WO2004019614A1

WO2004019614A1 - Smart card with nrss delay line for data alignment

Info

Publication number: WO2004019614A1
Application number: PCT/US2003/025763
Authority: WO
Inventors: Mark Alan Schultz; Dinakaran Chidambaram
Original assignee: Thomson Licensing S.A.
Priority date: 2002-08-22
Filing date: 2003-08-15
Publication date: 2004-03-04
Also published as: AU2003258277A1

Abstract

A smart card includes a DES decryptor for decrypting encrypted data. When unencrypted data is applied to the card, a delay line having a delay equal to that of the decryptor bypasses the decryptor. A controllable multiplexer selects between delayed unmodified data and decrypted data. A shift register coupled to the decryptor allows data packet header information to be modified, and allows uninterrupted data flow for nonstandard data packets.

Description

SMART CARD WITH NRSS DELAY LINE FOR DATA ALIGNMENT

Cross-Reference to Related Applications [0001] This application claims the benefit of U.S. Provisional Application No. 60/405,205 filed August 22, 2002.

[0002] This application is related to commonly assigned patent application entitled "FAST

SYNCHRONIZATION LN SMART CARDS" filed on 15 August 2003 in the name of Schultz et al., and to commonly assigned patent application S/N PU020256 entitled "KEY TRANSPORT TAMPER PROTECTION" filed on 09 May 2003 in the name of Duffield et al.

Field of the Invention [0003] This invention relates to smart cards for data decryption, and more particularly to arrangements for aligning processed and unprocessed data.

Background of the Invention [0004] Delivery of various forms of information and entertainment is often conditional, in that the information or entertainment is available only if the recipient pays the owner of the information, or is otherwise an authorized recipient. Smart cards can be used to provide the authorization necessary for such conditional delivery. In general, custody of the smart card represents the authorization required to interface with a delivery system. [0005] In the context of delivery of serial video using an MPEG standard transport stream, the video as delivered from a source may be encrypted in accordance with standards established by the National Renewable Security Standards(NRSS)Committee, and the smart card performs the decryption needed to convert the video to usable form. The decryption is performed by a decryption device or circuit located on the smart card. In order for decryption to take place, the decryptor on the smart card requires a proper key. The necessary decryption keys accompany the video stream, and can be extracted therefrom. These decryption keys are transmitted relatively infrequently, say every half-second or so. Thus, under least-optimum timing conditions, decryption might not start for one-half second after the key became available to the smart card. The key may be changed at the source every few seconds for improved security. There may be different keys for various different ones of the available video streams, andor for different ones of the smart-card/delivery-device pairs. [0006] In order to obtain the decryption key from the delivered encrypted information stream, the smart card must correctly decode the set of bytes containing the key information from the smart card must correctly decode the set of bytes containing the key information from among the bytes of each packet of information. As an example, a serial bit stream of MPEG transport stream video might be made up of successive packets of information, where each packet of information consists of 188 bytes, each of 8 bits. Within each 188-byte packet, the first 8-bit byte is a synchronization byte having a value of forty-seven (47). Four packet identification (PID) bytes immediately follow the packet synchronization byte. These packet identification bytes carry information relating to the type of information in the packet, the type of coding, error detection and correction (ED AC) and the like. Since each packet contains

188 bytes, there are 187 bytes between successive synchronization bytes, and 183 bytes between the end of the packet identification bytes and the next following synchronization byte. These 183 bytes are used for transport of the information, which in the example is video information.

[0007] FIGURE 1 is a simplified block diagram of a smart card 10. In FIGURE 1, a source of digital data is illustrated as a block 12, and includes a data clock (DCLK) source 13 and an associated data (DLN) source 15. The data may from time to time include an encoded MPEG transport stream. The MPEG transport stream is strongly encoded to prevent compromise during transport to the smart card. The data clock information from block 13 is applied to a Clock/Scan interface logic illustrated as a block 17 for testability using scan path vectors. The input data from source 15 is applied to an 8-bit delay line or chain 210 , each individual register of which is made available by way of a data path 212 to a state controller illustrated as a block 14. State controller or synchronizer 14 is illustrated in more detail in FIGURE 2. State controller 14 is a synchronizer that synchronizes the 8-bit bytes with packet header information, so that an eight-byte first-in, first-out (FIFO) or delay line 20 of FIGURE 1 can feed 8 bytes at a time to a decryption portion 26 of a triple DES engine 25. Path 51 feeds the 8-byte information from block 20 to state controller 14 so that the headers of the data can be examined to determine the type of packet and therefore, by implication, what should be done with the packet, such as decrypt or pass through. The decrypted data from decryption portion 26 is re-encrypted with a singe DES encryption in an encryption portion of DES engine 25 using local key instead of the TDES keys found at the data transmitter, so that the output of the smart card is at least somewhat protected against compromise on its way to the display device. The re-encrypted output of DES engine 25 is applied over a path designated 36 to an 8-byte FIFO 40 to re-convert to serial bit format. The output of FIFO 40 is applied through a serial shift register 42 to a digital data output port (DOUT) 44. [0008] In FIGURE 1, a microprocessor (μP) 48 includes μP (μ) clock, address, interrupts, data, and control ports, which are coupled to a register interface illustrated as a block 46.

Register interface 46 interfaces with state controller 14, and with an Entitlement Control

Message (ECM) first-in, first out (FIFO) 50, an Entitlement Management Message (EMM)

FIFO 52, and by way of data paths 46a and 46b with Scan Enable input (SCEN) and with a test (test mode) ports, respectively. Smart card 10 of FIGURE 1 also includes clock and input/output ports 56 and 58, respectively, which are coupled to a universal asynchronous transmitter (UART) 54. A reset port 60 allows resetting of (μP) 48 and ancillary devices.

Power is coupled to smart card 10 by way of power electrodes or ports NCC 62 and GΝD 64.

[0009] In operation of the arrangement of FIGURE 1, the applied data is coupled through a path including delay line 210, FIFO 20, DES engine 25, FIFO 40, and shift register 42, being synchronized, decrypted and reencrypted, and reconverted to serial bit form on its way.

[0010] Improved smart card arrangements are desired.

Summary of the Invention [0011] According to an aspect of the invention, a smart card comprises a first input coupled to a decryptor arrangement for receiving input data stream information which includes an identification header, and which may include data gaps which are not byte aligned, and processing the information including delaying, byte-aligning and decrypting the data stream information, to produce an output data sequence on an output line of the decryptor arrangement. A delay line has a first port coupled to the first input for receiving the input data stream information, and a second port for providing a delayed sequence of the input data stream information. The delayed sequence stream is delayed by an amount corresponding to the delay in processing the input data stream through the decryptor arrangement. A controllable switch selectively couples to one of a) the second port of the delay line and b) the output line of the decryptor arrangement, for passing to an output port selected bits of the delayed sequence stream and the output data sequence according to information in the input data stream.

[0012] In a particular version of this aspect of the invention, the decryptor arrangement of the smart card decrypts the information to clear information, and further comprises an encryptor arrangement coupled to the decryptor arrangement for re-encrypting the clear information to form re-encrypted information.

[0013] According to another aspect, a method is disclosed for enabling use of encrypted and unencrypted data stream information in a smart card having a decryptor arrangement which receives at an input thereof each packet in the data stream, regardless of whether the packet requires decryption, and which produces, at an output thereof, an output data stream. The method comprises providing a communication path having an input coupled to the input of the decryptor arrangement, and delaying the data stream carried in said communication path by an amount corresponding to the processing delay in the decryptor arrangement to produce a delayed data stream having bypassed the decryptor arrangement. One or more bits of the output data stream output from the decryptor arrangement and one or more bits of the delayed data stream, are selectively coupled to an output of the smart card according to information in the input data stream.

[0014] According to another aspect of the invention, a smart card is for receiving encrypted MPEG transport stream information, where the information includes an identification header, and which may include data gaps which are not byte aligned. The smart card controllably decrypts the information to produce decrypted information, or information encrypted at a lower level. The smart card comprises a decryptor arrangement including a serial output register. The decryptor arrangement has a processing delay. The smart card also includes a first delay line for delaying the information for a duration equal to a number of bits corresponding to the processing delay of the decryptor arrangement, to thereby generate bit- delayed information. A byte aligner is provided for byte aligning each incoming packet of the information to produce byte-aligned information. A controller receives the byte-aligned data and examines the identification header of each packet for determining if the packet information is to be decrypted, and if so for obtaining a key and enabling the decryptor arrangement. Means are provided for, prior to a time when the bit-delayed information comprises the identification header, loading the serial output register with a substitute header. Controllable multiplexing means is (or are) coupled to the first delay line and to the serial output register of the decryptor arrangement, for coupling the bit-delayed information to an output port prior to arrival of the identification header at the multiplexing means, and thereafter coupling to the output port the substitute header followed by information which has been decrypted.

[0015] In a particular version of this aspect of the invention, the decryptor arrangement of the smart card decrypts the information to clear information, and further comprises an encryptor arrangement coupled to the decryptor arrangement for re-encrypting the clear information to form re-encrypted information, and for coupling the re-encrypted information to the serial output register.

[0016] A method according to another aspect of the invention is for, by use of a smart card, enabling use of encrypted and unencrypted MPEG transport stream information, where the information includes an identification header associated with each packet of information, and which may include data gaps which are not byte aligned. The method comprises the step of, within the smart card, byte aligning packets of the information to thereby produce byte- aligned packets of information, and, also within the smart card, examining an identification header of each byte-aligned packet of information, to determine whether the associated packet should or should not be decrypted. The byte-aligned packets of information are applied to an input port of a decryptor arrangement having fixed bit delay, and concurrently with the coupling of the byte-aligned packets of information to the decryptor arrangement, the byte- aligned packets of information are coupled to an input of a delay line located in the smart card, which delay line has a bit delay equal to the bit delay of the decryptor arrangement. If a packet of information is not to be decrypted, an output of the delay line is coupled to a serial output port of the smart card, and if a packet of information is to be decrypted, a key is obtained, and the decryptor arrangement is enabled, for at least decrypting the byte-aligned packets of information, for thereby producing encryption processed information. If the packet of information is to be decrypted, a substitute header is loaded into an output register of the decryptor arrangement, and, immediately following the coupling of a prior packet to the output port of the smart card, the substitute header is coupled to the output port of the smart card, and immediately following the coupling of the substitute header to the output port of the smart card (10), the encryption processed information is coupled to the output port of the smart card.

[0017] In a particular mode of this method according to an aspect of the invention, the step of obtaining a key and enabling the decryptor arrangement includes the steps of (a) decrypting the information to produce decrypted information, and (b) re-encrypting the decrypted information.

Brief Description of the Drawing [0018] FIGURE 1 is a simplified diagram of a smart card, illustrating a state controller and the path for data signals requiring decryption; [0019] FIGURE 2 is a more detailed block diagram of a portion of a controller for the smart card of FIGURE 1 in accordance with a copending patent application; and

[0020] FIGURE 3 is a simplified block diagram of a smart card according to an aspect of the invention, including a delay line bypassing the decryptor. Description of the Invention [0021] FIGURE 2 is a simplified block diagram of a state controller portion of the smart card of FIGURE 1 generally according to copending patent application serial number PU020387, filed 15 August 2003 in the name of the inventors herein and copending patent application PU020256 filed 9 May 2003 in the name of David J. Duffield et al. In order to obtain the decryption key for the decryption portion 26 of DES engine 25 from the delivered encrypted information stream, the smart card must correctly decode the set of bytes containing the key information from among the bytes of each packet of information. As an example, a serial bit stream of MPEG transport stream video might be made up of successive packets of information, where each packet of information consists of 188 bytes, each of 8 bits. Within each 188-byte packet, the first 8-bit byte is a synchronization byte having a value of forty- seven (47). Four packet identification (PID) bytes immediately follow the packet synchronization byte. These packet identification bytes carry information relating to the type of information in the packet, the type of coding, error detection and correction (ED AC) and the like. Since each packet contains 188 bytes, there are 187 bytes between successive synchronization bytes, and 183 bytes between the end of the packet identification bytes and the next following synchronization byte. These 183 bytes are used for transport of the information, which in the example is video information. [0022] In FIGURE 2, encrypted serial information is applied from an input port 15 to a port 210i of an 8-bit delay line 210 controlled by state controller or synchronizer 14. The encrypted serial information is in the form of packets of 188 bytes, where each byte is of eight bits. Within each packet, the first byte is a synchronization byte, which has a particular value. In the case of a MPEG transport stream, the particular value of the synchronization byte is forty-seven (47). In this transport stream, four packet identification (PID) bytes immediately follow the synchronization byte.

[0023] State controller or synchronizer 14 of FIGURE 2 generates a byte clock on an output signal path 16, which is used to clock serial-to-parallel FIFO converter block 20. Encrypted serial information, delayed relative to the encrypted serial information applied to input port 2l0i of delay line 210, is produced on an output signal path 16 of synchronizer 14, and is applied to serial-to-parallel converter 20. Serial-to-parallel converter 20 produces on a signal path 24 a stream of eight-parallel-bit bytes in response to the byte clock generated on path 16. A packet synchronization or reset signal generated on an output path 22 of synchronizer 14 is used for a timing reference in the triple DES decryption portion of DES engine 25. The National Renewable Security Standards (NRSS) Committee system delay through the smart card 10 is a constant clock delay even though there may be gaps between the 188-byte packets. When decryption is active, the reset or sync signal of the next packet helps to establish if a gap exists or no gap is found between packets, which adjusts the processing for terminating the present or current packet and the beginning of processing of the incoming packet.

[0024] The encrypted stream of parallel-bit bytes produced by serial-to-parallel converter 20 of FIGURE 2 is applied to a key extraction arrangement illustrated as a block 30. The key information is transmitted in a number of bytes found in the serial bit stream entering port 12 of smart card 10, on an infrequent basis, such as every half-second. Block 30 monitors the parallel-bit byte stream and, when key information is available, extracts the key, and processes it, if necessary, as by decrypting, and applies the resulting decrypted key to a memory or register illustrated as a block 28. In operation, decryptor portion 26 of DES engine 25 receives the encrypted parallel-bit bytes from converter 20, and decrypts the information using the key which is available in register 28. Decryptor portion 26 produces decrypted video information. In order to maintain security of the decrypted video, the video may again be encrypted in a block illustrated as 34 with an encryption code which a utilization or display apparatus can decode. The re-encrypted video is produced on path 36 of FIGURE 1 and, after further processing, becomes available at smart card 10 output port or path 44.

[0025] In FIGURE 2, the encrypted serial information is applied to the input port 210i of an eight-bit delay line or serial register 210. Delay line 210 makes each of the stored eight bits available on a set 212 of output lines 212a, 212b, . . . 212g, 212h. The eight-bit-period delayed encrypted serial information is output from block 210 at an output port 210o, and is applied by way of signal path 18 to serial-to-parallel converter 20.

[0026] Also in FIGURE 2, an AND gate 214 includes eight input ports 1, 2, . . ., 7, 8, each of which is connected to one of the eight bit lines of set 212. More particularly, input ports 1 and 2 of AND gate 2^*14 are connected to bit lines 212g and 212h, respectively, and input ports 7 and 8 of AND gate 214 are connected to bit lines 212a and 212b, respectively. AND gate 214 includes a further input port designated EN9. This further input port is used as an enable (EN) input port, enabling the remaining input ports in response to a selected logic level applied over a bit line 216, and disabling the gate in response to the other logic level. In one version, positive logic is used, the enabling logic level is logic high, and the disabling logic level is logic low. [0027] During operation, AND gate 214 of FIGURE 2 monitors the value of the bits traversing 8-bit delay line 210. AND gate 214 is configured to, when enabled, respond to the value of a synchronizing byte, which in one version has a bit value of forty-seven (47). Thus, when the total value of the bits traversing delay line 210 equals 47 and AND gate 214 is enabled, AND gate 214 responds by producing a packet synchronizing (sync) or reset signal on signal path 22. The sync signal on signal path 22 is applied to a three (3)-bit counter illustrated as a block 218, which resets to zero (or to full count, as desired) and then counts eight clock cycles. Since a byte corresponds to eight bits or clock cycles, the full count of counter 218 occurs once per byte, and may be considered to be a byte clock. The byte clock signal produced by counter 218 is applied by way of path 16 to serial-to-parallel converter 20, to aid in producing the parallel-bit bytes. Thus, converter 20 accepts eight bits, and produces one byte every eight bit clock cycles. [0028] The sync or reset pulse produced on path 22 by AND gate 214 of FIGURE 2 is also applied to a reset input port 228r of a counter 228, together with the byte clock from counter 218. Counter 228 counts a number of bytes corresponding to the number of bytes between successive packet synchronizing pulses. More particularly, in an exemplary arrangement in which there are 188 bytes in each packet, one of which is the synchronization byte, there are 187 byte intervals between two successive synchronization bytes. At full count, counter 228 generates a logic high or logic 1 at its output port 228o, which is applied by way of an OR gate 310 to the enable input port EN9 of AND gate 214, to thereby enable AND gate 214 to detect the next synchronization byte. In the same manner, during counts other than a full count, output port 228o of counter 228 produces a logic low or 0 signal, which disables AND gate 214. Disabling the AND gate for all periods other than the expected arrival time of the synchronization byte tends to reduce the incidence of response of AND gate 214 to occasional byte values of 47, which may occur during operation.

[0029] The operation of the arrangement of FIGURE 2 as so far described makes it clear that, so long as the initial response of AND gate 214 is to a true synchronization byte, the synchronization system 14 is unlikely to respond to synchronization-level bytes which occur during the video portions of the signal, since the AND gate is disabled during the video portions of the signal. However, the first detection of a synchronization-value byte may occur in response to a video-content portion of the signal, rather than in response to a synchronization byte. In this event, the reset pulse will occur during the video interval, and the synchronization block 14 will not become aware of this error until the 187-byte-interval counter 228 reaches its full count. In such a situation, the reaching of a full count of counter

228 enables AND gate 214 during the video-content portion of the signal. In general, the video content at that location will no longer have the synchronization byte value, which is 47 in the example. In this event, synchronization has not been achieved, and a period of about one packet duration has already expired.

[0030] Considering that the decrypting key must be obtained and processed before decryption of the video content can be started, and packet synchronization must be achieved before that

(or those) of the bytes containing the decrypting key can be identified, and further considering that the encrypting key byte is available only intermittently, rapid synchronization is desirable to provide timely response of the smart card to a user's request.

[0031] As mentioned, OR gate 310 of FIGURE 2 is connected in signal path 216 between output port 228o of counter 228 and the enable input port EN9 of AND gate 214. More particularly, port 228o of counter 228 is connected to an input port 310i of OR gate 310, and the output port 3 lOo of OR gate 310 is connected to port EN9 of AND gate 214. OR gate 310 has no effect on the enabling and disabling of AND gate 214 by counter 228, so that when counter 228 reaches a full count of 187 byte intervals, it produces an enable signal which enables AND gate 214 for the next following byte, and maintains AND gate 214 disabled otherwise. [0032] OR gate 310 of FIGURE 2 has its second input port 310₂ connected to the output port 312o of an AND gate 312. AND gate 312 effectively provides a second input port, designated 312ii, by which AND gate 214 can be enabled. More particularly, if the output port 312o of AND gate 312 is logic high, that logic high level will be coupled through OR gate 310 to the enable input port EN9 of AND gate 214 regardless of the state of output port 228o of counter 228. A block illustrated as 314 in FIGURE 3 stores the bit patterns of the packet identification (PID) bytes which are of interest to the smart card 10 of FIGURE 1, and makes the patterns available to a comparator arrangement illustrated as a block 316. As mentioned, in a version involving MPEG video, the PID bytes immediately follow the sync byte. Comparator 316 is enabled for comparison of the stream of data bytes arriving by way of path 24 with at least one, and preferably a set of two or more, of the PID bytes within the data stream. Comparator 316 is enabled by an enable (EN) signal applied from the output port

320o of a window generator 320. Window generator 320 responds to at least the second count of the counter 228 following the sync or reset signal, and preferably to the second, third, fourth, and fifth counts, to enable comparison block 316 during the first, or preferably the first through fourth counter-228 counts following the sync bit which resets counter 228. During the window interval, comparison block 316 compares the stream of parallel-bit bytes applied from path 24 with the PID byte(s). If a match is found, the output port 316o of comparator

316 remains at an inactive (logic low) level. With port 316o at an inactive level, AND gate

312 is disabled, and the logic level at its output port remains at an inactive logic level. Thus, in the presence of a match between the stored PID bytes and the current data bytes, the PID comparison arrangement including memory 314, comparator 316, and gates 310 and 312 has no effect on the synchronization by counter 228. In the event of a lack of a match between the stored PID bytes and the current data bytes, output port 316o of comparator 316 produces an active logic state, such as a logic high level. The active logic state propagates through AND gate 312 if the gate is enabled by having its ON/OFF input port (and therefore its input port

312i₂) at an active logic state. The active logic level produced by comparison block 316 in the absence of a match between the stored PID bytes and the current data bytes propagates through AND gate 312 if enabled, and also propagates through OR gate 310 to the enable input port EN9 of AND gate 214, thereby enabling AND gate 214 to continue searching for a synchronization byte. Thus, if comparison block 316 fails to match any one of the PID bytes, synchronization is deemed to not be achieved, and AND gate 214 is re-enabled to search for another sync byte.

[0033] In the arrangement according to FIGURE 1 , the DES engine runs continuously, and consumes power even when decryption and re-encryption is not desired. This tends to cause excess power consumption during such times, and contributes to heating of the smart card. In addition, operation of the decryptor/encryptor in a manner which allows the signal to be passed without processing adds complication to the smart card. If the DES engine were to be run continuously, even when decryption was not needed, security could be compromised by repeatedly passing data having specific patterns through the DES engine, with the engine told to decrypt during one pass and to not decrypt during the next following pass, in an effort to discover the encryption keys. An additional problem is that the NRSS packets are in the form of a serial bit stream in which the packet headers indicate the type of information and consequently, at least by implication, the type of processing required. If the DES engine triple-decrypts and single-encrypts the data, the packet headers require changing to indicate the different level of decryption required. In some (long block) cases, the packet lengths of the incoming data may exceed 188 bytes, and this can create synchronization problems which may result in data dropouts. In those (short block) cases in which the packet length is less than 188 bytes, the arrangement of FIGURE 1 may render data inaccessible. [0034] FIGURE 3 illustrates a smart card according to an aspect of the invention. While the preferred state controller 14 has been described in some detail, any type of state controller may be used. In FIGURE 3, the single-encrypted output from DES engine 25 is applied by way of FIFO 40 and serial shift register 42 to a first input port 312il of a multiplexer (MUX)

312, and the output port of multiplexer 312 is coupled to DOUT port 44. Thus, when multiplexer 312 is in a state which couples first input port 312.il to output port 312o, the operation of the system of FIGURE 3 is identically as described in conjunction with FIGURE

1.

[0035] In FIGURE 3, the digital input data or signals are applied both to input port 210i of delay line 210 and additionally to the input port 310i of a further delay line or register 310. The delayed output signals from delay line 310 appear at an output port 3 lOo, and are applied to a second input port 312i2 of multiplexer 312. During those intervals in which multiplexer 312 couples first input port 31211 to output port 312o and the triple-decrypted, single- encrypted data is coupled to output port DOUT, the delayed data from delay line 310 is applied to "open" or non-connected second input port 312Ϊ2 of multiplexer 312, and goes no further. Thus, control of the state of multiplexer 312 allows selection of either the decrypted/encrypted (and delayed) data or unencrypted data to be coupled through the smart card. State controller 14 allows DES engine 25 to change the headers of the packets of data passing therethrough to correspond to the encryption state, and multiplexer 312 switches in specific bits that are being changed. [0036] Delay line 310 of FIGURE 3 allows unencrypted data to bypass the DES engine 25, and it may be turned off or deenergized to save power. In the event that the incoming data packets exceed 188 bytes in length, the data can be bypassed around the DES processing and some synchronization problems can be avoided, and thus allows continued flow of uninterrupted data. In the case of short blocks, the delay line 310 provides access to the data after the DES engine has started to perform processing. The delay line also allows bit-wise substitution of headers and non-DES encrypted portions of the packet with minimized control circuits in the DES processing; all data exiting the DES engine is byte-aligned, while the path through delay line 310 is not necessarily byte-aligned because of the possibility of gaps between packets. An additional advantage of the incorporation of delay line 310 into the smart card 10 is that, in the case of a non- authorized card, or a card in which authorization has lapsed, the DES circuits can be bypassed, and those portions of the data service which are unencrypted can pass unchanged through the smart card, to keep unencrypted services flowing. This helps to limit the microprocessor activity on a non-activated card, or on a card that the microprocessor has determined is in the process of being hacked so that the microprocessor shuts it down.

[0037] The length of delay line 310 is selected to equal the normal constant-delay requirements of the smart card, which in one embodiment corresponds to the delay of 140 flip-flops. A constant delay device such as a smart card may not need to have a specific number of delays for all devices. For any given application, a smart card may require only that the delay be constant, with different delays for different applications being provided by different smart cards suited to those different applications.

[0038] Thus, according to an aspect of the invention, a smart card (10) comprises a first input

(210i) coupled to a decryptor arrangement (25) for receiving input data stream information (12) which includes an identification header, and which may include data gaps which are not byte aligned, and processing the information including delaying, byte-aligning and decrypting the data stream information, to produce an output data sequence on an output line of the decryptor arrangement. A delay line (310) has a first port (310i) coupled to the first input (2101) for receiving the input data stream information, and a second port (310o) for providing a delayed sequence of the input data stream information. The delayed sequence stream is delayed by an amount corresponding to the delay in processing the input data stream through the decryptor arrangement. A controllable switch (312) selectively couples to one of a) the second port of the delay line and b) the output line of the decryptor arrangement, for passing to an output port (312o, 44) selected bits of the delayed sequence stream and the output data sequence according to information in the input data stream.

[0039] In a particular version of this aspect of the invention, the decryptor arrangement of the smart card (10) decrypts the information to clear information, and further comprises an encryptor arrangement (34) coupled to the decryptor arrangement (25) for re-encrypting the clear information to form re-encrypted information. [0040] According to another aspect, a method is disclosed for enabling use of encrypted and unencrypted data stream information in a smart card having a decryptor arrangement which receives at an input thereof each packet in the data stream, regardless of whether the packet requires decryption, and which produces, at an output thereof, an output data stream. The method comprises providing a communication path having an input coupled to the input of the decryptor arrangement, and delaying the data stream carried in said communication path by an amount corresponding to the processing delay in the decryptor arrangement to produce a delayed data stream having bypassed the decryptor arrangement. One or more bits of the output data stream output from the decryptor arrangement and one or more bits of the delayed data stream, are selectively coupled to an output of the smart card according to information in the input data stream.

[0041] While the foregoing invention has been described with reference to the above embodiments, various modifications and changes can be made without departing from the spirit of the invention. Accordingly, all such modifications and changes are considered to be within the scope of the appended claims.

Claims

WHAT IS CLAIMED IS :

1. A smart card for receiving encrypted data stream information which includes an identification header, and which may include data gaps which are not byte aligned, and producing decrypted information, comprising: a decryptor arrangement including a register and having a processing delay; a first delay line for delaying said information for a duration equal to a number of bits corresponding to said processing delay of said decryptor arrangement, to thereby generate bit- delayed information; a byte aligner for byte aligning incoming packets of the information to produce byte- aligned information; a controller for receiving said byte-aligned data and for examining said identification header of each packet for determining if the packet information is to be decrypted, and if so, enabling said decryptor arrangement; means for, prior to a time when said bit-delayed information comprises said identification header, loading a substitute header in said register; controllable multiplexing means coupled to said first delay line and to said an output of said register of said decryptor arrangement, for coupling said bit-delayed information to an output port prior to arrival of said identification header at said multiplexing means, and thereafter coupling to said output port said substitute header followed by information which has been decrypted.

2. The smart card of claim 1 , wherein said decryptor arrangement comprises a decryptor for decrypting said information to clear information, and further comprising an encryptor arrangement coupled to said decryptor arrangement for re-encrypting said clear information to form re-encrypted information, and for coupling said re-encrypted information to said register.

3. The smart card of claim 1 , wherein said data stream is an MPEG transport stream.

4. A method for, by use of a smart card, enabling use of encrypted and unencrypted

MPEG transport stream information, which information includes an identification header associated with each packet of information, and which may include data gaps which are not byte aligned, said method comprising the steps of: within said smart card, byte aligning packets of said information to thereby produce byte-aligned packets of information; within said smart card, examining an identification header of each byte-aligned packet of information, to determine whether the associated packet should or should not be decrypted; applying said byte-aligned packets of information to an input port of a decryptor arrangement having a bit delay; concurrently with said coupling of said byte-aligned packets of information to said decryptor arrangement, coupling said byte-aligned packets of information to an input of a delay line located in said smart card, which delay line has a bit delay equal to the bit delay of said decryptor arrangement; if a packet of information is not to be decrypted, coupling an output of said delay line to an output port of said smart card; if a packet of information is to be decrypted, enabling said decryptor arrangement, for at least decrypting said byte-aligned packets of information, for thereby producing encryption processed information; if said packet of information is to be decrypted, loading a substitute header into an output register of said decryptor arrangement; following the coupling of a prior packet to said output port of said smart card, coupling said substitute header to said output port of said smart card; and following the coupling of said substitute header to said output port of said smart card, coupling said encryption processed information to said output port of said smart card.

5. The method of claim 4, wherein the step of enabling said decryptor arrangement includes the steps of (a) decrypting said information using a key to produce decrypted information, and (b) re-encrypting said decrypted information.

6. A smart card comprising: a first input coupled to a decryptor arrangement for receiving input data stream information which includes an identification header, and which may include data gaps which are not byte aligned, and processing said information including delaying, byte-aligning and decrypting said data stream information, to produce an output data sequence on an output line of said decryptor arrangement; a delay line having a first port coupled to said first input for receiving said input data stream information, and a second port for providing a delayed sequence of said input data stream information, the delayed sequence stream being delayed by an amount corresponding to the delay in processing said input data stream through the decryptor arrangement; and a controllable switch for selectively coupling to one of a) the second port of said delay line and b) the output line of said decryptor arrangement, for passing to an output port selected bits of said delayed sequence stream and said output data sequence according to information in said input data stream.

7. The smart card of claim 5, wherein the input data stream is an MPEG transport stream.

8. The smart card of claim 6, wherein a controller responsive to the information in said input data stream, controls the passage of packets to the output port of the smart card via a signal to the switch, such that the output stream from the output port includes packet information having bypassed the decryptor arrangement.

9. The smart card of claim 8, wherein said switch comprises a multiplexer.

10. The smart card of claim 6, wherein said decryptor arrangement comprises a decryptor for decrypting said information to clear information, and further comprising an encryptor arrangement coupled to said decryptor arrangement for re-encrypting said clear information to form re-encrypted information in said output data sequence on said output line.

11. A method for enabling use of encrypted and unencrypted data stream information in a smart card having a decryptor arrangement which receives at an input thereof each packet in the data stream, regardless of whether the packet requires decryption, and which produces, at an output thereof, an output data stream, the method comprising: providing a communication path having an input coupled to the input of the decryptor arrangement, and delaying the data stream carried in said communication path by an amount corresponding to the processing delay in the decryptor arrangement to produce a delayed data stream having bypassed the decryptor arrangement; and selectively coupling one of a) one or more bits of the output data stream output from the decryptor arrangement; and b) one or more bits of the delayed data stream, to an output of said smart card according to information in said input data stream.

12. The method of claim 11, further comprising, in said decryptor arrangement, decrypting said information to clear information; and re-encrypting said clear information to form re-encrypted information in said output data stream.

13. The method of claim 11 , further comprising byte aligning each incoming packet of the information to produce byte-aligned information.