具体实施方式detailed description

本发明的DVB和IPTV互动业务保护系统包括客户端子系统、前端子系统、认证授权子系统、订户管理系统、节目流管理系统、节目信息管理系统等部分。其中客户端子系统、前端子系统、认证授权子系统为主要部分，订户管理系统、节目流管理系统、节目信息管理系统为外围辅助系统。该系统包括业务保护CAServer服务器、授权管理DRMServer和客户端STB中的CAClient模块三部分，其中CAServer服务器对应前端子系统，授权管理DRMServer对应认证授权子系统，客户端STB中的CAClient模块对应客户端子系统。The DVB and IPTV interactive service protection system of the present invention includes a client subsystem, a front-end subsystem, an authentication and authorization subsystem, a subscriber management system, a program flow management system, a program information management system and the like. Among them, the client subsystem, front-end subsystem, and authentication and authorization subsystem are the main parts, and the subscriber management system, program stream management system, and program information management system are peripheral auxiliary systems. The system includes three parts: business protection CAServer, authorization management DRMServer, and CAClient module in the client STB. The CAServer server corresponds to the front-end subsystem, the authorization management DRMServer corresponds to the authentication and authorization subsystem, and the CAClient module in the client STB corresponds to the client subsystem. .

参见附图2，客户端子系统(简称客户端)的基本结构如下：客户端为机顶盒或TV提供透明的节目内容访问，� �据用户提供的节目信息，负责与订户管理系统、认证授权子系统和前端子系统交互，获得解扰密钥，实施对� 扰节目的解扰工作，实现有条件接收和有条件播放能力。客户端的订购模块与订户管理系统通过安全信道交互� 递用户身份信息、用户信用信息等内容，完成注册、购买等功能，为用户提供查询其身份和信用信息的交互机制；客户端的业务申请模块与认证授权子系统的业务受理模块交互� 递用户身份信息以及对节目、节目单、节目类型(点播、广播、直播)的申请，并负责与认证授权子系统协商生成业务密钥，� 递给业务获取模块；客户端的业务获取模块对从前端子系统同步获取� 扰的节目内容进行解密和解扰工作，并在点播交互模式下向CA提交用户的播放控制信息(快进、快退、停止等)，实现对节目流的交互操作。Referring to accompanying drawing 2, the basic structure of the client subsystem (referred to as the client) is as follows: the client provides transparent program content access for the set-top box or TV, and is responsible for communicating with the subscriber management system, the authentication and authorization subsystem and the front end according to the program information provided by the user. Subsystems interact to obtain the descrambling key, implement descrambling of scrambled programs, and realize conditional reception and conditional playback capabilities. The ordering module of the client and the subscriber management system interactively transmit user identity information, user credit information and other content through a secure channel, complete functions such as registration and purchase, and provide users with an interactive mechanism for querying their identity and credit information; the business application module of the client and authentication The service acceptance module of the authorization subsystem interactively transmits user identity information and applications for programs, program lists, and program types (on-demand, broadcast, and live broadcast), and is responsible for negotiating with the authentication and authorization subsystem to generate a service key and passing it to the service acquisition module; The service acquisition module of the client terminal decrypts and descrambles the scrambled program content synchronously acquired from the front-end subsystem, and submits the user's playback control information (fast forward, fast rewind, stop, etc.) Flow interaction.

客户端采用分层和模块结构，便于系统的更新和升级，以提高系统的兼容性和灵活性。客户端从上到下分为接口层、控制层和业务层。接口层负责提供� �准的任务接口，接收用户的业务指令(如注册、订购、点播、广播、直播、快进、快退、停止等)及其相关信息(如用户的机顶盒号、身份证号、身份证书等)，提交给控制模块。同时，接口层也负责向用户反馈系统执行结果或解扰后的节目内容。The client adopts a layered and modular structure to facilitate system updates and upgrades to improve system compatibility and flexibility. The client is divided into interface layer, control layer and business layer from top to bottom. The interface layer is responsible for providing standard task interfaces, receiving user business instructions (such as registration, ordering, on-demand, broadcast, live broadcast, fast forward, fast rewind, stop, etc.) and related information (such as user set-top box number, ID number, Identity certificate, etc.), submitted to the control module. At the same time, the interface layer is also responsible for feeding back the system execution result or descrambled program content to the user.

控制层负责管理业务模块列表，� �据业务指令调用相应的业务层模块完成相应的业务。The control layer is responsible for managing the list of business modules, and calls the corresponding business layer modules to complete the corresponding business according to the business instructions.

业务层划分为若干个业务模块，各业务模块完成相对独立的业务。主要的业务模块包括：订购模块、业务申请模块、业务获取模块。订购模块完成注册、购买、查询功能。申请模块完成节目单申请、点播申请、广播申请、直播申请、协商密钥功能。业务获取模块完成解复用、解密ECM、解扰节目流、验证节目合法性功能。其中，解复用功能采用� 统DVB-CA终端与前端子系统建立同步，并接收、解复用，获得ECM和节目流；解密ECM功能使用协商的会话密钥对ECM进行解密获得解扰控制字CW；解扰节目流功能使用解密得到的控制字CW调用解扰算法(AES或CSA算法)对节目流进行解扰，将得到的DVB/IPTV节目流� 输给控制层；验证节目合法性功能用于提取节目流中的合法性� �识水印。The business layer is divided into several business modules, and each business module completes a relatively independent business. The main business modules include: ordering module, business application module, and business acquisition module. The ordering module completes the functions of registration, purchase and inquiry. The application module completes program list application, on-demand application, broadcast application, live broadcast application, and key negotiation functions. The service acquisition module completes the functions of demultiplexing, decrypting ECM, descrambling the program stream, and verifying the legitimacy of the program. Among them, the demultiplexing function uses the traditional DVB-CA terminal to establish synchronization with the front-end subsystem, and receives and demultiplexes to obtain the ECM and program stream; the decryption ECM function uses the negotiated session key to decrypt the ECM to obtain the descrambling control word CW; descrambling program stream function uses the decrypted control word CW to call the descrambling algorithm (AES or CSA algorithm) to descramble the program stream, and transmits the obtained DVB/IPTV program stream to the control layer; the function of verifying the legality of the program is used It is used to extract the legality identification watermark in the program stream.

客户端的主要信息流包括：有条件接收(CA)、有条件播出(CP)、和盗版追踪(PT)。� �据信息流定义，客户端函数由CA、CP、PT构成，分别为：The main information flows of the client include: Conditional Access (CA), Conditional Playout (CP), and Piracy Tracking (PT). According to the definition of information flow, the client function consists of CA, CP, and PT, which are:

其中DS为解扰函数，C为� 扰或� 密后的� 输流，CW为控制字生成器生成的控制字，K为业务密钥，D为解密函数，EX为从� 输流中解复用得到ECM(授权控制信息)的操作函数；WD为合法性水印提取函数，valid为检测是否成功的� �记，valid＝1表示检测成功，载体中包含水印W,valid＝0表示检测不成功，载体中未发现合法性水印W；FE为指纹水印嵌入函数，α,β∈{0,1}∧α� β。Among them, DS is the descrambling function, C is the scrambled or encrypted transport stream, CW is the control word generated by the control word generator, K is the service key, D is the decryption function, and EX is the demultiplexed data obtained from the transport stream. The operation function of ECM (authorization control information); WD is the legality watermark extraction function, valid is the mark of whether the detection is successful, valid=1 means that the detection is successful, the carrier contains the watermark W, valid=0 means that the detection is unsuccessful, and the carrier does not Find the legitimacy watermark W; FE is the fingerprint watermark embedding function, α, β∈{0,1}∧α� β.

参见附图3，前端子系统基本结构如下：前端子系统包括控制字生成器(CWG)、ECM生成器(ECMG)、水印嵌入算法(WEA)和通用� 扰算法(CSA)，其主要作用是生成控制字，调用CSA对来自节目流管理系统的节目内容进行� 扰，实现实时封装(RP)和预封装(PP)。此外，为了应对非法节目的� 输和干扰，在实时封装和预封装过程中通过嵌入合法性数字水印� �识W来实现有条件播放CP，相应的客户端子系统通过验证节目� 输流中是否存在合法性水印� �识W来实际控制节目在用户终端上的播出。Referring to accompanying drawing 3, the basic structure of the front-end subsystem is as follows: the front-end subsystem includes a control word generator (CWG), an ECM generator (ECMG), a watermark embedding algorithm (WEA) and a common scrambling algorithm (CSA), and its main functions are Generate control words, invoke CSA to scramble program content from program stream management system, and realize real-time encapsulation (RP) and pre-encapsulation (PP). In addition, in order to deal with the transmission and interference of illegal programs, in the process of real-time encapsulation and pre-encapsulation, the legality digital watermark W is embedded to realize conditional playback of CP, and the corresponding client subsystem verifies whether there is a legality watermark in the program transmission stream Mark W to actually control the broadcasting of the program on the user terminal.

� �据信息流定义，前端子系统函数为：According to the definition of information flow, the function of the front-end subsystem is:

其中C为� 扰或� 密后的� 输流，K为业务密钥，WE代表合法性水印嵌入函数，S代表� 扰函数，E代表� 密函数，T为载体，W为合法性水印生成器生成合法性水印信息。Among them, C is the scrambled or encrypted transport stream, K is the service key, WE represents the legality watermark embedding function, S represents the scrambling function, E represents the encryption function, T is the carrier, and W is the legitimate watermark generated by the legality watermark generator. Sexual watermark information.

α,β∈{0,1}∧α� β。α,β∈{0,1}∧α� β.

前端子系统的控制字发生器以系统密钥为基础生成控制字，采用DVB通用� 扰算法(CSA)对来自节目流管理系统(如CDN网络内容管理服务器)的节目内容进行� 扰操作。前端子系统同时也使用会话密钥对控制字进行� 密生成� 统的ECM。� 扰后的节目内容与ECM� 递给节目分发系统进行复用� 输。此外，前端子系统将以固定间隔重新生成� 扰控制字，保证节目内容的� 输安全。在点播交互模式下，前端子系统同时也负责接收用户的播放控制信息(快进、快退、停止等)，并对� 扰和节目流� 输进行调整。The control word generator of the front-end subsystem generates control words based on the system key, and uses the DVB common scrambling algorithm (CSA) to scramble the program content from the program stream management system (such as CDN network content management server). The front-end subsystem also uses the session key to encrypt the control word to generate a traditional ECM. The scrambled program content and ECM are delivered to the program distribution system for multiplex transmission. In addition, the front-end subsystem will regenerate the scrambling control word at fixed intervals to ensure the security of program content transmission. In the on-demand interactive mode, the front-end subsystem is also responsible for receiving the user's playback control information (fast forward, fast rewind, stop, etc.), and adjusts scrambling and program stream transmission.

条件接收前端的处理过程如下：The processing process of the conditional access front end is as follows:

1)嵌入合法性水印：为了支持条件播出和版权保护，通过水印嵌入器WEA的版权水印算法和合法性水印算法在TS� 输流嵌入版权和合法性水印。版权水印比特序列由认证服务器� �据前端� �识和业务信息产生。合法性水印比特序列由监管机构生成。1) Embedding legality watermark: In order to support conditional broadcasting and copyright protection, copyright and legality watermarks are embedded in the TS transport stream through the copyright watermarking algorithm and legality watermarking algorithm of the watermark embedder WEA. The copyright watermark bit sequence is generated by the authentication server according to the front-end identification and business information. The legitimacy watermark bit sequence is generated by the regulator.

2)生成CW：对于多节目� 输流和复杂的前端系统，CW由独立� 扰器生成。对于单节目� 输流和低成本的前端系统，CW由CWG生成。依据由EIS(事件调度系统)提供的初始向量(IV)和业务� �识(AC)，CWG通过非线性伪随机序列发生器为TS� 输流生成CW，并按照5-10秒的周期不断更新。2) Generate CW: For multi-program transport streams and complex front-end systems, CW is generated by an independent scrambler. For single-program Transport Stream and low-cost head-end systems, CW is generated by CWG. According to the initialization vector (IV) and service identification (AC) provided by the EIS (Event Scheduling System), the CWG generates a CW for the TS transmission stream through a nonlinear pseudo-random sequence generator, and continuously updates it according to a period of 5-10 seconds.

3)获取SK：在系统运行之前，前端系统将在认证服务器中进行注册。在系统运行中，前端系统与认证服务器将建立SAC(安全认证通道)。基于SAC以及业务密钥动态更新与获取协议，前端从认证服务器获取并动态更新业务密钥。3) Obtain SK: Before the system runs, the front-end system will register in the authentication server. During system operation, the front-end system and the authentication server will establish a SAC (Security Authentication Channel). Based on the SAC and service key dynamic update and acquisition protocol, the front end obtains and dynamically updates the service key from the authentication server.

4)� 扰和� 密：� 扰和� 密为并行运行。嵌过版权和合法性水印的� 输流TS送入硬件独立� 扰器或者系统前端的软件� 扰器进行� 扰。同时，ECMG采用AES算法在业务密钥SK的控制下对各视频业务的CW进行� 密得到ECM。4) Scrambling and encryption: scrambling and encryption run in parallel. The transport stream TS embedded with the copyright and legality watermark is sent to the independent hardware scrambler or the software scrambler at the front end of the system for scrambling. At the same time, the ECMG uses the AES algorithm to encrypt the CW of each video service under the control of the service key SK to obtain the ECM.

前端子系统由实时封装子系统、预封装子系统、安全存储子系统构成。实时封装子系统用于对节目内容的实时在线封装与保护，预封装子系统用于对节目内容的离线封装与保护。实时封装子系统与预封装子系统可以� �据需要选择其中之一使用或者共同使用。安全存储子系统可以� �据需要选择使用。在实时封装情况下，来自认证授权子系统的ski(密钥)将按照指定的时间间隔进行动态更新，采用推送方式将更新后的内容重新发送给前端子系统，前端子系统的业务密钥代理在收到推送消息后，也相应的从监听状态切换到push-ready(准备推送)状态，在检查了内部状态和存储空间后，向认证授权子系统指定的端口发送push-ready消息，激活ski的发送进程。在得到认证授权子系统的反馈，有新的sk消息到来时，业务密钥代理从监听状态切换到Recv-SKI(接收密钥)状态，解析来自认证授权子系统的消息，提取ski，存储到共享空间中。The front-end subsystem consists of a real-time packaging subsystem, a pre-packaging subsystem, and a secure storage subsystem. The real-time packaging subsystem is used for real-time online packaging and protection of program content, and the pre-packaging subsystem is used for offline packaging and protection of program content. The real-time packaging subsystem and the pre-packaging subsystem can be selected for use or used together according to needs. The secure storage subsystem can be used as required. In the case of real-time encapsulation, the ski (key) from the authentication and authorization subsystem will be dynamically updated according to the specified time interval, and the updated content will be resent to the front-end subsystem by means of push, and the business key agent of the front-end subsystem After receiving the push message, it also switches from the listening state to the push-ready state accordingly. After checking the internal state and storage space, it sends a push-ready message to the port specified by the authentication and authorization subsystem to activate the ski sending process. After receiving feedback from the authentication and authorization subsystem, when a new sk message arrives, the service key agent switches from the monitoring state to the Recv-SKI (receiving key) state, parses the message from the authentication and authorization subsystem, extracts the ski, and stores it in in shared space.

对于要封装的节目� 输流，首先要获得其PSI/SI等� 输流和业务信息，在捕获� 输流中的PSI/SI数据包后，Data-process(业务� 扰� 密)从Read-packet(读取包信息)状态切换到Read-PSI(读取PSI)状态，从数据包中分析出PSI和SI等信息。对于预封装过程，PSI、SI信息在整个� 输流中固定不变，� 此只需要经历一次Read-PSI状态，对于实时封装过程，PSI、SI信息在整个� 输流中可以� �据运营商的要求发生改变，� 此，存在PSI、SI信息更新的可能，这时需要对这些信息的版本进行识别，需要多次经历Read-PSI状态，进行相关信息的更新。For the program transport stream to be encapsulated, it is first necessary to obtain its transport stream such as PSI/SI and service information. After capturing the PSI/SI data packets in the transport stream, Data-process (service scrambling encryption) from Get packet information) state switch to Read-PSI (read PSI) state, analyze information such as PSI and SI from the data packet. For the pre-encapsulation process, the PSI and SI information are fixed in the entire transmission stream, so it only needs to go through the Read-PSI state once. For the real-time encapsulation process, the PSI and SI information can be changed in the entire transmission stream according to the requirements of the operator , therefore, there is a possibility of updating PSI and SI information. At this time, it is necessary to identify the versions of these information, and it is necessary to go through the Read-PSI state several times to update relevant information.

参见图4，认证授权子系统的结构如下：认证授权子系统包括业务受理模块、业务密钥SK更新模块、双向认证协议、SK协商协议、计时器、在线用户列表等部分组成。其作用是接受用户对节目内容的申请，通过认证和协商得到业务密钥SK，并周期性的进行密钥更新。Referring to Figure 4, the structure of the authentication and authorization subsystem is as follows: the authentication and authorization subsystem includes a service acceptance module, a service key SK update module, a two-way authentication protocol, an SK negotiation protocol, a timer, and an online user list. Its role is to accept the user's application for program content, obtain the service key SK through authentication and negotiation, and periodically update the key.

认证授权子系统的主要信息流包括：客户端认证(CT)、客户端授权(CR)、业务密钥更新与分配的能力(KM)，其时刻处于监听状态，对接入的客户端进行CT认证，并按照指定的时间间隔Δt动态的更新和分配业务密钥，在接收到来自客户端子系统和前端子系统的业务保护信息(SPI：Service Protection Information)请求和业务授权信息(SAI：ServiceAuthorization Information)请求后，分别作出响应，执行CR授权操作。The main information flow of the authentication and authorization subsystem includes: client authentication (CT), client authorization (CR), service key update and distribution capability (KM), which is always in the monitoring state, and CT Authentication, and dynamically update and distribute the service key according to the specified time interval Δt, after receiving the service protection information (SPI: Service Protection Information) request and service authorization information (SAI: Service Authorization Information) from the client subsystem and front-end subsystem ) requests, respond respectively and execute CR authorization operations.

� �据信息流定义，认证授权子系统的操作函数由CT、CR、KM构成：According to the information flow definition, the operation function of the authentication and authorization subsystem consists of CT, CR, and KM:

其中I代表身份认证函数，C代表信用认证函数，uid为用户的身份� �识，h_pass为静态密� �的哈希值，cert为用户身份证书，uid为用户的身份� �识；R代表权利描述函数，P代表权利封装函数，sid为用户uid可以使用的业务� �识，rid表示用户uid对业务sid拥有的基本权利� �识，cid表示权利执行时的条件和限制；KD代表业务密钥分配函数，PKG为生成权利封装密钥的操作函数，y_n-1为t-1时刻的业务密钥，α,β∈{0,1}∧α� β。Among them, I represents the identity authentication function, C represents the credit authentication function, uid is the user's identity, h _pass is the hash value of the static password, cert is the user's identity certificate, uid is the user's identity; R represents the right description function, P Represents the encapsulation function of rights, sid is the service identifier that user uid can use, rid represents the basic right identifier that user uid has to the service sid, cid represents the conditions and restrictions when the right is executed; KD represents the service key distribution function, and PKG is the right to generate Operation function of encapsulation key, y _n-1 is the service key at time t-1, α,β∈{0,1}∧α� β.

认证授权子系统的业务受理模块作为与用户的接口，负责� �据用户的节目申请启动相应的业务流程，在用户管理系统的配合下对用户的申请及其身份信息、信用信息进行合法性和有效性验证。对于合法、有效的申请，认证授权子系统提供密钥协商机制与用户协商获得会话密钥，并将会话密钥及其相关节目信息通过安全信道发送给前端子系统。此外，认证授权子系统将以固定间隔重新对用户的身份进行验证和重新生成业务密钥。The business acceptance module of the authentication and authorization subsystem acts as the interface with the user, responsible for starting the corresponding business process according to the user's program application, and checking the legality and validity of the user's application and its identity information and credit information with the cooperation of the user management system. verify. For legal and valid applications, the authentication and authorization subsystem provides a key negotiation mechanism to negotiate with the user to obtain a session key, and sends the session key and related program information to the front-end subsystem through a secure channel. In addition, the authentication and authorization subsystem will re-authenticate the user's identity and regenerate the service key at regular intervals.

认证授权子系统的业务受理模块与客户端的业务申请模块对应进行交互，支持的业务主要包括：节目表、点播、广播等。The service acceptance module of the authentication and authorization subsystem interacts with the service application module of the client side, and the supported services mainly include: program schedule, on-demand, broadcast, etc.

在点播和广播业务下，业务受理模块从用户管理系统获得用户相关信息，通过双向认证协议确认用户的身份信息和信用信息的合法性和有效性，然后通过SK协商协议生成与用户端一致的业务密钥SK，与用户信息一起发送到前端子系统，启动节目内容� 扰� 输过程。在成功协商密钥后，用户信息及其对应的SK将被保存到在线用户列表，计时器被启动。当到达指定时间间隔(该间隔规定重新认证协商的最小时间间隔，随着用户数的增多该间隔可能自动扩大)时，由SK更新模块对在线用户列表中的用户重新进行认证和密钥协商，更新会话密钥SK，以提高系统的安全性。Under on-demand and broadcast services, the business acceptance module obtains user-related information from the user management system, confirms the legitimacy and validity of the user's identity information and credit information through the two-way authentication protocol, and then generates services consistent with the user end through the SK negotiation protocol The key SK is sent to the front-end subsystem together with the user information to start the program content scrambling transmission process. After successfully negotiating the key, the user information and its corresponding SK will be saved to the online user list, and the timer will be started. When the specified time interval is reached (this interval stipulates the minimum time interval for re-authentication negotiation, and the interval may be automatically expanded as the number of users increases), the SK update module will re-authenticate and key-negotiate the users in the online user list, Update the session key SK to improve the security of the system.

SK更新模块产生并定时更新业务秘钥(SK)以及初始向量(IV)，并且通过SSL(安全套接层)安全信道向记录在在线用户列表中的客户端发送SK更新信令，通过TCP/IP协议向指定IP和端口的前端子系统发送更新后的SK数据，并且保证客户端与前端子系统的SK数据完全一致。The SK update module generates and regularly updates the service secret key (SK) and the initialization vector (IV), and sends the SK update signaling to the client recorded in the online user list through the SSL (Secure Sockets Layer) secure channel, through TCP/IP The protocol sends updated SK data to the front-end subsystem with specified IP and port, and ensures that the SK data of the client and the front-end subsystem are completely consistent.

认证授权子系统与客户端的密钥更新过程如下：(点播)The key update process between the authentication and authorization subsystem and the client is as follows: (on demand)

认证授权子系统与客户端建立SSL连接后，通过SSL安全信道� 输用户信息；After the authentication and authorization subsystem establishes an SSL connection with the client, it transmits user information through the SSL secure channel;

由用户管理系统处理用户信息，用户将点播申请表发送给认证授权子系统；The user information is processed by the user management system, and the user sends the on-demand application form to the authentication and authorization subsystem;

认证授权子系统利用点播申请表的Pid，向客户端发送相应的SK；The authentication and authorization subsystem uses the Pid of the on-demand application form to send the corresponding SK to the client;

客户端接收到� �志为SK的信息，分析该信息得到下一时刻的SK；The client receives the information marked as SK, and analyzes the information to get the SK at the next moment;

外围辅助系统Peripheral assistance system

订户管理系统提供用户注册、购买、查询服务。订户管理系统建立用户的基本信息记录，以及用户的资源信息记录，主要是智能卡相关信息的记录，并在此基础上记录用户与智能卡的对应使用情况。订户管理系统结合节目信息管理系统为用户提供订购界面，接收用户的注册、购买申请，验证用身份信息(如机顶盒编号、用户名、身份证号、公钥证书等)的合法性，生成用户注册信息库和用户订购信息库。用户可以只注册不购买，或者既注册又购买，或者不注册只购买(但必须提前注册)。节目流管理系统(如CDN网络内容管理服务器)对节目内容进行管理。节目信息管理系统对节目的信息进行分类，并对订户管理系统提供节目信息。The subscriber management system provides user registration, purchase and inquiry services. The subscriber management system establishes basic user information records and user resource information records, mainly smart card-related information records, and on this basis records the corresponding use of users and smart cards. The subscriber management system combined with the program information management system provides users with an ordering interface, receives user registration and purchase applications, verifies the validity of identity information (such as set-top box number, user name, ID number, public key certificate, etc.), and generates user registration Repository and User Subscription Repository. Users can only register without purchasing, or both register and purchase, or only purchase without registering (but must register in advance). The program stream management system (such as CDN network content management server) manages the program content. The program information management system classifies the information of programs and provides the program information to the subscriber management system.

(1)DVB/IPTV双模互动业务保护系统(1) DVB/IPTV dual-mode interactive service protection system

参见图5，系统总体模块包括：业务保护CAServer服务器、授权管理DRMServer和客户端STB中的CAClient模块三部分。其中CAServer服务器对应前端子系统，授权管理DRMServer对应认证授权子系统，客户端STB中的CAClient模块对应客户端子系统。Referring to Fig. 5, the overall system module includes three parts: business protection CAServer server, authorization management DRMServer and CAClient module in client STB. The CAServer server corresponds to the front-end subsystem, the authorization management DRMServer corresponds to the authentication and authorization subsystem, and the CAClient module in the client STB corresponds to the client subsystem.

CAServer服务器包括接收端口、发送端口、解扰器、密钥端口四部分。1)� 扰器实现CW(控制字)的生成，ECM(授权控制信息)的生成，TS流的分析，ECM的复用等� 扰过程中的全部� �心内容。2)接收端口实现实时接收指定UDP组播地址的TS节目流；3)发送端口实现实时的对� 扰复用后的节目TS流按照指定的UDP组播地址转发；4)密钥端口实现与DRMServer服务器的交互，并获取业务保护信息。CAServer includes four parts: receiving port, sending port, descrambler and key port. 1) The scrambler realizes all the core contents in the scrambling process such as the generation of CW (Control Word), the generation of ECM (Entitlement Control Information), the analysis of TS stream, and the multiplexing of ECM. 2) The receiving port realizes real-time reception of the TS program stream of the designated UDP multicast address; 3) The sending port realizes real-time forwarding of the scrambled and multiplexed program TS stream according to the designated UDP multicast address; 4) The key port realizes the connection with Interact with the DRMServer server and obtain service protection information.

授权管理DRMServer包括CA端口、STB端口、认证与链接管理模块、节目密钥管理模块和控制模块。1)CA端口负责接收CAServer服务器的业务密钥请求，并交由认证与链接管理模块建立连接后，进行业务保护信息和更新业务保护信息的� 输。2)STB端口负责接收客户端STB的业务授权请求，并交由认证与链接管理模块建立安全通道后，进行业务授权信息和更新业务授权信息的� 输。3)认证与链接管理模块完成DRMServer服务器与CAServer服务器之间的链接建立与维护、完成DRMServer服务器与客户端STB之间的链接建立与维护，建立并维护安全通道。4)节目密钥管理模块负责业务授权信息的生成、更新，负责向授权的在线客户端STB和CAServer服务器分发业务授权信息。5)控制模块负责系统模块管理，并为多用户的并发处理提供支持，支持系统的扩展和性能提升。Authorization management DRMServer includes CA port, STB port, authentication and link management module, program key management module and control module. 1) The CA port is responsible for receiving the service key request from the CAServer server and handing it over to the authentication and link management module to establish a connection for transmission of service protection information and updated service protection information. 2) The STB port is responsible for receiving the service authorization request of the client STB, and after the authentication and link management module establishes a secure channel, the service authorization information and updated service authorization information are transmitted. 3) The authentication and link management module completes the establishment and maintenance of the link between the DRMServer server and the CAServer server, completes the establishment and maintenance of the link between the DRMServer server and the client STB, and establishes and maintains a secure channel. 4) The program key management module is responsible for generating and updating service authorization information, and for distributing service authorization information to authorized online client STB and CAServer. 5) The control module is responsible for system module management, and provides support for multi-user concurrent processing, and supports system expansion and performance improvement.

CAClient模块包括解扰器和密钥端口两部分，也可以按层次划分为控制层、业务层，业务层是� �心层，实现用户的登记注册、业务授权信息获取、节目的解扰等功能。1)解扰器实现ECM的解复用、TS流的分析、CW的解密、节目的解扰等解扰过程中的全部� �心内容。2)密钥端口实现与DRMServer服务器的交互，提交客户端STB信息，并登记用户注册信息或者获取业务授权信息。客户端STB通过CAClient模块完成对用户选择的节目进行接收、解扰、解� �输出。3)客户端STB� �据用户操作要求，选择接入相应节目的组播地址。4)客户端STB将收到的节目交给CAClient模块，使用业务授权信息完成对� 扰控制字的解密。5)客户端STB将收到的节目交给CAClient模块，对其进行分析、解扰；(5)客户端STB将解扰后的节目进行解� �输出。The CAClient module includes two parts: a descrambler and a key port. It can also be divided into a control layer and a business layer. The business layer is the core layer, which realizes functions such as user registration, service authorization information acquisition, and program descrambling. 1) The descrambler realizes all core contents in the descrambling process such as ECM demultiplexing, TS stream analysis, CW decryption, and program descrambling. 2) The key port implements interaction with the DRMServer server, submits client STB information, and registers user registration information or obtains service authorization information. The client STB completes receiving, descrambling, decoding and outputting the program selected by the user through the CAClient module. 3) The client STB selects the multicast address for accessing the corresponding program according to the operation requirements of the user. 4) The client STB delivers the received program to the CAClient module, and uses the service authorization information to complete the decryption of the scrambled control word. 5) The client STB delivers the received program to the CAClient module for analysis and descrambling; (5) The client STB decodes and outputs the descrambled program.

(2)DVB/IPTV双模互动业务保护系统针对不同业务模式的应用(2) Application of DVB/IPTV dual-mode interactive service protection system for different service modes

直播(组播)模式：Live (multicast) mode:

直播(组播)系统基本工作流程：The basic workflow of the live broadcast (multicast) system:

启动机顶盒，BOSS系统(业务运营支撑系统)连接CA客户端，并浏览其所订服务列表，CA客户端通过EPG/Portal(电子节目指南/门户技术)向BOSS提供客户端ID和服务列表，订购节目或请求节目播放；Start the set-top box, the BOSS system (business operation support system) connects to the CA client, and browses its ordered service list, the CA client provides the client ID and service list to BOSS through EPG/Portal (electronic program guide/portal technology), and orders program or request a program to be played;

CA客户端向授权服务器提供客户端ID，并发送服务授权信息请求；授权服务器通过查找在线用户信息，并与BOSS间进行客户端ID的认证，生成服务授权信息，BOSS的资产管理模块确认用户的账户能否满足所订节目所需，若能满足，BOSS向授权服务器返回服务授权信息的请求结果；The CA client provides the client ID to the authorization server and sends a request for service authorization information; the authorization server searches for online user information and authenticates the client ID with BOSS to generate service authorization information, and the asset management module of BOSS confirms the user's Whether the account can meet the requirements of the ordered program, if so, BOSS will return the request result of service authorization information to the authorization server;

若通过授权，� 递指令给流服务器，节目数据流TS� �据请求的服务列表由SS(流服务器)发出，通过CA服务器，CA服务器向授权服务器发送服务保护信息请求；授权服务器给服务列表生成相应的系统密钥信息和服务保护信息，并返回CA服务器服务保护信息的请求结果；If the authorization is passed, the instruction is transmitted to the streaming server, and the program data stream TS is sent by the SS (streaming server) according to the requested service list, and through the CA server, the CA server sends a service protection information request to the authorization server; the authorization server generates a corresponding service list for the service list. System key information and service protection information, and return the request result of CA server service protection information;

在CA服务器端，TS流经过PSI(节目设定信息)分析、� 扰、� 密，� 送给CA客户端；CA客户端经过与CA服务器端相反的处理，解扰解密TS后并� 送到屏幕显示。On the CA server side, the TS stream is analyzed, scrambled, and encrypted by PSI (program setting information), and sent to the CA client; the CA client goes through the opposite process to the CA server, descrambles and decrypts the TS and sends it to the screen for display .

授权服务器通过推送接口分别向CA服务器和CA客户端的授权控制信息接口推送服务保护信息，用来� 扰和解扰。The authorization server pushes the service protection information respectively to the authorization control information interface of the CA server and the CA client through the push interface for scrambling and descrambling.

点播模式：On-demand mode:

点播iCAS系统基本工作流程：Basic workflow of on-demand iCAS system:

启动机顶盒，BOSS系统连接CA客户端，并浏览其所订服务列表，CA客户端通过EPG/Portal向BOSS提供客户端ID和媒体列表，订购节目或请求节目播放；Start the set-top box, the BOSS system connects to the CA client, and browses its ordered service list, the CA client provides the client ID and media list to BOSS through the EPG/Portal, order programs or request program playback;

CA客户端向授权服务器提供客户端ID，并发送媒体授权信息请求；授权服务器通过查找在线用户信息，并与BOSS间进行客户端ID的认证，生成媒体授权信息，BOSS的资产管理模块确认用户的账户能否满足所订节目所需，若能满足，BOSS向授权服务器返回媒体授权信息的请求结果；The CA client provides the client ID to the authorization server and sends a request for media authorization information; the authorization server searches for online user information and authenticates the client ID with BOSS to generate media authorization information, and the asset management module of BOSS confirms the user's Whether the account can meet the requirements of the ordered program, if so, BOSS will return the request result of media authorization information to the authorization server;

若通过授权，� 递指令给VOD服务器，节目数据流TS� �据请求的媒体列表由VS(视频点播服务器)发出；If authorized, transfer instruction to VOD server, program data flow TS is sent out by VS (Video on Demand Server) according to the media list of request;

预封装服务器向授权服务器发送媒体保护信息请求；授权服务器给媒体列表生成相应的系统密钥信息和服务保护信息，并返回预封装服务器媒体保护信息的请求结果；The prepackaging server sends a media protection information request to the authorization server; the authorization server generates the corresponding system key information and service protection information for the media list, and returns the request result of the prepackaging server media protection information;

在预封装服务器，TS流� �据C/S或B/S工作方式的预封装协议(预封装协议：BOSS系统中的资产管理向预封装服务器发送原始的URL和� 密后的URL，并对� 扰深度及� 扰模式等配置，预封装服务器将结果返回。)进行PSI分析、� 扰、� 密后，� 送给VOD服务器；CA客户端通过访问Web页面获得所需内容，经过与预封装服务器端相反的处理，解扰解密TS后并� 送到屏幕显示。In the pre-encapsulation server, the TS flow is based on the pre-encapsulation protocol of the C/S or B/S working mode (pre-encapsulation protocol: the asset management in the BOSS system sends the original URL and the encrypted URL to the pre-encapsulation server, and scrambles Depth and scrambling mode and other configurations, the pre-packaged server will return the result.) After PSI analysis, scrambling, and encryption, it will be sent to the VOD server; After descrambling and decrypting the TS, the TS is sent to the screen for display.

授权服务器通过推送接口分别向预处理服务器和CA客户端的授权控制信息接口推送媒体保护信息，用来� 扰和解扰。The authorization server pushes the media protection information respectively to the authorization control information interface of the preprocessing server and the CA client through the push interface for scrambling and descrambling.

(3)� 密模式可控的信息流� 密� 输(3) Encryption mode controllable information flow encryption transmission

该系统在前端子系统的预封装模块中� 扰模块采用CSA和AES两种算法，可� �据环境需要实时改变� 扰算法。� 密模块采用AES算法对CW� 密，支持CBC(反向块链接模式)、OFB(输出反馈模式)、CFB(密� �反馈模式)、CTR(技术模式)、ECB(电子密� �本模式)五种� 密模式对授权控制信息ECM进行� 密，可在前端子系统配置参数结构体中可以任意选取，从而实现了信息流的保密� 输。具体流程如下所示。The scrambling module in the pre-packaged module of the front-end subsystem adopts two algorithms, CSA and AES, and the scrambling algorithm can be changed in real time according to the needs of the environment. The encryption module uses the AES algorithm to encrypt CW, and supports five encryption modes: CBC (Reverse Block Chaining Mode), OFB (Output Feedback Mode), CFB (Cipher Feedback Mode), CTR (Technical Mode), and ECB (Electronic Code Book Mode) Encrypting the authorization control information ECM can be arbitrarily selected in the configuration parameter structure of the front-end subsystem, thus realizing the confidential transmission of information flow. The specific process is as follows.

1)ch_i为需要保护� 输的节目流，可以是单一逻辑频道，也可以是单一物理频道；1) ch _i is the program stream that needs to be protected and transmitted, which can be a single logical channel or a single physical channel;

2)sk_i为与节目(组)ch_i相关的业务密钥，由认证授权子系统控制产生和更新；2) sk _i is the service key related to the program (group) ch _i , which is generated and updated under the control of the authentication and authorization subsystem;

3)P为所有sk_i构成的集合，Q为用户所选择ch_i对应的sk_i构成的子集，并� 密� 输给用户；3) P is a set composed of all sk _i , Q is a subset composed of sk _i corresponding to ch _i selected by the user, and is encrypted and transmitted to the user;

4)cw_i ^t为在t时刻� 扰ch_i时使用的控制字，长度为64bits(CSA)或128bits(AES)；4) cw _i ^t is the control word used when scrambling ch _i at time t, and the length is 64bits (CSA) or 128bits (AES);

5)S(·)为对ts_i的� 扰函数，可选择为CSA和AES，� 扰密钥为cw_i ^t(注：S(·)和S^-1(·)选择算法和密钥应一致)；5) S(·) is the scrambling function for ts _i , which can be selected as CSA and AES, and the scrambling key is cw _i ^t (Note: S(·) and S ^-1 (·) select algorithm and key should be consistent);

6)S^-1(·)为对ts_i的解扰函数，可选择为CSA和AES，� 扰密钥为cw_i ^t(注：S(·)和S^-1(·)选择算法和密钥应一致)；6) S ^-1 (·) is the descrambling function for ts _i , which can be selected as CSA and AES, and the scrambling key is cw _i ^t (Note: S(·) and S ^-1 (·) select algorithm and encryption keys should be the same);

7)ECM_i为与ch_i对应的授权控制信息，包含cw_i ^t及其相关信息；7) ECM _i is the authorization control information corresponding to ch _i , including cw _i ^t and related information;

8)E(·)为ECM_i生成函数，选择为AES，� 密模式为CBC、CFB、OFB、CTR之一，� 密密钥为sk_i(注：D(·)和E(·)选择算法和模式、密钥应一致)；8) E(·) is the generation function of ECM _i , the choice is AES, the encryption mode is one of CBC, CFB, OFB, CTR, and the encryption key is sk _i (Note: D(·) and E(·) select the algorithm and The mode and key should be the same);

9)D(·)为ECM_i解密函数，选择为AES，� 密模式为CBC、CFB、OFB、CTR之一，解密密钥为sk_i(注：D(·)和E(·)选择算法和模式、密钥应一致)。9) D(·) is the ECM _i decryption function, the choice is AES, the encryption mode is one of CBC, CFB, OFB, CTR, and the decryption key is sk _i (Note: D(·) and E(·) select the algorithm and The mode and key should be the same).

(4)简化的业务保护层次(4) Simplified service protection level

该系统采用双层� 密策略，包含两个� 密层次，即单节目相关层(PRL:ProgramRelated Layer)和业务相关层(SRL:Service Related Layer)。PRL层实施基于控制字cw对视频内容的� 扰，SRL层基于业务密钥通过� 密生成业务相关控制信息(SRI:ServiceRelated Information)，即授权控制信息ECM。� 扰以CW为密钥，调用通用� 扰算法CSA完成对欲� 输节目内容的直接� 扰保护。� 密以业务密钥SK为密钥，调用� 密算法，如AES，实现对控制字CW的� 密，形成授权控制信息(ECM)。CW保证节目内容的安全� 输，同时CW与SK的分离，也使得节目内容的� 扰与用户� 关，降低了系统的复杂性。The system adopts a double-layer encryption strategy, including two encryption layers, that is, a single program-related layer (PRL: Program Related Layer) and a service-related layer (SRL: Service Related Layer). The PRL layer implements scrambling of video content based on the control word cw, and the SRL layer generates service-related control information (SRI: ServiceRelated Information) through encryption based on the service key, that is, authorization control information ECM. The scrambling uses CW as the key, and calls the common scrambling algorithm CSA to complete the direct scrambling protection of the program content to be transmitted. Encryption uses the service key SK as the key, calls an encryption algorithm, such as AES, to realize the encryption of the control word CW, and forms the entitlement control message (ECM). CW guarantees the safe transmission of program content, and the separation of CW and SK also makes the scrambling of program content irrelevant to users, reducing the complexity of the system.

授权控制信息ECM进一步与� 扰后的节目流复用形成� 输流，通过复用信道分发给客户端。由于ECM与用户相关，� 此只有持有SK的用户才能解扰，实现有条件接收的目� �。对于终端消费者，如果需要访问某个视频业务，必须通过IP双向通道与认证服务器交互获得与消费者相关的授权管理信息。The entitlement control information ECM is further multiplexed with the scrambled program stream to form a transport stream, which is distributed to the client through the multiplexing channel. Since the ECM is related to the user, only the user holding the SK can descramble and achieve the goal of conditional reception. For end consumers, if they need to access a certain video service, they must interact with the authentication server through an IP bidirectional channel to obtain authorization management information related to the consumer.

在PRL层，视频业务� 输流在� 扰密钥CW的控制下� 扰。CW由前端的CW生成器(CWG)生成，� 扰算法采用通用� 扰算法(CSA)以便与DVB-CAS兼容。在SRL层，CW将在业务密钥SK的控制下� 密生成ECM。而业务密钥SK则是由认证授权子系统与客户端的业务申请模块通过密钥协商协议产生。ECM将被复用到� 扰后的� 输流中。在消费者机顶盒等终端中完成相反的过程，解复用ECM并解密恢复出CW，进而得到原始的� 输流送给解� �器。与前端相同，客户端也将从认证授权子系统获取和动态更新业务密钥sk。At the PRL layer, the video service transport stream is scrambled under the control of the scrambling key CW. The CW is generated by the front-end CW generator (CWG), and the scrambling algorithm adopts the common scrambling algorithm (CSA) so as to be compatible with DVB-CAS. At the SRL layer, CW will encrypt and generate ECM under the control of the service key SK. The service key SK is generated through a key agreement agreement between the authentication and authorization subsystem and the service application module of the client. ECM will be multiplexed into the scrambled Transport Stream. The opposite process is completed in terminals such as consumer set-top boxes, where ECM is demultiplexed and decrypted to recover CW, and then the original transport stream is obtained and sent to the decoder. Same as the front end, the client will also obtain and dynamically update the service key sk from the authentication and authorization subsystem.

(5)业务密钥更新(5) Service key update

该系统运用了动态密钥更新与分配技术。动态密钥更新与分配分为两个阶段，分别是业务密钥交换阶段和动态业务密钥推送阶段。认证授权子系统与客户端的业务申请模块通过密钥协商协议产生业务密钥SK。在成功协商密钥后，用户信息及其对应的SK将被保存到在线用户列表，计时器被启动。当到达指定时间间隔(该间隔规定重新认证协商的最小时间间隔，随着用户数的增多该间隔可能自动扩大)时，由SK更新模块对在线用户列表中的用户重新进行认证和密钥协商，更新会话密钥SK，以提高系统的安全性。其中，业务密钥SK采用SSL等方式通过安全信道进行分发。除业务密钥SK外，本系统中还包含控制字CW和系统密钥MK。其中控制字CW的更新与用户� 关，按指定间隔(如10seconds)进行更新。当发现业务运营出现问题时，系统密钥才进行更新，或者当到达指定时间间隔(如1month)时进行更新。The system uses dynamic key update and distribution technology. The dynamic key update and distribution is divided into two phases, namely the business key exchange phase and the dynamic business key push phase. The authentication and authorization subsystem and the service application module of the client generate a service key SK through a key agreement agreement. After successfully negotiating the key, the user information and its corresponding SK will be saved to the online user list, and the timer will be started. When the specified time interval is reached (this interval stipulates the minimum time interval for re-authentication negotiation, and the interval may be automatically expanded as the number of users increases), the SK update module will re-authenticate and key-negotiate the users in the online user list, Update the session key SK to improve the security of the system. Wherein, the service key SK is distributed through a secure channel by means of SSL or the like. In addition to the service key SK, the system also includes the control word CW and the system key MK. The update of the control word CW has nothing to do with the user, and is updated at specified intervals (such as 10 seconds). The system key is updated only when there is a problem with the business operation, or when the specified time interval (such as 1month) is reached.

系统在更新业务密钥的过程中，分别采用了密钥分级更新技术和经过改进的组密钥更新技术。所谓密钥分级更新，就是DRM授权认证系统在进行密钥更新时，上一级DRMServer只对本区内的DRM Server进行密钥更新，而不直接对用户提供服务，而改进的组密钥协议的特点是考虑到电视业务的具体业务特点，将广播业务和其他增值业务进行区别对待，如果用户已经订购了指定的广播业务，那么在切换使用其他业务时，DRM系统不对广播业务密钥更新，只对增值业务进行密钥更新处理，而且在密钥更新的过程中寻找组密钥更新的最少节点，进一步降低业务密钥更新的通信开销和计算能力损耗。In the process of updating the service key, the system adopts the hierarchical key updating technology and the improved group key updating technology respectively. The so-called hierarchical key update means that when the DRM authorization authentication system performs key update, the upper-level DRMServer only updates the key of the DRM Server in the area, and does not directly provide services to users, and the improved group key agreement The feature is that broadcasting services are treated differently from other value-added services in consideration of the specific service characteristics of the TV service. If a user has subscribed to a specified broadcasting service, the DRM system does not update the broadcasting service key when switching to other services. Perform key update processing for value-added services, and find the least nodes for group key update during the key update process, further reducing communication overhead and computing power loss for service key update.

认证授权子系统与前端子系统的密钥更新过程如下：认证授权子系统与前端子系统建立TCP/IP连接，打开前端子系统的网络监听，实时对认证授权子系统发送的消息进行分析；认证授权子系统在规定的时间间隔发送更新的SK信息；前端子系统接收到认证授权子系统发送的消息� �志为SK的信息后，对该信息进行分析。对当前的SK进行验证并提取出下一个时刻使用的SK数据。然后向认证授权子系统发送确认信息。完成认证授权子系统与前端子系统的密钥更新。The key update process between the authentication and authorization subsystem and the front-end subsystem is as follows: the authentication and authorization subsystem establishes a TCP/IP connection with the front-end subsystem, opens the network monitoring of the front-end subsystem, and analyzes the messages sent by the authentication and authorization subsystem in real time; The authorization subsystem sends updated SK information at specified time intervals; the front-end subsystem analyzes the information after receiving the information marked as SK sent by the authentication and authorization subsystem. Verify the current SK and extract the SK data to be used at the next moment. Then send confirmation information to the authentication and authorization subsystem. Complete the key update of the authentication and authorization subsystem and the front-end subsystem.

认证授权子系统与客户端的密钥更新过程(广播)如下：认证授权子系统与客户端建立SSL连接后，通过SSL安全信道� 输用户信息；认证授权子系统� �据在线用户列表获得用户节目Pid和用户信息后，通知SSL是否� 输给用户业务密钥，以及其节目Pid；客户端接收到� �志为SK的信息，保存备用。The key update process (broadcast) between the authentication and authorization subsystem and the client is as follows: after the authentication and authorization subsystem establishes an SSL connection with the client, the user information is transmitted through the SSL secure channel; the authentication and authorization subsystem obtains the user program Pid and user After receiving the message, notify SSL whether to transmit the service key to the user and its program Pid; the client receives the message marked as SK and saves it for later use.

认证授权子系统与客户端的密钥更新过程(点播)如下：认证授权子系统与客户端建立SSL连接后，通过SSL安全信道� 输用户信息；由用户管理系统处理用户信息，用户将点播申请表发送给认证授权子系统；认证授权子系统利用点播申请表的Pid，向客户端发送相应的SK；客户端接收到� �志为SK的信息，分析该信息得到下一时刻的SK。The key update process (on-demand) between the authentication and authorization subsystem and the client is as follows: After the authentication and authorization subsystem establishes an SSL connection with the client, the user information is transmitted through the SSL secure channel; the user information is processed by the user management system, and the user sends the on-demand application form to To the authentication and authorization subsystem; the authentication and authorization subsystem uses the Pid of the on-demand application form to send the corresponding SK to the client; the client receives the information marked as SK, and analyzes the information to obtain the SK at the next moment.

(6)基于代理的预封装技术(6) Agent-based pre-packaging technology

参考图6，该系统模型采用C/S结构，如图所示。右面的预封装系统端是服务器，视频输入是客户端。在预封装系统内部亦使用C/S模式，由主服务器和代理服务器组成，代理服务器对主服务器来说是服务器端，主服务器是客户端。Referring to Figure 6, the system model adopts the C/S structure, as shown in the figure. The prepackaged system side on the right is the server, and the video input is the client. The C/S mode is also used inside the prepackaged system, which is composed of a main server and a proxy server. The proxy server is the server side for the main server, and the main server is the client.

整个模型的设计思想为：对需要封装� 密的视频，首先进入主服务器，其� �据视频大小进行判断，选择是否需要代理服务器封装。若不需代理执行，则不分割视频文件，自己直接进行封装� 密；若需要代理执行，则将视频文件� �据设计的算法均分为� 小段，然后自动搜索网络上的空闲代理服务器，将已分段的视频� 送给可用的代理，让其执行封装功能。代理服务器封装完成之后，再及时返回给主服务器端，由主服务器端将返回的分段进行重组，恢复成一个完整的已封装好的“原视频”文件。The design idea of the whole model is: for the video that needs to be encapsulated and encrypted, it first enters the main server, which judges according to the size of the video, and chooses whether to need encapsulation by the proxy server. If proxy execution is not required, the video file will not be divided, and the video file will be encapsulated and encrypted directly; if proxy execution is required, the video file will be divided into several segments according to the designed algorithm, and then the idle proxy server on the network will be automatically searched, and the segmented Segments of video are passed to available agents to perform encapsulation functions. After the encapsulation of the proxy server is completed, it will return to the main server in time, and the returned segments will be reorganized by the main server to restore a complete packaged "original video" file.

代理服务器主要包括预封装主控模块和预封装代理模块。� �据预封装主控模块的功能可将其分为两部分：一部分是中央控制器，主要实现对视频文件的代理封装操作，如分割、调度与合并；另一部分是独立预封装模块，即不使用代理服务器，直接对视频内容完成封装功能。The proxy server mainly includes a prepackaged master control module and a prepackaged proxy module. According to the functions of the pre-packaged main control module, it can be divided into two parts: one part is the central controller, which mainly realizes the proxy package operation of video files, such as segmentation, scheduling and merging; the other part is an independent pre-packaged module, which does not use The proxy server directly completes the encapsulation function for the video content.

基于代理的预封装技术方法主要包括视频分割，视频调度和密钥获取。Proxy-based pre-encapsulation technology methods mainly include video segmentation, video scheduling and key acquisition.

视频分割对于需要封装的视频来说，设其大小为m(mb)，需分割段数为s，视频封装速度为k(mb/s)，视频� 输的速度为v(mb/s)，视频分割需要时长t1，视频合并所耗时长为t2。在具体执行过程中，按如下规则进行：分割一段，� 输一段；� 输的同时，要进行实时的封装；视频段封装完成后立刻� 回去；� 回� 段，则合并� 段。应该分割的段数s应该满足公式：Δt₁+Δt₂·s+2(m/s)/v+(m/s)/k<m/k，其中，m/k为独立预封装所需要的时间。Video segmentation For the video that needs to be encapsulated, set its size as m (mb), the number of segments to be divided is s, the video encapsulation speed is k (mb/s), the video transmission speed is v (mb/s), and the video segmentation Time t1 is required, and time consuming for video merging is t2. In the specific execution process, the following rules are followed: divide a segment and transmit a segment; at the same time of transmission, real-time encapsulation is performed; after the video segment is encapsulated, it is sent back immediately; when several segments are returned, several segments are merged. The number of segments s that should be divided should satisfy the formula: Δt ₁ +Δt ₂ s+2(m/s)/v+(m/s)/k<m/k, where m/k is the time required for independent pre-packaging .

TS视频文件是由多个188字节的TS包组成，� 此分割视频的大小和分割视频件时所需要的缓冲区大小均应为188字节的整数倍。设输入的视频大小为n万个TS包，分割思想为：A TS video file is composed of multiple 188-byte TS packets, so the size of the split video and the size of the buffer required for splitting the video should be integer multiples of 188 bytes. Suppose the size of the input video is n ten thousand TS packets, the idea of segmentation is:

(1)n<＝160时，视频不分割；(1) When n<=160, the video is not divided;

(2)160<n<＝320时，视频分割为2段；(2) When 160<n<=320, the video is divided into 2 sections;

(3)320<n<＝480时，视频分割为3段；(3) When 320<n<=480, the video is divided into 3 sections;

(4)480<n<＝640时，视频分割为4段；(4) When 480<n<=640, the video is divided into 4 sections;

(5)n>640时，视频分割为5段。(5) When n>640, the video is divided into 5 segments.

视频调度主要实现了主控模块选择代理模块使之完成预封装的过程，具体流程为：预封装主控模块启动之后定时发送广播消息，在线的预封装代理模块收到广播消息后，向预封装主控模块端发送确认信息，预封装主控模块将各预封装代理模块的情况保存到数据库中。预封装主控模块端请求代理后，便开始� 输视频，视频� 送的相关信息会被保存到对应的日志文件(包括视频名称、视频� 送时间、视频被� 到的代理� �识等)中。当视频分段数少于回应的代理数时，需要随机选择其中的� 个代理执行封装过程，具体过程为：1)将收到的代理的� �识� 射为1-100之间的整数(假设代理总数<＝100)；2)� �据视频的分割数量，确定需要的代理数n；3)使用伪随机数发生器产生1-100之间的n个数；4)� �据产生的随机数找到对应的代理� �识，最终确定需要的封装代理。Video scheduling mainly realizes the process that the main control module selects the proxy module to complete the pre-packaging process. The specific process is: after the pre-packaging main control module is started, it sends broadcast messages at regular intervals. The main control module side sends confirmation information, and the prepackaged main control module saves the situation of each prepackaged agent module in the database. After the prepackaged main control module requests the proxy, it starts to transmit the video, and the relevant information of the video transmission will be saved in the corresponding log file (including the video name, video transmission time, and the proxy ID to which the video is transmitted, etc.). When the number of video segments is less than the number of agents responding, it is necessary to randomly select several agents to perform the encapsulation process. The specific process is: 1) map the received agent ID to an integer between 1-100 (assuming the agent Total <= 100); 2) According to the number of divisions of the video, determine the number of agents n required; 3) Use a pseudo-random number generator to generate n numbers between 1-100; 4) Find the corresponding agent according to the generated random number Proxy ID, and finally determine the required encapsulation proxy.

密钥获取包括前端子系统子系统预封装服务密钥的获取和客户端子系统预封装密钥获取。前端子系统子系统预封装服务密钥的获取流程为：视频内容DBMS(数据库管理服务器)� �据Mlist(媒体列表)向预封装主控模块发送� 输流，预封装主控模块给认证授权子系统的认证授权模块发送一个MPI(媒体保护信息)请求；认证授权模块建立MKI(媒体密钥信息)，生成MPI，将MKI存储到数据库，并以Mlist为索引；认证授权模块返回给预封装主控模块MPI请求结果；预封装主控模在调用代理完成预封装后，将TS� 送回给DBMS。客户端子系统预封装密钥获取流程为：启动机顶盒后，客户端接收到来自视频服务器的已封装好的视频内容；客户端子系统向认证授权子系统的认证授权模块提供客户端� �识和从视频� 输流中获取的媒体列表Mlist，发送MAI请求；认证授权模块与订户管理模块间进行客户端� �识的认证，订户管理模块向认证授权模块返回可以为用户授权的媒体列表Mlist’，� �据数据库中的Mlist’信息生成MAI；认证授权模块返回给客户端子系统MAI请求结果；客户端子系统即可解扰并收看视频内容。The key acquisition includes the acquisition of the pre-packaged service key of the front-end subsystem subsystem and the acquisition of the pre-packaged key of the client subsystem. The acquisition process of the pre-encapsulated service key of the front-end subsystem subsystem is as follows: the video content DBMS (database management server) sends the transport stream to the pre-encapsulated main control module according to the Mlist (media list), and the pre-encapsulated main control module sends the transport stream to the authentication and authorization subsystem. The authentication and authorization module sends a MPI (media protection information) request; the authentication and authorization module establishes MKI (media key information), generates MPI, stores the MKI in the database, and takes Mlist as an index; the authentication and authorization module returns to the prepackaged master control module MPI request result; the pre-encapsulation master control module sends the TS back to the DBMS after invoking the agent to complete the pre-encapsulation. The pre-packaged key acquisition process of the client subsystem is as follows: after starting the set-top box, the client receives the packaged video content from the video server; The media list Mlist obtained in the stream sends a MAI request; the authentication and authorization module and the subscriber management module perform client identification authentication, and the subscriber management module returns the media list Mlist' that can be authorized for the user to the authentication and authorization module, according to Mlist in the database 'The information generates MAI; the authentication and authorization module returns the MAI request result to the client subsystem; the client subsystem can descramble and watch the video content.

该系统支持离线数据处理，当预封装系统服务器需要关闭或者中断服务时，可以先通过中央控制器，选择代理服务器，在视频� 送之后，即关闭或中断服务。当预封装系统服务器的服务再次开启后，代理端会自动将视频发过来，服务器只需进行以后的操作就可以了。另外，还可以减轻主服务器负担，实现高效率封装。当一路视频需要封装时，若使用代理服务器帮忙，处理时间会减少；多路视频需要� 扰时，服务器端由于运算能力的限制，要完成多数据量的� 扰工作，会给服务器带来过大的负担，影响封装的效率。而如果将多个视频数据进行处理，然后交给代理服务器进行封装的工作，这� �会� 快封装的效率，减轻服务器端的负担。代理服务器的数量决定了视频分段的多少，代理服务器越多，视频的分段数越多。视频分的段数越多，就会使每个视频段所包含的数据量减少，这� �一方面可以进一步减少� 输时间，另一方面，所有代理服务器上的封装视频段所需时间也会变少，从而在整体上提高了工作效率。The system supports off-line data processing. When the pre-packaged system server needs to be closed or the service is interrupted, the proxy server can be selected through the central controller first. After the video is transmitted, the service is closed or interrupted. When the service of the pre-packaged system server is turned on again, the agent will automatically send the video, and the server only needs to perform subsequent operations. In addition, it can also reduce the burden on the main server and realize high-efficiency packaging. When one channel of video needs to be encapsulated, if a proxy server is used to help, the processing time will be reduced; when multiple channels of video need to be scrambled, due to the limitation of computing power on the server side, the scrambling of a large amount of data must be completed, which will bring excessive processing time to the server. A large burden affects the efficiency of packaging. However, if a plurality of video data are processed and then handed over to the proxy server for encapsulation, this will speed up the encapsulation efficiency and reduce the burden on the server. The number of proxy servers determines the number of video segments, the more proxy servers, the more video segments. The more video segments are divided into, the amount of data contained in each video segment will be reduced. On the one hand, the transmission time can be further reduced. On the other hand, the time required to encapsulate video segments on all proxy servers will also be reduced. Thereby improving work efficiency on the whole.

分布式预封装系统，若在高性能的网络环境下，将更具有优势。视频文件的� 输可以借助于高带宽网络或光纤等更� 快速的� 输介质，将视频文件进行实时的发送与接收。由于光纤等� 输介质的� 输速度非常快，在多个视频分段� 输方面，不会� 用太长时间，� 而整个系统的效率会提高。The distributed pre-packaged system will have more advantages if it is used in a high-performance network environment. The transmission of video files can be sent and received in real time by means of faster transmission media such as high-bandwidth networks or optical fibers. Since the transmission speed of optical fiber and other transmission media is very fast, it will not take too long in the transmission of multiple video segments, so the efficiency of the entire system will be improved.

(7)安全存储(7) Safe storage

该系统基于随机过程的存储空间遍历算法实现了安全存储。该系统设计了密钥分发中心(Key Distribution Center，KDC)来为客户端的� 解密文件提供业务密钥，KDC先获得客户端密文文件的分割情况(例如n个子文件)，生成相应的1至n不重复的随机序列，客户端� �据随机序列依次向存储服务器发送密文子文件；存储服务器建立新文件，将收到的密文子文件写入新文件，直至密文子文件发送完毕；这� �，存储服务器中便存入了乱序的密文文件，文件上� 成功。当用户申请下载文件时，存储服务器获取文件路径，查找到文件，将乱序的密文文件直接发送客户端，直接在客户端完成数据的安全解密，保护文件端到端的� 密� 输和数据的安全存储。The system realizes safe storage based on storage space traversal algorithm of random process. The system designs a key distribution center (Key Distribution Center, KDC) to provide business keys for the client's encryption and decryption files. n non-repetitive random sequence, the client sends the ciphertext sub-files to the storage server sequentially according to the random sequence; the storage server creates a new file, and writes the received ciphertext sub-files into the new file until the ciphertext sub-files are sent; in this way, the storage server The out-of-order ciphertext file is stored in the file, and the file is uploaded successfully. When a user applies for downloading a file, the storage server obtains the file path, finds the file, sends the out-of-order ciphertext file directly to the client, completes the secure decryption of the data directly on the client, and protects the end-to-end encrypted transmission of the file and the security of the data storage.

(8)选择性� 扰深度控制(8) Selective scrambling depth control

该系统为了实现对� 扰深度更� 精确的控制，对I帧和I-宏块的计数方法采用新的双上限计数(n1,n2)的方法，使得计数上限n值都可用和任意� 扰深度d都可以选择。对任意的d，如果：1)1/d为整数，则令n1＝1/d，n2＝1；2)1/d不是整数，则将1/d表示为分式，并用欧� 里德算法得到分子分母的最大公约数r，约后得1/d＝a/b，令：其中a和b是互质数。In order to achieve a more precise control of the scrambling depth, the system adopts a new double upper limit counting (n1, n2) method for the counting method of I frames and I-macroblocks, so that the counting upper limit n value is available and any scrambling depth d can be selected. For any d, if: 1) 1/d is an integer, then set n1=1/d, n2=1; 2) 1/d is not an integer, then express 1/d as a fraction, and use Euclidean The algorithm obtains the greatest common divisor r of the numerator and denominator, and after approximation, 1/d=a/b is obtained, so that: where a and b are co-prime numbers.

对找到的I帧计数c1，c2，当c1达到上限n1时，对当前帧执行� 扰操作；当c2达到上限n2时，两个计数器都清零，c1＝c2＝0。Count the found I frames c1 and c2, when c1 reaches the upper limit n1, perform scrambling operation on the current frame; when c2 reaches the upper limit n2, both counters are cleared, c1=c2=0.

在实际应用中提供两种� 扰深度的设置方式：1)n方式设置，n为� 扰上限，实际设置� 扰深度为1/n；2)d方式设置，d为� 扰深度，� 扰上限n值采用上述的双上限计数方法确定。In practical applications, there are two ways to set the scrambling depth: 1) n mode setting, n is the upper limit of scrambling, and the actual setting scrambling depth is 1/n; 2) d mode setting, d is the scrambling depth, scrambling Upper limit n values are determined using the double upper limit count method described above.

(9)密钥更新批处理策略(9) Key update batch processing strategy

系统设计引入密钥更新批处理策略，提供百万用户规模的密钥实时更新与分配，降低了系统开销，增强了整个密钥更新的能力，提升了系统的安全性，为付费电视业务提供了灵活多变的保护机制。提出的这种密钥管理结构包括一个授权服务器(AS，Authentication Server)和多个密钥服务器(KS，Key Server)这两个主要部分。授权服务器作为� �� �，分发业务保护的关键信息，并通过密钥服务器管理间接管理所有用户。The system design introduces a key update batch processing strategy to provide real-time update and distribution of keys for millions of users, which reduces system overhead, enhances the ability of the entire key update, improves system security, and provides pay TV services Flexible protection mechanism. The proposed key management structure includes two main parts: an authorization server (AS, Authentication Server) and multiple key servers (KS, Key Server). The authorization server acts as the root of the tree, distributes key information for business protection, and indirectly manages all users through key server management.

授权服务器，它包括用户认证模块、密钥服务器模块以及用户授权模块。其作用包括通过SSL安全信道接收用户的接入(离开)请求，并对用户进行身份认证；如果发生授权组成员变更，授权中心的密钥服务器管理模块通过SSL安全信道获取各个密钥服务器模块产生的点播业务密钥并通过单向函数计算出广播业务密钥，同时通知点播业务密钥服务器更新其子授权组广播(点播)业务密钥，承担授权服务器与各个点播密钥服务器构成的密钥� �的建立和维护工作；授权系统通过ES(Encryption System)接口与前端� 扰服务器进行控制字� 扰密钥信息交互，从而将各个密钥服务器的组播密钥作为控制字� 扰密钥发送给� 扰服务器；授权服务器与用户管理系统进行用户信息的交互，由授权中心签发基于x.509� �准的数字证书。该证书用于授权用户在申请� 入授权组时进行身份认证。Authorization server, which includes user authentication module, key server module and user authorization module. Its role includes receiving the user's access (leaving) request through the SSL secure channel, and authenticating the user; if the authorization group member changes, the key server management module of the authorization center obtains each key server module through the SSL secure channel. on-demand service key and calculate the broadcast service key through a one-way function, and at the same time notify the on-demand service key server to update its sub-authorized group broadcast (on-demand) service key, and assume the key composed of the authorization server and each on-demand key server The establishment and maintenance of the tree; the authorization system interacts with the front-end scrambling server for control word scrambling key information through the ES (Encryption System) interface, so that the multicast key of each key server is sent as the control word scrambling key To the scrambling server; the authorization server exchanges user information with the user management system, and the authorization center issues a digital certificate based on the x.509 standard. This certificate is used to authorize users to perform identity authentication when applying to join an authorization group.

密钥服务器，包括密钥生成模块、密钥分发模块以及密钥管理模块。其功能包括通过密钥生成模块产生伪随机数，作为待分发的点播业务密钥；由密钥分发模块实现针对授权组成员的组密钥分发；密钥管理模块与授权服务器进行数据交互，在授权服务器发出添� (� 除)指定成员的指令时，密钥管理模块通知密钥生成模块产生新的点播业务密钥，然后密钥管理模块将经过更新后的点播密钥发送给授权服务器，并由密钥分发模块对指定的用户密钥节点进行密钥更新。Key server, including key generation module, key distribution module and key management module. Its functions include generating pseudo-random numbers through the key generation module as on-demand service keys to be distributed; realizing group key distribution for authorized group members by the key distribution module; data interaction between the key management module and the authorization server. When the authorization server issues an instruction to add (delete) a designated member, the key management module notifies the key generation module to generate a new on-demand service key, and then the key management module sends the updated on-demand key to the authorization server, and the The key distribution module updates the key of the specified user key node.

参见图7，假定u3和u4是两个申请转移子授权组的用户。u3从A组转移到B组，u4从B组转移到A组。u4替换了u3原来的位置，u3替换了原来u4的位置。需要更新的密钥节点为K_A和K_B。要确定密钥更新路径，只需在每次更新的过程中，我们跟踪每个需要更新密钥的节点，对其上一级需要更新密钥的节点进行� �记。在这个过程中，如果发现有一个节点被� �记两次则停止该路径的� �记。直到所有路径� �记完毕，密钥更新路径就确定了。在整个密钥� �中，只有K_A’和K_B’需要更新。K_A点播业务密钥更新为K_A’，K_B点播业务密钥更新为K_B’。点播业务密钥服务器A向u1发送，向u2发送，向u4发送。点播业务密钥服务器B向u3发送，向u5发送，向u6发送。Referring to FIG. 7 , it is assumed that u3 and u4 are two users who apply for transferring sub-authorization groups. u3 is transferred from group A to group B, and u4 is transferred from group B to group A. u4 replaces the original position of u3, and u3 replaces the original position of u4. The key nodes to be updated are K _A and _KB . To determine the key update path, we only need to track each node that needs to update the key in the process of each update, and mark the nodes that need to update the key on its upper level. During this process, if a node is found to be marked twice, the marking of the path will be stopped. Until all paths are marked, the key update path is determined. In the entire key tree, only _KA ' and _KB ' need to be updated. The K _A on-demand service key is updated to K _A ', and the _KB on-demand service key is updated to _KB '. The on-demand service key server A sends to u1, sends to u2, and sends to u4. The on-demand service key server B sends to u3, to u5, and to u6.