Granted Patent B2

US 12,481,792 · App. 17/996,883 · Granted Nov 25, 2025

Inventors: Karine Villegas (Cheseaux-sur-Lausanne, CH); Roan Hautier (Cheseaux-sur-Lausanne, CH); Pascal Fuchs (Cheseaux-sur-Lausanne, CH); Fabien Gremaud (Cheseaux-sur-Lausanne, CH)

Assignee: NAGRAVISION SARL

G06F21/64H04L9/3247

Abstract

Claims (56)

1 . A method for processing digital information, performed by a processing device, said digital information being stored in a plurality of segments in an external memory, the method comprising:

loading a first integrity table containing a plurality of first integrity elements respectively authenticating the plurality of segments of digital information, and an associated digital signature of said plurality of first integrity elements, from the external memory;

verifying the digital signature associated with the first integrity table,

after loading the first integrity table and verifying the associated digital signature, loading encrypted segments of digital information from the external memory to the processing device;

loading separately integrity data of the segments of digital information from the external memory, wherein the integrity data of each segment of digital information includes a first integrity element encrypted and a second integrity element authenticating encrypted data resulting from an encryption of said segment of digital information concatenated with said first integrity element; and, for each segment of digital information:

concatenating the encrypted segment of digital information that has been loaded and the corresponding integrity data loaded separately;

verifying the integrity of the encrypted segment of digital information concatenated with the first integrity element encrypted using the second integrity element;

decrypting the segment of digital information and the first integrity element and outputting the segment of digital information and the first integrity element concatenated together;

verifying the integrity of the segment of digital information using the concatenated first integrity element;

checking that the first integrity element matches a corresponding first integrity element in the first integrity table, an authenticity of the segment being indirectly verified by the verification of the digital signature associated with the first integrity table; and

processing the segment of digital information.

2 . The method according to claim 1 , wherein the step of loading the first integrity table is executed during a startup procedure of the processing device.

3 . The method according to claim 1 , wherein the processing device loads, from the external memory, a second integrity table containing the integrity data for each of the plurality of segments of digital information, stores said second integrity table in an internal memory, and, for each encrypted segment of digital information that has been loaded, retrieves the corresponding integrity data from the second integrity table that is stored in the internal memory in order to concatenate the encrypted segment of digital information and the corresponding integrity data.

4 . The method according to claim 1 , wherein, for each segment of digital information to be processed that is handled by the processing device, the processing device performs an external access to the external memory and loads the corresponding integrity data from a second integrity table that is stored in the external memory.

5 . The method according to claim 1 , wherein the step of verifying the signature of said plurality of first integrity elements is performed using a global key, wherein the global key is a key that is generated and can be used for a plurality of processing devices in one cryptographic algorithm.

6 . The method according to claim 1 , wherein the step of verifying the integrity of the segment of digital information using the first integrity element concatenated with said segment of digital information is performed further using a global key, wherein the global key is a key that is generated and can be used for a plurality of processing devices in one cryptographic algorithm.

7 . The method according to claim 1 , wherein the step of verifying the integrity of the encrypted segment of digital information concatenated with the first integrity element encrypted using the second integrity element and the step of decrypting the segment of digital information and the first integrity element are performed using one or two unique keys, wherein each unique key is a key generated uniquely for the processing device.

8 . A non-transitory computer-readable medium comprising program instructions for causing the processing device for processing the digital information to perform the steps of the method of claim 1 when executed by processing circuitry of the processing device.

9 . A method for producing digital information, comprising:

segmenting the digital information in a plurality of segments of digital information;

computing a first integrity element for each of said plurality of segments of digital information, wherein the first integrity element allows authenticating the corresponding segment of digital information, in order to obtain a plurality of first integrity elements respectively associated with the plurality of segments of digital information;

generating a first integrity table containing only said plurality of first integrity elements, computing a single digital signature using said plurality of first integrity elements contained in the first integrity table, and adding said single digital signature to the first integrity table;

encrypting the segments of digital information respectively concatenated with the associated first integrity elements to output encrypted data; and

for each segment of digital information:

computing a second integrity element authenticating the encrypted data resulting from encrypting said segment of digital information concatenated with said first integrity element and concatenating said encrypted data and the second integrity element;

separating the encrypted segment of digital information and integrity data that includes the first integrity element encrypted and the second integrity element;

adding said integrity data into a second integrity table; and

storing the first integrity table, the second integrity table and the encrypted segments of digital information in a memory.

10 . A non-transitory computer-readable medium comprising program instructions for causing a digital information provider to perform the steps of the method of claim 9 when executed by processing circuitry of the digital information provider.

11 . A device for processing digital information stored in a plurality of segments in an external memory, the device comprising:

processing circuitry configured to

load, from the external memory, a first integrity table containing a plurality of first integrity elements respectively authenticating the plurality of segments of digital information, and an associated digital signature of said plurality of first integrity elements,

verify the digital signature associated with the first integrity table;

after loading the first integrity table and verifying the associated digital signature, loading from the external memory, encrypted segments of digital information;

loading separately, from the external memory, integrity data of the segments of digital information, wherein the integrity data of each segment of digital information includes a first integrity element encrypted and a second integrity element authenticating encrypted data resulting from an encryption of said segment of digital information concatenated with said first integrity element and are loaded separately from the segment of digital information;

concatenate an encrypted segment of digital information that has been loaded and the corresponding integrity data loaded separately;

verify the integrity of the encrypted segment of digital information concatenated with the first integrity element encrypted using the second integrity element;

decrypt the segment of digital information and the first integrity element and output the segment of digital information and the first integrity element concatenated together;

verify the integrity of the segment of digital information using the concatenated first integrity element;

check that the first integrity element matches a corresponding first integrity element in the first integrity table, an authenticity of the segment being indirectly verified by the verification of the digital signature associated with the first integrity table; and

process the segment of digital information.

12 . A system, comprising:

the processing device according to claim 11 , and

the external memory storing:

the digital information in the plurality of segments of digital information;

the first integrity table containing the plurality of first integrity elements respectively authenticating the plurality of segments of digital information and the digital signature of said plurality of first integrity elements; and

a second integrity table containing integrity data of the segments of digital information, wherein the integrity data of each segment of digital information includes the first integrity element encrypted and the second integrity element authenticating encrypted data resulting from an encryption of said segment of digital information concatenated with said first integrity element.

13 . A digital information provider for producing digital information, comprising:

processing circuitry configured to

segment the digital information in a plurality of segments of digital information;

generate a first integrity element for each of said plurality of segments of digital information, wherein the first integrity element allows authenticating the corresponding segment of digital information, in order to obtain a plurality of first integrity elements respectively associated with the plurality of segments of digital information;

generate a first integrity table containing only said plurality of first integrity elements and a single digital signature using said plurality of first integrity elements contained in the first integrity table;

encrypt the segments of digital information respectively concatenated with the associated first integrity elements into encrypted data, wherein the processing circuitry is further configured to generate a second integrity element authenticating the encrypted data resulting from encrypting said segment of digital information concatenated with said first integrity element and concatenating said encrypted data and the second integrity element;

separate the encrypted segment of digital information and integrity data that includes the first integrity element encrypted and the second integrity element; and

generate a second integrity table containing said integrity data of each segment of digital information; and

a memory to store the first integrity table, the second integrity table, and the encrypted segments of digital information in a memory.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (31)