WO2006024234A1

WO2006024234A1 - Method ano apparatus for protecting broadband video and audio broadcast content

Info

Publication number: WO2006024234A1
Application number: PCT/CN2005/001379
Authority: WO
Inventors: Jun Li
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2004-09-01
Filing date: 2005-09-01
Publication date: 2006-03-09
Also published as: CN1744707A; CN100356789C

Abstract

A method and apparatus for protecting broadband video and audio broadcast content to solve the problem of lower security of the broadband video and audio broadcast content existing in. the prior art. In this method, at the sending side it extracts the content of the the portion at the start of the payload from the IP message and calculates the information of the position scrambled and the index information; it obtains key from home using the index information, and make a process using the key and the information of the position scrambled to scramble the content of the specified clip which does not include the said content at the start in the IP message ;at the receiving side, it extracts the content of the the portion at the start of the payload from the IP message unscrambled and calculates the information of the position scrambled and the index information using the algorithm as scrambling; it obtains key from home at the receiving side using the index information, and make a process using the key and the information of the position scrambled to descramble the clips scrambled of the IP message .

Description

Method and device for protecting broadband video and audio broadcast content

Technical field

The present invention relates to broadband video and audio technologies in telecommunication networks, and more particularly to a method and apparatus for protecting broadband video and audio broadcast content. Background of the invention

In a cable television network, the video and audio streams are encrypted or scrambled before being broadcast to the network, and then the video and audio streams are transmitted to the user over the network, and the user terminal obtains the key from the network and completes the decryption or descrambling of the video and audio streams. In this method, the key is broadcast to all user terminals. In order to ensure that the key is not easily cracked, complex key management and encryption algorithms are required, and the key needs to be updated frequently in real time. Therefore, this method has the following disadvantages:

(1) The key must be transmitted online and easily cracked.

(2) The key needs to be updated frequently, which takes up a lot of network bandwidth.

(3) The encryption and decryption and key management algorithms are complex and costly.

(4) The encryption or scrambling algorithm is related to a specific video and audio coding format, and the adaptability is poor.

(5) Once the encryption and decryption algorithm is broken, there is no effective solution.

At present, the broadband access technology represented by Digital Subscriber Loop (DSL) can not only provide data services such as Internet access, but also provide video and audio services including broadband TV services, audio broadcasting services, and on-demand services. The video and audio services are usually based on a set-top box or a computer. After the set-top box or computer accesses the network, the video and audio content from the video/audio broadcast source or the video-on-demand server can be obtained through the network; usually, the on-demand service is carried by the unicast stream, the television class and The audio broadcast service is carried by the multicast stream, and its network model is shown in Figure 1.

One of the key points in the development of TV services and audio broadcasting services on broadband networks is to ensure content security. One of the meanings of so-called content security is to ensure that users cannot freely access channel content. An illegal digital copy is called an anti-digital copy. At present, there is no anti-digital copying measure for video and audio broadcast content on the broadband network, and the user can copy the content of any channel, so the security is poor. Summary of the invention

The present invention provides a method and apparatus for protecting broadband video and audio broadcast content to solve the problem of poor security of broadband video and audio broadcast content in the prior art.

In order to solve the above problems, the present invention provides the following technical solutions:

A method for protecting broadband audio and video broadcast content, the video and audio broadcast content being generated by a video audio broadcast source, and transmitted to a user terminal through a broadband network and a broadband access device in an IP message format, the method comprising the following steps:

A. On the transmitting side, extract the content of the beginning part of the payload from the IP packet, and calculate the scrambled location information and the index information by using the content of the beginning part of the payload;

B. Obtain a key locally from the transmitting side according to the index information calculated in step A, and use the key and the scrambled location information calculated in step A to specify a segment of the IP packet that does not include the content of the beginning portion. Content is scrambled;

Transmitting the scrambled IP packet to the receiving side;

D. On the receiving side, extract the content of the beginning part of the payload from the scrambled IP packet, and calculate the scrambled location information and the index information by using the same algorithm as that during scrambling;

E. The key is obtained locally from the receiving side according to the index information calculated in step D, and the scrambling segment of the IP packet is descrambled by using the key and the scrambled location information calculated in step D.

The local key seed library is set on the sending side or the receiving side respectively, and the index information calculated in step A and step D is key seed index information, and the key seed is obtained from the key seed database by using the key seed index information. And generating a key based on the key seed; Alternatively, the local key pool is set on the sending side or the receiving side respectively, and the index information calculated in steps A and D is key index information, and the key is directly obtained from the key pool by using the key index information.

The content of the beginning portion refers to content that changes as the content of the IP message changes, and the length of the extracted content can be set. - Wide f video and audio broadcasting systems include:

An audio and video broadcast source (201) for generating video and audio broadcast content of each channel; a user terminal (205) for receiving video and audio broadcast content of one or more channels; a broadband network (203) for transmitting the video and audio a broadcast content output by the broadcast source; a broadband access device (204), multicasting broadcast content of each channel transmitted by the broadband network to the user terminal;

It is also characterized by:

a scrambler (202), receiving video and audio broadcast content output by the video and audio broadcast source, and performing scrambling and transmitting to the broadband network (203);

The user terminal (205) descrambles the scrambled video and audio broadcast content.

The scrambler (202) includes:

The message receiving unit (301) is configured to: after receiving the IP packet, extract the content of the beginning part of the IP packet payload and the payload scrambling segment, and send the content of the payload start part and the IP packet to the packet. Text processing unit (302);

The message processing unit (302) is configured to calculate the scrambled location information and the index information by using the content of the payload start portion, obtain the key by using the index information, and use the key and the scrambled location information to perform the IP packet. The scrambling process is performed, and the scrambled IP packet is sent to the message sending unit (303);

The message sending unit (303) is configured to send the scrambled IP packet to the broadband access device through the broadband network. The processing unit (302) includes:

a key seed library (401) for storing a key seed for generating a key;

After receiving the content of the payload start portion of the IP packet from the packet receiving unit (301), the key seed index generating module (402) uses the key seed index generation algorithm to generate a key by using the content of the payload start portion. a seed index, and sending the key seed index to the key generation module (403);

a key generation module (403), obtaining a key seed from the key seed pool (401) according to the index, and generating a key by using a key generation algorithm;

The scramble location generating module (404), after receiving the content of the payload start portion of the IP packet from the packet receiving unit (301), adopts a scrambling location generation algorithm and utilizes the payload start portion of the IP packet The content of the generated message scrambles the location information;

The scrambling module (405), after receiving the scrambled location information and the key, scrambles the IP packet from the message receiving unit (301) by using a scrambling algorithm according to the key and the scrambled location information. And sending the scrambled IP packet to the message sending unit (303);

The user terminal further includes:

a key seed library (601) for storing a key seed for generating a key;

The key seed index generating module (602) is configured to extract the content of the beginning part of the message payload from the received IP packet and generate a key seed index, and send the index to the key generation module (603);

The key generation module (603) obtains a key seed from the key seed library (601) according to the index and generates a key;

The scrambling location generating module (604) is configured to extract the content of the payload starting portion from the IP packet, and generate scrambling location information by using the content of the payload starting portion;

The descrambling module (605) performs descrambling processing on the scrambling segment in the IP packet by using the generated key and the start and end location information of the scrambling segment. The message processing unit (302) includes:

a keystore (501) for storing a key;

The key index generation module (502), after receiving the content of the payload start portion of the IP packet from the message receiving unit (301), generates a key index using the content of the payload start portion, and utilizes the secret The key index obtains a key from the keystore;

The scramble location generating module (503) is configured to generate scrambled location information by using the content of the payload start portion after receiving the content of the payload start portion of the IP packet from the packet receiving unit (301);

The scrambling module (504) performs scrambling on the IP packet from the packet receiving unit (301) by using the obtained key and the scrambled location information, and sends the scrambled IP packet to the packet. Sending unit (303);

The user terminal further includes:

a keystore (701) for storing a key;

The key index generating module (702) is configured to extract a content of a start portion of the message payload from the received IP packet to generate a key index, and obtain a key from the key pool by using the key index. ;

The scrambling location generating module (703) is configured to extract, from the received IP packet, the content of the beginning part of the message payload and generate start and end location information of the message scrambling segment;

The descrambling module (704) performs descrambling processing on the scrambled segment of the message by using the captured key and the scrambled location information.

A scrambler includes:

The message receiving unit (301) is configured to: after receiving the IP packet, extract the content of the beginning part of the IP packet payload and the payload scrambling segment, and send the content of the payload start part and the IP packet to the packet. Processing unit (302);

a message processing unit (302), configured to calculate a scrambled bit by using content of a payload start portion The information and the index information are used to obtain a key, and the IP packet is scrambled by using the key and the scrambled location information, and the scrambled IP packet is sent to the packet sending unit ( 303);

The message sending unit (303) is configured to send the scrambled IP packet to the broadband network. The message processing unit (302) includes:

a key seed library (401) for storing a key seed for generating a key;

The key seed index generating module (402) generates a secret by using a key seed index generation algorithm after receiving the content of the payload start portion of the IP packet from the message receiving unit (301). Key seed index, and send the key seed index to the key generation module (403);

The key generation module (403) obtains a key seed from the key seed pool (401) according to the index, and generates a key by using a key generation algorithm;

The scrambling module (405), after receiving the scrambled location information and the key, performs scrambling on the IP packet from the packet receiving unit (301) by using a scrambling algorithm according to the key and the scrambled location information. The scrambled IP packet is sent to the message sending unit (303).

The message processing unit (302) includes:

The key seed index generating module (602) is configured to extract the content of the beginning part of the message payload from the received TP message and generate a key seed index, and send the index to the key generation module (603) ;

a scrambling location generating module (604), configured to extract a payload starting part from the IP packet And generating the scrambled location information by using the content of the beginning portion of the payload;

The descrambling module (605) performs descrambling processing on the IP packet by using the generated key and the scrambled location information.

A user terminal further includes:

a key seed library (601) for storing a key seed for generating a key;

a key seed index generating module (602), configured to extract a content of a payload start part from the received IP packet and generate a key seed index;

The key generation module (603) obtains a key seed from the key seed library according to the index and generates a key;

a scrambling location generating module (604), configured to: extract content of the payload starting part extracted from the received IP packet and generate message scrambling location information;

A user terminal further includes:

The key index generating module (702) is configured to extract a content of a start portion of the message payload from the received IP packet to generate a key index, and obtain a key from the keystore by using the key index. .

The scrambling location generating module (703) is configured to extract the content of the beginning part of the message payload from the received IP packet and generate message scrambling location information.

The descrambling module (704) performs descrambling processing on the scrambled segment of the message by using the acquired key and the scrambled location information.

The invention utilizes digital scrambling technology, and the video and audio streams are transmitted in a scrambled manner to ensure that only legitimate terminals can decode and view, and the user cannot directly obtain digital copies of the video and audio streams for viewing by other general terminals. By using this digital scrambling technology, the key can be avoided on the network, the risk of the key being cracked, and the additional network bandwidth usage can be reduced. Algorithm and specific The video frequency coding technology has nothing to do, and directly scrambles the payload of the IP packet, which can be applied to different video and audio coding technologies; does not require complicated key management technology and encryption algorithm, and does not increase the difficulty and cost of the implementation of the terminal set-top box, Reduce the cost of the central office; In addition, if the scrambling algorithm is compromised, the central office and terminal algorithm/key can be remediated in a timely manner through the network. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic diagram of networking of a broadband video and audio application in the prior art;

2 is a schematic diagram of networking for implementing content protection of broadband video and audio broadcasting according to the present invention; FIG. 3 is a schematic structural diagram of a specific embodiment of a scrambler according to the present invention;

4 is a schematic structural diagram of a specific embodiment of a packet processing unit in a scrambler; FIG. 5 is a schematic structural diagram of a second embodiment of a packet processing unit in a scrambler; FIG. 6 is a schematic diagram of a descrambling portion of a user terminal. A schematic structural view of a specific embodiment;

7 is a schematic structural diagram of a second embodiment of a descrambling portion of a user terminal;

FIG. 8 is a schematic flow chart of performing scrambling and descrambling according to the present invention. Mode for carrying out the invention

Referring to FIG. 2, the system of the present invention includes: an audio and video broadcast source 201, a scrambler 202, a broadband network 203, a broadband access device 204, and a user terminal 205. The video and audio broadcast source 201 is configured to generate video and audio broadcast content of each channel, and package the generated video and audio broadcast content into an IP packet for output to the scrambler 202. The scrambler 202 is configured to receive the video. The audio broadcast source 201 outputs an IP packet containing the audio and video broadcast content, and the IP packet is scrambled and transmitted to the broadband network 203; the broadband network 203 transmits the broadcast content output by the video and audio broadcast source; The broadband access device 204 multicasts broadcast content of each channel transmitted by the broadband network 203 to the user terminal; the user terminal 205 is configured to receive video and audio broadcast content of one or more channels, and scramble the content The IP packet is descrambled. User terminal The 205 can be a computer or a set top box.

It should be noted that the core idea of digital scrambling in the present invention is:

(1) Only the payload of the IP packet is scrambled, and the scrambling technique is independent of the specific payload content.

(2) The beginning of the payload of the IP packet may be used to convey certain protocol information, without adding the scrambling side and descrambling side settings.

(3) The same scrambling location generation algorithm, key seed index generation algorithm, key generation algorithm and descrambling algorithm need to be set on the scrambler and the user terminal, and the scrambler and the user terminal respectively save the same Key seed or keystore.

The scrambling segment that scrambles the IP packet mentioned below is a portion of the payload other than the payload start portion, or a portion or portions of the payload other than the payload start portion.

Referring to FIG. 3, the scrambler 202 includes a message receiving unit 301, a message processing unit 302, and a message transmitting unit 303. After receiving the IP packet, the message receiving unit 301 extracts the content of the payload start portion of the IP packet, and sends the content of the payload start portion and the IP to the packet processing unit 302.

The message processing unit 302 calculates the scrambled location information and the index information by using the content of the payload start portion, obtains the key from the local key pool by using the index information, and uses the key and the scrambled location information to the IP packet. The scrambling process is performed, and the scrambled IP packet is sent to the message sending unit 303.

The message sending unit 303 transmits the scrambled IP packet to the broadband access device 304 through the broadband network 203.

As shown in FIG. 4, the message processing unit 302 may include: a key seed library 40], a key seed index generating module 402, a key generating module 403, a scrambling location generating module 404, and a scrambling module 405. The key seed library 401 is configured to save a key seed for generating a key.

The key seed index generating module 402 is configured to generate a key seed by using a key seed index generation algorithm by using the content of the payload start part after receiving the content of the payload start part of the IP packet from the message receiving unit 301. Indexing, and sending the key seed index to the key generation module 403. The algorithm can use a proprietary algorithm, such as the Haval+MD5 combination algorithm.

The key generation module 403. acquires a key seed from the key seed pool 401 according to the index, and generates a key by using a key generation algorithm. The algorithm can use a proprietary algorithm, such as the Haval+MD5 combination algorithm.

The scramble location generating module 404, after receiving the content of the payload start portion of the IP packet from the packet receiving unit 301, uses the scramble location generation algorithm and generates a report by using the content of the payload start portion of the IP packet. The text scrambles the location information, that is, the start and end location information of the scrambling segment. The algorithm can use a proprietary algorithm, such as XOR, HASH and other algorithms combined algorithm.

The scrambling module 405 receives the IP packet from the message processing unit 301, the scrambled location information from the scrambled location generating module 404, and the key from the key generation module 403, according to the key and scrambling The location information is scrambled by the scrambling algorithm to the IP packet from the packet receiving unit 301, and the scrambled TP packet is sent to the packet sending unit 303. The scrambling algorithm can use algorithms such as DES, 3DES or AES.

Referring to FIG. 5, the message processing unit 302 may further include: a keystore 501, a key index generation module 502, a scramble location generation module 503, and a scrambling module 504.

Key store 501, used to save the key.

The key index generating module 502, after receiving the content of the payload start portion of the IP packet from the message receiving unit 301, generates a key index by using the content of the payload start portion, and uses the key index to extract from the The keystore obtains the key.

The scramble location generating module 503 is configured to generate a scrambled location by using the content of the payload start portion after receiving the content of the payload start portion of the IP packet from the packet receiving unit 301. Information, that is, the start and end position information of the scrambled segment.

The scrambling module 504 performs scrambling on the payload scrambling segment of the IP packet from the packet receiving unit 301 by using the extracted key and the start and end position information of the scrambling segment, and scrambles the scrambled segment. The IP packet is sent to the message sending unit 303.

The difference between the packet processing unit shown in FIG. 4 and FIG. 5 is that the manner of acquiring the key is different. The message processing unit shown in Fig. 4 uses the index information to first obtain the key seed from the library, and then generates the key, and Fig. 5 uses the index information to directly obtain the key from the library.

6 and 7 are structural diagrams of two specific embodiments of the descrambling portion of the user terminal, respectively. The present invention is to add an interference handling function on the basis of an existing user terminal that does not support descrambling, and since the user terminal itself already includes a message receiving and video decoding subsystem, the solution in the user terminal in the present invention The scrambler obtains ciphertext message information from the packet receiving subsystem of the user terminal for analysis, and performs descrambling processing on the ciphertext message according to the analysis result, and delivers the processed plaintext message to the video decoding of the user terminal. Subsystem processing.

Referring to FIG. 6, the structure corresponds to the structure of the message processing unit shown in FIG. 4. In addition to the basic structure in the prior art, the user terminal further includes:

The key seed store 601, which is the same as the key seed store in the scrambler shown in Fig. 4, is used to store the key seed for generating the key.

The key seed index generating module 602 is configured to extract content of the beginning portion of the message payload from the received IP packet, and generate a key seed by using the same algorithm as in the key seed index 402 shown in FIG. The index is sent to the key generation module 603.

The key generation module 603 extracts a key seed from the key seed library 601 according to the index and generates a key. The scrambling location generating module 604 is configured to extract the content of the payload start portion from the IP packet, and generate the message scrambling location information, that is, the start and end location information of the scrambling segment, by using the content of the payload start portion.

a descrambling module 605, using the generated key and the scrambled location information, that is, scrambling on The start and end position information is used to descramble the received IP packet.

Referring to FIG. 7, the structure corresponds to the scrambling structure shown in FIG. 5. In addition to the basic structure in the prior art, the user terminal includes:

The keystore 701, which is the same as the keystore in the scrambler shown in Fig. 5, is used to hold the key. The key index generating module 702 is configured to extract the content of the beginning part of the message payload from the received IP packet to generate a key index, and obtain the key from the key pool by using the key index.

The scrambling location generating module 703 is configured to extract the content of the beginning part of the message payload from the received IP packet and generate scrambling location information, that is, start and end location information of the scrambling segment.

The descrambling module 704 performs descrambling processing on the scrambled segment of the message by using the acquired key and the scrambling segment location information.

Referring to FIG. 8, the same key seed library is saved by the scrambler and the user terminal as an example. The specific processing procedure of adding 4 is as follows:

(1) On the transmitting side, the scrambler extracts some content of the content of the beginning portion of the IP packet payload by the scramble location generation algorithm and the key seed index generation algorithm. These are content that changes as the content of the package changes, rather than fixed content.

(2) The corresponding scrambling location information is calculated by the scrambling location generation algorithm, that is, the start and end positions of the message scrambling segment, and the key seed index is generated by the key seed index generation algorithm.

(3) The scrambler queries the corresponding key seed from the local key seed repository according to the key seed index.

(4) The scrambler calculates the key by the key generation algorithm according to the key seed.

(5) The scrambler performs a scrambling process on the specified segment of the IP packet according to the generated key and the scrambled location information by using a predetermined scrambling algorithm.

The specific processing of descrambling is as follows: (1) On the receiving side, after receiving the scrambled message, the user terminal extracts some content of the beginning part of the IP packet payload by using the same scrambling location generation algorithm and key seed index generation algorithm as the scrambler. These are the same as those in the scrambling step (1).

(3) The user terminal finds a corresponding key seed in the local key seed library according to the key seed index.

(4) The user terminal calculates the key by the key generation algorithm according to the key seed.

(5) The user terminal descrambles the designated scrambling segment according to the key and the scrambled location information by using a predetermined descrambling algorithm.

If the scrambler and the user terminal both store the key pool of the phase, the key index generation algorithm is used instead of the key index seed generation algorithm to generate the key index, and then the key index is directly used to obtain the key from the key pool. The disturbance or descrambling process is the same as above.

The above digital scrambling technology has the following characteristics:

(1) scrambling the IP message payload, which has nothing to do with the specific video and audio coding technology;

(2) does not occupy any additional bandwidth;

(3) Multi-layer encryption, multiple encryption algorithms;

(4) Dynamic scrambling according to the content of the package, dynamic exchange of scrambling information;

(5) The key is not delivered on the network;

(6) The scrambler and the terminal achieve low technical difficulty and low cost;

(7) High security, the user needs to obtain the following information to solve the algorithm: plus descrambling algorithm, scrambling location generation algorithm, key seed index generation algorithm, all key seed in key seed library, key generation Algorithm

(8) The algorithm and key seed can be implemented by upgrading the terminal software online.

.CT00/S00ZN3/X3d Li 90OZ OAV

Claims

Claim

A method for protecting broadband audio and video broadcast content, wherein the video and audio broadcast content is generated by an audio and video broadcast source, and is transmitted to a user terminal through a broadband network and a broadband access device in an IP message format, wherein the method is characterized in that the method Including the following steps:

C. The scrambled IP packet is transmitted to the receiving side;

2. The method according to claim 1, wherein the local key seed library is set on the transmitting side or the receiving side, and the index information calculated in step A and step D is key seed index information, and the The key seed index information obtains a key seed from the key seed library, and generates a key according to the key seed;

Alternatively, the local key pool is set on the sending side or the receiving side respectively, and the index information calculated in steps A and D is key index information, and the key is directly obtained from the key pool by using the key index information.

3. The method according to claim 1 or 2, wherein the content of the start portion refers to content that changes according to the content of the IP message, and the length of the extracted content can be set.

4. A broadband video and audio broadcasting system, comprising:

It is also characterized by:

5. The system of claim 4, wherein the scrambler (202) comprises:

The message receiving unit (301) is configured to: after receiving the IP packet, extract the content of the beginning part of the IP packet payload and the payload scrambling segment, and send the content of the payload start part and the TP packet to the packet艮文processing unit (302);

The message sending unit (303) is configured to send the scrambled IP packet to the broadband access device through the broadband network.

The system of claim 5, wherein the message processing unit (302) comprises:

a key seed library (401) for storing a key seed for generating a key;

The key seed index generating module (402) receives the received message from the message receiving unit (301) After the content of the payload start portion of the IP packet, the key seed index is generated by using the key seed index generation algorithm by using the content of the payload start portion, and the key seed is sent to the key generation module (403). );

The scrambling module (405), after receiving the scrambled location information and the key, performs scrambling on the IP packet from the packet receiving unit (301) by using a scrambling algorithm according to the key and the scrambled location information. And sending the scrambled IP packet to the packet sending unit (303);

The user terminal further includes:

a key seed library (601) for storing a key seed for generating a key;

The descrambling module (605) performs descrambling processing on the scrambling segment in the IP packet by using the generated key and the start and end location information of the scrambling segment.

The system of claim 5, wherein the message processing unit (302) comprises:

a keystore (501) for storing a key; The key index generation module (502), after receiving the content of the payload start portion of the IP packet from the message receiving unit (301), generates a key index using the content of the payload start portion, and utilizes the secret The key index obtains a key from the keystore;

a scrambling location generating module (503), configured to generate scrambled location information by using content of a payload start portion after receiving content of a payload start portion of an IP packet from the message receiving unit (301);

The user terminal further includes:

a keystore (701) for storing a key;

The key index generating module (702) is configured to extract a content of a start portion of the message payload from the received IP packet to generate a key index, and use the key index to extract a secret from the key pool. Key

8. A scrambler, comprising:

The message receiving unit (30) is configured to: after receiving the IP packet, extract the content of the beginning part of the IP packet payload and the payload scrambling segment, and send the content of the payload start part and the IP packet to the packet. Text processing unit (302);

The message processing unit (302) is configured to calculate the scrambled location information and the index information by using the content of the payload start portion, obtain the key by using the index information, and use the key and the scrambled location information to use the IP packet Perform scrambling processing, and send the scrambled IP packet to the packet. Delivery unit (303);

The message sending unit (303) is configured to send the scrambled IP packet to the broadband network.

The scrambler according to claim 8, wherein the message processing unit (302) comprises:

a key seed library (401) for storing a key seed for generating a key;

After receiving the scrambled location information and the key, the scrambling module (405) performs a scrambling process on the IP packet from the packet receiving unit (301) according to the key and the scrambled location information, The scrambled IP packet is sent to the message sending unit (303).

10. The scrambler of claim 8, wherein the message processing unit (302) comprises:

11. A user terminal, characterized by further comprising:

a key seed library (601) for storing a key seed for generating a key;

a key seed index generating module (602), configured to: extract content of a payload start part extracted from the received IP packet, and generate a key seed index;

12. A user terminal, characterized by further comprising: