ITU-T X 1194-2012 Algorithm selection scheme for service and content protection descrambling (Study Group 17)《业务和内容保护解码的算法选择方案 17号研究组》.pdf

《ITU-T X 1194-2012 Algorithm selection scheme for service and content protection descrambling (Study Group 17)《业务和内容保护解码的算法选择方案 17号研究组》.pdf》由会员分享，可在线阅读，更多相关《ITU-T X 1194-2012 Algorithm selection scheme for service and content protection descrambling (Study Group 17)《业务和内容保护解码的算法选择方案 17号研究组》.pdf（58页珍藏版）》请在麦多课文档分享上搜索。

1、 7 International Telecommunication Union ITU-T X.1194TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (04/2012) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Secure applications and services IPTV security Algorithm selection scheme for service and content protection descrambling Re

2、commendation ITU-T X.1194 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 DIRECTORY X.500X.599 OSI NETWORKING AND S

3、YSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X.1050X.1069 Telebiometrics X.1080X.1099

4、SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPTV security X.1180X.1199CYBERSPACE SECURI

5、TY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 CYBERSECURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/s

6、tate exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.1580X.1589 For further details, please refer to the list of ITU-T Recommendations.

7、 Rec. ITU-T X.1194 (04/2012) i Recommendation ITU-T X.1194 Algorithm selection scheme for service and content protection descrambling Summary Recommendation ITU-T X.1194 develops an algorithm selection standard for descrambling in various terminal devices. This Recommendation provides the general se

8、rvice and contentprotection (SCP) architecture, security requirements and algorithm selection scheme (ASS). In particular, the algorithm selection scheme consists of the SCP control client function, ASS descrambler/demuxer control function and descrambler authentication function. History Edition Rec

9、ommendation Approval Study Group 1.0 ITU-T X.1194 2012-04-13 17 Keywords Conditional access, descrambling, multiple descrambling, SCP client, service protection, terminal device. ii Rec. ITU-T X.1194 (04/2012) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized

10、 agency in the field of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a

11、view to standardizing telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommen

12、dations is covered by the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conci

13、seness to indicate both a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommenda

14、tion is achieved when all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party.

15、INTELLECTUAL PROPERTY RIGHTS ITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Right

16、s, whether asserted by ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers

17、 are cautioned that this may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2012 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permi

18、ssion of ITU. Rec. ITU-T X.1194 (04/2012) iii Table of Contents Page 1 Scope 1 2 References. 1 3 Definitions 1 3.1 Terms defined elsewhere 1 3.2 Terms defined in this Recommendation . 2 4 Abbreviations and acronyms 2 5 Conventions 3 6 Introduction 4 6.1 Internet Protocol television (IPTV) general ar

19、chitecture and content protection architecture 4 6.2 Service protection architecture . 5 6.3 General software architecture for terminal devices 6 6.4 Requirement for algorithm selection mechanism for service protection ITU-T X.1191 6 7 Algorithm selection scheme . 7 7.1 Overview 7 7.2 SCP control cl

20、ient function 10 8 Authentication functions for descrambling algorithm selection . 19 8.1 ASS descrambler authentication function 19 8.2 Generation and verification procedures for one-time ID . 23 9 Control functions for descrambling algorithm selection 24 9.1 ASS descrambler control functions 24 9.

21、2 ASS demuxer control functions 28 Annex A Descrambling algorithm and key delivery message 35 A.1 Contents key delivery messages . 35 A.2 ASS descrambling algorithm 37 Appendix I Descrambling-related standards . 39 I.1 ATIS IIF default scrambling algorithm (IDSA) . 39 I.2 ETSI TS 103 197 DVB SimulCr

22、ypt . 40 Appendix II Algorithm selection scheme-related use cases . 41 II.1 Definitions of the terms used in the diagram 41 II.2 Scenario 1: SCP update 41 II.3 Scenario 2: SCP downloads 42 II.4 Scenario 3: Multiple SCP . 43 Appendix III SCP messages in MPEG-2 TS 45 III.1 MPEG-2 TS PSI . 45 iv Rec. I

23、TU-T X.1194 (04/2012) Page Appendix IV Terminal device provisioning . 46 Appendix V Example of one-time ID generation . 48 Bibliography. 50 Rec. ITU-T X.1194 (04/2012) 1 Recommendation ITU-T X.1194 Algorithm selection scheme for service and content protection descrambling 1 Scope Recommendation ITU-

24、T X.1194 develops a set of algorithm selection functions from the existing descrambling algorithms to share terminal devices between service providers and security providers. The scope includes algorithm selection schemes (ASSs) and signalling for selection and interoperability issues and does not i

25、nclude any other schemes of Recommendation ITU-T X.1191. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation. At the time of publication, the editions indicated were valid. All Re

26、commendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references listed below. A list of the currently valid ITU-T Recommendations is regula

27、rly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. ITU-T X.800 Recommendation ITU-T X.800 (1991), Security architecture for Open Systems Interconnection for CCITT applications. ITU-T X.1191 Recommendation

28、 ITU-T X.1191 (2009), Functional requirements and architecture for IPTV security aspects. 3 Definitions 3.1 Terms defined elsewhere This Recommendation uses the following terms defined elsewhere: 3.1.1 access control ITU-T X.800: The prevention of unauthorized use of a resource, including the preven

29、tion of use of a resource in an unauthorized manner. 3.1.2 authentication ITU-T X.800: See data origin authentication, and peer-entity authentication. 3.1.3 authorization ITU-T X.800: The granting of rights, which includes the granting of access based on access rights. 3.1.4 conditional access ITU-T

30、 X.1191: The function served by a conditional access system; often used as an abbreviation for conditional access system. 3.1.5 conditional access system ITU-T X.1191: A component of a Service and Content Protection system the purpose of which is to prevent unauthorized (unentitled) access to a serv

31、ice or to content. 3.1.6 confidentiality ITU-T X.800: The property that information is not made available or disclosed to unauthorized individuals, entities, or processes. 3.1.7 data origin authentication ITU-T X.800: The corroboration that the source of data received is as claimed. 2 Rec. ITU-T X.1

32、194 (04/2012) 3.1.8 digital signature ITU-T X.800: Data appended to, or a cryptographic transformation (see cryptography) of a data unit that allows a recipient of the data unit to prove the source and integrity of the data unit and protect against forgery e.g., by the recipient. 3.1.9 integrity ITU

33、-T X.800: The property that data has not been altered or destroyed in an unauthorized manner. 3.1.10 key ITU-T X.800: A sequence of symbols that controls the operations of encipherment and decipherment. 3.1.11 key management ITU-T X.800: The generation, storage, distribution, deletion, archiving and

34、 application of keys in accordance with a security policy. 3.1.12 peer-entity authentication ITU-T X.800: The corroboration that a peer entity in an association in the one claimed. 3.1.13 scrambling algorithm ITU-T X.1191: An algorithm used in a scrambling (encryption) or descrambling (decryption) p

35、rocess. 3.1.14 service and content protection ITU-T X.1191: A combination of service protection and content protection, or a system or implementation thereof. 3.1.15 service protection ITU-T X.1191: Ensuring that an end user can only acquire a service, and, by extension, the content contained therei

36、n, that they are entitled to receive. 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 demuxer: Device that takes an input signal and selects one of the output-channels; the selected output channel is connected to the input signal. 3.2.2 descrambler: De

37、vice that transposes or decrypts encoded messages or video streams for the terminal or subscribers with privilege. 3.2.3 process: Instance of a computer program that is being executed; contains the program code and its current status. 3.2.4 virtual machine: Software implementation of a machine that

38、can execute programs just like a physical machine; supports separated operating systems. 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: A/V Audio/Video AAA Authentication, Authorization, and Accounting ASS Algorithm Selection Scheme CA Conditional Acc

39、ess CAS Conditional Access System CAT Conditional Access Table CBC Cipher Block Chaining CW Control Word DTCP Digital Transmission Content Protection ECM Entitlement Control Message EMM Entitlement Management Message Rec. ITU-T X.1194 (04/2012) 3 HMAC Hash-based Message Authentication Code IDSA IIF

40、Default Scrambling Algorithms IIF IPTV Interoperability Forum IPTV Internet Protocol Television MK Master Key MMS Multi-Mode Service MPEG Moving Picture Experts Group MPEG-2 TS MPEG-2 Transport Stream OTID One-Time Identifier PAT Program Association Table PES Packetized Elementary Stream PGP Pretty

41、Good Privacy PID Program Identifier PKI Public Key Infrastructure PMT Program Map Table RAL Resource Abstraction Layer SAC Secure Authenticated Channel SCP Service and Content Protection SIM Subscriber Identity Module SP Service Protection SSL Secure Socket Layer SVM Secure Virtual Machine TD Termin

42、al Device TK Terminals SAC Key TPS Triple Play Service TV Television USB Universal Serial Bus VM Virtual Machine VoD Video on Demand VPN Virtual Private Network 5 Conventions In this Recommendation: The keywords “is required to“ indicate a requirement which must be strictly followed and from which n

43、o deviation is permitted if conformance to this document is to be claimed. The keywords “is recommended“ indicate a requirement which is recommended but which is not absolutely required. Thus this requirement need not be present to claim conformance. 4 Rec. ITU-T X.1194 (04/2012) The keywords “is pr

44、ohibited from“ indicate a requirement which must be strictly followed and from which no deviation is permitted if conformance to this document is to be claimed. The keywords “can optionally“ indicate an optional requirement which is permissible, without implying any sense of being recommended. This

45、term is not intended to imply that the vendors implementation must provide the option and the feature can be optionally enabled by the network operator/service provider. Rather, it means the vendor may optionally provide the feature and still claim conformance with the specification. In the body of

46、this Recommendation and its annexes, the words shall, shall not, should, and may sometimes appear, in which case they are to be interpreted, respectively, as is required to, is prohibited from, is recommended, and can optionally. The appearance of such phrases or keywords in an appendix or in materi

47、al explicitly marked as informative are to be interpreted as having no normative intent. 6 Introduction In general, two or more SCPs are deployed on a single terminal device. The content acquired via one SCP system (e.g., from a network) can be accessed via another SCP residing on the same device ac

48、cording to the granted rights. There is a need to support SCP interoperability among multiple security systems that use different security mechanisms to support service and content protection interoperability, thereby maintaining transparency for users. The object of this Recommendation is to develo

49、p a set of functions of algorithm selection schemes from the existing algorithms for content descrambling. This includes the algorithm selection scheme, SCP function, RAL function, interoperability support function and message format. 6.1 Internet Protocol television (IPTV) general architecture and content protection architecture The general security architecture for IPTV is depicted in Figure 1 below. This general architecture is divided into two primary areas: one considered in-scop