Patent Publication Number: US-2004049681-A1

Title: Time stamping and time stamp validity verification system, method and device in a digital broadcasting environment

Description:
FIELD OF THE INVENTION  
       [0001] The present invention relates to the field of timestamping in a digital television environment, the timestamping of data being the action of marking these data with the aid of an information item taking account of a precise time and/or date, called a timestamp.  
       [0002] More precisely, the invention pertains to the timestamping of data requiring high security against fraud, on the basis of data broadcast especially in digital television services.  
       [0003] In a general manner, in what follows the term “service” will designate a stream of digital data such as for example a digital television service or a physical or logical channel for transmitting digital data.  
       BACKGROUND ART  
       [0004] Various timestamping techniques are known in the state of the art. In particular, a timestamping system used in a digital television environment is known. This system is described in patent application WO 95/15653 by the inventors Lappington, Marshall, Yamamoto, Wilson, Berkobin and Simons, the applicant being the company Zing Systems and which was published in June 1995. This document describes a system where two sets of data with a timestamp are dispatched separately to distant units comprising a data decoder, a remote control and an operations center. Within each distant unit, the timestamps are compared with a distant clock and a timestamp difference is noted for each of the two data sets. The two differences are compared so as to determine whether one of the sets has been delayed with respect to the other. Only the undelayed sets can be validated.  
       [0005] A drawback of this system of the prior art is the lack of security which it affords. Specifically, several flaws related to a lack of resistance to certain attacks may be discerned, in particular: the playing of a prerecorded video stream, the theft of a data set belonging to another person, the use of one and the same timestamp applied to different data.  
       [0006] The invention according to its various aspects has in particular the objective of alleviating these drawbacks of the prior art.  
       [0007] More precisely, an objective of the invention is to provide a system, a process and a device for timestamping and/or for verifying timestamp validity which affords high reliability and security in the timestamping of digital data on the basis of data broadcast by services in particular digital television and/or radio services.  
       [0008] Security comprises two essential aspects: integrity and nonrevocation. Integrity signifies that it is not possible to modify the timestamp. Nonrevocation implies that the transmitter of timestamped data cannot allege that the data were timestamped at a different moment from the timestamp. For example, in respect of a bet on a race, it is important to be certain that the bet took place before the start of the race.  
       [0009] Timestamping is easy when the event to be timestamped takes place in close conjunction with a trusted authority. It is much more complex if it takes place in a remote manner; if it is necessary to use for example a telephone call center to make a bet, the moment of receipt of a call is not desirable for timestamping an event since there may be if necessary a waiting time in a queue; this moment of receipt may be different from the actual instant of the bet. An objective of the invention is to allow precise timestamping (for example to within a second). Another objective of the invention is to allow a trusted authority to authenticate and to validate this timestamping so as, for example, to allow the user to obtain winnings from a bet or to allow the trusted authority to determine the actual order of the answers to a question.  
       DESCRIPTION OF THE INVENTION  
       [0010] With this aim, the invention proposes a process for timestamping digital data, noteworthy in that it comprises:  
       [0011] an operation of defining a sequence of services comprising at least one service, each service being chosen within a list of services according to a method of choice giving a variable result for each occurrence of defining a sequence of services; and  
       [0012] an operation of collecting a sequence of timestamp information elements, according to which at least one information element is extracted from each service of the sequence of services to form the elements of the sequence of information elements, each information element comprising an information item representative of a current timestamp.  
       [0013] Thus, the invention makes it possible to define a sequence of services which is not known in advance to a possible fraudster, which sequence contains information representative of a timestamp which could subsequently be used for a timestamping of data, this sequence being difficult to reproduce, to predict or to falsify. If a fraudster wishes to foil the system, he must record several streams and have the possibility of playing them back in a perfectly synchronized manner. If the number of streams is sufficiently large, the cost of such a fraud becomes prohibitive.  
       [0014] It will be noted that the list of services may have any size including the size equal to one. In the latter case, the implementation of the invention is simplified (the choice being a trivial operation). However, to optimize the efficiency of the invention, it is desirable to have at least two services. The number of services may be variable as a function of requirements (desired level of security).  
       [0015] According to a particular characteristic, the timestamping process is noteworthy in that the method of choice giving a variable result is a method of random or pseudo-random drawing. The same approach can be applied in respect of the number of services taken into account.  
       [0016] Thus, in this very advantageous mode of the invention, a possible fraudster has no means of predicting the defined sequence of services.  
       [0017] According to a particular characteristic, the timestamping process is noteworthy in that it comprises a step of transmission and/or of reception of a message comprising the number of services of the sequence of services and the list of services.  
       [0018] In this way, the invention advantageously allows a service broadcaster or an application server to determine a degree of implicit safety by tweaking the number of services of the list of services and the number of services of the sequence of services.  
       [0019] According to a particular characteristic, the timestamping process is noteworthy in that it comprises an operation of constructing a timestamped group of data comprising:  
       [0020] a group of information items comprising:  
       [0021] the digital data;  
       [0022] an identifier of each of the services of the sequence of services;  
       [0023] the sequence of timestamp information;  
       [0024] and a signature of at least one element of the group of information items.  
       [0025] According to a particular characteristic, the timestamping process is noteworthy in that it furthermore comprises an operation of collecting a sequence of information signatures, each of the signatures being associated in a one-to-one manner with each of the timestamp information items and signing an information item comprising the timestamp information item and an identifier of the service from which it arises, and the timestamping process also being noteworthy in that the timestamped group of data furthermore comprises the sequence of information signatures.  
       [0026] Thus, the invention advantageously offers a degree of extra safety by virtue of the signatures which prevent any alteration of the signed elements.  
       [0027] According to a particular characteristic, the timestamping process is noteworthy in that:  
       [0028] each timestamp information item furthermore comprises the definition of a retrieval challenge to be extracted from the list of services; and  
       [0029] in that the timestamping process furthermore comprises an operation of extracting an answer corresponding to the definition of each retrieval challenge.  
       [0030] Thus, in this advantageous mode of the invention, the degree of safety of the timestamping process is further increased, the means required to commit fraud being very unwieldy and prohibitively expensive whereas the timestamping process itself remains relatively simple to implement.  
       [0031] According to a particular characteristic, the timestamping process is noteworthy in that the timestamped group of data furthermore comprises the answer corresponding to the definition of each retrieval challenge.  
       [0032] According to a particular characteristic, the timestamping process is noteworthy in that each timestamp information item furthermore comprises an imprint of the answer.  
       [0033] An information imprint is an extract or a digest of information which is obtained by a hash technique.  
       [0034] Thus, the invention advantageously lends itself to verification of the timestamp not requiring a priori knowledge of the answer to the retrieval challenge, but necessitating only the taking into account of one or more public keys which preferably will serve to verify the signature of the timestamp information item and/or of the answer imprint. The timestamping process enables in particular a digest of the expected answers to the retrieval challenge to be passed from a broadcaster to a collection center. This digest travels via a terminal of the user but the expected answers are not accessible to the user. Additionally, the timestamping process remains simple to implement by virtue in particular of the presence of the imprints which make it possible to limit the size of memory or the bandwidth required for the transmission of the expected answers.  
       [0035] According to a particular characteristic, the timestamping process is noteworthy in that it comprises an operation of transmitting the timestamped group of data.  
       [0036] Thus, the invention advantageously allows verification of the data timestamp or remote utilization.  
       [0037] With the aforesaid aims, the invention also proposes a process for verifying the timestamp validity of digital data, which is obtained according to a timestamping process as described above. According to a particular characteristic, this process is noteworthy in that it performs a verification of at least one group of data which may be timestamped by a timestamping process as described above.  
       [0038] Thus, the timestamp associated with data and which was produced in accordance with a reliable process combating any fraud is advantageously utilized.  
       [0039] According to a particular characteristic, the process for verifying timestamp validity is noteworthy in that it comprises at least one operation of verification forming part of the group comprising:  
       [0040] an operation of verifying signature of a group of data;  
       [0041] an operation of verifying a number of services requested;  
       [0042] a verification operation attesting that each timestamp information item indeed corresponds to a requested service;  
       [0043] an operation of verifying the validity of an answer to a possible requested retrieval challenge for each timestamp information item; and  
       [0044] an operation of verifying the consistency of timestamping extracted from a group of timestamped data.  
       [0045] According to a particular characteristic, the process for verifying timestamp validity is noteworthy in that it comprises an operation of sending said validated digital data.  
       [0046] Thus, the verification process advantageously makes it possible to verify each of the points which guarantee the authenticity of a timestamp in a manner which may possibly be adapted to a sought-after degree of safety. The verification process takes account in particular of a digest of the expected answers to the retrieval challenge which remains inaccessible to the user of the timestamping process. Additionally, the verification process remains simple to implement by virtue in particular of the presence of the imprints which make it possible to limit the size of memory required (a trace of the information to be verified not being kept in memory).  
       [0047] The invention also relates to a system comprising means for implementing:  
       [0048] a process for broadcasting services, each of services containing information elements representative of a timestamp;  
       [0049] a timestamping process and a process for verifying timestamp validity such as described above.  
       [0050] The invention also proposes with the same aims as previously a device for timestamping digital data noteworthy in that it comprises means suitable for implementing a timestamping process and/or a process for verifying timestamp validity according to one of the abovementioned processes.  
       [0051] Likewise, the invention proposes a device for timestamping digital data noteworthy in that it comprises:  
       [0052] a means of defining a sequence of services comprising at least one service, each of the services being chosen within a list of services according to a method of choice giving a variable draw for two uses of the means of defining a sequence of services; and  
       [0053] a means of collecting a sequence of timestamp information elements, extracting at least one information element from each service of the sequence of services to form the elements of the sequence of information elements, each information element comprising an information item representative of a current timestamp.  
       [0054] Likewise, the invention proposes a device for verifying the timestamp validity of digital data, noteworthy in that it comprises at least one means of verification forming part of the group comprising:  
       [0055] a means of verifying signature of a group of data;  
       [0056] a means of verifying a number of services requested;  
       [0057] a verification means attesting that each timestamp information item indeed corresponds to a requested service;  
       [0058] a means of verifying the validity of an answer to a possible requested retrieval challenge for each timestamp information item; and  
       [0059] a means of verifying the consistency of timestamping extracted from a group of timestamped data.  
       [0060] The particular characteristics and the advantages of the devices and of the system for timestamping and for verifying timestamp validity being the same as those of the processes for timestamping and for verifying timestamp validity, they will not be recalled here. 
     
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
     [0061] Other characteristics and advantages of the invention will become more clearly apparent on reading the following description of preferred embodiments, given by way of simple nonlimiting illustrative examples, and of the appended drawings, among which:  
     [0062]FIG. 1 depicts a multimedia digital data broadcasting infrastructure with use of timestamping in accordance with the invention according to a particular embodiment;  
     [0063]FIG. 2 illustrates a multimedia digital decoder present in the infrastructure of FIG. 1 in accordance with the invention according to a particular embodiment;  
     [0064]FIG. 3 describes a secure processor allowing timestamping in accordance with the invention according to a particular embodiment;  
     [0065]FIG. 4 describes a device for collecting answers and for verifying a timestamp possessing a modem for recovering the answers in accordance with the invention according to a particular embodiment;  
     [0066]FIG. 5 describes a device for collecting answers and for verifying a timestamp which according to another preferred embodiment, possesses a secure processor reader, in accordance with the invention according to a particular embodiment;  
     [0067]FIG. 6 describes a protocol for exchange between a broadcaster, a central processor, a secure processor and a device for collecting answers such as described in conjunction with FIG. 4 in accordance with the invention according to a particular embodiment;  
     [0068]FIG. 7 describes a protocol for exchange between a broadcaster, a central processor, a secure processor and a device for collecting answers as described in conjunction with FIG. 5 in accordance with the invention according to a particular embodiment;  
     [0069]FIG. 8 describes a flowchart of the operation of a central processor with timestamping process in accordance with the invention according to a particular embodiment;  
     [0070]FIG. 9 describes a flowchart of the operation of a secure processor with timestamping process in accordance with the invention according to a particular embodiment; and  
     [0071]FIG. 10 describes a flowchart of the operation of a device for collecting answers with process for verifying timestamp validity in accordance with the invention according to a particular embodiment. 
    
    
     DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION  
     [0072] The general principle of the invention is based principally on the use of a number N of digital streams to define a timestamp required by an application. In the case for example of a digital television and/or radio broadcasting system, N is typically of the order of one hundred and these streams are specific digital television and/or radio services (S 1 , S 2 , . . . SN) transmitted by a broadcaster. Each of these services is called a “timestamping service” or TSS.  
     [0073] The application defined by an interactive service provider may itself be transmitted from an application server to a broadcaster and then broadcast when it is used by an interactive television and received by a multimedia digital decoder (or set top box) at a user&#39;s premises.  
     [0074] The regular TSS services transport additional data, called “time stamping information” or TSI.  
     [0075] Each such TSI information item comprises the following information:  
     [0076] the current timestamp t;  
     [0077] an identifier of the TSS service;  
     [0078] a definition of a retrieval challenge;  
     [0079] an imprint of the answer to the aforesaid retrieval challenge, this imprint being produced on the basis of a private key individual to the broadcaster;  
     [0080] a means of preventing alteration of the TSI information, for example a TSI signature based on a private key individual to the TSS service.  
     [0081] In addition to the information traditionally delivered by the service to which the timestamping applies, the broadcaster provides a timestamping challenge or TSC originating preferably from the application server which comprises:  
     [0082] the size of a challenge called SCH lying between 1 and N;  
     [0083] the number N of services TSS;  
     [0084] the list of all the TSS services, that is to say an ordered list of N services which provide time information.  
     [0085] The timestamping challenge TSC and the TSI information are received by a digital terminal which can be a multimedia digital decoder and which comprises:  
     [0086] a means of extracting the information given by a TSC;  
     [0087] a means of extracting a timestamp from each of the TSS services; and  
     [0088] a secure processor, removable or otherwise, possessing its own individual private encryption key.  
     [0089] To construct a timestamp, the terminal uses a secure processor which randomly (or pseudo-randomly) defines a sequence (that is to say an ordered series) of identifiers of the services comprising SCH services taken from among the N services of the list mentioned in the TSC challenge.  
     [0090] The secure processor must then collect the successive timestamps present in the TSI information of each of the SCH services defined by the ordered sequence. The set of services to be polled being defined randomly by the secure processor, a fraudster who wanted to reconstruct the timestamp would have to record all the TSS services and play back at some later time all the broadcast TSS services, this being extremely unwieldy to implement and prohibitively expensive. Specifically, SCH preferably being equal to a value lying between 1 and 10, the probability of a fraudster choosing the correct service values is small and is all the smaller the bigger SCH. If the security requirement must be increased, it will be possible to take a value of SCH greater than 10 or even than N. The value of SCH is preferably defined by the application server requiring a timestamping as a function of the desired degree of security. The application server can change the value of SCH often so as to increase security.  
     [0091] Furthermore, to increase the fraudster&#39;s difficulty, a further level of challenge called a retrieval challenge has been defined: this is a challenge demanding the extraction, according to a preferred embodiment, of a variable number of bytes from one or more of the components of at least one relevant service and, according to another embodiment, from the entire set of services. Typical challenges consist for example in recovering the bytes numbered 12 to 35 in a video stream at the precise instant at which the title of the event is broadcast. Thus, the secure processor must also collect the answer corresponding to the definition of successive retrieval challenges present in the TSI information of each of the SCH services defined by the ordered sequence.  
     [0092] After collecting the necessary information, the secure processor groups together in a TSM timestamp message:  
     [0093] the SCH timestamps;  
     [0094] the SCH answers to the retrieval challenges;  
     [0095] an imprint of each of the expected answers to the retrieval challenges, this imprint being provided by the broadcaster in the TSI information;  
     [0096] the SCH signatures of TSI (refer to the work “Applied Cryptography” written by B. Schneier and published by Wesley&amp;Sons in 1996 for the implementation of the signature methods).  
     [0097] Next, the secure processor signs the entire set consisting of the datum or data to be timestamped and of the TSM message together with its private key. The whole is transmitted to an Answer Collecting Center or ACC (or more generally a center for collecting digital data) via, for example, a telephone line coupled to a modem or a removable secure processor reader (a smart card for example).  
     [0098] The center for collecting answers is itself linked to an application server requiring timestamping via for example a telephone line.  
     [0099] The ACC center having in its possession the value or values of SCH, the list of the public keys serving for the verification of the signatures and of the imprints used during a period of validity of the timestamped data, performs a verification of the TSM message at several levels comprising:  
     [0100] a verification that the number of polled services is indeed equal to the value of SCH valid at the moment of the timestamping;  
     [0101] a verification of the signature of the entire set of the timestamped data and of the TSM message;  
     [0102] a verification that the imprint of the answer to each retrieval challenge does indeed correspond to the imprint of each expected answer provided by the broadcaster in the TSI information;  
     [0103] a verification of each TSI signature corresponding to a service of the ordered sequence;  
     [0104] a verification of the validity of the timestamps provided.  
     [0105] It is noted that the ACC center does not need to know the correct answers to the challenges outside of the data provided by the TSM message.  
     [0106] After verification of the timestamped data, the ACC center can transmit the validated data and the corresponding timestamp to the application server.  
     [0107] A multimedia digital data broadcasting infrastructure with use of timestamping is depicted in conjunction with FIG. 1.  
     [0108] This infrastructure comprises in particular:  
     [0109] an application server  109 ;  
     [0110] a digital television or radio broadcaster  100 ;  
     [0111] a center for collecting answers or ACC  108 ;  
     [0112] a set of S multimedia digital decoders  102 ,  103 ,  104 ;  
     [0113] a set of S users  112 ,  113 ,  114 .  
     [0114] The application server  109  transmits requests  110  for services requiring an answer (or digital data) with timestamp to a broadcaster  100  and receives answers  111  with validated timestamp originating from the ACC center  108 . The requests  110  for services also comprise timestamping challenges or TSCs containing a value of SCH which depends on the degree of security desired as well as a list of N services which can be used for timestampings.  
     [0115] The application server  109  is for example a game server or betting server.  
     [0116] The broadcaster  100  is for example a broadcaster of digital television and/or radio services through a medium such as a cable or a satellite.  
     [0117] In addition to the traditional television and/or radio services, it broadcasts timestamping challenges or TSCs  101 , which are preferably communicated thereto by the application server  109 , to the multimedia digital decoders  102 ,  103  and  104  after receipt of a request  110  for services requiring an answer with timestamp originating from the application server  109 .  
     [0118] According to a variant which is not represented, the challenges TSCs are produced by the broadcaster  100 .  
     [0119] The user  112  (respectively  113  and  114 ) can transmit an answer A  115  to his own multimedia digital decoder  102  (respectively  103 ,  104 ) (via for example a keypad, a remote control, a voice recognition or recording box or a touch screen) to a question from the application which he views for example on a television screen connected to his decoder  102  (respectively  103 ,  104 ).  
     [0120] Each of the S multimedia digital decoders  102 ,  103  and  104  receives timestamping challenges or TSCs  101 . Next, when the user thereof has provided an answer to a question from the application, a secure processor present in the relevant decoder  102 ,  103  or  104  respectively constructs a message comprising the answer A (digital data) and a timestamping message, or timestamp, TSM which it transmits over a channel  105 ,  106  or  107  respectively of the telephone link type or a direct link by secure processor reader to an ACC center  108 .  
     [0121] The ACC center  108  receives the answer A messages together with their timestamps. Its role is first of all to validate these messages, generated by the secure processors of the digital decoders  102 ,  103 ,  104  and transmitted on a corresponding channel  105 ,  106  or  107 , with the aid of the public keys of the secure processors. These public keys are provided by the broadcaster on any channel  112 . The ACC center is also responsible for transmitting the answers A together with the validated timestamps  111  to the application server  109 .  
     [0122]FIG. 2 diagrammatically illustrates a multimedia digital decoder  200  such as one of the decoders  102 ,  103  or  104  present in the infrastructure of FIG. 1.  
     [0123] The decoder  200  comprises interlinked by an address and data bus  203 :  
     [0124] a tuner  201 ;  
     [0125] a processor  202 ;  
     [0126] a random access memory  205 ;  
     [0127] a read only memory  204 ;  
     [0128] an extractor of timestamping information or TSI,  206 ;  
     [0129] a secure processor  207 ;  
     [0130] a modem  208 ;  
     [0131] a man/machine interface denoted RHM  217 ;  
     [0132] a video decoder  218 .  
     [0133] Each of the elements illustrated in FIG. 2 is well known to the person skilled in the art. These common elements are not described here.  
     [0134] It is observed furthermore that the word “register” used throughout the description designates in each of the memories mentioned, both a memory area of small capacity (a few binary data) and a memory area of large capacity (making it possible to store an entire program or the whole of a data sequence).  
     [0135] It is noted however that the tuner  101  is adapted for extracting and shaping the multimedia data corresponding to one or more television and/or radio services as well as the data of timestamping challenge or TSC type  101  originating from a channel  216 .  
     [0136] The video decoder  218  transforms the digital data received from the tuner  201  into analog data for the television. These analog data are provided on an output  219 .  
     [0137] The random access memory  205  keeps data, variables and intermediate results of processing, in memory registers bearing in the description, the same names as the data whose values they keep. The random access memory  205  comprises in particular:  
     [0138] a TSC register  210  in which a received timestamping challenge is kept;  
     [0139] an SCH register  211  in which a challenge size is kept;  
     [0140] a register  212  containing an answer A provided by a user;  
     [0141] a register  213  keeping a timestamping information item TSI and an answer information item “ret Challenge” to a retrieval challenge;  
     [0142] a register TSM  214  in which a timestamping message is kept.  
     [0143] The read only memory  204  keeps in registers which for convenience possess the same names as the data which they keep, in particular the program for operating the processor  202  in a “Prog” register  209 .  
     [0144] The TSI extractor  206  is adapted for extracting the timestamping information from a stream of data provided by the tuner  201 . The extractor transmits the extracted data over the bus  203  destined for the processor  202 .  
     [0145] The modem  208  is adapted for transmitting answers with timestamp to an ACC center via a telephone line. Other types of return path may of course be used.  
     [0146] The man/machine interface  217  is adapted for taking account of the answers given by the user through for example a keypad, a remote control, a voice recognition or recording box or a touch screen.  
     [0147]FIG. 3 diagrammatically illustrates a secure processor  207  such as illustrated in conjunction with FIG. 2.  
     [0148] The secure processor  207  comprises, interlinked by an address and data bus  303 :  
     [0149] an input/output interface  301 ;  
     [0150] a processor  302 ;  
     [0151] a nonvolatile memory  304  of EEPROM flash type; and  
     [0152] a random access memory  311 .  
     [0153] Each of the elements illustrated in FIG. 3 is well known to the person skilled in the art. These common elements are not described here.  
     [0154] It is observed however that the input/output interface  301  is able to interface a bus  303  with a bus  203  of a multimedia digital decoder or, when the secure processor is removable, with a removable processor reader  501  which will be described in conjunction with FIG. 5.  
     [0155] The nonvolatile memory  304  keeps in registers which for convenience possess the same names as the data which they keep, in particular:  
     [0156] the program for operating the processor  302  in a “Prog” register  305 ;  
     [0157] a private user key in a register “KPriU”  306 ;  
     [0158] The random access memory  311  keeps data, variables and intermediate results of processing, in memory registers bearing in the description the same names as the data whose values they keep. The random access memory  311  comprises in particular:  
     [0159] a number of challenges and a number of services in a register “SCH,N”  307 ;  
     [0160] an answer in a register “A”  308 ;  
     [0161] a timestamping information item TSI and a retrieval challenge information item as well as the answer to the retrieval challenge in a register “TSI, ret Challenge”  309 ;  
     [0162] a timestamping message in a register “TSM”  310 .  
     [0163] As a variant, the answer A and the timestamping message TSM are not placed in the volatile memory  311  but in the rewriteable nonvolatile memory  304  when in particular the secure processor  207  is removable and when notably the answer A and the timestamping message TSM are intended to be sent directly from the secure processor to a collecting center via the secure processor  207 .  
     [0164]FIG. 4 describes a device  400  for collecting answers ACC and for timestamp verification possessing a modem for recovering the answers. The device  400  is as the ACC collecting center  108  illustrated in conjunction with FIG. 1.  
     [0165] The ACC answer collecting device  400  comprises, interlinked by an address and data bus  403 :  
     [0166] a modem  401 ;  
     [0167] a processor  402 ;  
     [0168] a read only memory  404 ;  
     [0169] a random access memory  405 .  
     [0170] Each of the elements illustrated in FIG. 4 is well known to the person skilled in the art. These common elements are not described here.  
     [0171] It is observed however that the modem  401  is able to receive and to shape messages with timestamp originating from a multimedia digital decoder so as to retransmit them to the processor  402 .  
     [0172] The random access memory  405  keeps data, variables and intermediate results of processing, in memory registers bearing in the description, the same names as the data whose values they keep. The random access memory  405  comprises in particular:  
     [0173] a TSM register  409  in which is kept a message received with timestamp;  
     [0174] a register “KPubU”  407  containing a public key of the secure processor at the origin of the message received;  
     [0175] a register “KPubTSSi, KPubD”  410  containing the public keys of the timestamping services TSSI and the public key KPubD of the broadcaster;  
     [0176] a register “A”  408  containing an answer.  
     [0177] It will have been possible for the public key of the secure processor KPubU to have been sent with the TSM message received or for it to have been recorded previously according to any means known to the person skilled in the art.  
     [0178] The public keys of the timestamping services KPubTSSi or the public key of the broadcaster KPubD are known to the ACC center by any means.  
     [0179] According to a variant embodiment of the invention described in FIG. 5, a device for collecting answers and for timestamp verification possesses a secure processor reader.  
     [0180] The device of FIG. 5 comprises similar elements to those of the previously described FIG. 4 which bear the same reference numerals and will not be described further.  
     [0181] It is observed that a removable secure processor reader  501  replaces the modem  401 . This reader  501  is able to receive and to shape messages with timestamp originating from a removable secure processor so as to retransmit them to the processor  402 .  
     [0182] According to FIG. 6 which describes a protocol for exchange between a broadcaster  100 , a central processor  202  of a digital decoder, a secure processor  207  and a device for collecting answers such as are illustrated in conjunction with FIGS.  1  to  4 , following a request for services requiring an answer with timestamp, the broadcaster  100  performs a broadcast  601  of timestamping challenge TSC to the central processor  202 .  
     [0183] The central processor  202  extracts from TSC the number of challenges SCH and the number of services N to be taken into account for answer a timestamping and performs a transmission  602  of SCH, N and  603  of an answer A, given by the user through the interface  217 , to the secure processor  207 .  
     [0184] Next, the secure processor determines a random timestamping sequence CS, by performing a random or pseudo-random drawing of a sequence of SCH identifiers of services CS[i], each value which an identifier CS[i] lying between 1 and N can take, representing a service from among the N services of the list mentioned in the TSC challenge, the indices i lying between 1 and SCH inclusive, and two service identifiers in the CS sequence possibly being equal.  
     [0185] Next, a first operation of requesting information regarding time and answer to a retrieval challenge is performed, in the course of which the secure processor transmits a request  604  for timestamping information corresponding to a first service “Ask(CS[1])” to the central processor  202 . The latter, after adjusting the tuner  201  to the channel CS[1], extracts along with the flow the timestamping information of this first service TSI(CS[1]) as well as the answer to a first retrieval challenge RetC[1] defined by TSI(CS[1]) before sending, in step  606 , the information TSI(CS[1]) and the answer RetC[1] to the secure processor  207 . Next, this operation of requesting information regarding time and answer to a retrieval challenge is repeated for each of the services CS[i], with an integer i going from 2 to SCH.  
     [0186] After receipt of the last timestamp TSI(CS[SCH]) and of the answer to the last retrieval challenge Ret C[SCH], the secure processor signs the message TSM and the answer A with its private key KPriU  306  in the course of an operation  610  and transmits a signed TSM timestamping message  611  to the processor  202  which resends this message together with the answer A in a message  612  to the ACC center  108 .  
     [0187] The ACC center then validates the answer in the course of a step  613  and if necessary forwards the validated answer and the validated timestamp to the application server.  
     [0188] According to FIG. 7 which describes a protocol for exchange between a broadcaster  100 , a central processor  202  of a digital decoder, a removable secure processor  207  and a device for collecting answers such as those illustrated in conjunction with FIGS. 1, 2,  3  and  5 , following a request for services requiring an answer with timestamping, the broadcaster  100  performs a broadcasting  601  of TSC timestamping challenge to the central processor  202 .  
     [0189] The device of FIG. 7 comprises protocol elements similar to those described previously in FIG. 6 which bear the same reference numerals and will not be described further.  
     [0190] It is observed however that after signing of a timestamp message, the secure processor  207  keeps in its nonvolatile memory  304  the answer A and the corresponding message TSM. The user can then remove the secure processor  207  from the multimedia digital decoder  200  so as to insert it into the reader  501  of an ACC center  500 .  
     [0191] The ACC center  500  then performs a reading  711  of the answer A and of the signed timestamping message TSM.  
     [0192] The ACC center then validates the answer A and if necessary forwards the validated answer together with a timestamp to the application server.  
     [0193] In FIG. 8, which depicts the manner of operation of a central processor  202  with timestamping process included in the electronic device illustrated in FIG. 2, it is observed that after an initialization operation  800  in the course of which the registers of the random access memory  205  are initialized, in the course of a waiting operation  801 , the processor  202  waits to receive and then receives an answer A to be timestamped.  
     [0194] Then, immediately, in the course of an operation  802 , the processor  202  loads a TSC challenge originating from a broadcaster.  
     [0195] The TSC challenge comprises:  
     [0196] the size of the challenge SCH, that is to say the number of services to be taken into account in the challenge;  
     [0197] the number N of services TSS which can participate in the challenge;  
     [0198] and for each service TSSi, their order needing to be considered:  
     [0199] a network identifier network_ID for this service;  
     [0200] a transport stream identifier transport_stream_ID for this service;  
     [0201] a service identifier service_ID.  
     [0202] It is noted that the broadcasting system preferably complies with the DVB-SI standard of the ETSI (European Telecommunication Standard Institute), “Specification for Service Information in Digital Video Broadcasting Systems” published under the reference ETS300468. In the DVB-SI standard, the triplet network_ID, transport_stream_ID, service_ID uniquely identifies a broadcast service.  
     [0203] Next, in the course of an operation  803 , the processor  202  extracts from the TSC challenge, the size SCH of the challenge and the number N of services and then transmits SCH, N and the answer A to the secure processor  207 .  
     [0204] Then, in the course of an operation  804 , the processor  202  initializes a counter “Count” to 0.  
     [0205] Next, during an operation  805 , the counter “Count” is incremented by one unit.  
     [0206] Then, in the course of an operation  806 , the processor  202  places itself on standby waiting for a challenge request CS[Count] originating from the secure processor  207 .  
     [0207] When it receives such a request, during an operation  807 , the processor  202  extracts from the data received via the broadcasting channel the information TSI corresponding to the challenge CS[Count] denoted TSI(CS[Count]) and the answer corresponding to the retrieval challenge Ret C[Count] located in TSI(CS[count]) and then transmits them to the secure processor  207 .  
     [0208] In the preferred embodiment, the invention is compatible with the aforesaid DVB-SI standard which defines obligatory packets and private packets. The private packets can be parameterized according to requirements and may thus be used for timestamping services. Each TSS service has in its events information table, denoted EIT in the DVB-SI standard, a private data packet called the time information packet, denoted TIP.  
     [0209] The standardized structure of this TIP packet includes just an identifier and a number of bytes, all the other fields being defined by the user. Thus, the TIP packet is entirely adapted for the implementation of the invention and according to the preferred embodiment, the information TSI(CS[count]) is sent in the form of a TIP packet which comprises:  
     [0210] an identifier individual to the type of TIP, TIP_header_tag;  
     [0211] a number of bytes which follows, length_field;  
     [0212] a type of challenge, challenge_type, which contains the identifier of the packet from which the bytes of the retrieval challenge must be extracted;  
     [0213] a position of the first byte of the retrieval challenge, starting_byte, a zero value corresponding to the first byte;  
     [0214] a number of successive bytes to be extracted for the retrieval challenge, number_bytes;  
     [0215] a current timestamp, current_time, which contains the current time and date in coordinated universal time;  
     [0216] an imprint of the correct answer to the retrieval challenge, hashed_correct_answer, the imprint being defined with a private key of the broadcaster KPriD (an example of a hash function used to calculate the imprint being described in the document “Federal Information Processing Standards, secure hash standards” published by FIPS under the reference 180-1);  
     [0217] a signature SIGN(current_time∥hashed_correct_answer TSSi) which represents the RSA signature of current_time and hashed_correct_answer defined with the aid of a private key KPriTSSi of the TSSi service.  
     [0218] A retrieval challenge is completely defined by a definition CDef comprising the fields challenge_type, starting_byte and number_bytes.  
     [0219] The signature SIGN has two roles: it uniquely identifies the TSSi service with its private key and guarantees the integrity of the time information.  
     [0220] The broadcaster  100  can at any moment change the parameters of the challenge challenge_type, starting_byte and number_bytes.  
     [0221] The public key KPubTSSi of the service TSSi is present in the ACC center  108 . Independent service providers can use the same timestamp information which is provided by the broadcaster  100 .  
     [0222] Then, in the course of a test  808 , the processor  202  tests whether the value of the counter “count” is equal to the number SCH.  
     [0223] If not, the increment operation  805  is repeated.  
     [0224] If it is, in the course of an operation  809 , the processor  202  places itself on standby waiting for a TSM timestamping message originating from the processor  207 .  
     [0225] Then, when the TSM message is received, during an operation  810 , the processor  202  sends the ACC center the answer A together with the TSM message.  
     [0226] Next, the operation  801  is repeated.  
     [0227] It is noted that when the sending of the answer is carried out with the aid of a removable secure processor  207 , the operations  809  and  810  are not performed and we go directly from the test  808  with positive answer to the repeating of the operation  801 .  
     [0228] It is also noted that as a variant, the processor  202  can place several answers A with timestamping into a queue for transmission before transmitting them at some later time to an ACC center  108 .  
     [0229] In FIG. 9, which depicts the manner of operation of a secure processor  207  with timestamping process included in the electronic device illustrated in FIG. 2 and illustrated in detail in conjunction with FIG. 3, it is observed that after an initialization operation  900  in the course of which the registers of the random access memory  305  are initialized, in the course of a waiting operation  901  the processor  302  waits to receive and then receives an answer A to be timestamped, the size SCH of the challenge and the number N of services to be considered.  
     [0230] Next, in the course of an operation  902 , the processor  302  randomly or pseudo-randomly selects a sequence of SCH numbers lying between 1 and N (each of these numbers being a pointer to a service in the ordered list of services TSS) representing a sequence CS of SCH challenges.  
     [0231] Then, in the course of an operation  903 , the processor  302  initializes a counter “count” to zero.  
     [0232] Next, in the course of an operation  904 , the counter “count” is incremented by one unit.  
     [0233] Next, during an operation  905 , the secure processor  207  transmits the challenge of rank Compt to the central processor  202  CS[count].  
     [0234] Then, the processor  302  places itself on standby waiting for the information TSI(CS[count]) and for the definition of the corresponding retrieval challenge in the course of an operation  906 . It then performs an operation of extracting the answer to the retrieval challenge.  
     [0235] Next, in the course of a test  907 , the processor  302  verifies whether the value of the counter “count” is equal to the number of challenges SCH.  
     [0236] If not, the increment operation  904  is repeated.  
     [0237] If it is, in the course of an operation  908 , the processor  302  constructs a signed TSM message which comprises the following data:  
     [0238] For each value of i going from 1 to SCH:  
     [0239] a service number which defines the TSS service used for the challenge i; its value is the position of the TSS in the list provided by the TSC challenge; the first service of the list has the number 1;  
     [0240] For each value of i going from 1 to SCH:  
     [0241] the current timestamp, current_time;  
     [0242] the imprint, hashed_correct_answer;  
     [0243] the signature SIGN(current_time∥hashed_correct_answer, TSSi);  
     [0244] the number_bytes challenge bytes challenge_byte extracted from the data stream as a function of the retrieval challenge;  
     [0245] the signature total_signature obtained by RSA signature of the concatenation of the answer A and of all the data of the TSM message with the exclusion of its own signature; the operation of generating the signature total_signature uses the private key KPriU  306  of the secure processor  207 .  
     [0246] Next during an operation  909 , the signed TSM message is:  
     [0247] transmitted to the processor  202 ; or  
     [0248] kept in memory before being transmitted directly at some later time to an ACC center  108  if the secure processor is removable and there is no direct link between the processor  202  and an ACC center.  
     [0249] Next, the operation  901  is repeated.  
     [0250] In FIG. 10, which depicts the manner of operation of a device for collecting answers  108  ACC illustrated in FIG. 4 or in FIG. 5, it is observed that after an initialization operation  1000  in the course of which the registers of the random access memory  405  are initialized, in the course of a waiting operation  1001  the processor  402  waits to receive and then receives an answer A and a corresponding message TSM.  
     [0251] Next, during a test  1002 , the processor  402  verifies whether the signature total_signature of the answer A and of the message TSM is correct with the aid of the public key KPubU of the secure processor, the public key KPubU having been dispatched by the secure processor to the ACC center in the course of a previous operation (not represented).  
     [0252] If so, during a test  1003 , the processor  402  verifies that SCH challenges are actually present in the TSM message, SCH having previously been communicated by the broadcaster or the application server in the course of an operation (not represented).  
     [0253] If so, in the course of an operation  1004 , the processor  402  initializes a counter i to zero.  
     [0254] Then in the course of an operation  1005 , the processor  402  increments the counter i by one unit.  
     [0255] Next, in the course of a test  1006 , the processor  402  verifies the validity of the challenge of rank i by verifying:  
     [0256] the signature SIGN(current_time∥hashed_correct_value,CS[i]) by using the public key KPubCS[i] of the service CS[i];  
     [0257] the imprint of the retrieval challenge which must be equal to the corresponding value hashed_correct_value.  
     [0258] If so, in the course of a test  1007 , the processor  402  verifies whether the counter i has reached the value of SCH.  
     [0259] When the result of the test  1007  is negative, the increment operation  1005  is repeated.  
     [0260] When the result of the test  1007  is positive, in the course of the test  1008 , the processor  402  verifies the consistency of the timestamp information itself. The maximum time to process a complete challenge is denoted tProcess, comprising the calculation time of the secure processor, the processing time of the central processor and the switching time.  
     [0261] A simple verification consists in testing the value of TI[SCH] corresponding to the timestamp information of rank SCH which must be less than or equal to a value equal to the sum of the timestamp information of rank 1 and of the product of tProcess times the number of challenges minus 1:  
     [0262] TI[SCH]≦TI[1]+(SCH−1).tProcess.  
     [0263] A finer verification consists in testing for each value of an integer j lying between 2 and the value SCH, the value of TI[j] corresponding to the timestamp information of rank j which must be less than or equal to a value equal to the sum of the timestamp information of rank j-1 and of tProcess:  
     [0264] TI[j]≦TI[j−1]+tProcess for every value of j such that  2=j≦SCH.    
     [0265] According to a variant, the timestamp information TI[j] for a number j lying between 1 and SCH relates to a service of rank j: it depends not only on an actual timestamp but also on the service of rank j, each service having as it were its own timescale. It is thus possible to increase security by having a particular coding of the timestamp (which makes it possible to revert to an “absolute time” scale). Test  1008  then takes this coding into account, implements an operation which makes it possible to go from a timestamp relating to a service to an absolute timestamp independent of the service and considers only absolute timestamps for the test itself.  
     [0266] If so, in the course of an operation  1009 , the TSM message is declared as being valid and the answer A is sent to the application server with an absolute timestamp corresponding to TI[1] so as to be utilized.  
     [0267] When one of the tests  1002 ,  1003 ,  1006  or  1008  is negative, the message TSM is not valid and the answer A together with the corresponding timestamping information is rejected.  
     [0268] Then, following one of the operations  1009  or  1010 , the waiting operation  1001  is repeated.  
     [0269] The embodiment described does not have the objective of reducing the scope of the invention. Consequently, numerous modifications may be made thereto without departing from the framework of the invention; in particular, it will be possible to envisage processes, systems or devices with degraded implementation comprising just a subset of the operations or means of timestamping or of verification of timestamp validity described previously. Conversely, complementary operations may be added.  
     [0270] Of course, neither is the invention limited to the exemplary embodiments mentioned hereinabove.  
     [0271] In particular, the person skilled in the art may introduce any variant into the definition of the challenges.  
     [0272] It is noted moreover that the invention is not limited to a television and/or radio broadcasting infrastructure comprising a broadcaster, decoders and an ACC center but extends to any infrastructure for broadcasting digital streams with at least one application server, this application being linked to the use of timestamping or of events, such as for example an Internet server.  
     [0273] Likewise, the invention is not limited to the timestamping of answers to a broadcast question, but applies to the timestamping of any type of data sent or otherwise by a broadcaster requiring timestamping such as for example spontaneous messages, multimedia documents, purchase requests, the timestamping being based on the use of broadcast digital streams.  
     [0274] Moreover, the invention is not limited to terminals responsible for performing the timestamping which are of multimedia digital decoder type but extends to any type of terminal adapted for receiving digital data streams.  
     [0275] Furthermore, the invention is not limited to transmissions of the answers to an ACC center via a modem or a direct link with a secure processor, but extends to transmissions using any means of transmission such as for example a bus or a network.  
     [0276] It will also be noted that the invention is not limited to a purely hardware setup but that it may also be implemented in the form of a sequence of instructions for a computer program or any form mixing a hardware part and a software part. In the case where the invention is set up partly or wholly in software form, the corresponding sequence of instructions may be stored in a removable storage means (such as for example a diskette, a CD-ROM or a DVD-ROM) or a nonremovable one, this storage means being partly or wholly readable by a computer or a microprocessor.