HK1002482B - System for processing a video signal via series-connected high speed signal processing smart cards - Google Patents

Description

System for processing video signal by series high speed signal processing smart card

Technical Field

The present invention relates to access control systems having an Integrated Circuit (IC) card, or "smart" card, for restricting access to information in signal processing applications. Systems such as pay-tv systems include an access control subsystem that restricts access to certain programs or channels. Only authorized (i.e., paid) users are allowed to view the program. One way to restrict access is to modify the signal by, for example, scrambling or encrypting the signal. Scrambling typically involves modifying the form of the signal by methods such as removing synchronization pulses. Encryption involves modifying the data components included in the signal according to a particular cryptographic algorithm. Only individuals authorized access are given the "key" needed to scramble or decrypt the signal only. The terms encryption and decryption will be used hereinafter to generically represent access control techniques, including cryptography and scrambling.

Background

The access control system may include an Integrated Circuit (IC) card or "smart" card. A smart card is a plastic card of the same size as a credit card, with a signal processing IC embedded in the plastic. The smart card is inserted in a card reader which couples the signal to an IC within the card. The IC card interface is specified by standard 7816 of the International Standards Organization (ISO). ISO standard 7816-2 specifies, among other things, that the electrical interface to the card will be achieved by eight contacts disposed on the card surface as shown in fig. 2A. Six of the eight signals at the contact are defined as VCC (power supply voltage), RST (reset signal), CLK (clock signal), GND (ground), VPP (programming voltage of a programming memory in the card IC), I/O (serial data input/output). Two contacts are reserved for future use. The assignment of signals to the smart card contacts is shown in fig. 2B.

The IC in the smart card processes data such as security control information as part of an access control protocol. The IC includes a control microcomputer, such as the 6805 processor of Motorola semiconductor, Inc., which includes ROM, EEPROM, and RAM memory. The processor performs various security control functions including entitlement management and key generation for decryption of encrypted data components in the signal.

Entitlement management includes modifying information stored in the card that specifies the card owner's entitlements (i.e., programs and services that the user has access to). The processor adds and deletes the qualification based on qualification information included in qualification management information (EMM) of the input signal. EMM data typically indicates eligibility for a particular service, such as all programs in a particular channel, or a particular program provided by a service (e.g., a movie on a particular channel). EMMs are typically not frequently present in a signal because EMMs relate to relatively long-term qualification.

Once a service or program is authorized for use, decryption of the service or program can only occur after a decryption key is generated. The key is generated based on entitlement control information (ECM) also included in the input signal. The ECM provides initial data for a key generation subroutine executed by the processor. Each time the service provider changes the encryption key, ECM data is included in the signal so that the system entitled to access can generate a corresponding new decryption key. To prevent unauthorized access to the encrypted signal, the key is changed frequently, such as every two seconds. Thus, ECM data frequently appears in the signal.

The EMM and ECM data are transmitted to the smart card for processing through the serial I/O terminal of the ISO standard 7816 interface. The serial I/O terminal is also used to pass the generated key from the card to a decryption unit in the video signal processing path. The decryptor decrypts the data components (e.g., video and audio data) of the input signal, i.e., employs the key to produce a decrypted (or "plaintext") output signal. The decryption process is the inverse of the encryption process, for example using the inverse of the cryptographic algorithm to reinsert the synchronization pulse or decrypt the data. The decrypted data is further processed by a signal processing channel to produce video and audio signals suitable for coupling to output devices such as picture tubes and speakers, respectively.

Adding decryption functionality in the video signal processing path includes adding decryption hardware to the system. The hardware may be included in a Consumer Electronic (CE) device, such as a television, or may be located in a separate decoding unit, such as a cable box. The CE device or a separate decoding unit including decryption hardware is dedicated to a particular access control system. For example, the hardware may only be adapted to decrypt certain types of encryption algorithms. If, for example, for security reasons, the service provider decides to change to a different access control system, it is necessary to change the decryption hardware, i.e. modify the CE device and/or replace the decryption unit, which is an expensive and difficult task.

In addition, sending the decryption key generated by the smart card to a decryptor external to the smart card provides a "hacker" with an opportunity to attack the security system. Since the security control IC is embedded in the smart card, a hacker cannot directly access the IC and thus cannot break the security algorithm. Attempts to access ICs hierarchically to a smart card can corrupt the IC. However, sending the key to the decryptor through the card interface increases the likelihood that a hacker will monitor the key transfer protocol, intercept the key and compromise the access control system. In addition, existing smart cards provide access control with respect to a particular signal source, but implementing certain features in a television system may require access control to many signal sources simultaneously. For example, picture-in-picture (PIP) displays and picture-outside-picture (POP) displays may require signals from two or more different sources to be combined into one image signal for provision to a display device. Using signals from multiple pay-tv sources to provide features such as PIP or POP requires that access control processing be provided simultaneously for each pay-tv source.

An example of a pay-tv decoder using smart cards is described by Diehl et al in european patent 0562295 a1 (published in publication 93/39 on 9/29 1993) entitled "method and apparatus for controlling a plurality of smart cards". It will be appreciated that if a user has several smart cards, each dedicated to a particular station, then each time the user changes from one channel to another, he must exchange the smart cards to be able to decrypt the new channel. To facilitate the use of such a conditional access system, a plurality of card readers are connected and controlled by a single signal processor. Conveniently, a specific power supply controlled by the processor supplies the appropriate voltage to the card reader.

Disclosure of Invention

It is an object of the present invention to provide a solution to signal access control problems (e.g., decryption of signals) when information from more than one video signal is to be received and displayed simultaneously on a display screen (e.g., PIP, POP, etc.).

According to an aspect of the invention, a video signal comprising first and second signal components representing respective first and second video programs is processed through a data path comprising first and second smart cards. The signal resulting from the processing by the smart card is further processed to provide a signal suitable for generating a display image comprising first and second portions corresponding to the first and second video programs, respectively.

According to another aspect of the invention, the first and second signal components of the video signal comprise respective first and second encrypted signal components, which are decrypted by respective first and second smart cards.

According to another aspect of the invention, a video signal is generated that includes first and second signal components representing first and second video programs by combining a first signal that includes the first signal component and a second signal that includes the second signal component.

Drawings

The invention may be better understood with reference to the following drawings:

FIG. 1 illustrates, in block diagram form, a signal processing system including a smart card that provides both qualification processing and decryption;

FIG. 2A illustrates the location of signal contacts on a smart card surface according to ISO standard 7816-2;

FIG. 2B illustrates the assignment of smart card interface signals to the signal interface contacts shown in FIG. 2A according to ISO standard 7816-2;

FIG. 3 illustrates a format in which data included in a signal processed by the system shown in FIG. 1 is presented;

FIG. 4 illustrates, in block diagram form, one embodiment of signal processing functionality included in a smart card suitable for use with the system shown in FIG. 1;

FIGS. 5-8 illustrate the path of a signal through the smart card of FIG. 4 in various modes of operation of the system of FIG. 1;

FIG. 9 shows a portion of a signal processing system including several serially connected smart cards;

FIG. 10 shows a television receiver including the features shown in FIG. 9;

fig. 11 and 12 illustrate in block diagram form certain portions of a signal processing system constructed in accordance with the principles of the present invention.

Detailed Description

An embodiment of a smart card access control system incorporating the present invention will be described with reference to the exemplary video signal processing system shown in the block diagram of fig. 1. The system shown in fig. 1 includes signal processing functionality that may be found in a variety of signal processing systems. One particular example is DSS developed by Thomson consumer electronics^Direct broadcast satellite television system.

For pay television services including a smart card based access control system, a user wishing to obtain the service contacts the service provider, pays the service fee and obtains a smart card. The card to the user is provided with initial qualification information and stored in the EEPROM of the card. The entitlement information may include data identifying the user and data specifying the initial access entitlement range (e.g., the duration of the user's payment and/or the particular program). In addition, application-specific key generation software is stored in the card memory.

The entitlement information stored in the card may be remotely modified by the service provider using entitlement management information (EMM) and entitlement control information (ECM) inserted in certain parts of the signal. EMMs include information indicating subscription (long-term access) and pay-per-view (single program access) services that the user has paid for. The EMM may be directed to a specific smart card by including identification information corresponding to the identification information stored in the specific smart card in the EMM data. The ECM includes data such as the initial data required to generate the decryption key. Thus, the signal for a particular program includes an encrypted data component containing video and audio data and a control information component containing EMMs and ECMs.

When a user wishes to access a subscription television service, the smart card 180 of FIG. 1 is inserted into a card reader 190. The card reader 190 couples signals between the smart card 180 and the signal processing channels comprising the units 100 to 170 of figure 1. In detail, the card reader 190 is connected to 8 terminals (see fig. 2) located on the surface of the smart card 180 as specified in ISO standard 7816-2. The connection established by the card reader 190 creates an interface 187 between the smart card 180 and the signal processing channel. In accordance with an aspect of the present invention, which will be described below, the eight signals in interface 187 include signal 184, which is present at one high speed data input/output (I/O) port of smart card 180, and signal 182, which represents a subset of the ISO standard IC card interface signals.

The desired program or service may be selected by tuning the receiver to the appropriate channel using the tuner 100. The tuner 100 is controlled by a microcontroller 160 based on user input. For example, microcontroller 160 may receive the channel selection signal from a remote control (not shown in FIG. 1) operated by the user. In response to the channel selection signal, the microcontroller 160 generates a control signal to cause the tuner 100 to tune to the selected channel.

The output of tuner 100 is coupled to a Forward Error Corrector (FEC) 110. The FEC 110 monitors error control information, such as parity bits in the tuned signal, for errors and corrects the errors according to an error control protocol. The microcontroller 160 is coupled to the FEC 110 to monitor the signal for the occurrence of errors and to control the handling of errors. The FEC 110 also performs an analog-to-digital conversion (ADC) function that converts the analog output of the tuner 100 to a digital signal at the output of the FEC 110.

The transmit unit 120 processes the signal from the FEC 110 to examine and separate various types of data in the tuned signal. The data in the signal may be arranged into various formats. Fig. 3 shows an example of a data format used as a basis for the following description. The signal shown in fig. 3 comprises a data stream arranged in packets of data bytes, i.e. "packet" data. Each packet is associated with a particular type of information or substream in the data stream for the tuned channel. For example, the signals include program guide packets, control information (e.g., ECM or EMM) packets, video packets, and audio packets. The sub-stream to which a particular packet relates is defined by the data included in the header portion of each packet. The payload portion of each packet includes packet data. The exemplary data format shown in fig. 3 includes two bytes (16 bits) of data in the header and 186 bytes of data in the payload.

The first twelve bits of the header in each packet are Program Identification (PID) data bits. The PID data identifies the data sub-streams associated with the payload data. An example of the information provided by the PID data is as follows:

TABLE 1

PID value	Payload content
		1	Program guide information
4	EMM
		10	View of channel 101Frequency data
11	Audio data for channel 101

Other PID values identify video and audio data for other channels.

As part of the tuning process, the microcontroller 160 references a PID "map" stored in the microcontroller's memory to determine the PID value associated with the tuned channel. The appropriate PID value is loaded into the PID register of the transfer unit 120. For example, when channel 101 is selected, microcontroller 160 accesses the stored PID map, determines that the video and audio data for channel 101 are for PID values 10 and 11, respectively, and loads the values 10 and 11 into corresponding video and audio PID registers in transport unit 120. The PID values in the incoming packets are compared to PID values stored in a PID register to determine the payload content of each packet. The microcontroller 160 can update the PID map data based on the channel-related information of the PID in the "program guide" packet (PID value of 1).

The last four bits of the header of each packet further define the payload content as follows:

TABLE 2

Title bit	Name of	Function(s)
			13	ECM markers	Indicating whether the payload is an ECM
14	-	Retention
			15	ENC sign	Indicating whether the payload is encrypted
16	Key sign	Indicating whether the payload key is Key A or Key B

The ECM flag is valid, e.g. at logic 1, indicating that the payload comprises ECM data, such as the initial data for generating the key. The ENC flag is valid indicating that the payload is encrypted and must therefore be decrypted. The key flag determines which of the two keys a and B is to be used to decrypt the payload (i.e., logic 0 indicates key a and logic 1 indicates key B). The use of the key flag will be described below with reference to fig. 7.

The transfer unit 120 in fig. 1 extracts and processes header data in response to the packet clock signal shown in fig. 3. The packet clock signal is generated by the FEC 110 and synchronized with the data stream. Each transition of the packet clock signal indicates the start of a packet. The transmit unit 120 processes the 16 bits of header data after each packet clock signal transition to determine the destination of the packet payload. For example, the transmitting unit 120 transmits a payload containing EMM (PID value of 4) and ECM to the security controller 183 in the smart card 180 via the microcontroller 160. The video and audio data is directed to a demultiplexer/decryptor 130 for decryption and separation into video and audio signals. The program guide data (PID value of 1) is directed to microcontroller 160 for PID image update.

The security controller 183 processes EMM and ECM data. To provide access control functions including entitlement management and key generation. The security controller 183 is included in an Integrated Circuit (IC)181 and includes a microprocessor such as the processor 6805 of motorola, inc. Entitlement management involves processing EMM data to determine how and when to update entitlement information stored in IC 181, i.e., add or delete entitlements. The ECM data provides the initial values required by the security controller 183 to generate the decryption key. After the secret controller 183 generates the key, the key is passed via the microcontroller 160 to the decryptor 130 where the encrypted data components of the input signal from the tuned channel, such as video and audio program data, are decrypted. The decryption function may also be provided by a decryptor 185 included in IC 181, in accordance with the principles of the present invention as will be further described below.

The decrypted video and audio data are decompressed in video decompressor 140 and audio decompressor 145, respectively, and the program data is compressed in the program source using any one of a number of well-known data compression algorithms. Decompressors 140 and 145 are the inverse of the compression algorithm.

The outputs of the video and audio decompressors 140 and 145 are coupled to respective video and audio signal processors 150 and 155. The audio signal processor 155 comprises functions such as stereo signal generation and digital/analog conversion for converting the digital output signal in the decompressor 145 into an analog audio output signal AOUT from the processor 155 that can be coupled to a loudspeaker (not shown in fig. 1). Video signal processor 150 also includes digital-to-analog conversion functionality that is capable of converting the digital output of decompressor 140 to an analog video output signal VOUT suitable for display on a display such as a picture tube. Video processor 150 also provides signal conversions requiring the inclusion in signal VOUT of an on-screen display (OSD) signal generated by OSD processor 170. The OSD signal represents, for example, graphical information such as a channel number display to be included in the displayed image. A video switch in video processor 150 multiplexes the OSD signal to the signal VOUT needed to produce the desired display. The operation of OSD processor 170 is controlled by microcontroller 160.

Turning to the access control features of the system shown in FIG. 1, the features and functionality of the smart card 180 may be better understood by referring to the block diagram of the smart card IC 181 shown in FIG. 4. The same reference numbers in fig. 4 as in fig. 1 represent the same or similar features. In FIG. 4, integrated circuit 181 includes security controller 183, which contains Central Processing Unit (CPU)421, RAM 426, ROM 425, EEPROM423, and serial I/O unit 424. The CPU 421 may be a 6805 processor manufactured by motorola, inc. Key generation and entitlement management software is stored in ROM 425 and EEPROM 423.

Data indicating the current entitlement is also stored in the EEPROM423 and is modified according to the content of Entitlement Management Message (EMM) in the received signal. When the transport processor 120 in fig. 1 detects an EMM packet (packet PID value is 4), the microcontroller 160 in fig. 1 transports the packet payload to the security controller 183 via the serial I/O unit 424. CPU 421 transmits the EMM data in the payload to RAM 426 and CPU 421 processes the EMM data and modifies the entitlement data stored in EEPROM423 accordingly.

Packet payloads including entitlement control information (ECM) -indicated by the validity of the ECM flag in the packet header-are sent from the transport unit 120 to the security controller 183 via the microcontroller 160 and the serial I/O unit 424. Any type of packet, such as EMM, video or audio, may include ECMs. ECM data is used to generate decryption keys for a particular type of data. For example, the ECM data in an EMM packet is used to generate an EMM decryption key. When transferred to the privacy controller 183, the ECM data is stored in the RAM 426 until processed by the CPU 421. The key generation software stored in EEPROM423 and ROM 425 is processed by CPU 421 using the ECM data in RAM 426 to generate a particular key. The ECM data provides information such as initial values required by the key generation algorithm. The generated key is stored in RAM 426 until transferred by CPU 421 to decryptor 130 via serial I/O unit 324 and microcontroller 160.

The EMM and ECM data may be encrypted as indicated by an encryption flag ENC valid in the packet header. The encrypted data is transmitted from the transmission unit 120 to the decryptor 130 for decryption before being transmitted to the security controller 183 for the entitlement management or key generation process.

The features and operation of the IC 181 that have been described are common to known smart card systems. However, as described above, the use of a decryption unit (e.g., decryptor 130) external to the smart card can greatly reduce system security and make it inconvenient to change the decryption hardware. The structures shown in fig. 1 and 4 include features that significantly improve privacy over known smart card systems. In detail, the IC 181 of the smart card 180 comprises a decryption unit 185 and a high data rate synchronization interface 184, the latter comprising separate serial data input and serial data output lines. The combination of the decryptor 185 and the interface 184 makes it possible to perform various access control processes within the smart card 180.

In FIG. 1, a card reader 190 couples the ISO standard interface signal 165 from the microcontroller 160 and the high speed interface signal 125 from the transmission unit 120 to the smart card 180 via ports of the smart card interface 187, referenced 182 and 184, respectively. Fig. 4 shows signals included in the interface 187. The ISO standard signals 182 include power, ground, reset, and serial I/O signals in fig. 4 (corresponding to VCC, GND, RST, and I/O in fig. 2B). The high-speed interface signals 184 include high-speed data input and data output signals, packet clock signals, and high frequency (e.g., 50 mhz) clock signals. The ISO standard signal VPP (programming voltage) is replaced by a packet clock signal so that the interface 187 (including high-speed and low-speed interfaces) can be implemented using the 8-contact ISO standard architecture shown in fig. 2A.

Removing the signal VPP does not prevent the system shown in fig. 1 from operating with existing ISO standard smart cards that do not include the decryptor 185 and the high-speed data interface 184. Existing smart cards typically include EEPROM circuitry that does not require a separate programming voltage. The "supply pump" feature generates the required programming voltage from the card supply voltage when programming is required, so for most existing ISO standard smart cards the VPP signal specified by the ISO standard is an "unused" terminal. Using the system with an existing smart card requires modifying the operation of the system and therefore the high speed interface 184 and the decryptor 185 are not used. The required modifications can be implemented by merely changing the control software of the controller 160.

The decryptor 185 operates at a high data rate in response to a high frequency clock signal, while the privacy controller 183 requires a low frequency clock signal. A frequency divider 422 in the IC 181 divides the 50 mhz clock signal to generate a low frequency clock signal suitable for the security controller 183. Thus, the single high frequency clock signal functions as a timing signal for controlling the operation of the security controller 183 and the decryptor 185. The use of frequency divider 422 avoids dedicating 2 of the 8 smart card interface signals to separate the high and low frequency clock signals.

The decryptor 185 includes a transmission decoding unit 472, a PID & ECM filtering unit 474 and an EMM address filtering unit 476 for providing functions similar to those of the transmission unit 120 shown in fig. 1 described above. The high speed data input and data output signals of interface 187 couple a high speed data stream of input signals between transfer unit 120 and decryptor 185. The functionality of the transfer unit 120 is included within the smart card 180 so that the smart card 180 can process incoming data packets at the high data rate of the incoming signal. Both the data input and the packet clock signal are coupled to unit 472.

In response to each transition of the packet clock signal, unit 472 processes 16 bits of header data. The first 12 bits of the header are Program Identification (PID) data directed to a PID & ECM filtering unit 474. For each type of packet included in the tuned channel, unit 474 compares the PID data of the packet with the PID value stored in unit 474. Similar to the operation of delivery unit 120 described above (see table 1 above and its associated description), PID comparison in unit 474 determines what type of data the payload includes, such as program guide, EMM, video or audio. The PID value identifying the type of packet in the current tuning signal is stored in a register of unit 474. The registers are loaded as part of the tuning process described above for the system shown in fig. 1. In detail, microcontroller 160 accesses the stored PID "map" as described above and transfers the PID value associated with the currently tuned channel to a register in unit 474 via signal 182 and security controller 183 in smart card 180. The transfer of data between the security controller 183 and the functions of the decryptor 185 (e.g. the unit 474) is via a data bus internal to the IC 181 which is not shown in fig. 4.

How the smart card processes the payload data is determined by the result of the PID comparison in unit 474 and the 13-16 bit content of the packet header extracted by unit 472. Using the example above with respect to channel 101 (see table 1), the PID data identifies: the micro-controller 160 processes to update program guide data (PID ═ 1) of the PID image, and the security controller 183 processes to modify EMM data (PID ═ 4), video data (PID ═ 10), and audio data (PID ═ 11) qualified. The 13-16 bits of the header control security related operations in the smart card 180 (see table 2 and description thereof). If the 13 th bit (ECM flag) is valid, the payload includes ECM data that requires a key generation process by the security controller 183. If bit 15 (ENC flag) is valid, the payload is encrypted and decrypted in decryption unit 478 in decryptor 185. Bit 16 determines whether key a or key B is used for decryption in unit 478.

The encryption status bit ENC determines how the decryption unit 478 processes the payload data. The unencrypted payload data passes unchanged from the high speed data input of the smart card 180 to the high speed data output via the decryption unit 478. The encrypted data is decrypted by unit 478 at the data rate. The decrypted video and audio data is transmitted to the high-speed data output terminal of the smart card 180. In each decrypted audio or video packet, the ENC bit in the packet header is set to a logic "0" indicating that the packet is "clear," i.e., decrypted. To ensure that unauthorized users do not access data associated with credentials or keys, the decrypted EMM or ECM data is not sent out of the smart card 180 via the high-speed data output. Instead, the original encrypted EMM or ECM data (ENC bit set to logic 1) is passed from the high speed data input to the high speed data output via the smart card 180. The EMM and ECM data decrypted in the decryption unit 478 are temporarily stored in the RAM 426 of the security controller 183 until they are subjected to the entitlement management and key generation processing by the security controller 183. The transfer unit 120 in fig. 1 receives data (either unchanged or decrypted) from the high-speed data output of the smart card 180. The PID value of each packet is checked and the payload is passed to the appropriate functional device of fig. 1 (e.g., microcontroller 160 or decompressors 140 and 145) for further processing.

The operation of the smart card 180 is controlled by commands of the microcontroller 160 in fig. 1, which are transmitted to the smart card 180 via the ISO standard serial interface. In practice, microcontroller 160 is the master processor and security controller 183 is the slave processor. For example, microcontroller 160 transmits PID information to smart card 180 and instructs the smart card to decrypt the data in the corresponding data stream. For the appropriate type of data processing, such as qualification processing, key generation, and decryption, the security controller 183 responds by checking the qualification and configuring the smart card 180. In addition, the microcontroller 160 requests status information regarding whether decryption is in progress. The command is transmitted to the security controller 183 in the smart card 180 through the serial I/O terminal. Any response required by the command is returned to microcontroller 160 via the serial I/O terminal. Thus, the serial I/O signals function as control signals between the system and the smart card 180, while the high speed data interface provides high speed input and output data signals between the card and the system.

The serial communication between the microcontroller 160 and the smart card 180 is performed according to the protocol provided in ISO standard 7816-3. The smart card informs the system of the prescribed protocol to be used by sending a protocol type number T to the system. In detail, when a card is inserted into the card reader, the card reader supplies power to the card and resets the card by activating a reset signal. The card responds to the reset signal with a "reset acknowledge" data sequence as specified in ISO standard 7816-3 section 6. The answer to the reset comprises an interface byte TDi, the four least significant bits of which define the protocol type number T (see ISO standard 7816-3, section 6.1.4.3).

The protocol type of the system shown in fig. 1 is type T-5. The protocol is classified as "reserved" in the ISO standard, i.e. it is not currently defined. For the system shown in FIG. 1, protocol type 5 is the same as protocol type 0 (the asynchronous half-duplex protocol defined in section 8 of ISO Standard 7816-3), except for the way the baud rate of the serial I/O is determined. Serial I/O at the card interface proceeds at a rate determined according to table 6 as per ISO standard 7816-3. The baud rate calculation is based on the clock rate of the security controller 183. For existing smart cards, the clock frequency of the security controller 183 is equal to the clock frequency fs at the clock pin of the card. As shown in fig. 4, the smart card 180 includes a divider 422 for dividing the rate Fin of the high speed data input clock by a factor of N, i.e., Fin/N, to establish a clock rate for the privacy controller 183. Thus, for protocol type 5, table 6 of ISO standard 7816-3 is modified by defining fs ═ Fin/N.

All commands of the type 5 protocol are initiated by the microcontroller 160 as when the protocol type is 0. The command starts with a 5-byte header that includes a one-byte instruction class designation (CLA), a one-byte Instruction (INS), a two-byte argument (P1, P2) (e.g., address), and a one-byte number (P3) that defines the number of bytes of data that will follow the header as part of the command. For the system shown in fig. 1, the parameters P1, P2 are not needed, so these bytes are "irrelevant". The command thus has the following form:

CLA | INS | - | -P3 | data (P3 bytes)

The commands recognized by the smart card 160 include a status command and a PID transfer command. The smart card 160 responds to status commands from the microprocessor 160 by providing the processing status of the card, e.g., whether the card has completed key generation or whether the card is decrypting data. The microcontroller 160 employs a PID transmit command to transmit a PID number associated with the tuned channel. Other commands, such as a command to transfer EMM and ECM data, a command related to a key, and a "purchase offer" command are also possible, as will be explained below.

The operation of the smart card 180, and in particular the decryptor 185, will be described in more detail below with reference to fig. 5-8. When a new channel is tuned, microcontroller 160 transfers the PID value of the new channel from the PID map to smart card 180, as shown in fig. 5. PID data transfer is performed using one PID transfer command comprising N PID values, where N is specified in byte P3 of the command header. The command and PID values are transmitted via the serial data terminal of the smart card and the serial input/output unit 424. CPU 421 receives the PID value and directs the data to the appropriate PID register in register 474 of decryptor 185.

Before the signal can be decrypted, the user must be entitled to access and the correct key must be loaded into the decryptor 185. After transmitting the PID data to the smart card 180, the security controller 183 compares the PID value with the qualification data stored in the EEPROM423 to see whether the user is qualified to access the tuned channel. Assuming the user is qualified, the next step is key generation. Key generation includes processing ECM data. The ECM must be received and processed to generate the key before the audio and video data can be decrypted. The purpose of encrypting the ECM data is to reduce the possibility of unauthorized key generation. When the card is issued, a key for decrypting the ECM is stored in the EEPROM423 of the card. As shown in fig. 6. The ECM key is transferred by CPU 421 from EEPROM423 to an ECM key register in decryption unit 478.

If the user is not eligible to access the tuned channel, then the eligibility must be received before key generation and decryption can occur. The entitlement may be received via an EMM. The "address" identifying a particular smart card is stored in the card's EMM address unit 476 at the time of card issuance. The service provider may direct the EMM to a specific card by means of address information included in the EMM. The smart card compares the address information in the EMM with the card address stored in unit 476 to detect the EMM information directed to the card. If the user is not qualified, the security controller 183 configures the card for EMM processing in the case where EMM data is received.

In the case of an ECM key, the issued card stores an EMM key in EEPROM 423. In fig. 6, the EMM key is transferred by CPU 421 from EEPROM423 to an EMM key register in decryption unit 478. The encrypted EMM data of the transmission unit 120 of fig. 1 is input into the card via the high-speed data input port. After checking the EMM address in element 476, the EMM data assigned to the card is decrypted in decryption element 478. The decrypted EMM data is temporarily stored in RAM 426 and processed by CPU 421 to update the entitlement data stored in EEPROM 423.

After the PID values are loaded, the entitlement is present, the ECM keys are in place in the decryptor 185, and the card is ready to decrypt the ECM data and generate the audio and video keys. In fig. 7, ECM data in the signal is received by smart card 180 via a high speed data input and detected by transport decoder 472. The ECM data is directed to decryptor 478 where the previously loaded ECM key is used to decrypt the ECM data. Decrypted ECM data is transferred from decryptor 478 to RAM 424. When the decrypted ECM data is available, CPU 421 executes a key generation algorithm stored in EEPROM423 and ROM 425 to generate video and audio keys using the decrypted ECM data in RAM424, the generated keys being passed to appropriate video and audio key registers in decryptor 478.

As shown in fig. 7, decryptor 478 includes two key registers for video, video keys a and B, and two key registers for audio, audio keys a and B. Whether key a or key B is used to decrypt a particular packet is determined by the key flag in the packet header (see table 2 above). The use of the "multi-key" feature allows a new key to be generated when an existing key is used to decrypt data. Processing the ECM data in the security controller 183 to generate a new key and transfer the new key to the key register in the decryptor 478 requires a sufficient number of instruction cycles in the CPU 421. If decryption is suspended while the new key is generated and transmitted, the processing delay may require someone viewing the program to view the decrypted image until the new key is in place in decryptor 478. Having both key registers a and B allows the use of a key in one key register (e.g., key register a) to decrypt data while generating a new key that is loaded into a second key register (e.g., key register B). After key generation is initiated by sending ECM data, the service provider waits a period of time sufficient to ensure that key B is generated in decryptor 478 before the encrypted packets take on the new key B. The key flag informs the decryptor 185 when to start taking new keys.

After the operations shown in fig. 5, 6, and 7, the decryption key 478 has been activated. It has all the key information needed to process the data encrypted in the tuned channel, including EMMs, ECMs, video and audio data. Fig. 8 shows a signal flow when data processing is performed. Encrypted data enters the smart card 180 via the high speed serial data input, which is decrypted in decryptor 478 using the previously loaded key. For example, if the transfer unit 472 determines from the header of an incoming packet that the payload data is video data associated with video key a, the packet payload is decrypted in the decryptor 478 using video key a. The decrypted data is output directly from smart card 180 via a high-speed serial data output. Note that the data processing in fig. 8 does not require interaction between the decryption unit 185 and the privacy control unit 183, which allows the decryptor 478 to process data at a high data rate of an input signal.

The key generation in combination with the decryption feature of the decryption unit 478 in the security controller 183 provides the smart card 180 with full possibilities of handling encrypted signals, which may be implemented using a variety of algorithms, including the Data Encryption Standard (DES) algorithm and the Rivest-Shamir-adleman (rsa) algorithm. By providing various access controls related to processes in the smart card 180, security related data (e.g., key data) need not be transferred outside of the smart card 180. As a result, the security performance is significantly improved compared to systems employing decryptors external to the smart card.

Although it is advantageous to use a decryptor 185 within the smart card 180, an external decryptor, such as decryptor 130 in fig. 1, may also be used. An external decryptor may be required to implement the described smart card in compatibility with existing pay-tv systems that generate a key in the smart card 180 and transfer the key to the decryptor 130. On the other hand, both the decryptor 185 and the decryptor 130 may be used. For example, the signal may be twice encrypted using two different keys to enhance privacy. A twice encrypted signal can be decrypted using the system shown in fig. 1, with the following steps: the signal is decrypted once in the decryptor 185 using the first key, the partially decoded data is transmitted to the decryptor 130, and the signal is decrypted a second time in the decryptor 130 using the second key. The second key is generated in the smart card 180 and transmitted to the decryptor 130.

For applications comprising the decryptor 130, i.e. applications where key data is transferred outside the smart card 180, commands are provided to transfer key data between the controller 160 and the smart card 180 via the serial I/O interface. For example, the microcontroller 160 sends ECM data to the smart card in a command, and requests the status of key generation with a status command. After the status data indicates that key generation is complete, another command requests the key data, and the card responds by sending the key data to the controller 160. The key is thus transmitted to the decryptor 130.

Modifying the system of FIG. 1 in accordance with the principles of the present invention allows data to be processed via a configuration of several smart cards, where the high speed data paths of the cards are connected in series. In more detail, the high speed data output of one card is connected to the high speed data input of the next card. As will be explained below with reference to fig. 9-12, a system for processing video data via a serially connected smart card may employ multiple access control signals, such as pay-tv signals, to provide features such as picture-in-picture (PIP) and picture-outside-picture (POP) in a video system, such as a television receiver. For example, the PIP feature produces a signal representing a main video image and one or more small images inserted in a portion of the main image. In a television receiver, a main image may be generated in response to a signal from one television channel while an insert image may be generated in response to a signal from a second television channel. With a serial connection of two or more smart cards, one smart card processes a first signal, such as a decrypted pay-tv signal, to provide a main image, and one or more other smart cards processes one or more other signals, such as other pay-tv signals, to provide an insert image.

FIG. 9 illustrates a switch configuration for use in a smart card reader to provide the described serial connection high speed data path. In figure 9, switches 1 and 2 are responsive to the insertion of cards 1 and 2, respectively, into the card reader. Switches 1 and 2 route the high speed data in and data out signals to the decryptors in the respective smart cards. Each switch is shown in the form of a Single Pole Single Throw (SPST) switch, which will be in one of two possible states, a or B, depending on whether the corresponding card is inserted: state a if the corresponding card is not inserted; if the card is inserted, state B. In state a, the switch causes the input data, i.e. the signal data in, to bypass the corresponding card. In state B, input data is connected to the inserted card.

In fig. 9, both cards 1 and 2 are inserted such that both switches 1 and 2 are in position B. As a result, high speed data is directed from the "data in" through the serial cards 1 and 2. If only a single card is inserted and card2 is not inserted, switch S2 is in position a and the high speed data bypasses card 2. The switch configurations in fig. 9 are listed in table 3.

TABLE 3

Card status		Switch position
					Card1	Card2	S1	S2	Connection of
Insert into	Insert into	B	B	Data input to DIN1DOUT1 to DIN2

				DOUT2 to data output
					Insert into	Taking out	B	A	Data input to DIN1DOUT1 to data output (bypass card 2)
Taking out	Taking out	A	A	Data input to data output (bypass card 1)&2)

The operation of the high speed data signal switching structure shown in fig. 9 includes signals S1 CTRL (S1 control), S2 CTRL (S2 control), CARD1 INSERTED (CARD1 INSERTED) and CARD2INSERTED (CARD2 INSERTED). The switches S1 and S2 are electronic switches controlled by signals S1 CTRL and S2 CTRL, respectively. The switch control signal is generated by a control processor (e.g., microcontroller 160 in fig. 1) at the card reader or in the system in response to the signals "card 1 inserted" and "card 2 inserted". The signals "card 1 inserted" and "card 2 inserted" are generated by switches S3 and S4, respectively, in response to insertion of the respective card, and are coupled to respective interrupt inputs of microcontroller 160.

Before card1 is inserted, signal S1 CTRL is at logic 0, so that electronic switch S1 is in position a and signal data in bypasses card 1. Insertion of the card1 into the card reader causes the switch S3 to change from position a (card removed) to position B (card inserted). As a result, the signal "card 1 is inserted" changes from logic 1(+ power supply voltage) to logic 0 (ground). The interrupt handling routine of the microcontroller 160 detects a change in the signal "card 1 inserted" and changes the level of the signal S1 CTRL. Switch S1 responds by changing to position B, coupling the signal data in to card 1. Switches S2 and S4 operate in a similar manner in response to insertion of card 2.

The described reader operation directs the high speed data signals through a decryptor of each card inserted in the reader. To decrypt a signal that has been encrypted more than once, each decryptor in the series connection decrypts the signal using a particular key and algorithm. For the serial connection of cards, each card corresponding to a particular service, each card decrypts the data for the service associated with the card, while passing other data through unchanged. The selective decryption in each card is accomplished by the PID processing in each card. The PID register in each card loads the PID value for the service corresponding to that card. Each card examines the PID data in the header of each packet in the signal. If the PID data is not associated with the PID data stored in the card, the data passes through the card unchanged, and a packet payload is decrypted in the card only if the PID data of the card matches the packet PID data.

Control of the multi-card serial connection "stack" as shown in FIG. 9 is accomplished by ISO standard serial I/O signals. In addition to the high speed data I/O signals shown in FIG. 9, smart card interface signals "clock", "packet clock", "power" and "ground" (see FIG. 4 and its associated description) are also coupled to each card inserted into the card reader 190. The interface signals serial I/O and reset are coupled to only one smart card at any one particular time. The controller 160 detects that the card is inserted via the signal "card 1 is inserted" or "card 2 is inserted", and controls the switch S5 to couple the serial I/O and reset signals to the inserted card as needed to transfer data to the card. If more than one card is inserted, the controller 160 communicates with a particular card by controlling the switch S5 to couple the serial I/O and reset signals to only that card. The flow of high speed data through each card in the serially connected card stack is not affected by the operation of switch S5.

One aspect of card stack control is to include a delay between the high speed data and the packet clock signal that depends on the position in the stack of a particular card. The high speed data path of the smart card presents a one bit delay between data input and data output that is equal to the number of high speed clock cycles required for the data processing operations that occur in the card. A card that transfers data only from data input to data output will establish a different bit delay than a card that decrypts the data. The serial connection of the cards in the stack causes high speed data arriving at a particular card in the stack to exhibit a bit delay relative to the packet clock that depends on the number of cards in the stack that precede the particular card and the type of processing that occurs in each card before the particular card.

If the bit delay is not corrected, the other cards in the stack than the first card will not properly process the packetized data stream. For example, packet header data is extracted according to a transition generated in a packet clock signal, improperly extracted packet header data is caused by a bit delay corresponding to the packet clock, and then payload data is erroneously processed.

Correction of bit delays is accomplished by passing bit delay information between the controller 160 and the security controller 183 of each card in the stack. In response to a command from the controller 160, each card sends its specific bit delay value back to the controller 160. The card determines its current bit delay by, for example, referencing a look-up table in the card memory that specifies the bit delay for each data processing mode (i.e., decrypt, pass, etc.). The controller 160 obtains bit delay data for each card in the stack and sends the following information to each card: the number of cards in the stack, the location of the card in the stack (e.g., card 2), and the bit delay of all cards in the stack before a particular card. The card may correct the bit delays, for example, by controlling variable delay circuits in the packet clock signal path included within the transmit unit 478 using stack bit delay information in the controller 160.

The arrangement shown in fig. 9 for reading out several smart cards may be included in a television receiver. For example, fig. 10 shows a television receiver 1000 having the capability of reading two smart cards simultaneously. Two cards are inserted in slots 1010 and 1020. A card reading circuit similar to the circuit shown in fig. 9 is included in receiver 1000 to produce the serial connection of the two smart cards described above. As will be further described below in conjunction with fig. 11 and 12, the first and second smart cards inserted in slots 1010 and 1020 of fig. 10 process respective pay-tv signals to provide a PIP feature that produces a main image 1030 and a secondary image 1040.

Fig. 11 shows a portion of a system for processing video signals by connecting smart cards 180 and 1805 in a serial manner as described with respect to fig. 9. Each smart card includes the features described in connection with fig. 1 and 4-8. The same reference numbers used in fig. 11 as in fig. 1 represent the same or similar features. Features common to fig. 1 and 11 are described in detail above in connection with fig. 1. Fig. 11 and 12 will be described in connection with the processing of television signals, other video signals may be processed in a similar manner.

As depicted in fig. 1, tuner 100, Forward Error Corrector (FEC)110 and transfer unit (transfer) 120 in fig. 11 process input signal SIN under the control of controller (μ C)160 to produce output signal TRO from transfer unit 120 comprising a representation of the desired television program. To provide a multi-image display feature, such as a PIP or POP, in which the main and small images correspond to different television programs, signal TRO from transfer unit 120 includes a signal component corresponding to each program. Taking the packetized signal format described above as an example, the first component of the signal TRO comprises a first set of packets showing a first PID value corresponding to a first television program and the second component comprises a second set of packets showing a second PID value corresponding to a second television program. Each of the two components of the signal TRO may be encrypted.

The signal TRO is coupled via a card reader 190 to the high speed data input DI1 of the first smart card 180. The smart card 180 processes the first of the two components of the signal TRO, for example, the component representing the program to be present in the main image. The processing in the smart card 180 includes decrypting the data in the component if the data is encrypted. The high speed data output signal DO1 from the first smart card includes a first component that is processed (e.g., decrypted) and a second component that is not processed. The card reader 190 connects the high speed data path of the smart card 180 in series to the high speed data path of the second smart card 1805 by coupling the data output DO1 of the first smart card 180 to the data input DI2 of the second smart card 1805 as described above with respect to fig. 9. The smart card 1805 processes the second component of the signal, including decryption as needed, to produce the high speed data output signal DO 2. The signal DO2 includes a processed first component and a processed second component. If both components of the signal TRO are encrypted, the signal DO2 includes first and second decrypted components corresponding to the original encrypted components.

The signal DO2 is returned to the transmitting unit 120 via the card reader 190 for transmission to other functional devices in the system. For example, to produce a PIP display, the signal DO2 is passed to a Demultiplexer (DEMUX)130, which under the control of the controller 160 separates first and second processed signal components, which are decompressed in decompression units 140 and 1405, respectively. The decompressed data is further processed in signal processors 150 and 1505. In the case of a small image produced, for example, for a PIP or POP display, one of the processors 150 and 1505 processing the small image signal includes a video memory for storing and accessing data corresponding to the small image. The signals output by processors 150 and 1505 are combined by Multiplexer (MUX) or switch 1506 to provide a signal that will produce the desired image having a small image at the desired location in the image. The controller 160 controls the timing of the MUX 1506 to insert signal components corresponding to the small images at the appropriate time. The output processor 1507 couples the image signal to a display device, such as a picture tube 1508. Functions such as contrast control, brightness control, and picture tube driver amplification are provided by output processor 1507.

The system shown in fig. 11 provides the desired multi-picture feature when the data input of the first smart card 180 includes first and second signal components representing the first and second television programs described. This is the case when the signal tuned by tuner 100 comprises two components, or for example signal DI1 is provided by a source other than the tuner, FEC and transmission unit shown in fig. 11 which provides a signal comprising two components. An example of another signal source is a cable television signal that includes signal components corresponding to respective channels.

DSS as described above in the case where the signals are received directly from satellites^The signal, signal SIN in fig. 11, comprises signals with various frequencies generated by the various transponders of the satellite. The tuner 100 tunes only one transponder signal at a time. Although each tuned transponder signal includes signal components corresponding to several television programs, resulting in a multi-image display, such as a primary and secondary image channel selected by the user, the desired signal components may be received via different transponders. If so, the signal tuned by tuner 100 (and signals TRO and DI1) includes only one signal component necessary to produce the desired multi-image display. This will be referred to in the system shown in fig. 12.

In fig. 12, a tuner 101, FEC 111, transfer unit 121, and Multiplexer (MUX)127 are added to the system shown in fig. 11. The tuner 100, FEC 110 and transfer unit 120 tune a signal from a transponder and generate a signal TRO1 that includes a signal component required to generate a multi-image display. The tuner 101, FEC 111 and transfer unit 121 tune the signal from the second transponder and generate a signal TRO2, which includes the desired second signal component. MUX 127, under the control of controller 160, combines signals TRO1 and TRO2 to produce a signal at the output of MUX 127 that includes the two signal components required. The MUX output signal is coupled to the first smart card via the card reader 190 and processed as described in connection with fig. 11 to produce the desired multi-image display.

Various modifications may be made to the described embodiments. It will be apparent to those skilled in the art that the present invention may be applied to other video systems and video signal protocols than those shown in fig. 3, 11 and 12. Examples of other systems are the DSS described above^Satellite systems and High Definition Television (HDTV). In addition, the structures shown in fig. 9 to 12 can also be extended to accommodate more than two smart cards. For example, in FIG. 9, a switch and card detection capability is added to each additional card (i.e., an CARD INSERTED signal is generated). The addition of a smart card allows more than two signal components to be decrypted and a display is generated that includes an image portion corresponding to each decrypted signal component. In addition, the switch structure in FIG. 9 may be modified to directly control switches S1 and S2 in response to the insertion of a card without relying on the control of microcontroller 160. For example, switch S3 may be directly mechanically or electrically coupled to switch S1 such that insertion of card1 causes switch S1 to direct data through card 1. Although the described embodiments relate to digital I/O signals coupled to the smart card 180, the smart card 180 may also process analog signals. For example, the smart card 180 may include an analog-to-digital converter (ADC) at the high-speed data input and a digital-to-analog converter (DAC) at the high-speed data output. The ADC and DAC may be placed in IC 181 of fig. 1. Alternatively, IC 181 may be composed of "hybrid"Alternatively, i.e. in addition to the IC 181, the smart card 180 may comprise ADC and DAC circuits and an IC 181, all mounted on a single substrate and interconnected. For analog signal processing smart cards, the card reader 190 couples analog signals to the smart card. These and other modifications are intended to be included within the scope of the appended claims.

Claims (16)

1. A video signal processing system comprising:

a video signal source (100) comprising first and second signal components representing respective first and second video programs; said first and second signal components including control information for identifying said different respective video programs therein and permitting access to said programs;

-coupling means (190) for coupling said video signal to an input of a first smart card (180), for coupling an output signal generated by said first smart card to an input of said second smart card (1805), and for receiving an output signal generated by said second smart card; said output signal of said first smart card is generated in response to said video signal and said output signal of said second smart card is generated in response to said output signal of said first smart card;

means (130, 140, 150, 1405, 1505, 1506, 1507) responsive to said output signal of said second smart card (1805) for providing a signal adapted to be coupled to image display means (1508) for generating an image including a first image portion (1030) representing said first video program and a second image portion (1040) representing said second video program.

2. The video signal processing system of claim 1, comprising the first and second smart cards, wherein:

said first and second signal components of said video signal comprise respective first and second encrypted signal components;

-said output signal of said first smart card (180) comprises a first decrypted signal component representative of said first video program (1030) and comprises said second encrypted signal component;

said output signal of said second smart card (1805) comprises said first decrypted signal component and comprises a second decrypted signal component representative of said second video program (1040).

3. A video signal processing system according to claim 2, wherein each of said first (180) and second (1805) smart cards comprises:

a signal processor (185) included in an IC (181) mounted in said smart card for processing a plurality of signals;

a plurality of terminals disposed on a surface of the smart card for coupling the number of signals to the IC;

the plurality of signals comprise an input data signal, an output data signal separated from the input data signal, and a control signal; each of the number of signals is coupled to a respective one of the plurality of terminals;

the signal processor (185) included in the IC processes the input data signal in response to the control information included in the control signal to generate the output data signal.

4. A video signal processing system according to claim 3, wherein:

said plurality of signals further comprises a timing signal;

the signal processor included in the IC processes the input data signal at a first data rate in response to the timing signal to produce the output data signal having the first data rate.

5. The video signal processing system of claim 4, wherein the first data rate is greater than 10 megahertz.

6. A video signal processing system as defined in claim 5 wherein said control signal comprises a bi-directional signal and said input data signal and said output data signal are unidirectional signals.

7. A video signal processing system according to claim 6, wherein the plurality of terminals are provided on a surface of the smart card according to ISO standard 7816.

8. A video signal processing system according to claim 7, wherein the smart card has mechanical characteristics compliant with ISO standard 7816.

9. A video signal processing system according to claim 8, wherein said signal processor (183) included in said IC processes said control signal at a second data rate in response to said timing signal to control the processing of said input data signal.

10. The video signal processing system of claim 9, wherein the first data rate is greater than the second data rate.

11. A video signal processing system as defined in claim 10 wherein said IC comprises a frequency divider (422) coupled to receive said timing signal, to generate a first signal having a first frequency associated with said first data rate for controlling processing of said input data signal by said signal processor (185, 183), and to generate a second signal having a second frequency associated with said second data rate for controlling processing of said control signal by said signal processor.

12. A video signal processing system according to claim 1, wherein said source of said video signals comprises a tuner (100) for tuning out said video signals from a plurality of video signals.

13. The video signal processing system of claim 1, wherein the source of the video signal comprises:

-means (100) for generating a first signal representative of said first video program and comprising said first signal component;

-means (101) for generating a second signal representative of said second video program and comprising said second signal component;

means (127) for combining said first and second signals representing said first and second video programs, respectively, to produce said video signal comprising said first and second signal components.

14. A method for generating a signal suitable for coupling to an image display device (1508), comprising the steps of:

processing a video signal in a first smart card (180) to produce a first processed signal; said video signal including first and second signal components, said first and second signal components including control information for identifying said different respective programs therein and permitting access to said programs;

processing said first processed signal in a second smart card (1805) to produce a second processed signal;

processing (120, 130) said second processed signal to provide an image signal suitable for coupling to an image display device (1508) for generating an image comprising a first image portion (1030) representing said first video program and a second image portion (1040) representing said second video program.

15. A method according to claim 14, characterized in that the step of processing the video signal in the first smart card (180) comprises the step of decrypting encrypted signal components comprised in the first signal component of the video signal.

16. A method according to claim 15, characterized in that the step of processing said first processed signal in said second smart card (1805) comprises the step of decrypting an encrypted signal component comprised in said second signal component of said video signal.