Security system for television signal encryption

A conditional access system for over-air transmission and reception of scrambled television signals improves the reliability of the reception by transmitting a key signal for use in descrambling the television signal in a block of information which is itself encyphered by the key signal. On reception, the receiver after decyphering of the block of information compares the key signal recovered from the block with the key signal provided at the receiver for decyphering the block. Descrambling will only be allowed if comparison shows the two key signals to be the same. The system also provides for information relating to the credit status of each user to be transmitted over-air. In order to ensure rapid operation, the credit status signal is sent repeatedly and a further signal is appended which is used at the receiver to prevent repeated accumulation of credit. An alternative arrangement is for the transmitter to transmit a signal indicative of the total sum of credit ever purchased by a user and for the user's receiver to include a counter for accumulating all charges for programs viewed. A simple comparison between the two signals is sufficient to establish whether or not the viewer may view a program.

The present invention relates to a security system for television signal 
encryption, usable in the transmission and reception of television signals 
in either digital or sampled analogue form. In particular, the invention 
relates to such a security system which can provide an effective payment 
monitoring facility whereby relevant information can be transmitted, for 
example, in a satellite broadcasting channel. The invention may be used in 
the encryption of a multiplexed analogue component (MAC) television 
signal. 
The present invention is a development of certain aspects of the system 
described in our co-pending application U.S. Ser. No. 317796, and 
reference is directed thereto. 
PAY-PER-VIEW 
Pay-per-view is a very important feature which all subscription television 
services should contain. Typically, the decision to watch a programme is 
made in the few minutes before a service is broadcast. This factor of 
human behaviour could be very important to the economics of providing a 
new type of public service broadcasting. If the customer has to decide 
well in advance which programmes he will watch the viewer will tend to 
make a conservative estimate for his entertainment budget. Pay-per-view 
can be offered quite simply by including a meter in the receiver. A 
payment is made by the viewer to the broadcaster who then transmits the 
payment to the customer's receiver in the form of `electronic` over-air 
credit. The over-air credit is sent with the viewers validation signal and 
it is entered into the meter in his receiver. A money store is provided 
for each television channel and the store is decremented by a cost code 
which accompanies the television signal. In this way a viewer is able to 
gain immediate access to programmes and furthermore, he only pays for 
those programmes that he watches. 
Over-air credit provides a convenient and economical means of transferring 
credit units into a store in the receiver. However, in order that the 
system operates securely certain facts have to be taken into account: 
(i) how to make the transfer of credit units securely; 
(ii) how to inform the receiver that it has already received a specified 
quantity of credit units when the same quantity is being repeatedly 
transmitted; 
(iii) how to detect whether the data bits which represent the credit units 
have been received correctly in the presence of noise; and 
(iv) how to prevent the missed reception of credit units, which are part of 
a standing order, when the customer leaves the receiver switched off for a 
time longer than the payment period (such as when the customer goes away 
on holiday). 
The present invention is able to cope effectively with factors (i) to 
(iii). Factor (iv) is catered for provided a very large number of credit 
units are not missed.

The arrangement to be described, specifically with reference to FIG. 1, 
involves a technique by which over-air credit information may be sent 
securely under conditions of low signal-to-noise ratio, such as in a noisy 
satellite channel. A predetermined quantity of credit units (hereinafter 
referred to as "money") are sent to each customer per payment interval, 
encrypted in the transmitted signal, and entered in a meter in the 
receiver. The meter is decremented upon reception of a programme cost code 
in the transmitted signal. In this way, a full pay-per-view service can be 
made available to all categories of customer. The service can be organised 
on a pre-payment basis by transmitting appropriate credit units upon 
payment in advance by the customer. 
In accordance with the preferred technique, the following steps must be 
made in order to transmit securely money to each receiver for entry in the 
meter. The techniques described may also be applied when the system is 
used for tiering or a basic subscription. 
In FIG. 1, a television signal A is scrambled by an encryption key S prior 
to transmission in a scrambling circuit 10. For security reasons the key S 
hereinafter called the session key is itself encrypted in a second circuit 
11 by a further key P hereinafter termed the period key and the encrypted 
session key P(S) is also transmitted. The session key S and the period key 
P are generated by key generator circuits 12 and 14 respectively and both 
keys are changed periodically but with the session key S being changed 
more frequently than the period key P. 
Rather than directly transmitting the period key to a user so that he can 
use it to obtain the session key S and thus unscramble the television 
signal, it is proposed to generate in a circuit 16 an additional key 
called the distribution key D which will be made available to the user and 
to encrypt the period key P in a circuit 17 by the distribution key D 
prior to transmission. Thus far the arrangement is basically the same as 
that disclosed in our co-pending application U.S. Ser. No. 8317796. 
However, we propose to transmit information relating to the credit status 
of each user over air in addition to the scrambled signal and the various 
keys. To do this, a cost code generator circuit 20 generates a signal C 
indicative of the cost of each program and this signal is transmitted with 
the television signal. In order to prevent tampering with this signal at 
the receiving end, the signal C is encrypted prior to transmission and it 
is preferred to encrypt it with the period key P in an encryption circuit 
21. 
It is further proposed to transmit information M relating to the amount of 
credit held by each user and this is best achieved by generating the 
information M in a customer money circuit 22, adding it to the period key 
P in a manner to be described later and encrypting P+M with the 
distribution key D in the circuit 17. For reasons given later, a customer 
money label circuit 24 generates a money label ML which is also fed to the 
circuit 17 and is added to P+M to form P+M+ML and it is this block of 
information which is encrypted with the distribution key D and transmitted 
to the receiver. 
At the receiver, the received signal D (P+M+ML) is fed to a decryption 
circuit 30 where the distribution key D, supplied to the user either in 
the form of a SMART card or a chip built into the user's receiver or in 
some other way, is used to decrypt P+M+ML. The period key P is used to 
decrypt the session key S in a decryption circuit 31 but is also supplied 
to a further decryption circuit 32 in order to recover the cost code C 
which is used to decrement a counter 33 which is used as a meter. 
As will be explained in more detail later, the cost code C has added to it 
prior to transmission a further predetermined code which when received is 
checked in order to determine whether or not the transmission has been 
successful. It is preferred to use the period key P itself as the code and 
thus at the receiver, the circuit 33 recovers both the cost code C and the 
period key P which is checked in a comparison circuit 34 with the period 
key recovered in the circuit 30 from the received signal D(P+M+ML). 
It will be recalled that credit information is included in the signal 
D(P+M+ML) and the circuit 30 recovers the money information M as well as 
the money label M. The money label ML is stored in a circuit 35 while the 
money information M is used to increment the counter 33. Should the 
counter read zero, an inhibit signal is produced by the counter 33 which 
is fed to a gate circuit 36 to prevent the session key S from being 
applied to a descrambling circuit 37 which is used to decramble to 
scrambled television signal. 
OVER-AIR CREDIT INFORMATION 
Money which is sent over-air cannot simply be encrypted with a key K in the 
form K(MONEY). This is very insecure since the message MONEY is not 
unique. Let us assume that MONEY is a code which represents a 
monotonically increasing amount of transmitted money. Supposing the 
broadcaster sent the digital code all zeros, to represent a transmission 
of zero credit to a customer. Encrypting this information with the key K 
produces some bit pattern for K(MONEY). An unauthorised user (pirate) can 
simply add money to his receiver without knowledge of the key K by simply 
altering the bit pattern of K(MONEY). When the receiver decrypts the new 
message with the secret key K a new plain text message is produced which 
must be non-zero. This is because there only exists a one-to-one mapping 
of the cipher text into the plain text. Since the original cipher text 
message meant `zero money`, changing the cipher text message must produce 
a code which indicates that a non-zero amount of money has been 
transmitted. Hence a pirate has added money to his receiver, although he 
does not know the amount. 
The way to overcome this problem is to append a key to the money. The 
receiver will then only accept the money signal provided it has found the 
correct appended key. This is achieved by sending the signal D(M+P), where 
D is the distribution key, M the money and P the period key. Reference is 
directed to the aforementioned application U.S. Ser. No. 8317796 for more 
details of this. Clearly, if the receiver is to validate the money bits 
(M) with the period key (P) it must be sure that the period key has been 
received correctly. This can be achieved by the signal P(X+CODE), where x 
conveys some other information which is not unique, such as cost codes and 
date information. 
The signal CODE is a large number of bits and unique. The signal CODE is 
best made equal to the value of the period key. This gives greater 
security since the period key is a signal that changes with time and is 
kept secret. This idea uses the fact that there is an extremely good 
chance that the correct period key has been received if the signal P(X+P) 
can be decrypted with said received period key to yield the same 
decryption key--i.e. the period key P. 
Furthermore, in the same way that the period key P was used to check that 
the money bits M were correct in the signal PD(M+P), the period key P is 
also used to check that the message X is correct. Hence the value of X may 
be made equal to any plain text message. A typical signal that requires 
protection is the programme cost code (C). Hence the signal P(C+P) which 
is shown in FIG. 1 is used to check that the cost code (C), the period key 
(P) have all been received correctly. Since the period key (P) is known to 
have been received correctly the money bits (M) in the signal D(M+P) are 
also checked correctly. A further refinement is to combine the signals 
P(S) and P(C+P) to form the signal P(C+S+P), this then allows the period 
key to check that the session key (S) has been received correctly as well. 
PROGRAMME CHARGING METHODS 
There are two methods of decrementing the receiver's meter in order to pay 
for programmes. The first method causes small credits to be consumed 
during every 10 second period of the programme. The second method causes 
an amount equivalent to the total programme price to be consumed when the 
decision to receive that programme is made by the customer. In order to 
prevent multiple payment for the same programme a number is given to each 
programme and this programme number is stored in the receiver when the 
credit is consumed. Retransmissions of the same programme may be made with 
either the same or a different programme number depending upon whether an 
additional charge is to be made for further receptions of the same 
programme item. There are 256 programme numbers which repeat after one 
month; a date stamp keeps a record of the month and may also be used to 
record when payment was made for the programme. All of the above 
information which will be called x, and is sent encrypted with the period 
key P in the manner previously described as P(x+P). The period key 
performing the dual role of both encrypting the information and performing 
a check on the correct reception of the information. 
SECURITY 
It is assumed that the pirate cannot obtain his distribution key (D). He 
can only obtain the distribution key by breaking into his set, in which 
case he would be able to obtain free television anyway. Therefore, his 
only method of attack, assuming he cannot break the encryption algorithm, 
is to alter the cipher text D(M+P) in order to obtain a valid period key 
with a different code for the money (M). The statistical discussion below 
with reference to FIG. 2 shows that the probability of being able to 
change the money bits (M) but still retain the same period key (P) is 
given by: 
##EQU1## 
The same theory applies to other essential signals that are coded in this 
form. Furthermore, the same principles apply whether the cipher text is 
altered by a pirate or erroneously received from the satellite. 
Referring to FIG. 2, the encryption process provides a one-to-one mapping 
between n cipher text bits and n plain text bits. The customer bits are 
only valid provided that the correct period key (P) has been received. 
This protocol needs to be adopted since each combination of the customer 
bits contains a valid message. Since there are only m bits assigned to the 
period key, m&lt;n. There will be, in general, several mappings of the cipher 
text block into the same period key. This will result in a different, but 
valid, customer word having a valid period key. A pirate may try to alter 
his customer bits; in order to gain money for example. He does not know 
the key (K), but let us assume that he tries to alter the cipher text in 
order to `fool` the decoder into producing the same period key with a 
different customer word. In order to effect this process he tries many 
cipher text combinations. If the number of combinations that he has to try 
is made impossibly large, he will have negligible probability of producing 
his wanted result. 
There are a total of 2.sup.n combinations of n cipher text bits. One of 
these combinations, the one sent to the pirate, is of no interest. Hence 
there are a total of 2.sup.n -1 alternative combinations which might yield 
the desired result of leaving the m bit period key unaltered. 
Now assuming each mapping is equally likely, the probability of finding an 
alternative combination which leaves the period key unaltered is given by: 
##EQU2## 
wherein n.sub.1 =number of alternative mappings of cipher text into plain 
text leaving period key unaltered, and n.sub.2 =total number of 
alternative mappings of cipher text into plain text. 
There are a total of 2.sup.n mappings of the cipher text into the plain 
text. There are a total of 2.sup.n-m mappings that leave m bits unaltered, 
n&gt;m. Since one of these mappings is of no interest there are a total of 
2.sup.n-m -1 alternative mappings which produce an unchanged m bit period 
key. 
Therefore, 
##EQU3## 
now for m=0, p=1; as expected since the message is not protected with the 
period key in this case. 
for n=m, p=0; as expected since there exists only a one-to-one mapping of 
cipher text into plain text. 
for n-m&gt;1; n and m being positive integers, p=1/2.sup.m ; this is the usual 
case to consider. 
In this case, a period key of 56 bits yields 
p=1/2.sup.56 1.4.times.10.sup.-17 i.e. there is a negligible probability of 
the event happening. 
For the methods described herein, it is essential that the shared message 
block is adequately encrypted. A stream cipher cannot be used since both 
the magnitude and the position of the plain text information must be 
destroyed. A block or feedback cipher should be used and must have the 
following property. If one bit of the cipher text is altered, a number of 
bits of the plain text will be altered, under the same key, and these 
altered bits will be evenly distributed over the plain text message. FIG. 
3a shows schematically how long blocks may be ciphered using a number of 
64 bit sub-blocks. Each sub-block is a 64 bit block cipher. 
The essential feature is to overlap the sub-blocks and form an intermediate 
stage. The final cipher text block is guaranteed to have the properties 
described above by reversing the direction in which the sub-blocks are 
overlapped during the second stage. The same technique of forming an 
intermediate stage and reversing the direction in which the algorithm is 
performed for the second stage can be applied to cipher fed back in order 
to achieve the necessary cipher text properties. Cipher feedback is a well 
known technique and the technique of reciphering the cipher text in the 
reverse direction is shown in FIG. 3b. 
MONEY LABEL 
The transmission of the money must be accompanied by a date stamp or money 
label. A money label is just a date stamp of limited length. The money 
label (ML) is used to ensure that the money is only entered into the meter 
once during a payment period. This is required because the monetary 
information is repeated several times during the course of a payment 
interval. After the money has been entered along with the label further 
receptions of more money, having the same money label are inhibited; this 
is shown in FIG. 1. The money label (ML) takes the form of a two bit 
number which is appended to each individual customer's money bits (M). 
Hence the money labels appropriate to individual customers will change at 
different rates. 
In practice a date stamp also needs to be included in the plain text 
message to prevent fraudulent replays of old cipher text. However, for the 
sake of clarity this is not shown in any of the Figures. 
An alternative and possibly better method of preventing the receiver from 
continuously entering the same payment, which does not involve the use of 
money labels, is as follows. Instead of sending the new payment increment, 
the total sum of all payments ever sent to the broadcaster is transmitted 
over-air. The security device then merely subtracts the previously stored 
payment from the transmitted payment in order to find the actual payment. 
This method has the advantage that the rate of making payments to the 
broadcaster does not need to be kept in step with the rate of receiving 
over-air credit tokens. However, the method would normally require many 
bits to be used for the payment and this would dramatically increase the 
validation cycle time. A slight refinement to the principle overcomes the 
problem of the long cycle time and this is as follows. The total sum of 
all payments ever made is still sent--but in modulo 256 form; hence only 
eight bits are required. Since the total sum can only increase, and 
fraudulent replays of old payments are prevented by means of the date 
stamp, the following algorithm can be used. If the transmitted sum is 
greater than the stored sum the difference is taken as before. However, if 
the transmitted sum is less than the stored sum an overflow must have 
occurred and 256 is added to the difference calculations. The technique 
assumes that no more than one overflow will occur. This can be safely 
assumed if the monetary value of 256 tokens is extremely large. 
Furthermore, the stored total sum value represents a useful compact means 
of representing received over-air credit payments in the case of a 
dispute. Clearly the same principal applies to any modulus and 256 is only 
given by way of example. 
The above described embodiment discloses two major features in combination 
namely the use of the period key to encrypt a signal containing the period 
key in order to check correct transmission and reception and the use of a 
money label which is transmitted with the money signal in order to prevent 
multiple accumulations of the money signal. Although this latter feature 
is not claimed in independent form in the following claims, the applicants 
reserve the right to file at a later date such claims as they consider 
appropriate to this feature.