Hacking prevention system

1. A method for producing an output from an input encoding the output, the method comprising:

choosing functions G, F, and H;

at an Integrated Conditional Access Module (ICAM), performing the following:

providing an input x;

choosing a random number r, using at least one of a random number generator and a pseudo-random number generator;

computing x′=G(x, r); and

sending x′ to a computation unit;

at the computation unit, performing the following:

computing, in the computation unit, y′=F(x′); and

sending y′ to the ICAM;

computing, in the ICAM, the output w =H(y′, r); and

utilizing w as at least one of: a control word and a decryption key, wherein G, F, and H are chosen such that w is not dependent on the choice of r.

2. The method according to claim 1 and further comprising:

utilizing the output to decrypt an encrypted message.

3. The method according to claim 1 and wherein F comprises a secret function.

4. The method according to claim 1 and wherein the random number generator comprises a secure random number generator.

5. The method according to claim 1 and wherein the function G is chosen such that derivation of r from x and G(r, x) is computationally unfeasible.

6. The method according to claim 1 and wherein the function F is chosen such that, for two inputs x 1 and x 2 , it is computationally unfeasible to compute F(x 1 ) from x 1 , x 2 , and F(x 2 ).

7. The method according to claim 1 and also comprising choosing a group having a computationally hard discrete logarithm problem, and wherein:

G ( x, r )= x, g r , and

F ( x, u )= u a(x) , and

H ( y, r )= y 1/r mod order of the group , and

a(x) is a secret cryptographic function, and

g is a fixed generator of the group, and

r is a large secret random integer relatively prime with the order of the group.

8. The method according to claim 1 and also comprising:

providing a large prime number p;

choosing a random number r relatively prime with (p-1); and

computing r′=1/r mod (p-1), and wherein:

the output w has the form b a(x) mod p, and

a(x) is a secret cryptographic function, and

G ( x, r )=( x, b r mod p ), and

F ( x ′)= u a(x) mod p , where x ′=( x, u ), and

H ( y′, r )= y′ r′ mod p.

9. The method according to claim 8 and wherein b is a generator of all of 1 . . . p-1.

10. The method according to claim 8 and wherein b is a generator of a sub-group of 1 . . . p-1, the order of said sub-group being large and prime.

11. The method according to claim 10 and wherein the order of said sub-group is greater than 2 120 .

12. The method according to claim 10 and wherein the order of said sub-group is greater than 2 160 .

13. The method according to claim 1 and wherein the computation unit comprises a secure computation unit.

14. The method according to claim 13 and wherein the secure computation unit comprises a removable security element.

15. The method according to claim 14 and wherein the removable security element comprises a smart card.

16. A secure system for producing an output from an input x encoding the output, the system comprising:

an Integrated Conditional Access Module (ICAM), the ICAM comprising:

a random number generator choosing a random number r;

a randomized operation unit computing x′=G(x, r); and

an “inverse” randomized operation unit; and

a computation unit receiving x′ and computing y′=F(x′), wherein

the “inverse” randomized operation unit receives y′ from the computation unit and computes the output w =H(y′, r), and

G, F, and H are functions chosen such that w is not dependent on the choice of r.

17. The system according to claim 16 and wherein the random number generator, the randomized operation unit, and the “inverse” randomized operation unit are comprised in an output-production subsystem, and

the computation unit is adapted for use with more than one said output-production system, and

the computation unit is not operable to distinguish between one output-production subsystem and another output-production subsystem.

18. The system according to claim 16 and wherein the random number generator, the randomized operation unit, and the “inverse” randomized operation unit are comprised in an output-production subsystem, and

the computation unit is adapted for use with more than one said output-production system, and

the computation unit is not operable to determine, based solely on communication with the output-production subsystem, whether the output-production subsystem is entitled to receive output from the computation unit.

19. The system according to claim 16 and wherein the output comprises one of the following: a control word (CW); and a decryption key.

20. The system according to claim 19 and further comprising:

a utilization unit utilizing the output to decrypt an encrypted message.

21. The system according to claim 16 and wherein F comprises a secret function.

22. The system according to claim 16 and wherein the random number generator comprises a secure random number generator.

23. The system according to claim 16 and wherein the random number generator comprises a pseudo-random number generator.

24. The system according to claim 16 and wherein the function G is chosen such that derivation of r from x and G(r, x) is computationally unfeasible.

25. The system according to claim 16 and wherein the function F is chosen such that, for two inputs x 1 and x 2 , it is computationally unfeasible to compute F(x 1 ) from x 1 , x 2 , and F(x 2 ).

26. The system according to claim 16 and wherein a group having a computationally hard discrete logarithm problem is chosen, and

G ( x, r )= x,g r , and

F ( x, u )= u a(x) , and

H ( y, r )= y 1/r mod order of the group , and

a(x) is a secret cryptographic function, and

g is a fixed generator of the group, and

r is a large secret random integer relatively prime with the order of the group.

27. The system according to claims 16 and wherein a large prime number p is provided, and

a random number r relatively prime with (p-1) is chosen, and

r′=1/r mod (p-1) is computed, and

the output w has the form b a(x) mod p, and

a(x) is a secret cryptographic function, and

G ( x, r )=( x, b r mod p ), and

F ( x ′)= u a(x) mod p , where x ′=( x, u ), and

H ( y′, r )= y′ r′ mod p.

28. The system according to claim 27 and wherein b is a generator of all of 1 . . . p-1.

29. The system according to claim 27 and wherein b is a generator of a sub-group of 1 . . . p-1, the order of said sub-group being large and prime.

30. The system according to claim 29 and wherein the order of said sub-group is greater than 2 120 .

31. The system according to claim 29 and wherein the order of said sub-group is greater than 2 160 .

32. The system according to claim 16 and wherein the computation unit comprises a secure computation unit.

33. The system according to claim 32 and wherein the secure computation unit comprises a removable security element.

34. The system according to claim 33 and wherein the removable security element comprises a smart card.

35. A secure system for producing an output from an input x encoding the output, the system comprising:

an Integrated Conditional Access Module (ICAM), the ICAM comprising:

a random number generator choosing a random number r;

a randomized operation unit computing x′=G(x, r);

an interface adapted to communicate with a computation unit external to the secure system, the computation unit receiving x′ and computing y′=F(x′); and

an “inverse” randomized operation unit; wherein

the “inverse” randomized operation unit receiving y′ from the computation unit and computing the output w=H(y′, r), and

G, F, and H are functions chosen such that w is not dependent on the choice of r.

36. The system according to claim 35 and wherein the random number generator, the randomized operation unit, and the “inverse” randomized operation unit are comprised in an output-production subsystem, and

the computation unit is adapted for use with more than one said output-production system, and

the computation unit is not operable to distinguish between one output-production subsystem and another output-production subsystem.

37. The system according to claim 35 and wherein the random number generator, the randomized operation unit, and the “inverse” randomized operation unit are comprised in an output-production subsystem, and

the computation unit is adapted for use with more than one said output-production system, and

the computation unit is not operable to determine, based solely on communication with the output-production subsystem, whether the output-production subsystem is entitled to receive output from the computation unit.

38. The system according to claim 35 and wherein the output comprises one of the following: a control word (CW); and a decryption key.

39. The system according to claim 38 and further comprising:

a utilization unit utilizing the output to decrypt an encrypted message.

40. The system according to claim 35 and wherein F comprises a secret function.

41. The system according to claim 35 and wherein the random number generator comprises a secure random number generator.

42. The system according to claim 35 and wherein the random number generator comprises a pseudo-random number generator.

43. The system according to claim 35 and wherein the function G is chosen such that derivation of r from x and G(r, x) is computationally unfeasible.

44. The system according to claim 35 and wherein the function F is chosen such that, for two inputs x 1 and x 2 , it is computationally unfeasible to compute F(x 1 ) from x 1 , x 2 , and F(x 2 ).

45. The system according to claim 35 and wherein a group having a computationally hard discrete logarithm problem is chosen, and

G ( x, r )= x, g r , and

F ( x, u )= u a(x) , and

H ( y, r )= y 1/r mod order of the group , and

a(x) is a secret cryptographic function, and

g is a fixed generator of the group, and

r is a large secret random integer relatively prime with the order of the group.

46. The system according to claim 35 and wherein a large prime number p is provided, and

a random number r relatively prime with (p-1) is chosen, and

r′=1/r mod (p-1) is computed, and

the output w has the form b a(x) mod p, and

a(x) is a secret cryptographic function, and

G ( x, r )=( x, b r mod p ), and

F ( x ′)= u a(x) mod p , where x ′=( x, u ), and

H ( y′, r )= y r′ mod p.

47. The system according to claim 46 and wherein b is a generator of all of 1 . . . p-1.

48. The system according to claim 46 and wherein b is a generator of a sub-group of 1 . . . p-1, the order of said sub-group being large and prime.

49. The system according to claim 48 and wherein the order of said sub-group is greater than 2 120 .

50. The system according to claim 48 and wherein the order of said sub-group is greater than 2 160 .

51. The system according to claim 35 and wherein the computation unit comprises a secure computation unit.

52. The system according to claim 51 and wherein the secure computation unit comprises a removable security element.

53. The system according to claim 52 and wherein the removable security element comprises a smart card.