Background technology
Digital TV conditional accept (Conditional Access, CA) be the present information encryption technology in the concrete application of digital TV field, it has realized classification, mandate and the management of program and business information, is the important guarantee of Digital Television charge operating mechanism.
Fig. 1 is the structural representation of digital television conditional access system, and it comprises scrambler 101, descrambler 104, encryption equipment 102 and 103, decipher 105 and 106.
At transmitting terminal, scrambler 101 uses CW(Control Word, control word) 108 will comprise the TS(Transport Stream of audio/video information, transport stream) 107 use and upset algorithms and finish scrambling.The core of condition receiving system is exactly that the transmission of CW is controlled.Encryption equipment 102 uses SK(Service Key, business cipher key) 110 CW 108 and program attribute information 109 encrypted authorized control informations (Entitled Control Message, ECM) 114.Encryption equipment 103 uses PDK(Personal Distribute Key, individual distributing key) 112 SK 110 and program ordering information 111 encrypted obtain EMM(Entitled Management Message, Entitlement Management Message) 115.This layered encryption technology has very important effect for the fail safe that improves digital TV contents.
The TS 113 of the transmitting terminal of CA after with scrambling together with ECM 114 and EMM 115 through Web broadcasts to receiving terminal.
At receiving terminal, the CA system is first according to (the Program Association Table of the program association list in the transport stream, PAT) and Program Map Table (Program Map Table, PMT) PID (the Packet IDdentification of acquisition EMM 115 and ECM 114, the bag sign), filter out EMM 115 and ECM 114 according to PID again.Decipher 106 uses for the known PDK 112 deciphering EMM 115 of authorized user afterwards, obtain SK 110, it further deciphers ECM 114 decipher 105 recyclings, obtains CW 108, and last descrambler 104 utilizes CW 108 that scrambling TS 113 is reduced to original TS.
Layered encryption technology for transmitting terminal, receiving terminal adopts a kind of cipher key ladder (KeyLadder that is called usually, also be translated into, the level key) structure, decipher the acquisition Control Word, Fig. 2 has provided the structure chart that a number of plies is 2 cipher key ladder, comprises OTP(One-Time Programmable, disposable programmable)memory 201 and decipher 202,203.
Otp memory 201 is nonvolatile memory, be generally used for storage root key, PDK112 as mentioned above, decipher 202,203 all uses symmetric encipherment algorithm, Advanced Encryption Standardalgorithm (Advanced Encryption Standard for example, AES) and three secondary data encryption standard algorithms (Triple Data Encryption Standard, TDES).Whereindecipher 202 utilizes the root key that is stored among theOTP 201, and decipheringground floor ciphertext 204 obtainsground floor plaintext 206, and the PDK of utilization 112 deciphering (SK) PDK As mentioned above obtain SK 110, and with the temporary key input as the second layer of result; Expressly 206 as key, decipheringsecond layer ciphertext 205 can obtainfinal control word 207 with temporary ground floor for 203 of deciphers, and SK 110 deciphering (CW) SK that utilize As mentioned above obtain final CW.
Generally speaking, condition receiving system is based on disclosed cryptographic algorithms' implementation, so fail safe can only be guaranteed by key.In order to prevent key from stealing, most chips are kept at key in the nonvolatile memory of chip internal.And along with the progress of chip failure analysis and chip testing technology, the difficulty of stealing key is also reducing gradually.Common key is stolen means physical attacks, fault injection attacks and bypass attack etc.As: lie is attacked and (is comprised simple power analysis SPA, differential power is analyzed DPA, emi analysis EMA etc.) be exactly according to the difference of Password Operations type or the difference of deal with data, cause the variation of power consumption and electromagnetic radiation intensity, these change the assailant by using special measuring instrument and mathematical statistics method determination and analysis, just can obtain the specific key message in the chip.
Embodiment
Below in conjunction with drawings and Examples invention is described in detail.
As shown in Figure 3, the embodiment of the implement device of a kind of cipher key ladder of the present invention, the implement device of this cipher key ladder comprises:
Memory 301 is used for storage root key; And
Decipher 303 is used for being decrypted to the ciphertext of several (being assumed to N) effective layers and several (being assumed to M) redundant layers; M redundant layer interts at N effectively between the layer according to order at random, and M redundant layer and N putting in order between effectively layer is definite.
In the specific embodiment of the invention, so-called effective layer refers to the layered encryption technology for transmitting terminal, and receiving terminal adopts a kind of structure that is called cipher key ladder (KeyLadder also is translated into, the level key).
Wherein, N is natural number, and its size depends on the number of plies of transmitting terminal layered encryption in the condition receiving system, usually more than or equal to 2; Redundant number of plies M also is natural number, and its size is with effectively number of plies N is irrelevant, and redundant number of plies M is more, and fail safe is higher.N effectively exists N+1 gap between the layer, then inserts M in each gapiIndividual redundant layer, wherein MiFor more than or equal to zero at random natural number, the number M=M of the so final redundant layer that inserts1+ M2+ ... + MN+ MN+1, M wherein1Expression first is the number of plies of layer redundant layer that inserts before effectively, M2The number of plies of expression first effective layer and the second redundant layer that effectively inserts between the layer, by that analogy, MNRepresent that the effective layer of N-1 and N effectively insert the number of plies of redundant layer, M between the layerN+1Represent that the effective layer of N inserts the number of plies of redundant layer afterwards.
Wherein,decipher 303 uses symmetric encipherment algorithm, for example Advanced Encryption Standardalgorithm (Advanced Encryption Standard, AES) and three secondary data encryption standard algorithms (Triple Data Encryption Standard, TDES).Memory 301 can be disposable programmable (One-Time Programmable, OTP) memory.
In the work because, before each decryption oprerations, each effectively putting in order between layer and the redundant layer determine, and put in order according to this that effectively layer and redundant layer successively are decrypted to each.
Effective layer such as current layer, then:
Except the effective layer of ground floor, to adopt outside the input key of root key conduct ofmemory 301 storages,decipher 303 all is to adopt effective layer of plaintext of n-1 layer as the input key, n effectively layer plaintext will be generated after n effective layer the decrypt ciphertext, this n effectively layer is expressly temporary, as effective layer input key of n+1 layer, until the ciphertext of the effective layer of last one deck (i.e. N layer) is decrypted rear output control word (CW).Wherein, n is greater than 1 and less than the natural number of N.
Optimize, after all decryption oprerations are finished, just control word is exported to descrambler, in order to avoid the assailant penetrates last effectively position of layer.
For example, if current layer is first effective layer, then decipher 303 adopts the root key ofmemory 301 storages as the input key of first effective layer, first effective layer ofciphertext 311 is decrypted, acquisition first islayer plaintext 321 effectively, and temporary these firsteffective layer plaintext 311 input keys as second effective layer.
Wherein, the key of all effective layers is externally invisible, removes last effectively plaintext output of layer, is control word, and the plaintext of other layer is exported externally also invisible.
Redundant layer such as current layer, then:
Except the ground floor redundant layer is, adopt outside the first redundant layer key of input,decipher 303 all is to adopt the redundant layer of redundant layer of m-1 layer expressly as the input key, to generating m redundant layer after the decrypt ciphertext of m redundant layer expressly, and this m redundant layer input key of temporary redundant layer as the m+1 layer expressly, until the M layer redundant layer of exporting after the decrypt ciphertext of 303 pairs of last one decks of decipher (i.e. M layer) redundant layer expressly kept in.Wherein, m is greater than 1 and less than the natural number of M.
For example: if current layer is the first redundant layer,decipher 303 adopts the first redundant layer key of input, and 331 deciphering obtain the firstredundant layer plaintext 341 to the first redundant layer ciphertext, and temporary this first redundant layer is the 341 input keys as the second redundant layer expressly.
Wherein, attack in order to prevent null value, the first redundant layer key and the first redundant layer ciphertext 331 are unequal random number.Other redundant layer except the first redundant layer, ciphertext is input as random number.
Wherein, the key of all redundant layers, ciphertext, expressly externally all invisible prevent that the assailant from stealing the information of redundant layer.
The redundant number of plies of the above-mentioned increase of mentioning, and these redundant layers also have key and the ciphertext input of each redundant layer in each effectively distribution between the layer, related random number generation algorithm, can and realize that for different application scenarioss difficulty is different, does not do particular restriction.
In this embodiment, effectively the order of operation between the layer is identical when not having redundant layer for each, and each effectively inserts redundancy between the layer the number of plies at random, guaranteed the correctness of function.Before each cipher key ladder computing, in case effectively inserting the redundant number of plies between the layer, each determines, effectively layer just determines also that with the permutation and combination of redundant layer total number of plies equals effective number of plies and redundant number of plies sum, and each effectively also just determines by inserting the redundant number of plies at the interval of layer execution.
Consider ageing and compromise fail safe, can limit each redundant number of plies of effectively inserting between the layer, rather than only be confined to take natural number at random as the form of example, as long as upset the effectively purpose of layer execution interval in order to reach, and the implementation method of insertion redundant layer is all adopting within the claim scope of the present invention.
For some condition reception manufacturers, the number of plies of cipher key ladder is the part of sensitive information, can not be for known to the external world.The number of plies of supposing cipher key ladder is N, in situation about not expanding, starts a cipher key ladder computing, can finish N decryption oprerations, and wherein the size of N depends on the number of plies of transmitting terminal layered encryption in the condition receiving system, and N is more than or equal to 2 usually.And the lie information of revealing in the decrypting process, for example power consumption, electromagnetic radiation if do not shield and special processing, just is easy to victim and obtains and distinguish.Therefore the assailant starts a cipher key ladder computing, and the number of times of lie information leakage just can easily be known number of plies N during then by the analysis decryption oprerations.In the controlled condition receiving system of some number of plies, the assailant is in the situation of knowing number of plies N, can be by starting the cipher key ladder computing of a N+1 layer, become layer second from the bottom so that will export last one deck of control word originally, change the outgoing route of control word, control simultaneously the input of last one deck, utilize the lie analysis, reach the purpose of stealing control word.
The difficulty of attacking in order to increase lie is considered the number of plies of cipher key ladder is expanded, and increases some redundant layers.In cipher key ladder calculating process, the number of times of lie information leakage during decryption oprerations can become many because of the adding of redundant layer like this.When each cipher key ladder computing, the redundant number of plies M of increase at random after, the number of times of lie information leakage also can change with the variation of M, this will increase the assailant obtains effective number of plies N by the number of times of analyzing the lie information leakage difficulty greatly.In case effectively number of plies N can't know that N+1 layer attacks above-mentioned also just can't prove effective.
Effective number of plies N well can be stashed although increase the method for redundant layer, every layer of lie information that decryption oprerations is revealed for the assailant, remains transparent, so the position of redundant layer just seems particularly crucial.If effectively the position of layer relative redundancy layer is fixed, as long as the lie analysis is carried out by the decryption oprerations to certain layer in the position that the assailant has decoded redundant layer, can steal out control word equally, the difficulty of just attacking does not have the larger of redundant layer, but remains feasible.In order to determine the position of redundant layer, further promote simultaneously the ability of anti-attack, consideration is under the prerequisite that does not change effective layer of order, the redundant layer radom insertion is arrived effectively between the layer, so that the lie information of certain layer is also different during each cipher key ladder computing, thereby the restriction assailant attacks the lie of certain layer, improves security of system.
As shown in Figure 4, be the structural representation of application example of embodiment of the implement device of a kind of cipher key ladder of the present invention, its effective number of plies N=2, redundant number of plies M=3, effectively layer is pressed shown in Figure 4 with the distribution of redundant layer.
Ground floor is the first redundant layer, finishes for the first time redundant decryption oprerations.Two different random numbers respectively as the first redundant layer key and the firstredundant layer ciphertext 431, are sent intodecipher 403, and deciphering obtains the firstredundant layer plaintext 441, and temporary key as the second redundant layer.
The second layer is first effective layer, finishes for the first time effectively decryption oprerations, as in EMM SK being decrypted.Decipher 403 will be stored in the root key of disposableprogrammable memory 401 as key, decipher first effective layer ofciphertext 411, obtain firsteffective layer plaintext 421, and keep in the key as second effective layer.
The 3rd layer is the second redundant layer, finishes for the second time redundant decryption oprerations.The first redundant layer thatdecipher 403 will be kept in is deciphered the secondredundant layer ciphertext 432 expressly as key, obtains the secondredundant layer plaintext 442, and temporary key as the triple redundance layer.
The 4th layer is second effective layer, finishes last effective decryption oprerations, as in ECM CW being decrypted.First effective layer thatdecipher 403 will be kept in is deciphered second effective layer ofciphertext 412 expressly as key, obtains second effective layer plaintext, and temporary as final control word output, and after all decryption oprerations were finished, ability was exported to descrambler with temporary control word.
Layer 5 is the triple redundance layer, finishes last redundant decryption oprerations.The secondredundant layer plaintext 442 thatdecipher 403 will be kept in is deciphered tripleredundance layer ciphertext 433 as key, obtains tripleredundance layer plaintext 443, though still temporary without use, as redundant operation, prevent that the assailant from penetrating the position of last redundant layer.
Owing to be after all decryption oprerations are finished, just temporary control word is exported to descrambler, cause the illusion of five layer operations, avoid the assailant to penetrate last effectively position of layer.
As shown in Figure 5, the embodiment of the implementation method of cipher key ladder of the present invention, the number of plies of supposing cipher key ladder is N, and N is the natural number more than or equal to 2 usually, and the method comprises:
Step 501 before the cipher key ladder computing, increases several redundant layers, and with between several effective layers of these several redundant layer radom insertions, effectively layer is definite with putting in order of redundant layer; The number of plies of the redundant layer that each effectively inserts between the layer is the at random natural number more than or equal to 0; Concrete insertion process can referring to the embodiment of the implement device of cipher key ladder of the present invention, be given unnecessary details herein no longer one by one;
Wherein, the number of plies of redundant layer is with effectively the number of plies is irrelevant, and the number of plies of redundant layer is more, and fail safe is higher;
Step 502, according to putting in order of determining in the step 501, each effectively is decrypted between the layer successively, until the effective layer of last one deck obtains control word; Concrete, except ground floor effectively layer with pre-stored root key as the input key, first effective layer of ciphertext is decrypted outside acquisition first effective layer plaintext, the 2nd layer all is that the plaintext that above one effective layer is exported is done key to last effective layer, current effective layer ciphertext is decrypted the current effective layer plaintext of rear acquisition, and current effective layer plaintext is temporary as next effective key of layer, until last effectively layer to last one deck effectively a layer ciphertext be decrypted rear acquisition control word;
Wherein, the key of all effective layers is externally invisible, removes last effectively plaintext output of layer, and the plaintext in other intermediate layer is exported externally also invisible; Root key can be stored in the disposable programmable memory;
Step 503, the order according to determining in the step 501 is decrypted between each redundant layer successively; Concrete, except the ground floor redundant layer is to adopt the first redundant layer key of input that the first redundant layer ciphertext is decrypted acquisition the first redundant layer plaintext, the 2nd layer all is that the plaintext that an above redundant layer is exported is done key to last redundant layer, the ciphertext of current redundant layer is decrypted the plaintext of the current redundant layer of rear acquisition, and with the temporary key as next redundant layer of the plaintext of current redundant layer, until last redundant layer is exported last one deck redundant layer expressly;
Wherein, the key of the first redundant layer and ciphertext are input as unequal random number; The key of all redundant layers, ciphertext, expressly externally all invisible;
Step 504, after effectively layer and redundant layer decryption oprerations were finished, the output control word was to descrambler at all.
Execution sequence between above-mentionedsteps 502 and thestep 503 is determined by step step 501, that is to say, in case step 501 has been determined putting in order between effective layer and the redundant layer, then put in order according to this, successively the ciphertext of current layer is decrypted, if current layer is effective layer, then carries out according tostep 502, if current layer is redundant layer, this carries out according tostep 503.
Because redundant layer is being inserted between the effective layer at random, that is to say, each effectively the order of operation between the layer do not change, so, just can be under the prerequisite that does not change effective layer of order, the raising Security of the system.
Embodiment at the embodiment of the implementation method of cipher key ladder of the present invention and the implement device of cipher key ladder is corresponding, and other something in common and the effect that can reach are the same, give unnecessary details no longer one by one at this.
Above-mentioned embodiment illustrates but does not limit the present invention that those skilled in the art can design a plurality of examples that replace within the scope of the claims.The those skilled in the art should be appreciated that there not being violation within the defined scope of the present invention, can make suitable adjustment, modification etc. such as appended claims to specific implementation.Therefore, all according to the spirit and principles in the present invention, any modifications and variations of doing are all within the defined scope of the present invention of appended claims.