Secure Communication between Set-top Box and Smart Card in DTV Broadcasting

Transcription

1 882 IEEE Tranation on Conumr Eltroni Vol. 50 No. 3 AUGUST 2004 Sur Communiation btwn St-top Box and Smart Card in DTV Broadating Tianpu Jiang Yongmin Hou and Shibao Zhng Abtrat In digital tlviion (DTV) broadating rvi providr harg ubribing f by rambling th program with onditional a ytm a wll a ontrol th illgal riving th hargd program. Smart ard i ud to drypt th ontrol word and tranfr thm ba to t-top box (STB) to drambl th rambld program. Sur ommuniation btwn STB and mart ard i dirtly rlatd with th bnfit of rvi providr and th lgal right of ur whil y xhang i th ntial part of ur ommuniation. In thi papr w will propo a y xhang protool for STB and mart ard bad on Shnorr digital ignatur protool and on-way hah funtion. Our propod protool i dynami ur mutual authntiatd and lowr omputation. Morovr th propod protool an prvnt mart loning and MCorma Ha problm 1. Indx Trm onditional a ytm mart ard ttop box mutual authntiation y xhang. I. INTRODUCTION With th rapid digitization of tlviion broadating th onvntional tlviion mdia gradually ynthiz othr thnologi of information and ommuniation fild to form a ompltly nw and normou digital tlviion indutry. Thi nwborn indutry aborb many ountri to rarh and dvlop digital tlviion ytm. China ha bn rarhing and dvloping digital high dfinition tlviion (HDTV) broadating ytm in In Sp.1998 th funtional prototyp of HDTV ytm wa ufully fulfilld. And thn by broadating liv th 50th National Day lbration of China in th nxt yar th prforman of th HDTV broadating ytm wa ttd ufully. With vral yar ffort China ha alrady mad a ignifiant progr in dvloping HDTV ytm from had-nd ytm to riving trminal dvi. Nowaday mor and mor broadatr hav providd a varity of pifially 1 Thi wor wa upportd by Eltroni Dvlopmnt Fund of Minitry of Information Indutry of P.R.China. Tianpu Jiang i with th Intitut of Imag and Information Proing Shanghai Jiao Tong Univrity Shanghai P.R.China (-mail: tianpujiang@yahoo.om). Yongmin Hou i with th dpartmnt of ltroni nginring Shanghai Jiao Tong Univrity Shanghai P.R.China (-mail:hyongmin@jtu.du.n). Shibao Zhng i with th Intitut of Imag and Information Proing Shanghai Jiao Tong Univrity Shanghai P.R.China (-mail: bzhng@dtv.org.n). Contributd Papr Manuript rivd Jun /04/$ IEEE broadating mdia to atify th vr-inraing dmand of th ur in China and many othr ountri in th world. But th traditional rvnu way whih mainly dpnd on advrtimnt an t mt th outlay of ntwor ontruting and rvi any longr. In ordr to prrv th ontinud finanial tability of th broadatr to broadat th highruality and wll-produd program onditional a ytm (CAS) a on of th y thniu in digital tlviion (DTV) broadating alway ha bn adoptd to allow th alrady paid and authorizd ur to wath th ubribd program. In CAS om program information i rambld with ontrol word to prvnt illgitimat ur from riving normally [1][2][3]. Th authorizd ubribr an drambl th program with oopration of mart ard and STB. Th rvi providr harg ubribing f by iuing mart ard to th authorizd paid ubribr. Sin mot DTV broadating i unidirtional thr i no authntiation btwn th had-nd and th ubribr on lin o th rvi providr utiliz authntiation btwn STB and mart ard to prott thir bnfit. Th ur ommuniation btwn thm i vital to th urity of th ytm whih dirtly afft th rvnu of th rvi providr. Whil y xhang i th ntial part of th ur ommuniation. Morovr without mutual authntiation in th ommuniation btwn STB and mart ard on mart ard an b ud in diffrnt STB of th am typ whih will au MCorma Ha and mart ard loning problm [4]. MCorma Ha our whn th data lin from mart ard to STB i trappd and dirtd to anothr STB that at a if it ha th am mart ard inid. Smart ard loning i that dupliating a lgal ard to ma many illgal ard to allow unauthorizd riving th program. If y xhang pro i rad by th pirat th pirat an xtrat th y information of mart ard whih an b ud to dupliat many mart ard or rdirt to othr STB to ntitl illgitimat ubribr to riv th rambld program. A valuatd mdia providr uffr 100M dollar ah yar in lot rvnu du to mart ard bing rad [5]. Sur y xhang with mutual authntiation i th ntial part of ur ommuniation whih will gratly improv th urity of th ytm to rdu th lo. In thi papr w will put forward a y xhang with mutual authntiation protool btwn STB and mart ard bad on Shnorr digital ignatur protool [6] and on-way hah funtion whih i ur dynami lowr omputation a wll a prvnting MCorma Ha and mart ard loning problm. Th rt of thi papr i arrangd a th following.

2 T. Jiang t al.: Sur Communiation btwn St-top Box and Smart Card in DTV Broadating 883 Rlatd wor whih inlud ur ommuniation btwn STB and mart ard y xhang and mutual authntiation will b diud in tion Ⅱ. Th propod protool will b diud in tion Ⅲ. In tion Ⅳ urity and prforman analyi will b givn. Finally w will onlud th propod protool in tion Ⅴ. II. RELATED WORKS In DTV broadating rvi providr harg th ubribing f by rambling th program with onditional a ytm a wll a ontrol th illgal riving th hargd program. Th trutur of onditional a ytm [2][7] i hown a th figur 1. rtor th TS tram. ECM/EMM filtr filtr out th ECM and EMM tion whih ar nt to th mart ard to b dryptd for CW with Drypt2 and Drypt1a figur 1 hown. CW i tranparntly or nryptd with a ion y () in mart ard and tranfrrd ba to STB. Dramblr an u CW to drambl th TS. Aftr drambld TS will b dmultiplxd by dmultiplxr and dodd. And thn STB will ta opyright prottion bfor outputting th vido and audio to ubribr. Fig.2. Th oopration of STB and mart ard Fig.1. Th trutur of onditional a ytm At th had-nd th program information i rambld by a pudo random un whih i gnratd by a pudo random un gnrator (PRG) with a ontrol word (CW) a d. Th CW i nryptd by authorization y (AK) of th orrpondingly hannl to form ntitlmnt ontrol mag (ECM). AK and othr ntitlmnt mag ar nryptd by matr privat y (MPK) to form ntitlmnt managmnt mag (EMM). ECM EMM and th rambld program ar rmultiplxd in a nw tranport tram (TS) whih i broadat in th form of radio fruny ignal. Th ubribr managmnt ytm (SMS) i in harg of iuing or updating th mart ard for ubribr whih ontain MPK and othr aount information. At th rivr nd th rivr an drambl th program a th rvr tp of th had-nd with th oopration of mart ard and STB. A dmontration of th oopration [7] i hown in figur 2. In thi STB thr i an ECM/EMM filtr to filtr out th orrpondingly ECM and EMM tion in TS tram and a dramblr to drambl th program with th CW providd by mart ard. For anothr a both ECM/EMM filtr and dramblr ar ralizd in mart ard but in thi papr w mainly diu th formr. Whn th STB riv radio fruny RF ignal from th hannl tunr and dmodulator will pro th ignal to In th abov tp if CW i not nryptd bfor tranfrring ba to STB th advrary an rdirt th CW to anothr dramblr of th am typ to drambl th program dirtly by avdropping th ommuniation of th mart ard intrfa whih i inur. In th lattr a that CW i nryptd i important to p th ommuniation ur. Howvr in many urrnt hm i alway a fixd paramtr whih gratly rdu th urity in th pirat an ta nown plain-txt atta by avdropping th ommuniation. Morovr without mutual authntiation th pirat an dupliating mart ard or rdirt th ommuniation mag of a lgitimatd mart ard and STB to othr STB to ntitl th unauthorizd ur to riv th hargd program whih will au a grat lo for th rvi providr. So dynami and mutual authntiation btwn STB and mart ard i nary. Ky xhang protool i on of th way to raliz two or mor ntiti rahing an agrmnt on a ion y vn ovr inur hannl whih an b ud for dynami in our hm to improv th urity of th ytm [8]. In 1976 Diffi- Hllman propod th wll-nown publi y ditribution bad on dirt logarithm problm [9] to nabl two ntiti to rah a ommon ion y by xhang publi y. But in thir hm thr i no authntiation o it i vulnrabl to man-inmiddl atta and rplay atta. Morovr th omputation of xponntial modular in thir hm i a havy load for mart ard. D.S.Wong and A.H.Chan [10] propod a mutual authntiation and y xhang for low powr wirl ommuniation to rit th rplay atta and man-in-middl atta but K.Shim [11] howd that thir hm wa inur againt unnown y-har atta. Authntiation bad on zro-nowldg proof i an ffiint and ur way to raliz mart ard authntiation [12] but it nd a grat dal of xhangd mag. Bid thr no y xhang to

3 884 tablih ion y. So it i not uitabl for STB and mart ard dirtly. C.P.Shnorr [6] propod an ffiint digital ignatur protool in 1989 whih i ffiint and ur for mart ard appliation. Morovr it an hift mot of th omputational wor in a prproing priod. In our hm w adopt thi protool to raliz mutual authntiation for mart ard and STB whih will gratly improv th ffiiny of th ytm. Hr w giv a brif rviw of thi protool. Sytm hoo two prim p and whr i a prim fator of p-1 * (i.. p 1 ). α p and a 1mod p 1. Th ubribr Bob ha a privat y x and a publi y y whr x 1 < x < and y = g mod p. Th ignatur and vrifying pro i th following. Signr Bob hoo a random intgr and omput r = g mod p whr 1 < <. For mag m Bob onatnat (rm) and omput = h( r m) = xmod and nd ( ) to vrifir Ali for h i a on-way hah funtion whih map an vrifying whr () arbitrary bit tring to a bit tring having fixd lngth l * i.. h():{01} {01} l. Ali omput r' = g y mod p and h whthr hr ( ' m) = i tru or not. If it i tru thn ignatur ( ) i lgal. IEEE Tranation on Conumr Eltroni Vol. 50 No. 3 AUGUST 2004 III. SECURE COMMUNICATION BETWEEN STB AND SMART CARD In thi tion w put forward a y xhang with mutual authntiation bad on Shnorr ignatur and on-way hah funtion for th ur ommuniation btwn STB and mart ard whih an b dividd into fiv pha that i rgitration pha login pha mutual authntiation pha y agrmnt pha CW tranmiion pha. Th ur ommuniation btwn STB and mart ard i hown a figur 3. A. Rgitration Pha Lt h() b a ur on-way hah funtion who output lngth i 128 bit. i th bitwi-or xluion opration. Whn a ur appli to ubrib th harg program with hi mart ard idntity ID and paword PW SMS omput R = hid ( x) hpw ( ) hr x i a rt y of th STB. In addition SMS hoo two publi prim p and a thm in Shnorr hm whr p and ar 512 bit and 140 bit rptivly to guarant th urity of th ytm. x SMS omput y = g mod p hr x and y ar th privat y and th publi y of mart ard rptivly. SMS tor { R g ID ID h() E()} a wll a MPK and othr aount information in th mart ard and iu it to th ur whr E() i a ymmtrial nryption algorithm for nrypting CW. Smart Card STB Subribr input ID and PW Comput X = R h( PW) t r t Pr-omput T = g mod p Y = h( T ID ID ) Ch Comput M = hid ( r) d = t+ x mod X T Y r ID M d Ch X = h( ID X) Comput hid ( r) = M [02 ) Ch d A= h( g y mod p ID ID ) = h( r ID ID ) = h( r ID ID ) CW ( ) = E CW CW CW = E 1 ( CW ) Fig.3. Sur ommuniation btwn STB and mart ard.

4 T. Jiang t al.: Sur Communiation btwn St-top Box and Smart Card in DTV Broadating 885 B. Login Pha Whn a ur want to riv th ubribd program h mut attah hi mart ard to hi STB and input hi ID and PW. Th mart ard thn do th following: 1. Gnrat two random numbr t and r in and omput t T = g mod p and Y h( T ID ID ) =. All of th abov wor an b pr-omputd in th idl tim of lat running priod. 2. Comput X = R h( PW). 3. Snd login rut mag { XYrID } to th STB for login. C. Mutual Authntiation Pha Upon riving th login rut STB and mart ard nd do th following tp to raliz mutual authntiation: 1. STB firt h th validity of ID. If it i invalid STB rjt thi rut. 2. STB h X = h( ID x) tru or not. If tru STB riv th login rut and ta th nxt tp; othrwi rjt thi login rut. 3. STB hoo a random numbr 0 < 2 and omput M = hid ( r) whr th lngth of i 72 bit uggtd by Shnorr. 4. STB nd {M } to mart ard for idntifying. 5. Smart ard h M ' = hid ( r) = M tru or not if tru apt th STB idntity and ta th nxt tp othrwi dni thi ommuniation. 6. Smart ard omput d = t+ x mod p and nd it to d STB. STB h Y = h( g y ID ID) tru or not. If it i tru in d t+ x x g y mod p = g g mod p = g t mod p = T STB apt th mart ard; othrwi STB rjt th mart ard. D. Ky Agrmnt Pha If th mutual authntiation i pad ufully for both STB and mart ard thn thy u th following uation to omput a ommon ion y = h( r ID ID) whih inlud both th random numbr hon by STB and mart ard. E. CW Tranmiion Pha Aftr drypting out CW mart ard u to nrypt it a CW ( ) = E CW and nd CW ba to STB for drambling th program. STB an drypt th CW a CW = E 1 ( CW ) whr E ( x ) and E 1 ( x) man nrypting x with y and drypting x with y rptivly. IV. SECURITY AND PERFORMANCE ANALYSIS In our hm ion y i gnratd a th output of a on-way hah funtion who input i th onatnation of r ID and ID. ID and th on-way funtion ar only nown to th both ntiti without th information th pirat an t omput out th ion y by avdroppd mag. STB only nd to tor th mart ard idntity whih an prvnt attaing on STB to gt th paword of mart ard. Th rt y x i prottd by on-way hah funtion whih an t b dryptd for forging mart ard. For ah ommuniation thr nd mutual authntiation and y xhang to rah a dynami ion y for whih both ntiti provid y d information (i.. r and ) whih an rit rplay atta and impronatd atta a wll a avoid forward urity problm. Morovr at ah tim th ion y i diffrnt whih an inra th diffiulty to atta th nryption algorithm with nown plain-txt atta. For mart ard authntiation w u Shnorr digital ignatur who urity i bad on dirt logarithm problm. For authntiation for STB on-way hah funtion who urity i bad on th diffiulty to invr omputation i adoptd to rdu th omputation ot and improv th ffiiny. On mart ard loning and MCorma Ha problm whn a pirat u hi lond mart ard to anothr STB in thr i no STB ID in th lond mart ard and th hah funtion in STB i diffrnt with mart ard o it an not pa th mutual authntiation pha. Similarly whn a pirat rdirt on mart ard ommuniation mag to anothr on STB ha no information of ion y without mutual authntiation and y xhang o STB an t drypt th mag rdirtd from othr mart ard. Morovr th ur an frly hang hi mart ard paword from PW to PW ' jut by rplaing and toring R with R ' in mart ard whr R ' = R h( PW) h( PW ') whih an improv th urity of mart ard a wll a prvnt hildrn from wathing hargd program alon. So vn with martard a ur who don t now th paword till an t riv th program. Conidring th limitd omputation apability of th mart ard th wor load of mart ard hould b onidrd arfully. Th xponntiation modular omputation i a otly ta for mart ard whih hould b rdud a poibl. In th propod hm thr only on xponntiation modular whih an b promputd at th idl tim of th mart ard whih an gratly rdu th load of th mart ard. Bid ignoring th impl bitwi-or opration and onatnation omputation th mart ard only nd thr hah and on multipliation modular omputation and a ymmtrial nryption in all th pha whih i ffiint for mart ard ralizing. For STB thr only nd four hah funtion

5 886 omputation two xponntiation modular omputation and on dryption whih i a light load for STB. On ommuniation ot for mutual authntiation and y xhang th propod hm only nd XYrID Md btwn STB and mart ard with whih th pirat an t figur out th ion y. Morovr th total lngth of all th abov paramtr i about 800 bit whih i muh l than th ot of authntiation bad on RSA and othr algorithm. V. CONCLUSIONS In thi papr bad on Shnorr digital ignatur protool and on-way hah funtion w propod a y xhang protool for th ur ommuniation btwn mart ard and STB in DTV broadating whih ha th following mrit: urity dynami ion y mutual authntiation lowr omputation and ommuniation and frly paword for ur. Morovr th propod hm an prvnt two riou problm in DTV broadating that i mart loning and MaCorma Ha problm. REFERENCES [1]. F.Tu t al On y ditribution managmnt for onditional a ytm on Pay-TV ytm IEEE Tran. on Conumr Eltroni Vol.45. Fb 1999 pp [2]. T.Jiang t al Ky ditribution bad on hirarhial a ontrol for Conditional A Sytm in DTV broadat IEEE Tran. on Conumr Eltroni Vol. 50. Fb 2004 pp [3]. B.Ma and J.Quiuatr Cryptology for digital TV broadating Proding of th IEEE Vol. 83 No pp [4]. W.Kanjanarin and T.Amornraa Srambling and y ditribution hm for digital tlviion IEEE Intrnational Confrn on Ntwor Ot 2001 pp [5]. N.Kogam t.al A pratial rvoation hm for broadat nryption uing mart ard Pro. of IEEE ympoium on urity and privay 2003pp [6]. C.P.Shnorr Effiint idntifiation and ignatur for mart ard In Crypto 89 LNCS pp IEEE Tranation on Conumr Eltroni Vol. 50 No. 3 AUGUST 2004 [7]. F.Kamprman and B.V.Rijnovr Conditonal a ytm Introprability through oftwar downloading IEEE Tran. on Conumr Eltroni Vol 47 No pp [8]. Bru Shnir Applid Cryptography. John Wily&Son [9]. W.Diffi and M.E.Hllman Nw dirtion in ryptography IEEE Tran. on Information Thory V.IT-22 Nov 1976 pp [10]. D.S.Wong and A.H.Chan Mutually authntiation and y xhang for low powr wirl ommuniation. Pro. IEEE MILCOM Vol.1. pp [11]. K.Shim Cryptanalyi of mutual authntiation and y xhang for low powr wirl ommuniation IEEE ommuniation lttr Vol pp [12]. H.P.Konig Cryptographi idntifiation mthod for mart ard in th pro of tandardization IEEE ommuniation magazin Jun 1991 pp Tianpu Jiang rivd th B.S. and M.S. dgr in intrumnt and ignal proing nginring from Harbin Intitut of Thnology Harbin P.R China in 1999 and 2001 rptivly. H i urrntly woring for th Ph.D. dgr in ltroni nginring at th Intitut of Imag Communiation and Information Proing of Shanghai Jiao Tong Univrity Shanghai P. R. China. Sin 2001 h ha bn ngagd in th rarh and dvlopmnt for China digital tlviion broadating ytm and digital tlviion rivr. Hi rarh intrt inlud HDTV St-top box middlwar onditional a ytm and mart ard authntiation. Yongmin Hou i urrntly woring for th Ph.D. dgr in th dpartmnt of ltroni nginring at Intitut of Modrn Communiation Rarh of Shanghai Jiao Tong Univrity Shanghai P. R. China. Hi gnral rarh intrt inlud wirl ommuniation HDTV and mart ard authntiation. Shibao Zhng graduatd from Xidian Univrity in 1986 and rivd B.S. dgr. From 1986 to 1999 h wa an xprt of important projt in HDTV of China. From 2000 h word in Intitut of Imag Communiation and Information Proing of Shanghai Jiao Tong Univrity a a profor. Hi gnral rarh intrt inlud DTV multimdia in ntwor and ASIC dign.