Patent Publication Number: US-2007106909-A1

Title: Process, device and computer program for data decryption by use of a host-processor and a co-processor

Description:
The present invention concerns the decryption of encrypted data using a host-processor and a co-processor.  
      As decryption operations are consuming computation resources, the host-processor generally transmits the entire sets of encrypted data to a dedicated processor, also called co-processor, to achieve the decryption operations. Usually the host-processor also transmits required decryption keys.  
      Such decryption is widely used for the reception of television programs in which the programs are encrypted and the user is provided with a key which permits their decryption.  
      Although the host-processor and co-processor are both designed to protect the key stored within them for any steal attempts, either physically by sealing the co-processor hardware in metal cases with breach or intrusion sensors for example, or logically by using specific software to communicate keys to the co-processor, the linked between the host-processor and the co-processor can be spied.  
      Eventually, both the entire set of encrypted data and the entire set of decrypted data are transferred on the link between the host-processor and the co-processor.  
      Thus, by spying this link it is possible to retrieve directly the entire set of decrypted data. Also by analyzing the encrypted and the decrypted data it is possible to retrieve the used keys.  
      Some known systems, such as those described in documents US 2004/186979 and EP 1 115 094, increase the security of the decryption by use of several redundant processors. However, this does not solve the problem addressed above.  
      Accordingly, there is a need for improving the security of the decryption achieved by using a host-processor and a co-processor.  
      To this effect, the invention relates to a method for decrypting data as recited in claim  1 , a corresponding device and program as recited in claims  10  and  11 .  
      Thanks to the segmentation of the set of encrypted data prior to its decryption and to the decryption of some segments by the host-processor, neither the entire set of encrypted data nor the entire set of decrypted data is transmitted on the link between the host-processor and the co-processor. This results in a higher security. 
    
    
      Other features and advantage of the invention will be apparent from the description, the claims and the drawings in which:  
       FIG. 1  is a block diagram of a decrypting unit achieving the method according to the invention;  
       FIG. 2A  is a diagram of the method according to the invention;  
       FIG. 2B  represents the data during the method of  FIG. 2A . 
    
    
      In the example represented on  FIG. 1 , a decrypting unit is part of a set up box adapted to receive signals of digital television, some of which are encrypted.  
      The decrypting unit  2  has a data input  4  through which sets of encrypted data are provided to a host-processor  6 . This host-processor  6  is connected through a bi-directional bus  8  to a co-processor  10  and, through another bidirectional bus  12 , to a memory  14  as for example a RAM memory. RAM stands for random access memory in English.  
      In the described example, the host-processor  6  is the central processor of the set up box and the co-processor  10  is a dedicated co-processor with fast computing features especially adapted for decryption.  
      The link  12  between the host-processor  6  and the RAM memory  14  is a protected link. For example, the RAM  14  is built on the same chip as the host-processor  6 .  
      The behaving of this unit will now be described with reference to  FIGS. 2A and 2B .  
      The method of decryption is initiated by the reception in a step  20  of a set of encrypted data by host-processor  6  through the input port  4 .  
      In the example, the set of encrypted data is a data packet designated by the reference D on  FIG. 2B .  
      A data packet is a coherent group of data with a determined pattern comprising several fields corresponding to several types of data. For example, the data packet comprises a field of raw data and also fields for service data such as header HD, footer FT, error correction code CRC or the like.  
      Step  20  is followed by a step  22  of transmission of a decryption key by the host-processor  6  to the co-processor  10 . This transmission is achieved in conventional way through secure links which are not represented.  
      The method then comprises a step  24  of segmenting the set of encrypted data D in segments by the host-processor  6 . These segments of encrypted data are represented on  FIG. 2A  under the references S* 1  to S* 5 .  
      Advantageously, step  24  comprises analyzing the pattern of the set of encrypted data to form the segments, without decrypting the data. For example, segments are determined in such a way that some fields of service data, such as the CRC field, are spread over several segments.  
      Advantageously, some segments, such as segments, S* 2  and S* 4 , are of smaller size than the others segments S* 1 , S* 3  and S* 5 .  
      At step  26 , a first part of the segments of the set is provided to the co-processor  10  by the host-processor  6  through the bi-directional bus  8 .  
      Advantageously, step  26  of providing the segments to the co-processor comprises selecting said segments to form the first part according to determined criterion.  
      For example, the segments transmitted to the co-processor  10  are selected as a function of their size, the bigger segments being selected, of their position, only no consecutive segments being selected or of their content, segments containing critical fields not being selected. Other criterion and combinations thereof can be used to select the segments that are included in the first part to be provided to the co-processor  10 .  
      In the described embodiment, the bigger and no-consecutive segments, such as segments S* 1 , S* 3  and S* 5 , are selected to form the first part.  
      The method then comprises a step  28  of decrypting said first part of the segments by the co-processor  10 , thus achieving hardware decryption of segments S* 1 , S* 3  and S* 5  to deliver segments S 1 , S 3  and S 5  of decrypted data.  
      Advantageously, more than 50% of the encrypted data are decrypted by the co-processor  10 .  
      The method then comprises a step  30  in which is achieved decryption of a second part of the segments from the set by the host-processor  6 . In the example, this second part comprises every segment that was not selected in the first part and the segments to be decrypted by the host-processor are the smallest ones in size so that decryption does not require too much computation time. More precisely, segments S* 2  and S* 4  are decrypted in step  30  by the host-processor by use of adapted software to deliver segments S 2  and S 4 . This decryption is called software decryption.  
      In the embodiment described, the method then comprises the transmission of the decrypted segments S 1 , S 3  and S 5  by the co-processor  10  to the host-processor  6  which then memorises them in the RAM  14  together with the decrypted segment S 2  and S 4 , in a step  32  of delivering the decrypted data comprising a combination of the decrypted first and second parts.  
      Thus, the method of the invention prevents the transfer between the host-processor  6  and the co-processor  10  of the entire set of encrypted data or of decrypted data. Accordingly, even by spying the bus  8  it would have been impossible to retrieve the entire set of data or to retrieve the used keys.  
      Of course, other embodiments of the invention are also possible.  
      For example, the segmentation of the sets of encrypted data and/or the selection of the segments to be decrypted by the host-processor or the co-processor, is achieved at random.  
      In another embodiment, the selection of the segments to be decrypted by the co-processor is achieved as a function of the availability of the host-processor and/or the co-processor.  
      In another embodiment, the memory is a direct random access memory, also called DRAM, into which both the co-processor and the host-processor can write directly the decrypted data in the delivering step.  
      The method and device of the invention can also be used with any type of data such as IP plackets and video or audio streams.  
      In one embodiment, only some of the data in a set of data are encrypted. In that case, the segmentation and selection is achieved only on the encrypted data, in order to achieve some decryption in the host-processor and some in the co-processor.  
      Yet in another embodiment, the host-processor in connected to several co-processors, each of them receiving some segments for decryption, and the host-processor achieving the decryption of some segments that are not transmitted to any co-processor.  
      The invention can be achieved by use of a decrypting device comprising a host-processor, such as programmable component or a dedicated chip. The host-processor comprises: 
          an interface with at least one co-processor     means for segmenting a set of encrypted data into segments;     means for providing a first part of the segments from said set to the co-processor;     means for controlling the co-processor to decrypt said first part of the segments; and     means for decrypting a second part of the segments from said set.        

      The method of the invention can also be achieved by a computer program for execution by a host processor of a decryption device, the computer program having instructions to perform the following processing when executed by said host-processor: 
          segmenting a set of encrypted data into segments;     providing a first part of the segments from said set to at least one co-processor;     controlling said co-processor to decrypt said first part of the segments; and     decrypt a second part of the segments from said set.        

      Such a device or host-processor program can be adapted to achieve any of the embodiments described above and can be adapted in any kind of electronic articles such as digital television receiver, computers, laptops, and any other device and the internal components thereof.