JP6440302B2 - Receiving apparatus, broadcasting system, receiving method and program - Google Patents

Description

  The present invention relates to a receiving apparatus, a broadcasting system, a receiving method, and a program.

  Conventionally, adoption of various technologies has been studied for the advancement of broadcasting. One of the technologies that are being studied for adoption is the introduction of a conditional access system (CAS program) that implements the functions of CAS (Conditional Access System) with software. CAS is a technology for preventing viewing of broadcast programs and unauthorized duplication of broadcast programs by parties other than legitimate subscribers using encryption technology. CAS is conventionally realized by hardware such as an IC (Integrated Circuit) card as described in Patent Document 1. By introducing the CAS program, even if the encrypted data by CAS is decrypted, the CAS program can be updated to prevent the damage caused by the decryption. On the other hand, the receiving device of the authorized contractor downloads the latest CAS program by broadcast waves and makes it possible to view the broadcast program using the received CAS program.

JP 2014-86793 A

  However, at the timing when the CAS program needs to be updated, the broadcast wave is not downloaded, and the receiving apparatus may not be updated to the latest CAS program. In such a case, for example, there is a case where a reception failure has occurred or the power supply to the receiving device is not turned on. Once the CAS program is not updated, there is a problem that the user cannot view the broadcast program until the next CAS program is updated.

  The present invention has been made to solve the above-described problems, and provides a receiving device, a broadcasting system, a receiving method, and a program that allow a legitimate user to reliably view a broadcast program.

The present invention has been made to solve the above-described problems, and one aspect of the present invention is a program activation unit that activates a limited reception program for decoding received data, and the program activation unit is activated. A data decoding unit for decoding the data by executing the limited reception program, and a program acquisition unit for acquiring a new version of the limited reception program from the activated limited reception program when decoding of the data fails, It is a receiver provided with.

  According to the present invention, a broadcast program can be reliably viewed.

It is a block diagram which shows the structure of the broadcast system which concerns on this embodiment. It is a block diagram which shows the structure of the transmitter which concerns on this embodiment. It is a block diagram which shows the structure of the delivery data generation part which concerns on this embodiment. It is a figure which shows the example of a DII message. It is a figure which shows the example of a compatibility descriptor. It is a figure which shows the example of a DDB message. It is a figure which shows the example of notification information. It is a figure which shows the example of a download content descriptor. It is a figure which shows the example of a network download content descriptor. It is a figure which shows the example of CA starting descriptor. It is a block diagram which shows the structure of the server apparatus which concerns on this embodiment. It is a block diagram which shows the structure of the receiver which concerns on this embodiment. It is a block diagram which shows the structure of the decoding part and control part which concern on this embodiment. It is a flowchart which shows operation | movement of the receiver which concerns on this embodiment.

  Embodiments of the present invention will be described with reference to the drawings.

FIG. 1 is a block diagram showing a configuration of a broadcasting system 1 according to the present embodiment.
The broadcast system 1 includes a transmission device 11, a server device 21, and a reception device 31. The transmission device 11 and the server device 21 constitute, for example, a broadcasting facility that a broadcaster has. The reception device 31 receives a broadcast program broadcast from the transmission device 11, displays a video of the received broadcast program, and reproduces the sound of the broadcast program. The receiving device 31 is installed, for example, in each home or business office.

  The transmission device 11 transmits broadcast program data (program data) to the reception device 31 via the broadcast transmission path 12. Moreover, the transmission apparatus 11 transmits the CAS program which has the function regarding the limited reception of a broadcast program by a data carousel. The data carousel is a transmission method that repeatedly transmits the same data for a certain period. The transmission device 11 repeatedly transmits the CAS program of the same type and the same version for a certain period. In order to ensure security, a key (described later) used for encrypting the CAS program is updated. Further, the version of the CAS program is changed every time the key is updated. For example, when the security is ensured, such as prevention of the leakage of the encryption key of the CAS program used in the reception device 31, the transmission device 11 is updated in a case where the CAS program used according to the service to be provided is updated. Send a version of the CAS program.

  The broadcast transmission path 12 is a transmission path for transmitting various data transmitted by the transmission apparatus 11 to an unspecified number of reception apparatuses 31 in one direction at the same time. The broadcast transmission path 12 is, for example, a radio wave in a predetermined frequency band that is relayed by the broadcast satellite 13. A part of the broadcast transmission path 12 may include a communication line, for example, a communication line from the transmission device 11 to a transmission facility (not shown) for transmitting radio waves.

  The server device 21 is a server device that acquires a new CAS program transmitted by the transmission device 11 and stores the acquired CAS program (CAS server). The location of the server device 21 is notified to the receiving device 31 via the communication transmission path 22 as, for example, a URL (Uniform Resource Locator). The server device 21 transmits the CAS program to the receiving device 31 when receiving the CAS program request signal from the receiving device 31.

  The communication transmission path 22 is a transmission path for bidirectionally transmitting various data between the server device 21 and the receiving device 31. The communication transmission path 22 is, for example, the Internet having a wired large-capacity backbone network. The communication transmission path 22 may be configured to include a communication network including a wireless access network in part, for example, a public wireless communication network.

  The reception device 31 activates a CAS program for decrypting encrypted data received from the transmission device 11 via the broadcast transmission path 12, and decrypts the received data by executing the activated CAS program. The received data may include program data and a newer version of the CAS program than the active CAS program. When the receiving device 31 fails to decode the received data (decoding error), the server device sends a CAS program request signal for requesting a CAS program of a newer version than the activated CAS program via the communication transmission path 22. To 21. Thereafter, the receiving device 31 acquires the CAS program from the server device 21 via the communication transmission path 22. The receiving device 31 is, for example, a television receiving device, a video recording device, or the like.

  As described above, when the reception device 31 fails to decode the data received from the transmission device 11, a newer version of the CAS program is acquired, and the acquired CAS program is used for decoding the data. Even when the receiving device 31 cannot acquire the CAS program of the version via the broadcast transmission path 12, the data scrambled by the method corresponding to the CAS program of the version is successfully decoded. Therefore, the user can view the broadcast program more reliably. When the CAS program cannot be acquired via the broadcast transmission path 12, for example, when power is not supplied to the receiving device 31, when the electric field strength of the broadcast wave is reduced due to rain, the broadcast wave is transmitted to a building or other object. There are reception problems caused by obstruction.

(Configuration of transmitter)
Next, the configuration of the transmission device 11 according to the present embodiment will be described.
FIG. 2 is a block diagram illustrating a configuration of the transmission device 11 according to the present embodiment.
The transmission apparatus 11 includes a program data scrambler 110, an ECM generator 111, an EMM generator 112, a distribution data generator 113, a distribution data scrambler 114, a DCM generator 115, a DMM generator 116, a notification information generator 117, and an activation. The program specifying unit 118, the multiplexing unit 119, and the transmission unit 120 are included.

In FIG. 2, the configuration of part C surrounded by a broken line is provided for each set of CAS program and its version. In the following description, the configuration of the C part is referred to as a conditional access function unit C. The conditional access function unit C includes a program data scrambler 110, an ECM generator 111, an EMM generator 112, a distribution data scrambler 114, a DCM generator 115, and a DMM generator 116.
For example, when the CAS program differs for each manufacturer of the reception device 31, the transmission device 11 includes a limited reception function unit C for each manufacturer. Further, when a plurality of CAS programs having different versions are temporarily distributed, the transmission device 11 includes a conditional access function unit C for each version.

The program data scrambler 110 scrambles (encrypts) the input program data Ct with the scramble key Ks to generate the encrypted content Sct. In encryption with the scramble key Ks, a common key encryption algorithm, for example, AES (Advanced Encryption Standard) is used. The program data scramble unit 110 outputs the generated encrypted content Sct to the multiplexing unit 119.
The program data Ct is data indicating the content (content) of the program. The program data Ct includes audio data indicating audio and video data indicating video. The audio data and video data may each be stream format data or section format data.

  The scramble key Ks is updated by being input to the program data scramble unit 110. The scramble key Ks may be updated over time. The update interval of the scramble key Ks is, for example, several seconds.

The ECM generator 111 encrypts the scramble key Ks used for scrambling in the program data scrambler 110 with the work key Kw, and generates common information including the encrypted scramble key Ks. The generated common information is security information that is common to all the receiving apparatuses 31 that are transmission destinations.
A common key encryption algorithm is used for encryption with the work key Kw. The ECM generation unit 111 generates the common information as a message having a predetermined transmission method, for example, an ECM (Entirement Control Message) structure defined by MPEG (Moving Picture Experts Group) -2 Systems. The ECM generation unit 111 outputs the generated common information (ECM) to the multiplexing unit 119.

  The work key Kw is updated by being input to the ECM generation unit 111. The work key Kw may be updated over time. The work key Kw may have a longer update interval than the scramble key Ks. The update interval of the work key Kw is, for example, one month.

The EMM generation unit 112 encrypts the work key Kw used for encryption in the ECM generation unit 111 with the master key Km, and generates individual information including the encrypted work key Kw. The generated individual information is individual security information for each receiving device 31.
A common key encryption algorithm is used for encryption using the master key Km. The EMM generating unit 112 generates the individual information as a message having a predetermined transmission method, for example, an EMM (Entitlement Management Message) structure defined by MPEG-2 Systems. The EMM generation unit 112 outputs the generated individual information (EMM) to the multiplexing unit 119.

  The master key Km is an encryption key that is different for each receiving device 31 and distributed to each receiving device 31 in advance. Each master key Km is stored in advance in a storage unit (not shown) of the transmission device 11. The EMM generation unit 112 reads each master key Km from the storage unit, and uses the read master key Km for encryption.

  The common information (ECM) and the individual information (EMM) are security information for only the receiving device 31 of each user who has a regular reception contract with the broadcaster to unscramble. Only the receiving device 31 of the user can unscramble the program data, and the receiving device 31 of another user cannot unscramble, thereby realizing limited reception.

  The distribution data generation unit 113 receives a new version of the CAS program P. The distribution data generation unit 113 converts the input CAS program P into a data carousel data format, and generates distribution data (distribution data). Distribution data generation unit 113 outputs the generated distribution data to distribution data scramble unit 114. The configuration of the distribution data generation unit 113 will be described later.

The distribution data scramble unit 114 scrambles (encrypts) the distribution data input from the distribution data generation unit 113 with the transmission path protection key Kt to generate encrypted distribution data Scas. In the encryption with the transmission path protection key Kt, a common key encryption algorithm, for example, AES is used. The distribution data scramble unit 114 outputs the generated encrypted distribution data Scas to the multiplexing unit 119.
The transmission path protection key Kt is updated by being input to the distribution data scramble unit 114. The transmission path protection key Kt may be updated over time. The update interval of the transmission path protection key Kt is, for example, several seconds.

The DCM generation unit 115 encrypts the transmission path protection key Kt used for scrambling in the distribution data scrambling section 114 with the download key Kdl, and common information including the encrypted transmission path protection key Kt (DCM: Download Control Message) Is generated. The generated common information (DCM) is security information common to all the receiving apparatuses 31 that are transmission destinations.
A common key encryption algorithm is used for encryption using the download key Kdl. The DCM generation unit 115 generates common information (DCM) as a message in a section extension format defined by a predetermined transmission method, for example, MPEG-2 Systems. The DCM generation unit 115 outputs the generated common information (DCM) to the multiplexing unit 119.
The download key Kdl is a key transmitted to the receiving device 31 regardless of whether there is a reception contract. The download key Kdl is updated by being input to the DCM generation unit 115.

When the CAS program to be activated is designated by the activation program designating unit 118, the DCM generating unit 115, the CAS program P identifier (CAS-ID), version (CAS-Ver), transmitted by the program arrangement information, And the hash value (CAS-H) of the CAS program P is added to the common information (DCM). The hash value (CAS-H) is a value calculated by a hash function (for example, SHA-256: Secure Hash Algorithm 256-bit) common to the hash function used in the receiving device 31 for the data constituting the CAS program P. It is.
Thereby, the receiving device 31 can prevent malfunction due to alteration of the identifier (CAS-ID) or version (CAS-Ver) of the CAS program P transmitted by PSI / SI. In addition, the receiving device 31 can detect a mismatch in the hash values of the accumulated CAS program P and prevent malfunction.

The DMM generating unit 116 encrypts the download key Kdl used for encryption in the DCM generating unit 115 with the CAS infrastructure key Kb, and generates individual information (DMM: Download Management Message) including the encrypted download key Kdl. . The generated individual information (DMM) is individual security information for each receiving device 31.
A common key encryption algorithm is used for encryption using the CAS infrastructure key Kb. The DMM generating unit 116 generates individual information (DMM) as a message in a section extension format defined in a predetermined transmission method, for example, MPEG-2 Systems.
The DMM generating unit 116 is a root public key certificate in which the digital signature of the certificate authority is added in advance to the public key (verification key) Kpp corresponding to the secret key Kps used for generating the signature value in the distribution data generating unit 113. RPKC is added to the individual information (DMM). The DMM generating unit 116 outputs the individual information (DMM) to which the root public key certificate RPKC is added to the multiplexing unit 119.
The CAS infrastructure key Kb is an encryption key common to the receiving apparatuses 31 and is an encryption key distributed to each receiving apparatus 31 in advance. By making the CAS infrastructure key Kb common among the receiving apparatuses 31, it is possible to reduce the transmission amount of individual information (DMM). Note that the CAS infrastructure key Kb may be a different encryption key for each receiving device 31.

  The common information (DCM) and the individual information (DMM) are security information for all of the receiving apparatuses 31 of users who have a regular reception contract to unscramble. Common information (DCM) and individual information (DMM) are information used for encrypting and transmitting the CAS program.

  The notification information generation unit 117 receives download control information Dc including various types of information when the receiving device 31 downloads the CAS program P. The notification information generation unit 117 generates notification information (SDTT: Software Download Trigger Table) including the input download control information, and outputs the generated notification information SDTT to the multiplexing unit 119. The notification information SDTT is, for example, a section format data table. The download control information Dc includes, for example, identification information for specifying the CAS program P to be transmitted, for example, an identifier (CAS-ID) and a version (CAS-Ver) of the CAS program P. The download control information Dc includes information for transmitting the CAS program P by broadcasting and information for transmitting the CAS program P by communication. For example, the start time and the distribution continuation time are included for broadcast transmission. For transmission by communication, the address of the server device 21 holding the CAS program P is included. A data configuration example of the notification information will be described later.

  The activation program designation unit 118 generates program designation information that designates the CAS program P to be activated in the receiving device 31. The program designation information includes an identifier (CAS-ID) and a version identifier (CAS-Ver) of the CAS program P. The program designation information is generated as, for example, a CA activation descriptor (CA_startup_descriptor ()). The activation program designating unit 118 arranges the generated program designating information in program arrangement information PSI (Program Specific Information) / SI (Service Information Information) CAT (Conditional Access Table) and PMT (Program Map Table). The start program specifying unit 118 outputs the program arrangement information PSI / SI to which the program specifying information is added to the multiplexing unit 119.

The multiplexing unit 119 includes the encrypted content Sct input from the program data scramble unit 110, common information (ECM) input from the ECM generation unit 111, individual information (EMM) input from the EMM generation unit 112, and distribution data. Encrypted distribution data Scas input from the scramble unit 114, common information (DCM) input from the DCM generation unit 115, individual information (DMM) input from the DMM generation unit 116, input from the notification information generation unit 117 The notification information SDTT and the program arrangement information PSI / SI input from the activation program designating unit 118 are multiplexed to generate multiplexed data in a predetermined format. For example, the multiplexing unit 119 generates multiplexed data of each input information in a TS (Transport Stream) format (MPEG-2 TS) defined by MPEG-2 Systems. The multiplexing unit 119 outputs the generated multiplexed data to the transmission unit 120.
The transmission unit 120 transmits the multiplexed data input from the multiplexing unit 119 to the reception device 31 via the broadcast transmission path 12. Here, the transmission unit 120 modulates a carrier wave having a predetermined carrier frequency with multiplexed data that is a baseband signal, and radiates radio waves in a channel band corresponding to the carrier frequency.

  In order to ensure security in the broadcast system 1, the CAS program key is updated as time elapses (for example, at intervals of one month), and the version number is updated each time the key is updated. However, immediately after the update of the new version of the CAS program P, the download of the CAS program P is not always performed simultaneously in all the receiving apparatuses 31 of the users. Therefore, when the transmission apparatus 11 is a predetermined period (for example, one week) from the distribution start time of the new CAS program, the transmission apparatus 11 can decrypt the encrypted distribution data Scas and the encrypted content Sct that can be decrypted by the version of the CAS program before the update. Is provided with a conditional access function unit C ′. Therefore, when the start time for starting the distribution of the next version of the CAS program is known, the notification information generating unit 117 determines that the distribution end time of the latest version of the CAS program P at that time is the next version of the CAS program. The distribution continuation time before the start time of the program P is set in the notification information SDTT. In addition, the activation program designating unit 118 includes information (activation instruction (described later)) instructing that the later version of the latest version is included in the activation target version in the program designation information. Thereby, even when the program designation information cannot be received by broadcasting, the receiving device 31 can start the acquired CAS program when acquiring a new version of the CAS program by communication.

(Configuration of distribution data generation unit)
Next, the configuration of the distribution data generation unit 113 will be described.
FIG. 3 is a block diagram illustrating a configuration of the distribution data generation unit 113 according to the present embodiment.
The distribution data generation unit 113 includes a signature value calculation unit 1131, a division unit 1132, an encryption unit 1133, and a section data generation unit 1134.

  The signature value calculation unit 1131 calculates the signature value of the digital signature for the input CAS program P. The signature value calculation unit 1131 generates a hash value from data constituting the CAS program P using a hash function common to the hash function used in the reception device 31. The signature value calculation unit 1131 calculates a signature value by encrypting a hash value generated with the secret key Kps corresponding to the public key (verification key) Kpp. The signature value calculation unit 1131 outputs the calculated signature value to the section data generation unit 1134. When calculating the signature value, the signature value calculation unit 1131 can use, for example, DSA (Digital Signature Algorithm) and RSA (Rivest Shamir Adelman) encryption. The public key (verification key) Kpp for verifying the digital signature corresponding to the secret key Kps used for calculating the signature value is included in the individual information (DMM) as the root public key certificate RPKC as described above, and is received by the receiving device 31. Sent to.

The dividing unit 1132 divides the input CAS program P into a predetermined size, and outputs the divided data (divided data) to the encryption unit 1133. The size of the divided data is a block size specified by the DDB message.
The encryption unit 1133 encrypts the divided data input from the dividing unit 1132 using the master secret key Kms, and outputs the encrypted divided data to the section data generation unit 1134. The encryption unit 1133 uses a public key encryption algorithm, for example, a method defined by PKCS # 1 (Public-Key Cryptography Standards # 1) at the time of encryption. Note that the master secret key Kms is an encryption key that is common to all of the receiving apparatuses 31 and is stored in advance in a storage unit (not shown) of the transmitting apparatus 11.

The section data generation unit 1134 sections the divided data encrypted by the encryption unit 1133 as a DDB message, and sections the configuration information as a DII message. The section data generation unit 1134 arranges the identifier (CAS-ID) and version (CAS-Ver) of the input CAS program P in the DII message. As a result, the identifier and version of the CAS program P to be transmitted are notified to the receiving device 31.
The section data generation unit 1134 arranges the signature value calculated by the signature value calculation unit 1131 in the DII message when sectioning the DII message. As a result, the reception device 31 can verify whether or not the CAS program P received from the transmission device 11 is a legitimate program using the digital signature.

  When the program data input to the program data scramble unit 110 includes audio data and video data in the stream format, an error check block may be added to the data block that stores these data. An error detection code calculated by a predetermined algorithm, for example, cyclic redundancy check (CRC) is added to the error check block. According to the cyclic redundancy check, a CRC value is calculated as an error detection code. When the program data includes section format data consisting of a DII message and a DDB message, which are section format data, the calculated CRC value may be added to the DII message. The receiving device 31 can verify whether or not the CRC value calculated based on the decoded program data is correctly decoded based on whether or not it matches the added CRC value.

(Data structure of DII message)
Next, an example of a DII message when the CAS program P is transmitted will be described.
FIG. 4 is a diagram illustrating an example of the DII message. In the example shown in FIG. 4, the DII message includes a compatibility descriptor (compatibilityDescriptor ()) and a CAS program digital signature (CAS_digital_signature). An example of the compatibility descriptor (compatibilityDescriptor ()) will be described later. The CAS program digital signature (CAS_digital_signature) indicates a signature value calculated by the signature value calculation unit 1131.
The DII message includes the number of modules (num_of_modules), module identification (module_id), and module size (module_size) of the DII / DDB message.

(Compatibility descriptor data structure)
Next, the data structure of the compatibility descriptor will be described.
FIG. 5 is a diagram illustrating an example of the compatibility descriptor. In the example shown in FIG. 5, the compatibility descriptor includes a descriptor type (descriptorType), an identifier type (specifiertype), and a version field (version). The value 0xFD set in the descriptor type (descriptorType) is a value indicating that information is set in the supplementary information (additionalInformation) area of the subdescriptor (subDescriptor (), and is set in the identifier type (specifierType). The value 0xFD is a value indicating the update of the conditional access function, that is, the update of the CAS program P. The version field (version) indicates a group identification (group_id) and a version identification (version_id), and the group identification (group_id) is This is information for specifying a group of receiving devices to be downloaded, and is intended to distribute the receiving devices to be downloaded for each group. ) As, version (CAS-Ver) is described.

  In the supplementary information (additionalInformation) area of the subdescriptor (subDescriptor ()), a model identification (model_id) corresponding to a manufacturer identification (maker_id) indicating a CAS-based manufacturer is described. Further, an identifier (CAS-ID) of the CAS program P is stored as model identification (model_id).

(Data structure of DDB message)
Next, the data structure of the DDB message used when the CAS program P is distributed will be described.
FIG. 6 is a diagram illustrating an example of a DDB message. In the example shown in FIG. 6, the DDB message includes a block number (BlockNumber), a module identification (moduleId), and a payload area (blockDataByte). The block number (BlockNumber) is information that is incremented by 1 for each block by the section data generation unit 1134 and written. Therefore, the block number (BlockNumber) is a number indicating the order of the CAS program P divided and encrypted into blocks. The module identification (moduleId) is identification information that identifies each DDB. The payload area (blockDataByte) is an area in which the CAS program P divided and encrypted by the section data generation unit 1134 is written.

(Data structure of notification information)
Next, the data structure of the notification information SDTT generated by the notification information generation unit 117 will be described.
FIG. 7 is a diagram illustrating an example of the notification information SDTT. In the example illustrated in FIG. 7, the notification information SDTT includes a table identification extension (table_id_ext), a target version (target_version), a new version (new_version), a download level (download_level), a version instruction (version_indicator), a start time (start_time), and distribution. It includes a duration and a descriptor area (descriptors ()).

The upper 16 bits of the table identification extension (table_id_ext) indicate a predetermined value (0xFE), and the lower 8 bits indicate a manufacturer identification (maker_id). In the manufacturer identification (maker_id), an identifier (CAS-ID) of the CAS program P is described.
The target version (target_version) stores a version number to be updated. In the new version (new_version), a CAS program P to be downloaded, that is, a version (CAS-Ver) related to the CAS program P transmitted by the transmission apparatus 11 is described.
In the download level (download_level), a value indicating a download mode is stored. For example, “01” indicates forced download, and “00” indicates optional download.
The version instruction (version_indicator) indicates the range of versions to be updated. '00' indicates all versions, and '03' indicates only the specified version.
The start time (start_time) indicates the time at which the transmission apparatus 11 starts transmitting the CAS program P.
The distribution continuation time (duration) indicates a time during which the transmission device 11 continues to transmit the CAS program P. In the notification information SDTT, a start time (start_time) and a distribution duration (duration) can be set in plural ways.
In the descriptor area (descriptors ()), a download content descriptor and a network download content descriptor are described.

(Data structure of download content descriptor)
Next, the data structure of the download content descriptor will be described.
FIG. 8 is a diagram illustrating an example of a download content descriptor. The download content descriptor includes a compatibility flag (compatibility_flag), a compatibility descriptor (compatibilityDescriptor ()), a module number (num_of_modules), a module identification (module_id), a module size (module_size) and a private data area (p_value). Including.
The compatibility flag (compatibility_flag) is a flag indicating the presence / absence of a compatibility descriptor (compatibilityDescriptor ()). In the example illustrated in FIG. 8, the compatibility flag (compatibility_flag) describes a value indicating the presence or absence in “()” of the compatibility descriptor (compatibilityDescriptor ()). The compatibility descriptor (compatibilityDescriptor ()) includes the same content as the above-described compatibility descriptor (FIG. 5). Here, the version (CAS-Ver) is described.

The number of modules (num_of_modules), module identification (module_id), and module size (module_size) describe the number of modules, module identification, and module size of the DII / DDB message, respectively.
Download priority (download_priority) is described in the first byte of the private data area (private_data_byte). In the download priority (download_priority), a value indicating the priority order of either broadcasting or communication is described as a download path. Download priority (download_priority) is also called a priority flag.

(Data structure of network download content descriptor)
Next, the data structure of the network download content descriptor will be described.
FIG. 9 is a diagram illustrating an example of a network download content descriptor. The network download content descriptor includes a compatibility flag (compatibility_flag), a compatibility descriptor (compatibilityDescriptor ()), a session protocol number (session_protocol_number), a reconnection count (retry), an address type (address_type), an address, and an address Contains a number (port_number).
Also in the example illustrated in FIG. 9, the compatibility flag (compatibility_flag) is set to a value indicating the presence or absence in “()” of the compatibility descriptor (compatibilityDescriptor ()), as in the example illustrated in FIG. 8. Has been. The compatibility descriptor (compatibilityDescriptor ()) includes the same content as the above-described compatibility descriptor (FIG. 5). Here, the version (CAS-Ver) is described.
The session protocol number (session_protocol_number) is a number indicating a protocol (for example, TCP: Transmission Control Protocol) used for network download, that is, download via the communication transmission path 22. The number of reconnections (retry) indicates the upper limit of the number of attempts to reconnect to the transmission source communication server, that is, the server device 21. The address type (address_type) is a number indicating the type of address indicating the location of the transmission source communication server. In the example shown in FIG. 9, any of IPv4, IPv6, and URL (Uniform Resource Locator) can be specified as the address type. The address indicates the location of the transmission source communication server, and is an address represented by the type specified by the address type (address_type). The port number (port_number) indicates the port number of the communication server.

(Data structure of CA activation descriptor)
Next, the data structure of the CA activation descriptor indicating the program designation information generated by the activation program designation unit 118 will be described.
FIG. 10 is a diagram illustrating an example of the CA activation descriptor. The CA activation descriptor includes a conditional access system identification (CA_system_ID), a CAS program identification (CA_program_ID), and an activation instruction (load_indicator).
The conditional access system identification (CA_system_ID) is information for identifying a system that transmits a CAS program to be activated, and is represented by a value corresponding to the CAS program.
The CAS program identification (CA_program_ID) is identification information (ID) of the CAS program to be activated and information indicating the version.
The activation instruction (load_indicator) is information indicating the range of the version related to the CAS program to be activated by a value set in the lower 3 bits or the lower 4 bits. Specifically, when the value of the lower 3 bits is “001”, the version after the version specified by the CAS program identification (CA_program_ID) is the activation target, and when it is “010”, This indicates that the version prior to the version specified by the CAS program identification (CA_program_ID) is the activation target. When the lower 3 bits (bit0 to bit2) indicate the range of the version of the CAS program to be activated, the value of the fourth bit (bit3) from the least significant is 0. Is the activation target, and the value of the fourth bit (bit3) being 1 indicates that the CAS program related to the minimum version of the range is the activation target.

(Server device configuration)
Next, the configuration of the server device 21 will be described.
FIG. 11 is a block diagram illustrating a configuration of the server device 21 according to the present embodiment.
The server device 21 includes a control unit 210, a communication unit 214, and a storage unit 215. The control unit 210 implements the functions of the distribution data acquisition unit 211, the version response unit 212, and the distribution data distribution unit 213 by executing a control program stored in the storage unit 215. The control unit 210 is, for example, a CPU.

  The distribution data acquisition unit 211 acquires the distribution data of the CAS program P generated by the distribution data generation unit 113 from the transmission device 11. The distribution data acquisition unit 211 reads the identifier (CAS-ID) and version identifier (CAS-Ver) of the CAS program P from DII included in the acquired distribution data. The distribution data acquisition unit 211 stores the read identifier (CAS-ID) and version identifier (CAS-Ver) of the CAS program P in association with the acquired distribution data in the storage unit 215. Therefore, the server device 21 stores distribution data related to the latest version of the CAS program that can be transmitted at that time.

The version response unit 212 receives a version inquiry signal from the receiving device 31. The version inquiry signal is a signal for inquiring the version (CAS-Ver) stored in the server device 21 for the CAS program identified by the designated identifier (CAS-ID). The version response unit 212 searches for the version identifier corresponding to the distribution data stored in the storage unit 215 from the distribution data related to the CAS program identified by the identifier (CAS-ID) specified by the received version inquiry signal. To do. The version response unit 212 generates a version response signal including the searched version identifier (CAS-Ver).
Further, the received version inquiry signal may include a version identifier (CAS-Ver). In that case, the version response unit 212 generates a version response signal including a version identifier indicating a version newer than the version identifier (CAS-Ver) included in the version inquiry signal.
The version response unit 212 transmits the generated version response signal to the reception device 31.

  The distribution data distribution unit 213 receives a distribution request signal from the receiving device 31. The distribution request signal is a signal for requesting distribution data related to a CAS program identified by a specified identifier (CAS-ID) and version (CAS-Ver). The distribution data distribution unit 213 reads distribution data corresponding to the identifier (CAS-ID) and version (CAS-Ver) specified by the distribution request signal from the storage unit 215. The distribution data distribution unit 213 transmits the read distribution data to the receiving device 31.

The communication unit 214 transmits and receives various data between external devices such as the transmission device 11 and the reception device 31. Transmission / reception by each component of the server device 21 is performed via the communication unit 214. The communication unit 214 is a communication interface, for example.
The storage unit 215 stores various data. The storage unit 215 includes a storage medium, for example, an HDD (Hard-disk Drive), a flash memory, a ROM (Read-only Memory), a RAM (Random Access Memory), or a combination thereof.

(Receiver configuration)
Next, the configuration of the receiving device 31 will be described.
FIG. 12 is a block diagram illustrating a configuration of the receiving device 31 according to the present embodiment.
The receiving device 31 includes a tuner 311 (reception unit), a separation unit 312, a decoding unit 313, an audio decoding unit 314, an audio level detection unit 315, a reproduction unit 316, a video decoding unit 317, a video level detection unit 318, a display unit 319, A communication unit 321, a control unit 331, and a storage unit 341 are included.

  The tuner 311 receives the multiplexed signal from the transmission device 11 via the broadcast transmission path 12. The tuner 311 demodulates the received signal in the channel band received by radio waves into a multiplexed signal that is a baseband signal at a corresponding carrier frequency. The tuner 311 outputs the demodulated multiplexed signal to the separation unit 312.

  The demultiplexing unit 312 includes the encrypted content Sct from the multiplexed signal input from the tuner 311, common information (ECM) including information for limited reception, individual information (EMM), and information for encrypted transmission of the CAS program. The common information (DCM) and individual information (DMM), encrypted distribution data Scas, notification information SDTT, and program arrangement information PSI / SI are separated. Further, the separation unit 312 separates the encrypted distribution data Scas from the multiplexed signal when a distribution data separation instruction is notified from the notification information analysis unit 334 (described later). The separation unit 312 outputs the separated encrypted content Sct, common information (ECM), individual information (EMM), common information (DCM), individual information (DMM), and encrypted distribution data Scas to the decryption unit 313. The separation unit 312 outputs the separated notification information SDTT and program arrangement information PSI / SI to the control unit 331.

The decryption unit 313 decrypts the encrypted content Sct input from the separation unit 312 using common information (ECM) and individual information (EMM) to generate program data. The decryption unit 313 decrypts the encrypted distribution data Scas input from the separation unit 312 using the common information (DCM) and the individual information (DMM), and reproduces the distribution data.
The decoding unit 313 outputs audio data of the decoded program data to the audio decoding unit 314 and outputs video data to the video decoding unit 317. The decryption unit 313 reproduces the CAS program P by decrypting the distribution data acquired by the schedule indicated by the notification information SDTT or the distribution data received by the control unit 331 from the server device 21. The decryption unit 313 stores the reproduced CAS program P in the storage unit 341 in association with the version (CAS-Ver).
The functional configuration of the decoding unit 313 will be described later.

  The audio decoding unit 314 receives audio data from the decoding unit 313. The input audio data is data encoded by a predetermined audio encoding method (for example, MPEG-2 audio). The audio decoding unit 314 decodes audio data input by a decoding method corresponding to the encoding method used for encoding, and generates decoded audio data. The decoded audio data is data indicating the audio level at each time. The audio decoding unit 314 outputs the decoded audio data to the audio level detection unit 315.

The voice level detection unit 315 detects whether or not the amplitude level of the voice indicated by the voice data input from the voice decoding unit 314 is abnormal. An amplitude level abnormality is, for example, a state where the amplitude level is zero or close to zero. This state indicates that there is no sound. Hereinafter, this state is referred to as level zero. For example, when the absolute value of the amplitude level indicated by the audio data is lower than a threshold value of a predetermined amplitude level, the audio level detection unit 315 performs audio output when the audio data is detected for a predetermined duration (for example, 0.1 second) or longer. It is determined that the amplitude level is abnormal, and otherwise it is determined to be normal. When it is determined that the sound level is abnormal, the sound level detection unit 315 generates a sound level abnormality signal (sound level abnormality) indicating that the sound amplitude level is abnormal, and the generated sound level abnormality signal is sent to the control unit 331. Output. When the sound level detection unit 315 determines that the sound level is normal, the sound level detection unit 315 outputs the input sound data to the reproduction unit 316.
The reproduction unit 316 reproduces audio based on the audio data input from the audio level detection unit 315. The playback unit 316 includes, for example, a speaker.

  The video decoding unit 317 receives video data from the decoding unit 313. The input video data is data encoded by a predetermined video encoding method (for example, MPEG-2 video). The video decoding unit 317 decodes video data input by a decoding method corresponding to the encoding method used for encoding, and generates decoded video data. The decoded video data is data indicating signal values forming a video at each time. The video decoding unit 317 outputs the decoded video data to the video level detection unit 318.

The video level detection unit 318 detects whether or not the signal level in each frame forming the video data input from the video decoding unit 317 is abnormal. An abnormality is, for example, a state where the signal level is zero or close to zero. For example, the video level detection unit 318 determines that the video signal level is abnormal when the signal level indicated by the video data is lower than a predetermined level threshold for a predetermined duration (for example, 0.1 seconds) or longer. In other cases, it is determined to be normal. When it is determined that the video level is abnormal, the video level detection unit 318 generates a video level abnormality signal indicating that the video signal level is abnormal, and outputs the generated video level abnormality signal to the control unit 331. When it is determined that the video level detection unit 318 is normal, the video level detection unit 318 outputs the input video data to the display unit 319.
The display unit 319 reproduces a video based on the video data input from the video level detection unit 318. The display unit 319 includes a display, for example.

  The communication unit 321 transmits and receives various data between external devices, for example, the transmission device 11 and the server device 21. Transmission / reception by each component of the reception device 31 is performed via the communication unit 321. The communication unit 321 is, for example, a communication interface.

The control unit 331 controls various operations of the receiving device 31. For example, the control unit 331 analyzes the notification information SDTT input from the separation unit 312, specifies the version (CAS-Ver) of the CAS program P to be received, and receives the CAS received from the broadcast transmission path 12 at the specified time. The decryption unit 313 is caused to acquire the program P.
The control unit 331 checks the update information of the CAS program P in the server device 21 when the decoding of the data received from the transmission device 11 via the broadcast transmission path 12 fails. The data decoding failure includes (1) failure of decoding of the CAS program in the decoding unit 313, (2) failure of decoding of the program data in the decoding unit 313, and (3) of the audio detected by the audio level detecting unit 315. There is an abnormality in the amplitude level, or (4) an abnormality in the signal level of the video detected by the video level detection unit 318.

The control unit 331 determines whether there is a CAS program P of a version newer than the CAS program P stored in the storage unit 341 among the versions indicated by the update information of the CAS program P. When the control unit 331 determines that there is a newer version of the CAS program P than the CAS program P, the control unit 331 requests the server device 21 for the latest version of the CAS program P. As a response, the control unit 331 receives distribution data indicating the CAS program P from the server device 21 and causes the decoding unit 313 to decode the received distribution data.
When the control unit 331 determines that there is no newer version of the CAS program P than the CAS program P, the control unit 331 outputs a message corresponding to the data decryption failure reason (1) to (4) to the display unit 319. In the case of (1), the message indicates failure of the decoding process of the CAS program. In the case of (2), the message indicates an audio / video (program) decoding error, and (3) or (4) In this case, the message indicates a warning.

  Further, the control unit 331 extracts program designation information from the program arrangement information PSI / SI input from the separation unit 312, and stores a version (CAS-Ver) CAS program P designated by the extracted program designation information in the storage unit 341. Extract from The control unit 331 executes the extracted CAS program P to realize the function of the decoding unit 313. The functional configuration of the control unit 331 will be described later.

  The storage unit 341 stores various data. The storage unit 341 includes a storage medium, for example, an HDD, a flash memory, a ROM, a RAM, or any combination thereof.

(Configuration of decoding unit and control unit)
Next, configurations of the decoding unit 313 and the control unit 331 according to the present embodiment will be described.
FIG. 13 is a block diagram illustrating configurations of the decoding unit 313 and the control unit 331 according to the present embodiment.
The decoding unit 313 includes an EMM decoding unit 3131, an ECM decoding unit 3132, a program data decoding unit 3133, a DMM decoding unit 3134, a DCM decoding unit 3135, a distribution data decoding unit 3136, a distribution data separation unit 3137, and a program decoding unit 3138. Consists of. The decryption unit 313 is realized by executing the CAS program activated by the program activation unit 333. The decoding unit 313 may be configured by a control device such as a CPU that is unique to the decoding unit 313, or may be configured by a control device that is common to other functional units.

  The EMM decryption unit 3131 decrypts the individual information (EMM) input from the separation unit 312 with the master key Km. Only when the identifier of the receiving device 31 included in the non-encrypted area of the EMM matches the identifier stored in the storage unit 341, the EMM decryption unit 3131 stores the master key stored in advance from the storage unit 341. Read Km. The EMM decryption unit 3131 decrypts the encrypted area of the EMM using the read master key Km, and extracts the work key Kw. As a result, the work key Kw is extracted only for the receiving device 31 of the user who has a regular contract with the broadcaster. The EMM decryption unit 3131 outputs the decrypted work key Kw to the ECM decryption unit 3132.

  The ECM decryption unit 3132 decrypts the common information (ECM) input from the separation unit 312 with the work key Kw input from the EMM decryption unit 3131. The ECM includes a scramble key Ks used when program data is scrambled. As the decrypted common information (ECM), the scramble key Ks used when generating the encrypted content Sct is reproduced. The ECM decryption unit 3132 outputs the decrypted scramble key Ks to the program data decryption unit 3133.

  The program data decryption unit 3133 decrypts (descrambles) the encrypted content Sct input from the separation unit 312 with the scramble key Ks input from the ECM decryption unit 3132 and extracts the program data Ct. The decoding process executed by the program data decoding unit 3133 corresponds to the inverse operation of the scramble process executed by the program data scramble unit 110.

When the program data Ct includes audio data and video data in the stream format, an error detection code, for example, an error check block in which a CRC value is described is added to the data block for storing the data. There may be. The program data decoding unit 3133 calculates an error detection code for the program data Ct extracted from the data block using the same algorithm as that used for calculating the error detection code. The program data decoding unit 3133 determines whether or not the calculated error detection code matches the error detection code described in the error check block.
When the program data Ct includes a DII message and a DDB message, the DII message may be described as an error detection code, for example, in a CRC descriptor (not shown). In this case, the program data decoding unit 3133 calculates an error detection code for the program data Ct extracted from all modules of the DDB message using the same algorithm as that used for calculating the error detection code. The program data decoding unit 3133 may determine whether or not the calculated error detection code matches the error detection code described in the DII message.

  When it is determined that they match in the above determination, the program data decoding unit 3133 determines that the program data has been successfully decoded, and outputs the extracted program data Ct to the audio decoding unit 314 and the video decoding unit 317. When it is determined that they do not match, the program data decoding unit 3133 determines that decoding of the program data has failed, and a control unit 331 generates a program decoding result signal (audio / video decoding error) indicating that decoding of the program data has failed. Is output to the update information confirmation unit 336.

The DMM decryption unit 3134 only when the identifier of the receiving device 31 included in the non-encrypted area of the individual information (DMM) input from the separation unit 312 matches the identifier stored in the storage unit 341 in advance. Then, the CAS infrastructure key Kb stored in advance from the storage unit 341 is read. The DMM decrypting unit 3134 decrypts the encrypted area of the DMM using the read CAS infrastructure key Kb, and extracts the download key Kdl. The DMM decryption unit 3134 outputs the decrypted download key Kdl to the DCM decryption unit 3135.
When the root public key certificate RPKC is included in the DMM, the DMM decryption unit 3134 extracts the root public key certificate RPKC from the DMM, and stores the extracted root public key certificate RPKC in the storage unit 341. .

The DCM decryption unit 3135 decrypts the common information (DCM) input from the separation unit 312 with the download key Kdl input from the DMM decryption unit 3134. In the DCM, the transmission path protection key Kt used when the distribution data is scrambled is extracted. The DCM decryption unit 3135 outputs the decrypted transmission path protection key Kt to the distribution data decryption unit 3136.
In some cases, an identifier (CAS-ID), a version (CAS-Ver), and a hash value (CAS-H) of CAS program P transmitted by PSI / SI are added to DCM. In that case, the DCM decoding unit 3135 outputs the added information (CAS-ID, CAS-Ver, CAS-H) to the program activation unit 333 of the control unit 331.

  When the reception instruction signal is input from the control unit 331, the distribution data decryption unit 3136 descrambles the encrypted distribution data Scas input from the separation unit 312 with the transmission path protection key Kt input from the DCM decryption unit 3135. (Decode) and extract distribution data. The reception instruction signal is a signal instructing reception of the CAS program P. The descrambling process executed by the delivery data decoding unit 3136 corresponds to the inverse operation of the scramble process executed by the delivery data scrambler 114. Distribution data decoding section 3136 outputs the extracted distribution data to distribution data separation section 3137.

  The distribution data separation unit 3137 separates the encrypted CAS program P from the distribution data input from the distribution data decryption unit 3136 or the program acquisition unit 335 of the control unit 331. Specifically, the distribution data separation unit 3137 refers to the DII message of the distribution data, extracts the data described in the payload area (blockDataByte) included in the DDB message, and concatenates and extracts the extracted data. The CAS program P is configured.

  Further, the distribution data separation unit 3137 extracts the identifier (CAS-ID) and version (CAS-Ver) of the CAS program P from the compatibility descriptor in the DII message, and extracts the CAS program P described in the DII message. Extract the signature value. The distribution data separation unit 3137 outputs the encrypted CAS program P, the extracted identifier (CAS-ID), version (CAS-Ver), and signature value to the program decryption unit 3138.

  The program decryption unit 3138 decrypts the CAS program input from the distribution data separation unit 3137. The program decryption unit 3138 includes an encryption / decryption unit 3138a and a signature verification unit 3138b.

  The encryption / decryption unit 3138a reads the master secret key Kms stored in advance from the storage unit 341, and decrypts the encrypted CAS program P from the distribution data separation unit 3137 using the read master secret key Kms. The master secret key Kms is the same as the master secret key Kms key used for encryption of the CAS program P in the encryption unit 1133 of the transmission device 11. The encryption / decryption unit 3138a outputs the decrypted CAS program P to the signature verification unit 3138b.

  The signature verification unit 3138b verifies the digital signature added to the CAS program P input from the encryption / decryption unit 3138a. Here, the signature verification unit 3138b calculates a hash value of the CAS program P using a hash function common to the signature value calculation unit 1131 of the transmission device 11. Then, the signature verification unit 3138b reads the root public key certificate RPKC from the storage unit 341, and decrypts the signature value input from the distribution data separation unit 3137 with the public key Kpp included in the root public key certificate RPKC. The signature verification unit 3138b determines whether or not the decrypted signature value matches the calculated hash value. It can be verified whether or not the received CAS program P is a legitimate program that has not been tampered with, depending on whether or not they match.

  If the decrypted signature value matches the calculated hash value, the signature verification unit 3138b determines that the received CAS program P has been successfully decrypted. When the signature verification unit 3138b determines that the decryption is successful, the CAS program input from the encryption / decryption unit 3138a is stored in the storage unit 341 in association with the identifier (CAS-ID) and version (CAS-Ver). To do. Also, the signature verification unit 3138b determines that the decryption has failed when the decrypted signature value does not match the calculated hash value. When the signature verification unit 3138b determines that the decryption has failed, the signature verification unit 3138b does not store the CAS program input from the encryption / decryption unit 3138a in the storage unit 341, and generates a CAS decryption result signal indicating that the decryption of the CAS program has failed. To do. The signature verification unit 3138b outputs the generated CAS decryption result signal (CAS program decryption error) to the update information confirmation unit 336 of the control unit 331.

  The control unit 331 includes an activation program determination unit 332, a program activation unit 333, a notification information analysis unit 334, a program acquisition unit 335, an update information confirmation unit 336, and a message output unit 337. The control unit 331 is realized by executing a control program stored in advance in the storage unit 341. The control unit 331 may be configured by a control device such as a CPU that is unique to the control unit 331, or may be configured by a control device that is common to other functional units.

  The activation program determination unit 332 extracts the identifier (CAS-ID) and version (CAS-Ver) of the CAS program P, which is program designation information, from the CAT or PMT of the program arrangement information PSI / SI input from the separation unit 312. . Thereby, the CAS program P to be started is specified. The activation program determination unit 332 outputs the extracted identifier (CAS-ID) and version (CAS-Ver) of the CAS program P to the program activation unit 333.

  The program activation unit 333 activates the CAS program P specified by the identifier (CAS-ID) and version (CAS-Ver) input from the activation program determination unit 332, and executes the function. Here, based on the identifier (CAS-ID) and version (CAS-Ver) input from the startup program determination unit 332, the program startup unit 333 receives a CAS associated with the corresponding identifier and version from the storage unit 341. Read program P. Then, the program activation unit 333 executes the read CAS program and realizes the function of the decoding unit 313. In the initial operation, that is, when the CAS program P is not received, the program activation unit 333 activates the CAS program P stored in the storage unit 341 in advance.

However, the program activation unit 333 receives the identifier (CAS-ID) and version (CAS-Ver) input from the DCM decoding unit 3135 and the identifier (CAS-ID) and version (CAS-Ver) input from the activation program determination unit 332. Ver)) is determined. If it is determined that they do not match, the program activation unit 333 does not activate the CAS program P. In this determination, the identifier (CAS-ID) and version (CAS-Ver) distributed by the program arrangement information PSI / SI are compared with the identifier (CAS-ID) and version (CAS-Ver) transmitted by DCM. Therefore, malfunction of the CAS program P due to falsification of the identifier (CAS-ID) and version (CAS-Ver) is prevented.
Therefore, the program activation unit 333 receives the identifier (CAS-ID) and version (CAS-Ver) input from the DCM decoding unit 3135 and the identifier (CAS-ID) and version (CAS-Ver) input from the activation program determination unit. ), The program activation unit 333 generates a CAS decoding result signal (CAS program decoding error) indicating that decoding of the CAS program has failed, and checks the generated CAS decoding result signal for update information. You may output to the part 336.

In addition, the program activation unit 333 calculates the hash value of the read CAS program P using a hash function common to the hash function used in the DCM generation unit 115 of the transmission device 11. The program activation unit 333 determines whether or not the calculated hash function and the hash value (CAS-H) of the CAS program P input from the DCM decryption unit 3135 match. If it is determined that they do not match, the program activation unit 333 does not activate the CAS program P. This prevents the activation of an unauthorized CAS program P that has been tampered with.
Therefore, when the program activation unit 333 determines that the hash value (CAS-H) of the CAS program P input from the DCM decoding unit 3135 does not match the calculated hash value, the program activation unit 333 determines that the CAS program P A CAS decoding result signal indicating that the decoding of the error has failed may be generated, and the generated CAS decoding result signal (CAS program decoding error) may be output to the update information confirmation unit 336.

The notification information analysis unit 334 analyzes the notification information SDTT input from the separation unit 312 and identifies information related to reception of the CAS program P. The notification information analysis unit 334 specifies the identifier (CAS-ID) of the CAS program P to be distributed from the table identification extension (table_id_ext) of the notification information SDTT. The notification information analysis unit 334 specifies the version to be updated from the target version (target_version) of the notification information SDTT. The notification information analysis unit 334 identifies the version (CAS-Ver) to be distributed from the new version (new_version) of the notification information SDTT.
When the identified identifier (CAS-ID) and the update target version are stored in the storage unit 341 and the distribution target version (CAS-Ver) is not stored, the notification information analysis unit 334 determines the CAS of the distribution target version. It is determined that the program P is received. If it is determined to be received, the distribution time of the CAS program P is specified from the start time (start_time) of the notification information SDTT and the distribution duration (duration), and the notification information SDTT is output to the program acquisition unit 335 at the specified distribution time. To do. The specified distribution time is a time zone that starts at the start time (start_time) and ends at the time when the distribution continuation time (duration) has elapsed from the start time (start_time). When the identified identifier (CAS-ID) and the update target version are not stored in the storage unit 341 or the distribution target version (CAS-Ver) is stored, the notification information analysis unit 334 determines the distribution target version. It is determined that no CAS program P is received.

The program acquisition unit 335 receives the notification information SDTT from the notification information analysis unit 334. The program acquisition unit 335 downloads the CAS program P via either the broadcast transmission path 12 or the communication transmission path 22 based on the value set in the download priority (download_priority) included in the download content descriptor of the notification information SDTT. Judge whether to do. For example, when the value set for download priority (download_priority) is 0x01 or 0x02, the notification information analysis unit 334 determines to download the CAS program P via the broadcast transmission path 12.
Even when download priority (download_priority) is not set in the download content descriptor, the notification information analysis unit 334 determines to download the CAS program P via the broadcast transmission path 12. The program acquisition unit 335 generates a reception instruction signal instructing reception of the version (CAS-Ver) CAS program P specified by the notification information SDTT, and outputs the generated reception instruction signal to the distribution data decoding unit 3136.

On the other hand, when update information instructing download via communication is input from the update information confirmation unit 336 to the program acquisition unit 335, it is determined that the CAS program is to be downloaded via the communication transmission path 22. In the update information, the identifier (CAS-ID) and version (CAS-Ver) of the CAS program P to be distributed are specified.
The program acquisition unit 335 specifies the address and port number of the server device 21 specified by the network download content descriptor of the notification information SDTT. The program acquisition unit 335 generates a distribution request signal instructing a request for distribution data related to the CAS program identified by the identifier (CAS-ID) and version (CAS-Ver) specified by the update information. The program acquisition unit 335 transmits the generated distribution request signal to the server device 21 via the communication unit 321 using the protocol specified by the network download content descriptor.

Note that the program acquisition unit 335 may determine that the download is to be performed via the communication transmission path 22 based on a value set for download priority (download_priority) included in the download content descriptor of the notification information SDTT. In that case, the program acquisition unit 335 instructs the identifier (CAS-ID) and version (CAS-Ver) specified from the notification information SDTT in the distribution request signal.
As a response, the program acquisition unit 335 receives distribution data from the server device 21 and outputs the received distribution data to the distribution data separation unit 3137. As a result, the CAS program P decrypted from the requested distribution data is stored in the storage unit 341.

  When the decryption of the data received from the transmission device 11 fails, the update information confirmation unit 336 uses the CAS program identified by the decryption identifier (CAS-ID) among the versions stored in the storage unit 341. Read the latest version (CAS-Ver). When data decoding fails, for example, (1) when decoding of the CAS program fails, (2) when decoding program data fails, (3) when the audio amplitude level is abnormal, 4) The video signal level may be abnormal. (1) is detected when a CAS decryption result signal is input from the signature verification unit 3138b or the program activation unit 333. (2) is detected when a program decoding result signal is input from the program data decoding unit 3133. (3) is detected when a sound level abnormality signal is input from the sound level detection unit 315. (4) is detected when a video level abnormality signal is input from the video level detection unit 318.

  The update information confirmation unit 336 generates a version inquiry signal for inquiring a version newer than the read version (CAS-Ver), identified by the identifier (CAS-ID). The update information confirmation unit 336 transmits the generated version inquiry signal to the server device 21 whose address is specified by the program acquisition unit 335 via the communication unit 321 using the protocol specified by the notification information SDTT received in the past. To do. This is because at that point in time, reception of data by broadcasting has failed, so that notification information cannot be received at that point, or even if it can be received, it cannot be trusted. The update information confirmation unit 336 receives a version response signal from the server device 21 via the communication unit 321 as a response to the version inquiry signal. When there is a version newer than the extracted version among the versions indicated by the received version response signal, the update information confirmation unit 336 determines that the latest CAS program is in the server device 21. In this case, the update information confirmation unit 336 generates update information indicating the CAS program P identified by the latest version (CAS-Ver) among the versions indicated by the identifier (CAS-ID) and the version response signal related to decoding. . The update information confirmation unit 336 outputs the generated update information to the program acquisition unit 335.

  On the other hand, when there is no version newer than the extracted version among the versions indicated by the received version response signal, it is determined that the server apparatus 21 does not have the latest version of the CAS program. The update information confirmation unit 336 generates a failure cause signal indicating any one of (1) to (4) as the cause of the decoding failure, and outputs the generated failure cause signal to the message output unit 337.

  The message output unit 337 reads a message corresponding to the failure cause signal input from the update information confirmation unit 336 from the storage unit 341. For example, when the failure cause signal indicates (1) the decoding failure of the CAS program, the message output unit 337 reads the message of the decoding error of the CAS program stored in advance. When the failure cause signal indicates (2) failure of decoding the program data, the message output unit 337 reads a message of audio / video decoding error stored in advance. If the failure cause signal is (3) an audio amplitude level abnormality or (4) an image signal level abnormality, the message output unit 337 reads a warning message stored in advance from the storage unit 341. The message output unit 337 outputs the read message to the display unit 319. The display unit 319 displays a message input from the message output unit.

(Receiver operation)
Next, the operation of the receiving device 31 according to this embodiment will be described.
FIG. 14 is a flowchart showing the operation of the receiving device 31 according to this embodiment.
(Step S101) The decryption unit 313 decrypts the encrypted distribution data obtained by encrypting the CAS program P from the individual information (DMM) and the common information (DCM) received from the transmission device 11 according to the schedule specified by the notification information SDTT. To do. Thereafter, the process proceeds to step S102.
(Step S102) The decoding unit 313 determines whether or not the decoding process of the CAS program has failed (decoding process error). When it determines with having failed (step S102 YES), it progresses to step S103. If it is determined that the process has succeeded (NO in step S102), the process proceeds to step S107.

(Step S103) The update information confirmation unit 336 confirms the update information of the CAS program in the server device 21. Specifically, the update information confirmation unit 336 inquires whether a CAS program of a newer version than the CAS program stored in the storage unit 341 can be distributed by transmitting a version inquiry signal to the server device 21. Thereafter, the process proceeds to step S104.
(Step S104) The update information confirmation unit 336 determines whether or not the server device 21 has the latest version of the CAS program. Specifically, the update information confirmation unit 336 determines whether there is a version of the CAS program that is newer than the CAS program stored in the storage unit 341 among the versions indicated by the version response signal received from the server device 21. If it is determined that there is (YES in step S104), the process proceeds to step S105. If it is determined that there is not (NO in step S104), the process proceeds to step S106.

(Step S105) The program acquisition unit 335 updates the CAS program via the network. Here, the program acquisition unit 335 transmits a distribution request signal related to the latest version of the CAS program included in the apparatus to the server apparatus 21 and receives distribution data obtained by encrypting the CAS program from the server apparatus 21. The program decryption unit 3138 decrypts the distribution data and reproduces the CAS program. The program activation unit 333 activates the reproduced CAS program. Then, it returns to step S101.
(Step S106) The message output unit 337 acquires a message indicating a decryption error of the CAS program, and causes the display unit 319 to display the acquired message. Then, the process shown in FIG. 14 is complete | finished.

(Step S107) The decoding unit 313 decodes the program data from the individual information (EMM) and the common information (ECM) received from the transmission apparatus 11 according to the schedule specified by the program arrangement information PSI / SI (audio / video decoding process) ). Thereafter, the process proceeds to step S108.
(Step S108) The decoding unit 313 determines whether or not the program data decoding process has failed (decoding process error). When it determines with having failed (step S109 YES), it progresses to step S109. If it is determined to be successful (NO in step S109), the process proceeds to step S113.

(Step S109) The update information confirmation unit 336 confirms the update information of the CAS program in the server device 21. Specifically, the update information confirmation unit 336 performs processing similar to the processing in step S103. Then, it progresses to step S110.
(Step S110) The update information confirmation unit 336 determines whether the server apparatus 21 has the latest version of the CAS program. Specifically, the update information confirmation unit 336 performs processing similar to the processing in step S104. If it is determined that there is (YES in step S110), the process proceeds to step S111. If it is determined that there is not (NO in step S110), the process proceeds to step S112.

(Step S111) The program acquisition unit 335 updates the CAS program via the network. Specifically, the program acquisition unit 335, the program decryption unit 3138, and the program activation unit 333 perform processing similar to the processing in step S105. Then, it returns to step S101.
(Step S112) The message output unit 337 acquires an audio / video decoding error message and causes the display unit 319 to display the acquired message. Then, the process shown in FIG. 14 is complete | finished.

(Step S113) The audio level detector 315 detects the amplitude level of audio data included in the decoded program data. The video level detection unit 318 detects the signal level of the video data included in the decoded program data. Thereafter, the process proceeds to step S114.
(Step S114) The sound level detection unit 315 determines whether or not the detected amplitude level is abnormal. The video level detection unit 318 determines whether or not the detected signal level is abnormal. If it is determined that either or both of the audio amplitude level and the video signal level are abnormal (YES in step S114), the process proceeds to step S115. When it is determined that both the audio amplitude level and the video signal level are normal (NO in step S114), the audio level detection unit 315 outputs audio data to the reproduction unit 316, and the video level detection unit 318. Outputs the video data to the display unit 319. Then, the process shown in FIG. 14 is complete | finished.

(Step S115) The update information confirmation unit 336 confirms the update information of the CAS program in the server device 21. Specifically, the update information confirmation unit 336 performs processing similar to the processing in step S103. Thereafter, the process proceeds to step S116.
(Step S116) The update information confirmation unit 336 determines whether or not the server device 21 has the latest version of the CAS program. Specifically, the update information confirmation unit 336 performs processing similar to the processing in step S104. If it is determined that there is (YES in step S116), the process proceeds to step S117. If it is determined that there is not (NO in step S116), the process proceeds to step S118.

(Step S117) The program acquisition unit 335 updates the CAS program via the network. Specifically, the program acquisition unit 335, the program decryption unit 3138, and the program activation unit 333 perform processing similar to the processing in step S105. Then, it returns to step S101.
(Step S118) The message output unit 337 acquires a warning message and causes the display unit 319 to display the acquired message. Then, the process shown in FIG. 14 is complete | finished.

  Note that the program acquisition unit 335 may display an execution confirmation screen on the display unit 319 before starting the process of updating the CAS program (for example, steps S105, S111, and S117). On the execution confirmation screen, a message prompting the user to confirm whether or not to update the CAS program, a confirmation button, and a rejection button are displayed. The version of the CAS program to be updated and the version of the updated CAS program may be further displayed on the execution confirmation screen. The program acquisition unit 335 executes processing for updating the CAS program when detecting the pressing of the confirmation button by the operation input. When the pressing of the reject button by the operation input is detected, the program acquisition unit 335 ends the process shown in FIG. 14 without executing the process of updating the CAS program. Therefore, the CAS program is updated after the user's intention is confirmed.

As described above, the reception device 31 according to the present embodiment executes the program activation unit 333 that activates the CAS program for decoding the received data, and the CAS program activated by the program activation unit 333. And a decoding unit 313 for decoding data. In addition, the receiving device 31 includes a program acquisition unit 335 that acquires a CAS program of a version different from the CAS program being executed when data decoding fails.
With this configuration, when the received data fails to be decrypted, a different version of the CAS program is used for decryption, thereby successfully decrypting the data encrypted by the method corresponding to that version of the CAS program. Therefore, the user can view the broadcast program more reliably.

In addition, the reception device 31 includes an update information confirmation unit 336 that confirms the presence or absence of a different version of the CAS program when data decoding fails. In addition, the reception device 31 includes a message output unit that outputs a message indicating failure of data decoding when the update information confirmation unit 336 determines that there is no different version of the CAS program.
With this configuration, when decryption of the received data fails, it is possible to confirm the presence or absence of a CAS program whose version is different from the activated CAS program. Therefore, it is possible to make the user know why the received data has failed to be decrypted. Therefore, it is possible to urge the user to take actions for avoiding decoding failure, for example, improvement of the reception environment, conclusion of a regular reception contract with the broadcaster, and the like.

In the receiving device 31, the data described above is a CAS program or program data for decoding program data.
With this configuration, when decryption of the received CAS program or broadcast program data fails, a different version of the CAS program is acquired, and the acquired CAS program is used to encrypt in a method corresponding to that version of the CAS program. Successful decoding of CAS program or program data. Therefore, the user can surely view the broadcast program.

In the receiving apparatus 31, when the amplitude level of the audio data or the signal level of the video data constituting the program data is in a predetermined range, the program acquisition unit 335 has a version of the limited reception program different from the limited reception program. To get.
With this configuration, when the amplitude level of the audio data of the received program data or the signal level of the video data is in a predetermined range, for example, an abnormal value range, the limited reception program of a version different from the activated CAS program is provided. To be acquired. The program data encrypted by a method corresponding to the version of the CAS program is successfully decrypted, and the audio data indicating the amplitude level that does not normally occur as the amplitude level of the audio data or the signal level of the video data, and the video data indicating the signal level Generation is avoided. Therefore, the user can view the broadcast program more reliably.

In addition, when the amplitude level of the audio data of the program data or the signal level of the video data is within a predetermined range, the receiving device 31 confirms update information for determining whether there is a version of the CAS program different from the activated CAS program. Part 336. In addition, the reception device 31 includes a message output unit 337 that outputs a warning message that warns of abnormality of program data when the update information confirmation unit 336 determines that there is no different version of the CAS program.
With this configuration, when the amplitude level of the audio data of the received program data or the signal level of the video data is within a predetermined range, for example, an abnormal value range, the amplitude level of the audio data of the received program data is given to the user. Alternatively, attention can be drawn to the signal level of the video data. Therefore, it is possible to prompt the user to take actions for avoiding abnormalities in the program data, for example, improvement of the reception environment, conclusion of a regular reception contract with the broadcaster, and the like.

It should be noted that the present invention is not limited to the above-described embodiments, and various modifications are possible within the scope indicated in the claims, and the technical configurations disclosed in different embodiments are appropriately combined. The obtained embodiment is also included in the technical scope of the present invention.
Each component of the present invention can be arbitrarily selected, and an invention having a selected configuration is also included in the present invention.

For example, the transmission device 11 and the server device 21 may be configured as a single transmission device.
In the receiving device 31, both or one of the reproduction unit 316 and the display unit 319 may be omitted. Also, any one of the set of the audio decoding unit 314 and the audio level detection unit 315 and the set of the video decoding unit 317 and the video level detection unit 318 may be omitted.
In the above-described embodiment, the case where the system defined by MPEG-2 Systems is used as an example of the transmission system for transmitting various types of data. However, other transmission systems such as MPEG-H are used. A media transport system based on MMT (MPEG Media Transport) may be used. In addition, a data format, an encryption method, and an encoding method related to transmission may be a format or a method defined by the transmission method.

  In addition, a part of the transmission device 11, the part of the server device 21, and the part of the reception device 31 in the above-described embodiment may be realized by a computer. In that case, the program for realizing the control function may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read by the computer system and executed. Here, the “computer system” is a computer system built in the recognition data transmission apparatus, and includes an OS and hardware such as peripheral devices. The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” is a medium that dynamically holds a program for a short time, such as a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line, In this case, a volatile memory inside a computer system that serves as a server or a client may be included that holds a program for a certain period of time. The program may be a program for realizing a part of the functions described above, and may be a program capable of realizing the functions described above in combination with a program already recorded in a computer system.

In addition, this invention can be implemented also in the following aspect.
(1) A program activation unit that activates a limited reception program for decoding received data, a data decoding unit that decodes the data by executing the conditional reception program activated by the program activation unit, and the data And a program acquisition unit that acquires a limited reception program of a version different from that of the limited reception program when the decryption fails.

(2) When the decryption of the data fails, an update information confirmation unit that confirms the presence / absence of the different version of the conditional access program, and the update information confirmation unit determines that there is no different version of the conditional reception program, The receiving apparatus according to (1), further comprising: an output unit that outputs error information indicating failure in decoding the data.

(3) The reception device according to (1) or (2), wherein the data is a limited reception program for decoding broadcast program data or broadcast program data.

(4) The receiving device according to (3), wherein when the signal value indicated by the broadcast program data is within a predetermined range, the program acquisition unit acquires a limited reception program of a version different from the limited reception program.

(5) When the signal value of the broadcast program data is within a predetermined range, an update information confirmation unit that confirms the presence or absence of a limited reception program of a version different from the limited reception program, and the update information confirmation unit is the different version (4) A receiving apparatus comprising: an output unit that outputs warning information that warns of abnormality of the broadcast program data when it is determined that there is no limited reception program.

(6) A broadcasting system including data and a transmission device that transmits a conditional reception program for decoding the data, a server device that stores the conditional reception program, and a reception device, wherein the reception device includes: A program activation unit that activates a limited reception program that decodes data received from the transmission device; a data decoding unit that decodes the data by executing the limited reception program activated by the program activation unit; and A broadcast system comprising: a program acquisition unit that acquires, from the server device, a limited reception program of a version different from the limited reception program when decoding fails.

(7) A receiving method in a receiving apparatus, wherein a program starting process for starting a conditional access program for decoding received data and executing the conditional access program started in the program starting process A receiving method comprising: a data decoding process for decoding; and a program acquisition process for acquiring a limited reception program of a version different from the limited reception program when decoding of the data fails.

(8) A program start procedure for starting a conditional access program for decoding received data in a computer of the reception device, and a data decoding for decoding the data by executing the conditional access program started in the program start procedure A program for executing a procedure, a program acquisition procedure for acquiring a limited reception program of a version different from the limited reception program when decoding of the data fails.

  DESCRIPTION OF SYMBOLS 11 ... Transmission apparatus, 110 ... Program data scramble part, 111 ... ECM production | generation part, 112 ... EMM production | generation part, 113 ... Delivery data production | generation part, 1131 ... Signature value calculating part, 1132 ... Dividing part, 1133 ... Encryption part, 1134 ... Section data generation unit, 114 ... Delivery data scrambler, 115 ... DCM generation unit, 116 ... DMM generation unit, 117 ... Notification information generation unit, 118 ... Start program designation unit, 119 ... Multiplexing unit, 120 ... Transmission unit, DESCRIPTION OF SYMBOLS 12 ... Broadcast transmission path, 13 ... Broadcast satellite, 21 ... Server apparatus, 210 ... Control part, 211 ... Delivery data acquisition part, 212 ... Version response part, 213 ... Delivery data delivery part, 214 ... Communication part, 215 ... Storage part , 22 ... communication transmission path, 31 ... receiving device, 311 ... tuner, 312 ... separation unit, 313 ... decoding unit, 3131 ... EMM recovery 3132 ... ECM decoding unit 3133 ... Program data decoding unit 3134 ... DMM decoding unit 3135 ... DCM decoding unit 3136 ... Distribution data decoding unit 3137 ... Distribution data separation unit 3138 ... Program decoding unit 3138a ... Encryption Decoding unit 3138b Signature verification unit 314 Audio decoding unit 315 Audio level detection unit 316 Playback unit 317 Video decoding unit 318 Video level detection unit 319 Display unit 321 Communication unit 331 ... Control unit, 332 ... Start program determination unit, 333 ... Program start unit, 334 ... Notification information analysis unit, 335 ... Program acquisition unit, 336 ... Update information confirmation unit, 337 ... Message output unit, 341 ... Storage unit

Claims (8)

A program launcher that launches a conditional access program for decrypting the received data;
A data decoding unit that decodes the data by executing a conditional access program started by the program starting unit;
A program acquisition unit that acquires a new version of the limited reception program from the activated limited reception program when decoding of the data fails;
A receiving device. An update information confirmation unit that confirms the presence or absence of the new version of the conditional access program when the data decryption fails;
The receiving apparatus according to claim 1, further comprising: an output unit that outputs error information indicating a failure in decoding the data when the update information confirmation unit determines that there is no new version of the limited reception program.   The receiving apparatus according to claim 1, wherein the data is a limited reception program for decoding broadcast program data or broadcast program data. The receiving device according to claim 3, wherein when the signal value indicated by the broadcast program data is within a predetermined range, the program acquisition unit acquires a limited reception program of a version different from the limited reception program. When the signal value of the broadcast program data is within a predetermined range, an update information confirmation unit that confirms the presence or absence of a limited reception program of a version newer than the limited reception program;
An output unit for outputting warning information for warning an abnormality of the broadcast program data when the update information confirmation unit determines that there is no new version of the conditional access program;
The receiving apparatus according to claim 4. A broadcasting system comprising: a transmission device that transmits data and a limited reception program for decoding the data; a server device that stores the limited reception program; and a reception device,
The receiving device is:
A program activation unit that activates a limited reception program for decoding data received from the transmission device;
A data decoding unit that decodes the data by executing a conditional access program started by the program starting unit;
A program acquisition unit that acquires a new version of the limited reception program from the activated limited reception program when decoding of the data fails;
A broadcasting system comprising: A receiving method in a receiving device,
A program start process for starting a conditional access program for decoding received data;
A data decoding process for decoding the data by executing a conditional access program started in the program starting process;
A program acquisition step of acquiring a new version of the limited reception program from the activated limited reception program when decoding of the data fails;
Receiving method. In the computer of the receiving device,
A program start procedure for starting a conditional access program for decrypting received data;
A data decoding procedure for decoding the data by executing the conditional access program started in the program starting procedure;
A program acquisition procedure for acquiring a new version of the limited reception program from the activated limited reception program when decoding of the data fails;
A program for running

Images