Simplified method for renewing symmetrical keys in a digital network

The invention concerns a method implemented in a communication network comprising a source device including: a first symmetrical key for encrypting data to be transmitted to a display device connected to the network; and the first symmetrical key encrypted with a second symmetrical network key known only to at least one display device connected to the network. When the source device needs to renew its first symmetrical key to encrypt new data, it generates a random number, then it calculates a new symmetrical key based on the first symmetrical key and on the random number. It then encrypts the data to be transmitted with the new symmetrical key and transmits to a display device, via the network: the data encrypted with the new symmetrical key, the random number, and the first encrypted symmetrical key with the second symmetrical network key.

This application claims the benefit, under 35 U.S.C. §365 of International Application PCT/FR03/03250, filed Oct. 30, 2003, which was published in accordance with PCT Article 21(2) on May 21, 2004 in French and which claims the benefit of French patent application No. 0213982, filed Oct. 30, 2002.

FIELD OF THE INVENTION

The present invention relates generally to the domain of managing cryptographic keys in local digital networks and more particularly in digital home networks.

BACKGROUND ART

Such a network is comprised of a set of devices interconnected by a digital bus, for example a bus according to the standard IEEE 1394. It particularly comprises two types of devices:Source devices capable of sending data over the network: These devices can recover the data through a “channel” external to the network.Presentation devices adapted to receive the data circulating on the network, to process it or present it to the user.

Hence, if the example of a digital home network designed to carry audio and/or video data to the various rooms of a house is used, the source devices are for example digital decoders receiving video programs from outside the network via a satellite antenna or via a cable connection, or even optical disc drives broadcasting data (audio and/or video) in digital form, on the network, read from a disc (in this case, the disc contains data coming from outside the network). The presentation devices are for example television receivers that can display video programs received from the network or, more generally, any type of device with the capability of decrypting encrypted data.

If one considers the viewpoint of the content providers that supply data coming from outside the local network, particularly from service providers broadcasting Pay TV programs or even optical disc editors for example, it is necessary to ensure that this transmitted data cannot be copied and can freely circulate (for example by being copied onto an optical disc or any other recording support) from one local network to another.

For this, it is known that data can be transmitted in secret form by encrypting it with cryptography algorithms using keys that are known beforehand by the devices authorised to receive this data or else that are exchanged according to specific secure protocols between the content provider and these devices.

The patent application PCT WO 00/62505 in the name of THOMSON multimedia, filed on Mar. 31, 2000 and claiming the priority of a French patent application in the name of the same applicant, filed on Apr. 13, 1999 and published under the reference FR 2792482, relates to a home network in which a public key specific to the network is used to encrypt the data circulating between the devices of the network, typically from the source devices mentioned above toward presentation devices. Only the presentation devices of this network have the private key corresponding to the public key. The pair (public key, private key) being specific to the network, data encrypted within the framework of this network cannot be decrypted by the devices of another network.

The use of a pair of asymmetric keys has some advantages, but also a few disadvantages. One of the main advantages is that no secret is memorized in the source devices: these devices know the public key but not the private key. However, the implementation of asymmetric keys is relatively slow with respect to that of symmetric keys. Moreover, the lifetime of asymmetric keys is short, demanding a regular revocation and the creation of new keys. In this case, data encrypted with a key, then recorded, can suddenly no longer be decrypted on the network. In addition, a large number of asymmetric keys are required.

The use of a symmetric key to encrypt the data would be considered as attractive. However, this would require the source devices to know this key, which would impose increased security constraints on them and consequently make them more expensive.

The present invention aims to solve the above-mentioned problems.

SUMMARY OF THE INVENTION

The subject of the invention is a method for renewing a symmetric key in a communication network comprising a device of a first type containing:a first symmetric key for encrypting the data to be transmitted to a device of a second type connected to the network; andsaid first symmetric key encrypted with a second symmetric network key known only by at least one device of a second type connected to said network.

According to the method, the device of a first type generates a random number, then computes a new symmetric key as a function of the first symmetric key and the random number. It then encrypts the data to transmit with the new symmetric key then it transmits to a device of a second type, via the network:the data encrypted with the new symmetric key;the random number; andthe first symmetric key encrypted with the second symmetric network key.

The method can additionally comprise the steps that consist, for the device of a second type that receives the data transmitted by the device of a first type, of decrypting, with the second symmetric network key, the encryption of the first symmetric key; then to determine, according to the first symmetric key obtained in this manner and the random number received, the new symmetric key; and to decrypt the data received with the new symmetric key thus obtained.

DETAILED DESCRIPTION OF THE EMBODIMENT OF THE INVENTION

An example of a communication network will be described initially to illustrate the manner in which the data and the different keys are exchanged. Subsequently, a more detailed description will be given of the specific management of the keys and their use for a secure transmission of data between a source device and a presentation device.

I] Description of the Network

FIG. 1shows a digital home network comprising a source device1, a presentation device2and a recording device3interconnected by a digital bus4, which is for example a bus according to the standard IEEE 1394.

The source device1comprises a digital decoder10featuring a smart card reader fitted with a smart card11. This decoder receives digital data, particularly audio/video programs broadcast by a service provider.

The presentation device2comprises a digital television receiver (DTV)20featuring a smart card reader fitted with a smart card21and the recording device3is particularly a digital video recorder (DVCR).

The digital data that enters the network via the source device1is generally data scrambled by a content provider, for example according to the principle of paying television. In this case, the data is scrambled using control words CW that are themselves transmitted in the data flow in encrypted form using an encryption key KFby being contained in ECM (Entitlement Control Message) control messages. The encryption key KFis made available to users that have paid to receive the data, particularly by being stored in a smart card. In the example ofFIG. 1, the smart card11contains such a key KFtogether with a conditional access module CA14capable of decrypting the control words CW.

However, it should be noted that frequently, the authorization to receive the data is only temporary, as long as the user pays a subscription to the content provider. The key KFis therefore modified regularly by the content provider. Thanks to the method that will be described hereafter, the user will nevertheless be able to record the programs broadcast while he is a subscriber and can replay them as many times as he wishes on his own network, even when the key KFhas been changed. However, as the data is recorded in scrambled form in the manner described, it can only be read on the network of the user that recorded them.

The source device1that receives this scrambled digital data formats it so that it can be broadcast on the digital network in a protection format specific to the domestic network. The decoder10comprises an “ECM unit” module13that extracts, from the flow of data received, the ECM messages containing the control words encrypted using the key KFto send them to the CA module14. This module decrypts the control words CW and transmits them to a converter module12also contained in the smart card11.

The converter module12contains a symmetric key KC, for which the generation and transmission between the devices of the network will be described hereafter.

It should be noted that onFIG. 1, the network is shown in the state in which it is found when all the devices have been connected and have exchanged cryptographic keys according to the methods described hereafter.FIG. 1particularly illustrates, for the source device1and presentation device2, all the keys contained in each device. The keys shown are not necessarily present at every moment in the devices.

In particular, the presentation device2comprises in a memory a symmetric network key KN. This key is distributed to every new presentation device recently connected to the network according to a secure protocol that is not the subject of the present invention and will not be described in further detail. Moreover, each presentation device has a pair of asymmetric keys (KPUBT, KPRIT), the first key being public and the second private. These keys are used within the framework of the authentication of network devices, as well as for the initial exchange of the symmetric keys as we will show subsequently.

The converter module12uses the symmetric key KCto encrypt the control words CW and it inserts these encrypted control words into messages called LECM (Local Entitlement Control Message). These LECM messages have the same function as the ECM messages included in the data flows received initially, namely transmit the control words in a protected form, but in the LECM messages, the control words CW are encrypted using the symmetric key KCinstead of being encrypted using the key KFof the content provider.

Preferably, the key KCis frequently renewed, for example during the initiation of each transmission of data, with the purpose of preventing the source device from containing a long term secret, which would require increased protection.

Moreover, the converter module12inserts the symmetric key KCitself into the LECM messages, but encrypted using another symmetric key KNby an algorithm E2, that is E2{KN}(KC).

In the rest of the description, the notation “E{K}(M)” will be used to mean the encryption of data M by an algorithm E with a key K.

The key KN, which will be called network key hereafter, is not located in the source device1, but in the presentation device2. Following the creation of the key KC, this latter is transmitted in a secure manner to the presentation device2, which encrypts it using KNand retransmits the result to the source device that memorizes it in the converter module12of its card, for subsequent use.

The LECM messages thus constructed are then sent to the ECM unit13, which inserts them into the flow of data instead of the ECM messages. It should be noted that when the content received is not already in scrambled form as described above and does not contain any ECM message, the converter module12is responsible in this case for putting the data in this form so that the data flow broadcast on the bus4is always in the form of data packets such as the packet40shown inFIG. 1containing an LECM message and scrambled data.

The content of this packet can be summarized as follows:

where “|” represents the concatenation operator.

The data therefore always circulates in scrambled form in the bus4, and only the devices with access to the symmetric key KCcan decrypt the control words CW and therefore decrypt the data. These devices are those having the network key KN. This therefore prevents any copy made in the domestic network ofFIG. 1from being broadcast on other local networks.

When the digital television receiver20receives the data packets40, they are transmitted to the “LECM unit” module23, which extracts the LECM messages from them to be sent to a terminal module22contained in the smart card21. This card first decrypts E2{KN}(KC) using the key KNthat it contains to obtain the key KC. Next, using the key KC, it decrypts E3{KC}(CW) to obtain the control word CW that it transmits to the “LECM unit” module23. It can then unscramble the data E4{CW}(<data>) using the control word. The unscrambled data is then presented to the user. For video data, this data can be viewed on the television receiver20.

Thanks to the local digital network described above, the flow of data received from a content provider is converted by the source device which receives it in a data flow in which the data (or more specifically the control words CW) is encrypted with a symmetric key KC. The key KCis transmitted with the data encrypted with its help, being itself encrypted using another symmetrical key, the network key KN. The flow of data circulating in the local network thus contains data having a format specific to this local network that can only be decrypted by the presentation devices of the local network which all contain the network key KN.

In addition, as the key KCis broadcast with the data (in encrypted form), it can be recorded, for example by the digital video recorder (DVCR)4, at the same time as the data, which will provide subsequent access to the encrypted data.

Moreover, as the network key KNis not stored in the source devices, they do not contain any “long term” secret requiring increased security precautions.

However, the key KCmust be renewed frequently and a more detailed description will now be given of how this key KCis generated and how its encryption using the network key KNis obtained according to different variants.

II] Generation and Management of the Symmetric Key KCDuring a First Connection to the Network of a Source Device

Suppose that the source device1has just been connected to the domestic network illustrated inFIG. 1. Initially, it has no key in its converter module12.

FIG. 2shows the stages of an initial protocol enabling the source device to obtain a symmetric key KCencrypted using the network key KNheld by a presentation device of the network.

When a first stage101, the source device1launches a request on the network, requesting any presentation device to send its public key to it. InFIG. 1, a single presentation device is shown but naturally the digital home network can comprise several different presentation devices connected to the bus4. All the presentation devices present and in the “activated” status on the network (namely, those whose power supply is not off or which are not in a standby mode with greatly reduced power supplied to the circuits of the device) are supposed to respond to the request of the source device by sending their public key.

Hereafter, it is assumed that the first key received by the source device1is the public key KPUBTsent during step102by the presentation device2. The source device1acknowledges the first message received and will then exchange messages with the relevant presentation device.

The source device1, and more precisely the converter module12, then randomly generates a “short term” symmetric key KCand it memorises this key KC(step103). For example, it uses a pseudo-random number generator for the generation of KC.

The key KCis then encrypted at step104with the public key KPUBTby the intermediary of an asymmetric encryption algorithm E1, for example the algorithm “RSA OAEP” (“Rivest, Shamir, Adleman Optimal Asymmetric Encryption Padding”—described in “PKCS#1:RSA Cryptography Specifications, version2.0 (October 1998)”), then transmitted in encrypted form E1{KPUBT}(KC) to the presentation device2(step105). This presentation device decrypts the key KCusing its private key KPRITthen encrypts it again according to a symmetric encryption algorithm E2using the symmetric network key KN(step106) and sends back KCthus encrypted (i.e. E2{KN}(KC)) to the source device (step107), which memorizes this information (step108), preferably in its converter module12.

At the end of this first series of steps101to108, the source device1thus possesses a symmetric key KCin its converter module12that will be able to be used to encrypt data, typically the control words CW, and the encryption of this key KCusing the network key KN. It is then ready to broadcast data over the network. It should be noted that the source device does not know the secret network key KN.

The subsequent steps109to113shown inFIG. 2relate to the transmission of “useful” data, i.e. typically scrambled audio video data.

The data received by the source device1comprises ECM messages. The source device decrypts these messages to extract the control words CW from them then it encrypts the control words CW using the symmetric key KCby the intermediary of a symmetric encryption algorithm E3(step109). The source device1then reinserts these encrypted control words (i.e. E3{KC}(CW)) into the data flow and transmits all the data over the bus4to the presentation device(s) on the network (step110). During step110, the source device also sends the key KCencrypted using KNthat it previously memorized at step108. In practice, the data E2{KN}(KC) and E3{KC}(CW) are inserted into the LECM message that is sent with the scrambled “useful” data E4{CW}(<Data>).

It should also be noted that the useful data transmitted at step110are encrypted according to a symmetric encryption algorithm E4using control words CW.

The presentation device2that receives the data sent at step110first decrypts E2{KN}(KC) using KNto obtain the key KCwhich is memorized (step111) and, using KC, it can decrypt E3{KC}(CW) to access the control words CW (step112) and thus descramble the useful data (step113).

The symmetric encryption algorithms E2, E3and E4can be identical or different. For example, it is possible to use the “AES” algorithm (Advanced Encryption Standard—also called “Rijndael”—and described by J. Daemen and V. Rijmen in “Proceedings from the First Advanced Encryption Standard Candidate Conference, National Institute of Standards and Technology(NIST), August 1998”), or else the “TwoFish” algorithm (described in the article “TwoFish—a Block Encryption Algorithm” by B. Schneier, J. Kelsey, D. Whiting, D. Wagner, N. Ferguson and published in the same NIST conference report).

III] Renewal of the Symmetric Key KC

When it is necessary to renew the key KC, particularly before broadcasting new content on the network, one can consider using the same protocol as described inFIG. 2(steps101to108). Nevertheless, this protocol involves encryption computations using asymmetric algorithms that require a fairly large computing power and which are relatively long to implement in smart card processors. This is why a second protocol is used for the renewal of the “short term” symmetric KC.

This second protocol enabling the renewal of the symmetric key K.sub.C is shown inFIG. 3.

According to this protocol, during a first step400, the source device1(or more specifically its converter module12) generates a random number D and memorizes it. It then computes (step401) the new symmetric key K′Cby applying a function f to the key KCmemorized during the first protocol (at step103) and to the number D. The function f is particularly a classic derivation function such as a hash function (for example, the function SHA-1 described in the document “Secure Hash Standard, FIPS PUB180-1,National Institute of Standard Technology,1995” can be used) or even an encryption function such as the function XOR. It is a “one way” function”, namely, knowing the result f(KC, D) and the number D, it is impossible to find the key KC.

Step402corresponds to step109of the protocol ofFIG. 2and consists of extracting ECM messages included in the data received by the source device to decrypt them in the module CA14and extract the control words CW from them in the converter module by using the new symmetric key K′C. However, the broadcasting of “useful” data over the network by the source device is slightly different from the broadcasting carried out in step110.

Indeed, in step403, the source device inserts the data D generated in step400into the LECM message. It also inserts the following into this LECM message:the initial symmetric key KCencrypted with the network key KN(E2{KN}(KC)) andone or more control words CW encrypted with the new symmetric key K′C(E3{K′C}(CW)).

When the presentation2receives the data broadcast in step403, it first decrypts E2{KN}(KC) with the network key KN(step404), then it computes the new symmetric key K′Cfrom KCand from D by applying the function f (step405). Having obtained K′C, it can then decrypt E3{K′C}(CW) to obtain the control word CW (step406) and unscramble the “useful” data using this control word (step407).

Thanks to this protocol, it is unnecessary to exchange data between a source device and a receiver device to obtain the renewal of a symmetric key K′C. This is particularly advantageous for example when no presentation device is in an “activated” status on the network and when a user wants to record a program (digital content) received by the source device. The source device can thus renew its symmetric encryption key KCwithout requiring any presentation device and can thus broadcast useful data accompanied by LECM messages protected by this key renewed so that the data is recorded in a digital storage device such as the video recorder3ofFIG. 1.