Control word protection method for conditional access system

1. A method for securely obtaining a control word (CW), the method comprising:

receiving a secure version of a link key (LK) from a processor of a receiver;

using a signature verification key (SPK) corresponding to a signature key (SSK) and a secret key (CSK) to obtain the link key (LK) from the secure version of the link key;

receiving a secure version of provisioning data from the processor;

using the obtained link key (LK) or the signature verification key (SPK) corresponding to the signature key (SSK) to verify authenticity of the secure version of the provisioning data;

receiving a secure version of a virtual control word (r) from the processor;

using the obtained link key (LK) to obtain the virtual control word (r) from the secure version of the virtual control word (r); and

using a cryptographic function (h) to generate the control word (CW) from inputs, wherein the inputs include the virtual control word (r), the signature verification key (SPK), and the provisioning data.

2. The method of claim 1 , wherein:

the secure version of the link key (LK) is encrypted using a public key (CPK) so that confidentiality of the link key is protected, and is obtained by making a signature using the signature key (SSK) associated with a sender so that the authenticity of the link key is protected, and

the secure version of the link key (LK) includes:

i) a unique chipset ID (chipset-ID) associated with a chipset of the receiver, ii) a link key (LK) encrypted using the public key (CPK) associated with the chipset, and iii) a signature generated from the chipset ID and the encrypted link key (LK) using the signature key associated with the sender, and

wherein using a signature verification key (SPK) comprises:

i) verifying the signature using the signature verification key (SPK) corresponding to the signature key (SSK), and

ii) decrypting the encrypted link key (LK) using the secret key (CSK) associated with the chipset.

3. The method of claim 2 , further comprising:

receiving multiple signature verification keys from the processor, wherein each of the signature verification keys is associated with a conditional access/digital rights management system corresponding thereto; and

verifying the signature included in the secure version of the link key (LK) using one of the received signature verification keys.

4. The method of claim 2 , further comprising storing, by the chipset, the link key (LK) obtained from the encrypted link key (LK) in order to use the link key (LK) for decrypting the secure version of the virtual control word (r), received by the chipset, and to verify authenticity of the secure version of the provisioning data.

5. The method of claim 3 , further comprising determining, using the stored link key (LK), whether a message authentication code is identical to a message authentication code attached to the secure version of the provisioning data,

wherein if it is determined using the stored link key (LK) that the message authentication code is not identical to the message authentication code attached to the secure version of the provisioning data, the link key (LK) is not used to obtain the virtual control word (r) from the secure version of the virtual control word (r).

6. The method of claim 1 , further comprising:

receiving multiple signature verification keys from the processor, wherein each of the signature verification keys is associated with a conditional access/digital rights management system corresponding thereto; and

providing a signature verification key used to verify authenticity of the secure version of the link key (LK), among the received signature verification keys, as an input of the cryptographic function (h).

7. The method of claim 1 , the secure version of the provisioning data is obtained by attaching a message authentication code (MAC) using the link key (LK) or a key derived from the link key to the provisioning data, or by making a signature using the signature key (SSK) associated with the sender so that authenticity of the provisioning data is protected.

8. The method of claim 7 , wherein the secure version of the provisioning data includes a first message in which the message authentication code is attached to a bit string (CW-URI) defining usage rule information for the control word (CW), and a second message in which the message authentication code is attached to the bit string (AD) indicating the application data.

9. The method of claim 7 , wherein the secure version of the provisioning data includes a first message in which the signature using the signature key (SSK) associated with the sender is attached to the bit string (CW-URI) defining usage rule information for the control word (CW) and a second message in which the signature using the signature key (SSK) associated with the sender is attached to the bit string (AD) indicating the application data.

10. The method of claim 1 , wherein:

the provisioning data is configured to selectively include at least one of i) a bit string (CW-URI) defining the usage rule information for the control word (CW), and ii) the bit string (AD) indicating the application data, and

the provisioning data further includes a bit string (flag b ) defining whether each of the bit strings is included in the provisioning data.