2 871 017. of the applicant, do not effectively prevent the interception of data transiting via the decoder-security processor interface.

The purpose of the invention is to ensure the security of the decoder-security processor interface by obscuring this interface, that is to say, by rendering the data that passes through it unintelligible in order to prevent its reconstitution. Fraudulent interception. This mechanism can be applied alone to the data flows exchanged or in combination with the known solutions.

SUMMARY OF THE INVENTION To this end, the invention recommends a method of securing a communication interface between a first transmitter / receiver device and a second transmitter / receiver device exchanging data via said interface.

The process according to the invention comprises the following steps:

defining a nonzero integer N of distinct communication channels Ci, i = 1 to N, between said decoder and said security processor,

- cutting said data into a number M of data segments Dj, j = 1 to M,

assigning to each data segment Dj at least one communication channel Ci and a transmission row R _D via said channel according to a distribution procedure programmed to execute in the decoder and in the security processor, said distribution procedure being defined by a pseudo-random law constructed from pseudo-random generators initialized with parameters of equal values in the decoder and in the security processor,

transfer each data segment Dj from the decoder to the security processor or from the security processor to the decoder via said channel Ci and according to said rank rj. Thanks to the invention, fraudulently intercepted data at the interface of the transmitter and receiver devices are unusable in the state insofar as the information needed to properly recombine the data blocks are not accessible via this interface.

The step of defining the integer N of distinct communication channels Ci, the step of splitting said data into an M number of segments, and the step of assigning a channel and a transmission rank to each segment are based on the use of a deterministic law so as to provide the same result in the transmitting device and in the receiving device, and thus enabling the reconstitution of said data by the receiving device. In a preferred embodiment, the step of defining the integer N of distinct communication channels Ci, the step of splitting said data into a number M, and the step of assigning channels to each segment are based on the using a pseudo-randomized law initialized with parameters of equal values in the transmitting device and in the receiving device, so as to provide an unpredictable result for an external observer and thus guarantee the quality of the obscuration of the interface to protect.

In a first variant, each data segment Dj is encrypted, during each of its transmissions on the channel Ci, with a secret key Ki associated with the channel Ci and known both of the first device and the second device. In another variant, all the data segments Dj are encrypted with the same secret key K known from both the first device and the second device. The Ci channels are open logical channels in nonzero number N, preferably at least equal to 2, on at least one physical channel existing between the transmitter and receiver devices. The logical channel concept is described in ISO 7816 for example. In a manner known per se, such a logical channel is dynamically dedicated to the communication of a given application of one of the devices with a given application of the other device.

The transmitted data may optionally include, in addition to useful data segments to be transmitted, at least one decoy data segment.

Preferably, the decoy data segments are of arbitrary length and comprise data computed randomly.

The method according to the invention applies to secure the interface between a decoder capable of transmitting data to a security processor via a communication interface connecting said decoder and said security processor, said decoder comprising:

means for determining an integer N of distinct communication channels Ci via said communication interface, means for splitting the data to be exchanged into a number M of data segments Dj, means for assigning to each data segment Dj at least one communication channel Ci and a transmission row R _D via said communication channel Ci according to a distribution procedure programmed to execute in the decoder and in the security processor ,

means for encrypting each segment of data Dj with a secret key Ki associated with the channel Ci; means for transferring each segment of data Dj to the security processor via said channel Ci and according to said row r _D.

The security processor includes:

means for determining, for each data segment Dj transmitted, its order j in the initial block of data resulting from the division of this block, the channel Ci and the rank r _D which have been assigned to it by the distribution procedure, means for storing the first received instance of each data segment Dj according to the results of said division and of said distribution, means for re-ordering said first received instances of the data segments Dj according to the results of said division and of said distribution, means for concatenating said first instances received from data segments Dj to obtain said initial data block. In a particular embodiment, the decoder and the security processor exchange the data via at least a first proxy module (or proxy) arranged in the decoder or a second proxy module (or proxy) arranged in the security processor. These proxy modules (or proxies) provide all the necessary processing to implement the method according to the invention, for all embedded applications in the transmitter and receiver devices.

In this context, the proxy module may be an emitter module and in this case:

means for defining an integer number N of distinct communication channels Ci via said communication interface,

means for splitting the data to be exchanged into a number M of data segments Dj,

means for assigning to each data segment Dj at least one communication channel Ci and a transmission row R _D of said segment via said communication channel Ci according to a procedure for dividing the data segments Dj between the communication channels Ci defined by a pseudo-random law constructed from pseudo-random generators initialized with parameters of equal values in the decoder and in the security processor,

means for encrypting each data segment Dj with a secret key Ki associated with the channel Ci,

means for transferring each data segment Dj to the receiving proxy module via said channel Ci and according to said row r _D. The proxy module can also be a receiver device and comprises for this purpose:

means for determining, for each segment Dj of transmitted data, its order j in the initial block of data, resulting from the division of this block, the channel Ci and of rank r _D which have been assigned to it by the distribution procedure, means for storing the first received instance of each data segment Dj according to the results of said division and said distribution, means for re-ordering said first instances received from the data segments Dj as a function of the results of said division and of said distribution means for concatenating said first instances received from data segments Dj to obtain said initial data block.

BRIEF DESCRIPTION OF THE DRAWINGS

Other characteristics and advantages of the invention will emerge from the description which follows, taken by way of non-limiting example, with reference to the appended figures in which: FIG. 1 diagrammatically illustrates a first device and a second device capable of exchanging data via a secure interface by the method according to the invention,

FIG. 2 represents a flowchart illustrating a first embodiment of the method for sending data according to the invention; FIG. 3 represents a flowchart illustrating a second embodiment of the method for sending data according to the invention;

FIG. 4 illustrates the prior processing of a block of data before transfer via the secure interface; FIG. 5 illustrates the processing of said data block on reception via the secure interface; FIG. 6 represents a flowchart illustrating a second embodiment of the method for receiving data according to the invention.

DETAILED PRESENTATION OF PARTICULAR EMBODIMENTS

The invention will now be described with reference to FIG. 1 in a particular application in which a first device, constituted by a decoder 2 of scrambled contents, exchanges, with a security processor, constituted by a smart card 6, via a communication interface 4, data which is associated with at least one access condition. The decoder 2 and the smart card 6 are capable of acting either as transmitters or receivers of said data.

The smart card 6 has means and specific data for verifying whether the decoder 2 fulfills the access condition or conditions, and means for generating and supplying said decoder 2 with the secret keys for descrambling the contents.

In operation, the decoder 2 sends the smart card 6 requests for secret keys. In response to these requests, and after verification of access conditions attached to the contents, the smart card 6 provides the decoder 2 the data necessary for descrambling these contents. These exchanges are done via the interface 4 connecting the decoder 2 and the smart card 6.

In the example described in FIG. 1, the decoder 2 comprises an application AT 10 that communicates with an application AC 12 embedded in the smart card 6, via a proxy module (or proxy) PAC 14 also embedded in the smart card. 6.

In the remainder of the description, we will denote by D a data block comprising the bytes coding the descrambling information of the contents that this smart card transmits to the decoder 2 in response to a request. We will denote by L the length of block D.

FIG. 2 schematically illustrates the essential steps of the obscuration method of the interface 4 between the decoder 2 and the smart card 6. For the sake of clarity, this example corresponds to the case where the smart card 6 acts as an emitting entity and the decoder 2 acts as a receiver entity. In this example, block D represents the bytes encoding a secret key. Of course, the method according to the invention applies symmetrically when the decoder 2 acts as an emitting entity and the smart card 6 acts as a receiving entity.

The value of the length L is previously transmitted to the decoder 2 by the smart card 6 in a data block of length predetermined LO known both of the decoder 2 and the smart card 6.

In operation, in step 20, the application AT 10 and the application AC 12 open an integer N of distinct communication channels Ci via the ISO interface 7816, i being between 1 and N.

The opening of these channels is performed by a signaling exchange using the exchange protocol used. In step 22, the application PAC 14 executes a first software module G1 to cut the data block D into a number M of data segments Dj.

For this purpose, the software module Gl calculates, from the value L and optionally of the value N, the number M of segments to be produced, and the sequence L1,

L2, ... Lj, ... LM of the respective lengths of the segments D1,

D2, ... Dj, ... DM.

In step 24, a second and a third software modules G3 and G4 are executed to distribute the M blocks Dj obtained in step 22 over the N channels.

This.

For this purpose, for each segment Dj, the second software module G3 generates a first number n _D representing the number of a channel C ₁ , then the number nj is transmitted to the third software module G4 which in turn generates a second number r ₃ representing the transmission rank of the segment D _D via the channel Cn _D.

Similarly, software modules

Gl, G3 and G4 are executed by the application AT 10 in the decoder 2 to produce, from the value L and optionally the value N, the following L1, L2, ... Lj,... LM of the respective lengths of the segments D1, D2,..., DM, and the same pair (n-, r-) for the segment Dj, j ranging from 1 to M.

The generation of the numbers Lj, and the pair (n- ,, r-,) is carried out according to a deterministic law.

So, at any moment, for every segment

Dj, the decoder 2 and the smart card 6 simultaneously know the number nj of the channel Ci to which is assigned the segment Dj considered, and the rank rj of transmission of said segment via said channel Ci.

Preferably, the generation of the numbers Lj, and of the pair (nj, rj) is performed according to a pseudo-random law initialized with parameters of equal values in the decoder 2 and in the smart card 6.

Thus, these results are unpredictable for an observer outside the terminal.

Optionally, each data segment Dj is encrypted by a secret key Kj known both from the application AT 10 of the decoder 2 and the application PAC 14 of the smart card 6.

In a particular variant embodiment, the application PAC 14 encrypts each segment of data Dj with the same secret key K known from both the AT application 10 of the decoder 2 and the application PAC 14 of the smart card 6. .

The key K can be established by means of a keying protocol by the two applications AT 10 and PAC 14. In another variant embodiment, each segment Dj is encrypted with a secret key Kn _D , associated with its transmission channel, and known both from the application AT 10 of the decoder 2 and the application PAC 14 of the smart card 6.

The segments obtained are then transmitted, in step 26, via the channels Ci to the smart card 6.

On receipt, the AT application 10 sorts the segments received as a function of the pairs (nj, rj), previously calculated, and reconstitutes the initial data block. In another variant embodiment of the method, each segment Dj is transmitted Xj times, Xj being a non-zero integer. In this embodiment, the segment Dj is transmitted on Xj channels and each transmission is associated with a rank rjk. The different transmissions of the segments Dj are therefore defined by a series of pairs (njk, rjk), k ranging from 1 to Xj.

This embodiment provides a redundancy mechanism to ensure the transfer of data even if one or more communication failures occur on one or more communication channels.

FIG. 3 schematically illustrates the obscuration steps of the interface 4 in a particular embodiment of the invention further comprising an additional step of inserting decoy data into the block of useful data exchanged between the decoder 2 and the smart card 6.

In this case, a fourth software module G2 makes it possible to insert segments DLj, for j ranging from 1 to M + 1, including said decoy data among the Dj segments of the D block.

This insertion is carried out by generating the M + 1-tuplet consisting of lengths LLi to LL _{M +} i, possibly zero, of the decoy segments to be inserted before each of the segments D1 to DM and after the segment

DM, then, for each of these positions j ranging from 1 to

M + 1, if LLj is nonzero, by generating the random content of the decoy segment DL _D , then inserting the decoy segment DL _D.

The generation of M + 1-tuples is defined by a deterministic law, preferably pseudo-randomly.

In step 30, the application PAC 14 calculates a number M + 1 of decoy segments DLi, DL2,..., DL _M , DL _M + i and a number M + 1 of lengths LLi, LL ₂ ,. .., LL _M , LL _{M +} i for these segments, then inserts each of these non-zero length decoy segments before the useful data segment of the same index. The sequence of the resulting segments D ' ₃ is therefore constituted as follows:

_{2D + I} = DL _D for J = O to M; _2D = D _D for j = 1 to M.

In step 24, the second software module G3 and the third software module G4 are executed to distribute the M 'blocks D' j obtained in step 30 on the N open channels Ci.

For this purpose, for each segment D 'j, the second software module G3 generates a first number nj, j varying from 1 to M', representing the number of a channel Ci, nj being then transmitted to the third module software G4 which in turn generates a second number rj, j ranging from 1 to M ', representing the transmission rank of the segment D' j via the channel Cnj.

Similarly, a fourth identical software module G2 is executed by the AT application

10 in the decoder 2, in addition to the software modules

Gl, G3 and G4, to produce, from the values L and

M, and optionally of the value N, the sequence LLi, LL2,

..., LL _M , LL _{M + 1} representing the respective lengths of the lure segments DLi, DL ₂ , ..., DL _M , DL _{M +} i.

FIG. 4 illustrates the processing of the data block D of length L by the PAC application 14 before the transfer.

Block D, length L, shown in the starting stage 40 is cut at step 42, M D _D segments of respective lengths Li, L _2, ..., L _M calculated by the software module Gl .

In step 44, the software module G3 assigns a channel Ci to each segment D-. In step 46, the software module G4 assigns each segment a transmission rank via the channel assigned to it by the module G3. Thus, the segment D1 will be the third segment transmitted, and will be via channel C2. The D2 segment will be the first segment transmitted, and will be via the CN channel, etc.

In step 48, each segment is transmitted via the channel allocated to it by the module G3, at the rank assigned to it by the module G4.

FIG. 5 illustrates the reconstitution, by the AT application 10, of the data block D from the segments Dj received by the decoder 2. In step 50, the software module G1 recalculates the number M and the lengths L1, L2,..., LM of the data segments D1, D2,..., DM.

In step 52 the software module G3 recalculates the index nj of the transmission channel of each data segment Dj.

In step 54 the module G4 recalculates the rank rj of transmission of the data segment Dj on the channel Cnj. In step 56, the decoder receives the data segments according to the rank of their transmissions, stores the first received instance of each data segment Dj, reorders the first received instances as a function of the pairs (nj, rj), and concatenates said first instances received to obtain the initial data block D.

Fig. 6 is a flowchart illustrating the steps of the method performed upon receipt of the payload data segments and decoy by the receiving device.

In step 70, the receiver device recalculates the number N of channels from the value L.

In step 72, the software module Gl recalculates the number and the length of the useful segments to receive.

In step 74, the software module G2 determines the length of the decoy segments.

In step 76, the software module G3 determines the distribution of all the segments on the open channels. In step 78, the software module G4 determines the ranks of the transmissions of the segments according to said distribution thus resulting in pairs (nj, rj). In step 80, the decoder receives the segments at the expected ranks, stores the first instance received from each of the only useful data segments Dj, and re-orders said useful segments as a function of the pairs (nj, rj). In step 82, the decoder concatenates said useful segments to obtain the initial block D.

Other procedures for dividing the data segments Dj obtained by step 22 on the communication channels Ci open in step 20 may be used without departing from the scope of the invention. More specifically, the clipping procedure can be adapted to the type of data to be exchanged and the processing capabilities of the smart card and the decoder.

Claims

A method of securing a communication interface (4) between a decoder (2) and a security processor (6) associated with said decoder (2), the decoder (2) and the security processor (6) exchanging data via said interface (4), characterized by the following steps:

defining a non-zero integer N of distinct communication channels Ci, i = 1 to N, between said decoder (2) and said security processor (6),

- cutting (9) said data into a number M of data segments Dj, j = 1 to M,

assigning to each data segment Dj at least one communication channel Ci and a transmission row R _D via said channel according to a distribution procedure programmed to execute in the decoder

(2) and in the security processor (6), said distribution procedure being defined by a pseudo-random law constructed from pseudo-random generators initialized with parameters of equal values in the decoder (2) and in the processor security (6).

transfer each data segment Dj from the decoder (2) to the security processor (6) or from the security processor (6) to the decoder (2) via said channel Ci and according to said rank rj.

2. Method according to claim 1, wherein each data segment Dj is transmitted via several distinct channels C ₁ and according to several distinct ranks r _η

3. Method according to claim 1, wherein each data segment Dj is encrypted with a secret key Kj known from both the decoder (2) and the security processor (6).

4. The method of claim 3, wherein each data segment Dj is encrypted with a secret key Ki associated with a channel Ci, and known both of the first decoder (2) and the security processor (6).

5. The method according to claim 3, wherein all the data segments Dj are encrypted with the same secret key K known to both the decoder (2) and the security processor (6).

The method of claim 1, wherein the procedure of dividing the data segments Dj between the communication channels Ci is defined by a deterministic law.

7. The method of claim 1, wherein the channels Ci are logical channels in number greater than or equal to two.

The method of claim 1 wherein the Ci channels are open on at least two physical channels.

9. Method according to one of claims 1 to 8, wherein the data exchanged between the decoder (2) and the security processor (6) comprise, in addition to useful data segments Dj, at least one data segment of lure.

The method according to claim 9, wherein the decoder (2) and the security processor (6) exchange said data via at least a first proxy module arranged in the decoder (2) or a second proxy module (14) arranged in the security processor (6).

11. Decoder (2) able to transmit data to a security processor (6) via a communication interface (4) connecting said decoder (2) and said security processor (6), characterized in that it comprises:

means for determining an integer number N of distinct communication channels Ci via said communication interface (4),

means for allocating to each data segment Dj at least one communication channel Ci and a transmission row R _D via said communication channel Ci according to a distribution procedure programmed to execute in the decoder (2) and in the security processor (6), means for encrypting each data segment Dj with a secret key Ki associated with the channel Ci,

means for transferring each data segment Dj to the security processor (6) via said channel Ci and according to said row r _D.

12. Security processor (6) adapted to receive data transmitted by the decoder (2) according to claim 11 via a communication interface (4), characterized in that it comprises:

means for determining, for each data segment Dj transmitted, its order j in the initial block of data resulting from the division of this block, the channel Ci and the rank r _D which have been assigned to it by the distribution procedure, means for storing the first received instance of each data segment Dj according to the results of said division and of said distribution, means for re-ordering said first received instances of the data segments Dj according to the results of said division and of said distribution, means for concatenating said first instances received from the data segments Dj to obtain said initial data block.

13. Computer program recorded on a medium and intended to implement the method according to claim 1 when executed in a decoder (2) or in a security processor (6).

Transmitter proxy module (10) arranged in a decoder (2) and exchanging data via an interface (4) with a receiving proxy module (14) arranged in a security processor (6), characterized in that it comprises :

means for defining an integer number N of distinct communication channels Ci via said communication interface (4),

means for assigning to each data segment Dj at least one communication channel Ci and a transmission row R _D of said segment via said communication channel Ci according to a procedure for dividing the data segments Dj between the communication channels Ci defined by a pseudo-random law constructed from pseudo-random generators initialized with parameters of equal values in the decoder (2) and in the security processor (6),

means for encrypting each segment of data Dj with a secret key Ki associated with the channel

This,

means for transferring each data segment Dj to the receiving proxy module (14) via said channel Ci and according to said row r _D.

15. Receiving proxy module (14) arranged in a security processor (6) and intended to receive data transmitted by a transmitter proxy module arranged in a decoder (2) via a communication interface (4), characterized in that it comprises :