CN1315324C - Safe access method and device for digital broadcast television network - Google Patents

Abstract

The invention discloses a method for safely accessing a digital broadcast television system. The method includes: 1) establishing an interactive digital broadcast television system; 2) when the terminal part is turned on, the interactive service processing unit initiates an authentication for accessing the interactive network to the interactive network , the interactive network uses the user access protocol of the interactive network itself to authenticate the user's access to the interactive network for the terminal part; The part of the terminal authenticated by the user access system accesses the digital broadcasting television system. The present invention also discloses a security access device set according to the above method. The front part of the device includes a multiplexer, a scrambler, a control word generator and a service management control unit, and the terminal part includes a decomplexer, a descrambler and an interactive service processing unit. The invention also discloses the corresponding front-end and back-end devices. The method and device of the present invention overcome the defect that the system completely relies on key encryption and has poor security, and has simple structure, easy realization and easy control of the system.

Description

Method and device for secure access to digital broadcasting television network

technical field

The invention relates to the access technology of the broadcast television network, in particular to a method and device for safely accessing the digital broadcast television network.

Background technique

Most of the current radio and television networks ignore security issues at the initial stage of construction. Even if security issues are considered, the security mechanism is only based on the physical security mechanism. It is useless to say. For example: the cable TV network and satellite TV network in some areas have been illegally attacked, and people's normal viewing has been disturbed or interrupted, which has caused great damage to the TV network, brought huge economic losses, and even caused extremely bad social impact . Therefore, logical measures, such as security protocols, cryptography, and security management, are necessary and should be adopted to strengthen access authentication and prevent illegal user intrusion.

Just in order to achieve the above purpose and solve various threats to the current broadcast network security, an effective method is to develop digital TV, because the conditional access (CA) system in the digital TV system platform plays the core security protection effect. The CA system refers to the conditional access mechanism of the digital broadcast TV system, and is the basic operation support facility to protect the legitimate operating income of digital TV content providers and broadcast TV network operators. Scrambling, descrambling and restoration at the user end, online authorization for paid users, can enable paid TV users to watch programs normally, and unpaid TV users cannot watch programs, so the CA system is also a way to protect the interests of TV operators. The charging control system implemented by encryption technology for the fundamental purpose. Since the CA system involves the digital TV front end, transmission network and user end, that is to say, it involves the entire broadcast TV network, it is also a security system that can resist digital TV maliciously attacked for commercial or political purposes. Its main security goal is to prevent Digital TV user authorization devices are counterfeited or copied in large numbers by pirates for commercial purposes, and to prevent illegal digital TV programs or information from being mixed into digital broadcast TV networks.

The current CA system is designed for a one-way broadcast TV network, and its implementation method is shown in FIG. 1 . FIG. 1 is a block diagram of a CA system in an existing one-way digital broadcast TV system. As shown in Figure 1, the front-end part 110 of existing digital broadcast television system comprises: multiplexer 111, scrambler 112, encryptor 113, encryptor 114, service information (SI) generator 115, user authorization system 116, Control word (CW) generator 117, program information management system 118 and user management system 119; terminal part (STB) includes: descrambler 132, decomplexer 131, descrambler 133, descrambler 134, security processor 135. Terminal section 130 includes a smart card system 136 .

In the above-mentioned unidirectional digital broadcasting TV system, the CA system is mainly implemented through user access authentication and service authorization, and its security is completely concentrated on the terminal. The specific process is given below.

In the front end, the existing CA system uses a triple key mechanism to encrypt the transmission program:

1. Using the scrambler 112, according to the control word generated by the control word (CW) generator 117, the pseudo-random sequence generator is initially triggered to generate a new pseudo-random sequence to scramble the service information. The control word is a set of The random number changes randomly every few seconds, and it needs to be descrambled under the control of the same control word at the receiving end;

2, encrypt the control word that control word (CW) generator 117 produces with encryptor 114, put into entitlement control information (ECM);

3. Use the encryptor 113 to encrypt the user management information provided by the user management system 119 to form authorization management information (EMM). The encrypted information and program information (PSI) are combined by the multiplexer 111 to form service information. The service information is scrambled by the scrambler 112 and transmitted to the terminal part 130 through the broadcast network 120 .

In the terminal part 130, the existing CA system first uses the decryptor 134 to decrypt the EMM with the PDK (personal distribution key), takes out the service key (SK), sends it to the security processor 135, and judges whether the terminal has the right to receive business. If authorized, the decryptor 133 uses the service key SK to decrypt the control word CW in the ECM, and then provides the CW to the descrambler 132 for use. The descrambler 132 uses the control word to descramble, and the descrambled information is sent to the decomplexer 131; otherwise, the service information cannot be received.

It can be seen from the existing CA system user access authentication and service authorization scheme described above that the CA system is limited by the one-way network, which makes the scheme not only complicated, but also has some disadvantages in terms of security:

1. Its security relies heavily on the capabilities of the terminal. Once the algorithm is cracked, any place within the system's scope of action will be completely exposed to the threat of stolen solutions.

2. The existing CA system cannot authenticate specific business authorization, so it is difficult to prevent illegal business.

3. Due to the one-way nature of the existing CA system structure, its encryption and decryption algorithms are completely bound to the device, so pirates have enough opportunities to research a complete cracking solution, and auxiliary measures such as backup algorithms cannot make up for this fundamental defect. Therefore, the security of the existing CA system is not high.

The European DVB (Digital Video Broadcasting) organization once proposed a plan for a related interactive digital broadcast television network. In this plan, the front-end part is not only connected to the terminal part through the broadcast network, but also connected to the terminal part through the interactive network. It can realize interactive services such as broadcasting services and on-demand programs, that is to say, it can increase the interactive functions of digital broadcasting and television networks. The interactive digital radio and television network can increase the two-way interactive function of the radio and television network, and at the same time can establish a powerful user and business management platform to realize the operability and management of the radio and television system. Although there is no actual implementation plan yet, due to the powerful functions of the interactive digital broadcasting television network, it is a direction for the development of the digital broadcasting television network and has a good development prospect.

Contents of the invention

In view of this, the object of the present invention is to provide a method and device for securely accessing a digital broadcasting television network, so as to improve the security of the digital broadcasting television network.

In order to achieve the above object, the present invention provides a method for securely accessing a digital broadcast television system, the method comprising the following steps:

1) Set up a service management control unit at the front end of the digital broadcast television system, and set an interactive service processing unit at the terminal part of the digital broadcast television network system,

Connecting the service management control unit to the interactive network, connecting the interactive service processing unit to the interactive network, and establishing an interactive digital broadcasting and television system;

2) When the terminal part is turned on, the interactive service processing unit initiates the authentication of accessing the interactive network to the interactive network, and the interactive network uses the user access protocol of the interactive network itself to perform user access interactive network authentication on the terminal part, and the interactive network will pass the user The user information for accessing the interactive network authentication is sent to the service management control unit of the front end;

3) The service management control unit performs user access system authentication on the terminal part that passes the user access interactive network authentication according to the received user information, and connects the terminal part that passes the user access system authentication to the digital broadcasting and television system.

Wherein, the user access system authentication described in step 3) can be realized by the service management control unit by comparing the received user information with the user information stored by itself.

The method may further include: after the user access system is authenticated, before the service starts or the service is switched, the terminal part sends its own user information and service management information to the service management control unit of the front-end part through the interactive network, and the service management control unit The unit performs user service authorization authentication according to the user information and service management information, and returns the authentication result to the terminal part through the interactive network, and the terminal part obtains service information according to the authentication result.

The interactive network can be a wireless interactive network, including: Global System for Mobile Communications GSM network, or General Packet Radio Service GPRS network, or wideband code division multiple access WCDMA wireless communication network, or CDMA 2000 wireless communication network, or mobile broadband wireless Access the MBWA network. The step 1) may further include: setting the business management control unit as a business management module and a business control module connected to each other, connecting the business control module with the original compounder of the system, and simultaneously connecting the business control module through authentication interaction The interface is connected with the interactive network, and the service management module is connected with the interactive network through the service interface.

When the interactive network is a WCDMA network, the step 2) can be: first the terminal part reads user information from the smart card system, then the terminal part establishes a connection with the interactive network to register users, and the core network CN in the interactive network simultaneously Send the authentication request message to the smart card system through the interactive service processing unit in the terminal part, the smart card system performs authentication calculation according to the message, and send the authentication result to CN through the interactive service processing unit in the terminal part, CN according to As a result of the authentication, the users of the terminal part are authenticated for accessing the interactive network, and the user information authenticated by the accessing interactive network is sent to the service control module of the front-end part through the authentication interactive interface; Return to the interactive service processing unit of the terminal part.

In step 2), authentication can be performed by the AAA authentication server in the CN according to the wireless AAA authentication protocol of the interactive network itself.

The step 2) may further include: when the terminal is turned on, the interactive service processing unit sends the user's personal identity number PIN received by the smart card system to the interactive network, and the interactive network authenticates the number.

The step 1) further includes: setting the service management control unit as a service management module and a service control module connected to each other, connecting the service control module with the original compounder of the system, and simultaneously connecting the service control module with the authentication interaction interface. The interactive network is connected, and the service management module is connected with the interactive network through the service interface; when the interactive network is a WCDMA network, the specific process of the user service authorization authentication can be: the terminal part processes the user information and service request information through the interactive service The unit sends to the service GPRS node SGSN of the CN in the interactive network, and the SGSN forwards the information to the gateway GPRS node GGSN. After routing through the GGSN, the information is sent to the front-end service management module through the service interface. The service management module according to the service request information to complete real-time service switching, and at the same time, the service control module judges whether the user has the right to use the service according to the service request information and user information. part; otherwise, the service information will not be executed and returned to the terminal part.

The authorization information returned to the terminal part may be a service control word generated by the control word generator, and the terminal part descrambles the requested service through the descrambler according to the received service control word to obtain the corresponding service.

The user service authorization authentication process may further include: the service control module starts charging the user of the terminal part while returning confirmation authorization information to the terminal part.

At the same time, the present invention provides a secure access device for a digital broadcast television system, which is applied to an interactive digital broadcast television network. The device includes a front-end part and a terminal part. , the multiplexer is connected to the scrambler, the scrambler is connected to the broadcast network, the terminal part includes a demultiplexer and a descrambler, the decomplexer is connected to the descrambler, and the descrambler is connected to the broadcast network;

The front-end part further includes a service management control unit, which is used to perform user access system authentication on the user information received from the interactive network and passed the authentication for access to the interactive network, and pass the authentication result through interactive The network returns to the terminal section; where,

The control word generator is connected between the scrambler and the interactive network, and the service management control unit is connected between the multiplexer and the interactive network;

The terminal part further includes an interactive service processing unit, which is used to send the user information read from the smart card system to the interactive network for authentication of access to the interactive network, and receive the authentication of access to the interactive network from the interactive network Results and user access system authentication results; where,

The interactive service processing unit is connected between the descrambler and the interactive network, the interactive service processing unit is connected with the demultiplexer, and the interactive service processing unit is connected with a smart card system.

The service management control unit may further include: a service management module and a service control module, the service control module is used to receive the user information sent from the interaction network by the authentication interaction interface and passed the authentication of the access interaction network, and Perform user access system authentication according to the user information, and return the authentication result to the terminal part through the authentication interaction interface and the interaction network; wherein,

The service management module and the service control module are connected to each other, the service control module is connected to the complex, and the service control module is connected to the interaction network through the authentication interaction interface, and the service management module is connected to the interaction network through the service interface.

The present invention also provides a secure access front-end device for a digital broadcast television system, which is applied to an interactive digital broadcast television network. The device includes a multiplexer, a scrambler, and a control word generator. The scrambler is connected to the broadcast network,

The device further includes a business management control unit; used to perform user access system authentication on the user information received from the interactive network and passed the authentication for accessing the interactive network, and send the authentication result through the interactive network; wherein,

The control word generator is connected between the scrambler and the interactive network, and the service management control unit is connected between the compounder and the interactive network.

The service management control unit may further include: a service management module and a service control module; the service control module is used to receive the user information sent from the interactive network by the authentication interaction interface and passed the authentication of the access interactive network, and Perform user access system authentication according to the user information, and send the authentication result through the authentication interaction interface; wherein,

The service management module and the service control module are connected to each other, the service control module is connected to the complex, and the service control module is connected to the interaction network through the authentication interaction interface, and the service management module is connected to the interaction network through the service interface.

The present invention also provides a secure access terminal device for a digital broadcast television system, which is applied to an interactive digital broadcast television network. connected to the broadcast network,

The device further includes an interactive service processing unit, which is used to send the user information read from the smart card system to the interactive network for authentication of access to the interactive network, and receive the authentication result of access to the interactive network and the user access system authentication result from the interactive network ;in,

The interactive service processing unit is connected between the descrambler and the interactive network, the interactive service processing unit is connected with the demultiplexer, and the interactive service processing unit is connected with a smart card system.

Wherein, the smart card system may be a SIM card system.

It can be seen from the technical solution of the present invention that the secure access method of the digital broadcast television network of the present invention is to realize the power-on access authentication and service authorization authentication of the interactive digital broadcast television through the interactive network, which overcomes that the original CA system completely relies on Key encryption has the disadvantage of poor security. At the same time, from a structural point of view, it is much simpler than the original system, and it is easier to implement. The core of the encryption mechanism of the present invention lies in the authentication and authorization of the front end, which is in a controllable state for the operator, and solves the problem that the core of the encryption mechanism of the existing CA system lies in the key of the terminal, which is in an uncontrollable state for the operator question.

Description of drawings

Fig. 1 is the realization schematic diagram of CA system in the existing unidirectional digital broadcasting television system;

Fig. 2 is a schematic diagram of an interactive digital broadcast television system of a preferred embodiment of the inventive method;

Fig. 3 is a schematic diagram of the process of terminal part accessing the interactive digital broadcasting television system in the embodiment shown in Fig. 2;

FIG. 4 is a schematic diagram of a partial service authorization authentication process of the terminal in the embodiment shown in FIG. 2 .

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the embodiments and accompanying drawings.

The present invention provides a method and device for securely accessing a digital broadcast television network. The main method is to establish an interactive digital broadcast television system, establish bidirectional point-to-point interaction through the interactive network, and realize secure access to the terminal part. The access device is set up in this way. The invention makes authentication and authorization completely managed by the front-end control center, so that the equipment is completely separated from the security system, so that the equipment platform is completely open, and hackers lose their use.

Referring to Fig. 2, Fig. 2 is a schematic diagram of an interactive digital broadcasting television system according to a preferred embodiment of the inventive method. The present invention transforms the existing one-way digital broadcasting television system to form the security access device of the present invention:

In the front-end part 210, that is, in the front-end device, a service management control unit 213 is set, and the compounder 211, the scrambler 212, and the control word generator 214 in the original system are reserved; the compounder 211 and the scrambler 212 are connected, and the The scrambler 212 and the broadcast network 221, the control word generator 214 is connected between the scrambler 212 and the interactive network 222, and the service management control unit 213 is set between the multiplexer 211 and the interactive network 222.

In this embodiment, the business management control unit 213 is split into a business management module 215 and a business control module 216 that are connected to each other, and the business control module 216 is connected to the compounder 211. The network 222 is connected, and the service management module 215 is connected to the interactive network 222 through a service interface.

In this embodiment, the two scramblers 113 and 114 in the original system are not used. Of course, if not all terminal parts 230 are connected to the interactive network 222 in the household broadcasting television system, there are several that are not connected to the interactive network 222. When the terminal part 230 is connected, these two encryptors should be reserved, and the terminal part 230 not connected to the interactive network 222 should also retain the corresponding two decryptors.

In the terminal part 230, that is, in the terminal device, an interactive service processing unit 233 is set, and the decomplexer 231 and descrambler 232 in the original system are reserved; The broadcasting network 221, the interactive service processing unit 233 is arranged between the descrambler 232 and the interactive network 222, and the interactive service processing unit 233 and the demultiplexer 231 are connected simultaneously, and the interactive service processing unit 233 is connected with a smart card system 234, the smart card System 234 may be a commonly used SIM card system.

The connected interactive network 222 in the present invention can be a wireless interactive network, and can adopt mainstream cellular system: Global System for Mobile Communications (GSM) network, or General Packet Radio Service (GPRS) network, or Wideband Code Division Multiple Access (WCDMA) wireless The communication network, or the CDMA 2000 wireless communication network, can also be a non-mainstream mobile broadband wireless access network (MBWA), but considering the maturity of technology, cost, and scalability, it is better to choose the cellular system. In this embodiment, WCDMA wireless communication network is used as the wireless interactive network standard to implement.

Therefore, as shown in Figure 2, in this embodiment, the service control module 216 is connected to the wireless AAA authentication server 224 in the wireless core network packet domain 223 in the interactive network 222 through the authentication interface; the service management module 215 is connected through the service interface. In the example, the Gi interface is connected to the firewall 225 in the packet domain 223 of the wireless core network; the interactive service processing unit 233 is connected to the WCDMA wireless access network 228 in the interactive network 222 .

Referring to FIG. 3, FIG. 3 is a schematic diagram of the process of partial access of the terminal to the interactive digital broadcasting television system in the embodiment shown in FIG. 2;

As shown in Figure 3, the terminal part accessing the interactive digital broadcasting television system includes two basic processes:

First, user access interactive network authentication.

When the terminal part is turned on, first the terminal part reads the user information from the smart card system, then the terminal part establishes a connection with the interactive network, sends the user information to the SGSN in the CN in the interactive network for user registration, and sends the user information to WAAA server, the WAAA server sends the authentication request message to the smart card system through the interactive service processing unit in the terminal part, and the smart card system performs authentication calculation according to the message, and sends the authentication result through the interactive service processing unit in the terminal part To the WAAA server in the CN, the CN authenticates the user's access to the interactive network for the terminal part according to the authentication result of the WAAA server in the CN.

The entire authentication process is performed according to the wireless AAA authentication protocol of the WCDMA network itself. This process is similar to the boot authentication process when the WCDMA mobile phone accesses the WCDMA network, but the user information is different.

The authenticated user information is sent to the service control module of the front-end part through the authentication interactive interface, and the user information not passed the authentication is returned to the interactive service processing unit of the terminal part.

In addition, when the terminal part is turned on, the interactive service processing unit can also send the user's personal identification number (PIN) received by the smart card system to the interactive network, and the interactive network authenticates the number. This process is also the same as the process of authenticating the WCDMA mobile phone user's personal identification number (PIN) by the WCDMA network.

Second: user access system authentication.

The service control module performs user access system authentication by comparing the received user information with the user information stored by itself.

That is to say, the service control module performs user access system authentication on the user information received from the WAAA server through the interactive authentication interface. The business control module judges whether the user has the right to use the system business according to the user's bill information, balance information, business control, load control, etc. referred to in the user information, gives the judgment information and sends it back through the interactive authentication interface again through the interactive network user terminal.

In this way, through the interactive network, the above-mentioned authentication is performed as soon as the terminal is turned on, so as to prevent illegal users.

In this embodiment, the legal terminal part after identity authentication needs to perform service authorization authentication when obtaining services to prevent illegal services. That is, before the service starts and the service is switched, the service authorization authentication is performed on the user's service request.

FIG. 4 is a schematic diagram of a partial service authorization authentication process of the terminal in the embodiment shown in FIG. 2 .

As shown in Figure 4, first the terminal part sends the user information and service request information to the service GPRS node (SGSN) of the CN in the interactive network through the interactive service processing unit, and the SGSN forwards the information to the gateway GPRS node (GGSN), and the GGSN Provide routing to send the information to the front-end service management module through the service interface, and the service management module forwards the information to the service control module. User information judges whether the user has the right to use the service, and if so, confirms the authorization information, that is, the service control word generated by the control word generator is returned to the terminal part by the service interface through the interactive network through the service management module; otherwise Return the non-execution service information to the terminal part. The terminal part sends back confirmation information to the service control module, and at the same time descrambles the requested service through the descrambler according to the received service control word to obtain the corresponding service. The service control module starts charging the users of the terminal part while returning confirmation authorization information to the terminal part.

Once the user terminal wants to terminate the service, it will send a termination message, similar to the service authorization process, the user information and the request to terminate the service information are transmitted to the service management module through the interactive network through the Gi interface, and the service management module completes the real-time service termination according to the request to terminate the service information , and at the same time, the service control module stops charging the user, and then sends the service termination confirmation information back to the terminal user through the service management module through the Gi interface and then through the interactive network.

It can be seen from the above embodiments that the secure access method of the digital broadcasting television network of the present invention overcomes the defect that the original CA system completely relies on key encryption and has poor security, and at the same time, the system structure is simple and easy to implement. The core of the encryption mechanism in the present invention lies in the authentication and authorization of the front end, which is in a controllable state for the operator, and solves the problem that the core of the encryption mechanism of the existing CA system lies in the key of the terminal, which is in an uncontrollable state for the operator The problem.

Claims (17)

1. A secure access method for a digital broadcast television system, characterized in that the method comprises the following steps: 1) Set up a service management control unit at the front end of the digital broadcast television system, and set an interactive service processing unit at the terminal part of the digital broadcast television network system, Connecting the service management control unit to the interactive network, connecting the interactive service processing unit to the interactive network, and establishing an interactive digital broadcasting and television system; 2) When the terminal part is turned on, the interactive service processing unit initiates the authentication of accessing the interactive network to the interactive network, and the interactive network uses the user access protocol of the interactive network itself to perform user access interactive network authentication on the terminal part, and the interactive network will pass the user The user information for accessing the interactive network authentication is sent to the service management control unit of the front end; 3) The service management control unit performs user access system authentication on the terminal part that passes the user access interactive network authentication according to the received user information, and connects the terminal part that passes the user access system authentication to the digital broadcasting and television system. 2. The secure access method according to claim 1, characterized in that the user access system authentication described in step 3) is realized by the service management control unit by comparing the received user information with the user information stored by itself . 3. The secure access method according to claim 1, characterized in that the method further comprises: after the user is authenticated to access the system, before the service starts or the service is switched, the terminal part transmits its own user information and The service management information is sent to the service management control unit of the front-end part. The service management control unit performs user service authorization authentication according to the user information and service management information, and returns the authentication result to the terminal part through the interactive network. The terminal part obtains the service according to the authentication result. information. 4. The secure access method according to claim 3, wherein the interactive network is a wireless interactive network, including: a Global System for Mobile Communications (GSM) network, or a General Packet Radio Service (GPRS) network, or a broadband code division multiple WCDMA wireless communication network, or CDMA2000 wireless communication network, or mobile broadband wireless access MBWA network. 5. The secure access method according to claim 1 or 4, characterized in that said step 1) further comprises: setting the business management control unit as a business management module and a business control module connected to each other, and setting the business control The module is connected with the original compounder of the system, and at the same time, the service control module is connected with the interactive network through the authentication interactive interface, and the service management module is connected with the interactive network through the service interface. 6. The secure access method according to claim 5, wherein when the interactive network is a WCDMA network, said step 2) is: first, the terminal part reads user information from the smart card system, and then the terminal part and The interactive network establishes a connection and performs user registration. At the same time, the core network CN in the interactive network sends the authentication request message to the smart card system through the interactive service processing unit in the terminal part. The result is then sent to the CN through the interactive service processing unit in the terminal part, and the CN authenticates the user of the terminal part to access the interactive network according to the authentication result, and sends the user information authenticated through the access interactive network to the front end through the authentication interactive interface Part of the business control module; return the user information that has not passed the authentication of the access interactive network to the interactive service processing unit of the terminal part. 7. The secure access method according to claim 6, characterized in that said step 2) is to perform authentication through the AAA authentication server in the CN according to the wireless AAA authentication protocol of the interactive network itself. 8. The secure access method according to claim 6, characterized in that said step 2) further comprises: when the terminal part is turned on, the interactive service processing unit sends the user's personal identity number PIN received by the smart card system to the interactive network , the interactive network authenticates the number. 9. The secure access method according to claim 3, characterized in that: The step 1) further includes: setting the service management control unit as a service management module and a service control module connected to each other, connecting the service control module with the original compounder of the system, and simultaneously connecting the service control module with the authentication interaction interface. The interactive network is connected, and the service management module is connected with the interactive network through the service interface; When the interactive network is a WCDMA network, the specific process of the user service authorization authentication is: the terminal part sends the user information and service request information to the service GPRS node SGSN of the CN in the interactive network through the interactive service processing unit, and the SGSN sends the information Forward it to the gateway GPRS node GGSN. After routing through the GGSN, the service interface sends the information to the service management module of the front-end part. The service management module completes real-time service switching according to the service request information, and the service control module judges the Whether the user has the right to use the service, if yes, the confirmation authorization information will be returned to the terminal part through the service management module and the service interface through the interactive network; otherwise, the service information will not be executed and returned to the terminal part. 10. The secure access method according to claim 9, wherein the authorization information returned to the terminal part is the service control word generated by the control word generator, and the terminal part performs the requested service control word according to the received service control word. The business is descrambled by the descrambler to obtain the corresponding business. 11. The secure access method according to claim 9, characterized in that, the user service authorization authentication process further comprises: the service control module starts to perform the authentication on the user of the terminal part while returning confirmation authorization information to the terminal part Billing. 12. A secure access device for a digital broadcast television system, which is applied to an interactive digital broadcast television network. The device includes a front-end part and a terminal part. The front-end part includes a multiplexer, a scrambler, and a control word generator. The multiplexer and The scrambler is connected, the scrambler is connected to the broadcast network, the terminal part includes a decomplexer and a descrambler, the decomplexer is connected to the descrambler, and the descrambler is connected to the broadcast network; it is characterized in that: The front-end part further includes a service management control unit, which is used to perform user access system authentication on the user information received from the interactive network and passed the authentication for access to the interactive network, and pass the authentication result through interactive The network returns to the terminal section; where, The control word generator is connected between the scrambler and the interactive network, and the service management control unit is connected between the multiplexer and the interactive network; The terminal part further includes an interactive service processing unit, which is used to send the user information read from the smart card system to the interactive network for authentication of access to the interactive network, and receive the authentication of access to the interactive network from the interactive network Results and user access system authentication results; where, The interactive service processing unit is connected between the descrambler and the interactive network, the interactive service processing unit is connected with the demultiplexer, and the interactive service processing unit is connected with a smart card system. 13. The secure access device according to claim 12, wherein the service management control unit further comprises: a service management module and a service control module, and the service control module is used to receive the authentication interaction interface from the interactive The user information sent by the network and passed the authentication of the access interactive network, and the user access system authentication is performed according to the user information, and the authentication result is returned to the terminal part through the interactive network through the authentication interactive interface; wherein, The service management module and the service control module are connected to each other, the service control module is connected to the complex, and the service control module is connected to the interaction network through the authentication interaction interface, and the service management module is connected to the interaction network through the service interface. 14. A secure access front-end device for a digital broadcast television system, which is applied to an interactive digital broadcast television network. The device includes a multiplexer, a scrambler, and a control word generator. The multiplexer is connected to the scrambler, and the scrambler is connected to the The broadcast network is connected, and it is characterized in that: The device further includes a business management control unit; used to perform user access system authentication on the user information received from the interactive network and passed the authentication for accessing the interactive network, and send the authentication result through the interactive network; wherein, The control word generator is connected between the scrambler and the interactive network, and the service management control unit is connected between the compounder and the interactive network. 15. The secure access front-end device according to claim 14, wherein the service management control unit further comprises: a service management module and a service control module; The user information sent by the interactive network and passed the authentication of the access interactive network, and the user access system authentication is performed according to the user information, and the authentication result is sent through the authentication interaction interface; wherein, The service management module and the service control module are connected to each other, the service control module is connected to the complex, and the service control module is connected to the interaction network through the authentication interaction interface, and the service management module is connected to the interaction network through the service interface. 16. A secure access terminal device for a digital broadcast television system, which is applied to an interactive digital broadcast television network. The device includes a demultiplexer and a descrambler. The demultiplexer is connected to the descrambler, and the descrambler is connected to the broadcasting network. , characterized by: The device further includes an interactive service processing unit, which is used to send the user information read from the smart card system to the interactive network for authentication of access to the interactive network, and receive the authentication result of access to the interactive network and the user access system authentication result from the interactive network ;in, The interactive service processing unit is connected between the descrambler and the interactive network, the interactive service processing unit is connected with the demultiplexer, and the interactive service processing unit is connected with a smart card system. 17. The secure access terminal device according to claim 16, wherein the smart card system is a SIM card system.

Images