Nagravision S.a.

Guy Moreillon

Alexandre Karlov

Nicolas Fischer

Henri Kudelski

Sebastien Robyr

Fabien Gremaud

Corinne Le Buhan

Frederic Thomas

Joel Wenger

André Nicoulin

Michael John Hill

Philippe Desarzens

Frédéric Thomas

Sébastien Robyr

Nikolai Keychenko

Jean-Michel Puiatti

A technique to manage members of a group of decoders having access to broadcast data, each group member sharing a common broadcast encryption scheme (BES) comprising the steps of, in a stage for a decoder to become a group member, receiving keys pertaining to the position in the group according to the BES, receiving a current group access data comprising a current group access key, and in a stage of accessing broadcast data, using the current group access data to access the broadcast data, and in a stage of renewing the current group access key, sending a first group message comprising at lease a next group access key encrypted so that only non-revoked decoders can access it, said group message being further encrypted by the current group access key, updating the current group access key with the next group access key.

Apparatus for managing members of at least one group of decoders having access to broadcast data

A device to reduce bandwidth necessary for renewal of subscriptions for reception of broadcast services including: defining a plurality of sets of subscriber identification numbers, each set being associated with a product; splitting a set of subscriber identification numbers into groups of subscribers; searching for an available subscriber identification number related to the desired product at the time of initialization of a new subscriber; confirming that an inhibit duration has elapsed between the end of the previous subscription and the start of the new subscription; sending an initialization message to the new subscriber addressed with his unique identification address and containing the subscriber identification number of, and rights to, his product; preparing a group rights renewal message for the product to the group containing the subscriber identification number, this message comprising the group header containing this subscriber and a compressed bitmap for individually addressing each of the group members.

Device for the allocation and management of subscriptions for the reception of broadcast products

A method for conditional access to a digital data stream encrypted with at least one control word and broadcasted to at least one mobile device, said transmitter also transmitting a control message stream containing control words and access conditions, said mobile device being connected to a mobile communication network via a mobile access point, comprises: receiving the control message stream by the mobile device; determining a location identifier for the said mobile device by either the identifier of the mobile access point or the identifier of the broadcasting network transmitter; verifying access conditions contained in the control message, said access conditions comprising a reception condition related to a mobile access point identifier and/or an identifier of one broadcasting network transmitter; comparing the determined identifier with the identifier(s) contained in the access conditions; and authorizing or blocking the access to said data stream depending on the result of the comparison.

Method of local conditional access for mobile equipment

The invention concerns a method for providing a plurality of receivers with conditional access to broadcast services using a simplified means for managing the control messages required by such conditional access schemes. The method involves providing all information which will allow a registered receiver having the necessary decryption key to access the services without having any prior rights loaded locally. A management center keeps a register of all subscribed receivers, including a list of services to which the receiver is subscribed, and encrypts the services using control words encrypted by the necessary keys. Control messages comprising the control words for decryption are provided within a special channel to which the receiver has permanent access, the special channel being a different one from channels used for broadcasting audio/video services.

Method for accessing services by a user unit

A method to manage members of a group of decoders having access to broadcast data, each group member sharing a common broadcast encryption scheme (BES) comprising the steps of, in a stage for a decoder to become a group member, receiving keys pertaining to the position in the group according to the BES, receiving a current group access data comprising a current group access key, and in a stage of accessing broadcast data, using the current group access data to access the broadcast data, and in a stage of renewing the current group access key, sending a first group message comprising at least a next group access key encrypted so that only non-revoked decoders can access it, said group message being further encrypted by the current group access key, updating the current group access key with the next group access key.

Method to manage members of at least one group of decoders having access to broadcast data

A method to reduce bandwidth necessary for renewal of subscriptions for reception of broadcast services including: defining a plurality of sets of subscriber identification numbers, each set being associated with a product; splitting a set of subscriber identification numbers into groups of subscribers; searching for an available subscriber identification number related to the desired product at the time of initialization of a new subscriber; confirming that an inhibit duration has elapsed between the end of the previous subscription and the start of the new subscription; sending an initialization message to the new subscriber addressed with his unique identification address and containing the subscriber identification number of, and rights to, his product; preparing a group rights renewal message for the product to the group containing the subscriber identification number, this message comprising the group header containing this subscriber and a compressed bitmap allowing to individually address each of the group members.

Method for the allocation and management of subscriptions for the reception of broadcast products

A method allows a broadcasted conditional access content accessible at the time of transmission to be also accessible at a later time thanks to intermediate storage on a hard disk of a user unit. The processing method includes the steps of receiving at the user unit a data stream encrypted by at least one control word, at least one control message stream containing the control words, forming an index file, each index comprising an identifier of a control message formed by the extraction of data associated to the control messages and an identifier of the part of the content to which the control message is applied; and, at the time of the deferred processing of the content, extracting at least one part of the control messages and resynchronizing the content with the control messages by the use of the index file, the identifier of the control message allowing the selection of the current control message from a set of control messages at the time of the exploitation of the content identified by the identifier of the part of the content related to this control message.

Method for processing conditional access contents by a user unit

A method for protecting multimedia data exchanged between a multimedia processing device and a security module managed by a management center, the multimedia processing device receiving an encrypted multimedia data, decrypting the encrypted multimedia data and converting the decrypted multimedia data, said multimedia processing device including a personal key, the method comprising obtaining an identifier pertaining to an entity representing a group of multimedia processing devices, calculating a security key formed by a one-way function based on the personal key of the processing multimedia device and the entity identifier, transmitting this security key and the entity identifier to the security module connected to said multimedia processing device, calculating the security key using a one-way function based on the personal key of said multimedia processing device and the entity identifier, and using the calculated security key to secure the data exchanged between the multimedia processing device and the security module.

Method to secure data exchange between a multimedia processing unit and a security module

A first variant of the process includes receiving an encrypted stream representing a service, this stream comprising a data channel and an ECM channel; slicing the stream to send it in packets to a mobile receiver; extracting the control message channel of this stream; forming a block containing the data channel, compatible with the diffusion to the receiver; extracting from the sliced stream a control message and introducing the control message into the block, in order to form a packet. A second variant of the process includes receiving an encrypted stream, this stream comprising a data channel and an ECM channel; cutting the stream; forming a block from the stream, comprising the data channel and the ECM channel, compatible with the diffusion to receivers; determining identical messages of the ECM channel repeated in the block and eliminating identical repeated messages, while conserving at least one of the identical messages.

Process for the generation of packets for at least one mobile receiver

A method that allows the optimization of the consumption of conditional access content in order to guarantee less vulnerable right messages involves three steps: the selection by the user of a content and the indication of this interest to said management center; the sending of a notification message containing or indicating the access authorisation message shortly before the broadcast of said content and storage of this authorisation message; and the sending of the content itself and the use of the data of the authorisation message in order to access the data of the content. There may be a fourth stage, namely the validation of the authorisation message by the user. This validation is executed in general at the time of the reception of the content or alternatively the user confirms their intention to purchase.

Access method for conditional access audio/video content

An aim to reach may be on one hand, to allow the reading of a content stored by a digital video recorder from a decoder of the local network regardless of the time elapsed between storage and reading, and on the other hand to prevent the transfer or improper copying of the content stored from one network to another. An aim may be achieved by a method of an embodiment, for transmitting digital data in a local network including members constituted by at least one first multimedia unit having a content storage device and at least one second multimedia unit intended to restore the content. The first multimedia unit may be connected, on one hand, to a broadcasting server of encrypted digital audio/video data and on the other hand to the second multimedia unit, each member possessing a security module including a network key. The first multimedia unit receives and decrypts the encrypted data forming a content broadcasted by the broadcasting server and re-encrypts the content previously decrypted. The method of an embodiment may include steps wherein the content is re-encrypted with a random key and transmitted to the second multimedia unit accompanied by an authorization block including the random key encrypted with the network key, the second multimedia unit decrypts the authorization block, and extracts the random key to be used for decrypting the content.

Method for transmitting digital data in a local network

The present invention relates to a method for creating and managing a local area network including at least one device for reproducing an encrypted data flow and a device for transmitting and re-encrypting all or part of said encrypted data, which devices include security modules. The method includes the steps of connecting a so-called master security module in one of the devices connected to the local area network, causing the master security module to generate a network key, securely transmitting the network key to one or more so-called user security modules, decrypting the data encrypted by the transmission and re-encryption device, re-encrypting the data with said device by means of a local key, transmitting the re-encrypted data to the reproduction device, and holding the reproduction device to perform decryption using the user security module associated therewith and provided with means for locating the local key.

Method for generating and managing a local area network

Example embodiments are directed to a digital audio/video (AV) data processing unit and a method of controlling access to the digital AV data. The processing unit of AV digital data includes a deciphering unit of the AV data, a decompression unit, an input/output interface of the processed AV data and communication device towards a security module. The deciphering and decompression units respectively include an encryption unit and a decryption unit, each having at least one personal key and a common encryption key. Deciphering the AV data using the control words and re-encrypting the deciphered AV data occurs only after a successful verification of the control word and the common key. After temporary storage, the re-encrypted AV data cannot be decrypted by the decryption unit unless the common key has been positively verified by the security module by way of a random number generated by the decryption unit.

Growing community of inventors

Bioley-Orjulaz, Switzerland

Guy Moreillon