Abstract:
Frame-based information is transmitted through a transmission medium, whilst assigning payload information of a particular frame to one or more transmission packets and encrypting the payload information of such frame through a frame encryption key. Each transmission packet is provided with individual streamcipher-based synchronization information for in combination with the frame decryption key enabling decrypting of an associated encrypted transmission packet. In particular, the streamcipher-based synchronization information is transmitted as being redundantly included in a second transmission packet that is next to the first transmission packet that originates the individual streamcipher-based synchronization information in question. Thereby, the streamcipher-based synchronization information can operate as seed information for decrypting the second transmission packet.

Description:
BACKGROUND OF THE INVENTION  
         [0001]    The invention relates to a method as recited in the preamble of Claim  1 . Although the present invention would in principle be applicable to a variety of transmission media, a particular application that the inventors had in view is Internet. Now, the quality of the information content communicated on Internet is rapidly improving due to advances in bandwidth saving coding technology, and also due to the increasing of the bandwidth itself. Content providers intend to sell such high value content to users, and in consequence the need is arising to provide a scheme for so-called Conditional Access or Digital Rights Management. Any such system will encrypt a content item or part thereof and subsequently manage the decryption keys in such manner that only authorized end-users are able to decrypt.  
           [0002]    Now, such user information will generally be structured into frames. Especially in case of video content, such frames will in general be large, which necessitates to transmit the payload of such frame through a plurality of network packets in sequence. A particular manner of replaying the content is where the user will play as soon as it arrives, without providing for downloading the whole data file before playing. This approach will provide faster access at the receiver end, but will in general not allow for retransmission of a particular packet. If for some reason data is lost, the content player has to self-reliantly execute some repair operation. By itself, various such repair mechanisms have been known, but the approach remains sub-optimum.  
           [0003]    Now, the encrypting is best effected at the level of the frame. By itself, the assigning of user or payload information to a frame has been done according to a variety of standards, such as MPEG. Encryption at the frame level allows for persistent or end-to-end encryption that applies both to transmitted and to stored content. Now, the accepted best manner of encrypting multi-media information is by using a stream cipher, and especially, a self-synchronizing stream cipher. A stream cipher will then generate a cipher text through applying an EXOR operation to a combination of the plain text and the key stream. The ciphered stream is subsequently retrocoupled, cf. FIG. 2, and by itself represents an internal state of the encoder, and allows for synchronizing the decoder subsequently. Using such stream cipher, the sequence of transmission packets may be encrypted in a straightforward manner. In fact, self-synchronizing stream ciphering generates the key stream on the basis of the cipher text and a secret key. An initialization vector is required to start the generation process of the key stream.  
           [0004]    Now, although the stream-ciphering is in principle self-synchronizing, the loss of a single transmission packet may entail the loss of one or more following transmission packets as well, or even the remainder of the associated frame, or in certain standards, even the whole of the associated frame. In fact, at the receiver side, the loss of a single transmission packet could easily imply the loss of the next transmission packet as well, through loss of synchronization of the ciphering stream. This may cause a serious degradation of the content quality, because in many cases a content decoder should have been able to decode all or nearly all of the information outside the faulty transmission packet.  
         SUMMARY TO THE INVENTION  
         [0005]    In consequence, amongst other things, it is an object of the present invention to allow improved reception reliability of the sequence of individual decryption synchronizing informations, even under failure of certain particular transmission packets, through enabling resynchronization of the decoding procedure with respect to the synchronizing ciphering stream as quickly as possible. On another level, the invention provides some of the advantages of the encrypting on the level of a frame, such as an easier way to manage the storing of information at the receiving side.  
           [0006]    Now therefore, according to one of its aspects the invention is characterized according to the characterizing part of Claim  1 .  
           [0007]    The invention also relates to a method for decrypting such encrypted information, to a device for encrypting or for decrypting such information, to a system for encrypting and/or decrypting such information, to a tangible carrier for storing such encrypted information for use with such methods, and to a signal carrying encrypted payload information arranged for being used with such methods. Further advantageous aspects of the invention are recited in dependent Claims. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWING  
       [0008]    These and further aspects and advantages of the invention will be discussed more in detail hereinafter with reference to the disclosure of preferred embodiments, and in particular with reference to the appended Figures that show:  
         [0009]    [0009]FIG. 1, an encrypting format for use with the invention;  
         [0010]    [0010]FIG. 2, an encrypting device for use with such format;  
         [0011]    [0011]FIG. 3, a decrypting device for use with such format;  
         [0012]    [0012]FIG. 4, an overall encrypting/decrypting system for use with such format. 
     
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS  
       [0013]    [0013]FIG. 1 illustrates an encrypting format for use with the invention. The top row relates to the user information such as audio or video, and which consists of a single frame  20 , with frame header FH and frame payload FP. A sequence of such frames need not have uniform amounts of payload data, but the size thereof may depend on the applicable degree of information compaction. Further to the frame structure as shown, the format may have a sub-frame format associated to the application which has not been shown further, but which may constitute a further dividing of the frame over various subframes, without such division being noticeable in the further encryption/decryption procedure considered herinafter. These subframes may be related to a further information structure associated to the application to which the transmitted payload relates.  
         [0014]    On the second row, frame  20  is mapped on a sequence of three transmission packets  22 , which number is in principle arbitrary. The format of each packet is governed by an applicable transmission standard, and generally, all packets have a uniform size as indicated by arrow  24 . Within the packet indicated by arrow  24 , there is packet header PH and packet payload PP. Furthermore, synchronization information SCS 2  is governed by the streamciphering state of the actual packet at the end thereof for allowing the next successive packet to instantaneously synchronize to the stream ciphering procedure. In fact, SCS 2  forms part of the encrypted data. Finally, packet  24  contains synchronization information SCS 1  which is governed by the streamciphering state of the preceding packet at the end of the latter for allowing the next successive packet, i.c. packet  24  itself to instantaneously synchronize to the streamciphering procedure. For the packet that would start the synchronization, SCS 1  is either absent, or may represent an initialization vector of the frame encryption. For subsequent packets, SCS 2  is a repetition of the preceding SCS 2 . The packet formats of the other packets are corresponding. The synchronizing by the streamciphering synchronization informations may or may not cross the border between contiguous transmission frames. For brevity, further detailing of the various formats has been ignored.  
         [0015]    At the lower right-hand side of the Figure, the transmission packets of the frame in question have been drawn again. If all goes right, these will be exact copies of the transmission packets at left. Therefore, transmission packet  26  will be mapped by decryption on payload part  30  of received frame  28 , and correspondingly for payload parts  32  and  34 . The problems occurring when a transmission packet will partly or wholly go astray, will be discussed with reference to FIGS. 2, 3 hereinafter.  
         [0016]    Now, FIG. 2 illustrates an streamcipher-based encrypting device for use with the format according to the present invention. For brevity, only the processing of payload FP will be discussed. The payload information enters on input terminal  80 , for example bit-serially, but this is not an express limitation. Item  82  implements an EXCLUSIVE-OR operation for encryption. The encrypted information becomes available on output terminal  84 . For brevity, all special operations with respect to header PH of FIG. 1 have been ignored. Furthermore, the encrypted information is retrocoupled into local encrypting state information register  86  and subsequently encrypted with the encryption key K received on input terminal  90  from some provider mechanism that has been known in the art, and subsequently stored in register  92  for EXCLUSIVE-ORING with the input information received on input terminal  80 . At the beginning, register  86  is at zero or another feasible information, so the encrypting is with the frame encryption key K. The information from Register  92  has been termed the key stream.  
         [0017]    The EXCLUSIVE-ORING in element  82  may be executed bit-by-bit, or rather be bit-parallel such as for 128 bits or another appropriate number. The register width of register  92  would then be accordingly higher, and the clock frequency applied to the intermediate storage registers  86  and  92  would be accordingly lower. At the end of encrypting of a particular transmission packet, register  86  contains the internal state of the streamcipher-based encoding. For introducing a synchronization information into the encoding, this information is transmitted in a redundant manner in the next-following transmission packet. This means that at the receiving side this information will be available as a seed information for initializing the decrypting of the next transmission packet, even if the first transmission packet has not been received in a sufficiently correct manner.  
         [0018]    [0018]FIG. 3 illustrates a decrypting device being arranged for use with the above disclosed format, and in fact rather closely resembles FIG. 2. Herein, the encrypted payload is entered on input terminal  94 , which branches to register  98  for storing the streamcipher-based synchronization information SCS 1  provided at the beginning of the transmission packet in question. Furthermore, the information to be decrypted is forwarded to EXCLUSIVE-OR facility  96 . Facility D  102  receives the frame decoding key K′, that is the inverse of encrypting key K in FIG. 2. Furthermore, facility  102  receives the information from register  98 , that is a correctly received version of the streamcipher-based synchronization information for on the basis thereof executing the decryption. The combination of the latter two informations is forwarded to register  100 . Finally, through EXCLUSIVE-ORING of the output from register  100  and the input received from terminal  94  the correct data is reconstructed again.  
         [0019]    In this manner, there is no forced dependency between the decryption of two contiguous transmission packets, in that the information of the internal state on the encryption is always available at the receiving side, regardless of the reception quality of the preceding packet. There is no further necessity for bookkeeping of the encryption state at the receiver: it will always be available immediately at the beginning of a new transmission packet. Note furthermore, that generally, the streamcipher mechanism is self-synchronizing, which however will take a certain amount of time, and which in case of a lost transmission packet may lead to additionally lost information outside the lost packet.  
         [0020]    [0020]FIG. 4 illustrates an overall encrypting/decrypting system being arranged for use with the format according to the present invention. Block  40  represents a data generating facility, such as a memory, camera, or other. Block  42  represents the facility for generating or presenting one or more frame encryption keys. The encryption proper occurs in facility  44  along the lines presented hereabove with respect to FIG. 2. The encrypted data are transported over medium  46 , that may be CD-ROM, DVD, Internet, broadcast, or other. At the receiving side, the position of switch  48  controls either forwarding to decoder facility  50 , or to data storage facility  54 . The decoder facility  50  operates according to the lines discussed supra with respect to FIG. 3. After decrypting, through further providing with appropriate frame decoding key or keys from key presentation facility  52 , the decrypted payload is stored in data storage facility  54 . If decryption is effected only after a certain delay, the data storage facility will present its appropriate content or part thereof to decoding facility  50 . For brevity, communication with a further application or user facility has not been discussed further.