Method for Processing a Digital Signal in a So-Called Secure Communication System and Use of This Method for Access Control and/or Binary Signature

The present invention relates to a method of processing a digital signal of dimension k such that the digital signal at output cannot be deduced from the digital signal at input.

This type of method is particularly useful in so-called secure communication systems. These systems are in general conditional-access systems requiring the use of a control word or a signature. The systems employing this type of secure communications are very numerous. In particular may be cited subscription television systems, banking type systems making it possible to handle standing orders or any other systems of the same type giving rise to exchanges of confidential information.

In conditional-access systems, such as those implemented in subscription television systems, use is generally made of a digital signal of n bits forming a control word making it possible, in particular, to control the scrambling and unscrambling of the information transmitted. This control word must be frequently changed and is, in general, transferred from a sending station to the receiving system or terminal.

This control word must be accessible only to the authorized person. Therefore, this control word is enciphered during transmission to the receiver which is a secure system such as a smart card. This receiver may perhaps be paired with a non-secure unscrambling system and it then provides the latter with the control word after decipherment. In order to carry out this type of transaction, a secret key cryptographic system is used in which the sender and the receiver share a common digital signal termed the common secret key. Therefore, the sender enciphers the control word and the receiver deciphers it by a symmetrical operation.

In order to carry out this type of operation, various methods of processing are known by those skilled in the art. Thus, the DES, standing for "Data Encryption Standard", system may in particular be mentioned.

This process has the drawback that it is necessary to use a reversible function in order to encipher and then decipher the message. However, certain problems do not require the use of a fixed and significant digital signal which would be enciphered and deciphered; it is often sufficient for the forwarder and the recipient to be able to share a confidential random digital signal. It is then sufficient to use a one-way function, that is to say a function which does not allow an image of the digital signal to be found if the said function is not known perfectly. In particular, a key-based hash function may be used, the principle of operation being known but not exploitable without a valid key.

Thus, as represented in FIG. 1 which relates to the use of a one-way function, a random digital signal m termed the control word selector is drawn at random by the sender E including a random digital signal generation circuit referenced A. Its image under the one-way function f is then the confidential random digital signal shared by the sender E and the receiver R, henceforth termed the control word. The sender transmits the control word selector m to the receiver and both calculate its image under the one-way hash function f with the same key, thus obtaining the same control word m. The only constraint imposed in respect of confidentiality is that it must be impossible to calculate the control word m from the control word selector m without knowing a certain secret, the shared key, which is located in two secure domains: the sender and the receiver.

The state of the art is to use either cryptographically safe reversible functions, for example the DES, or to use cryptographically weak functions whose only defence is the computational complexity and the secrecy of the structure, which amounts to saying that the key is the function itself and what limits its use is its universality.

The purpose of the present invention is to propose a method for processing digital signals which in particular addresses this problem, in so far as the function is public and that only one key of limited size is kept secret. The compromising of a key does not endanger the systems which use the same scheme with a different key.

The purpose of the present invention is also to propose a method of processing which can be used in all digital signal transmission systems of secure type.

Consequently, the subject of the present invention is a method of processing a digital signal of dimension k in a so-called secure communication system, such that the digital signal (y) at output cannot be deduced from the digital signal (x) at input, consisting in despatching the digital signal (x) to a device effecting a one-way function, characterized in that the processing includes the following steps:

the digital signal (x, x1) at the input is dispatched to a circuit C (1, 2, 4) which gives as output a digital signal (x, x'1 ) of dimension n acceptable to the one-way function;

the signal (x', x'1) from the circuit C (1, 2, 4) is dispatched to the circuit (3, 5) effecting the one-way function giving as output the digital signal (y).

According to one embodiment, the one-way function is effected by multiplying the digital signal (x") by a matrix M of dimensions n.times.m whose coefficients a.sub.ij are chosen randomly once and for all. A function of this type is described for example in French Patent Application No. 92 15915 in the name of Jacques Stern.

Preferably, in order in particular to limit memory storage, the coefficients a.sub.ij of the matrix are generated by a pseudo-random function.

According to this embodiment, the scrambling circuit is chosen so as to exhibit good spreading qualities, that is to say a very weak modification of the signal at input causes a large difference in the signal at output. Preferably, the scrambling function is controlled by a secret key (S).

Similarly, the purpose of the formatting circuit is to transform the signal at input into a data item of dimension n bits and of weight approximately d, d being determined by the Gilbert-Warshamov bound: m=n.H.sub.2 (d/n) where H.sub.2 (x) is the entropy function

According to a preferential embodiment, m=n/2; the weight of the digital signal input to the one-way function must be approximately 0.11.times.n.

In the context of the present invention, the scrambling and formatting functions can be effected in accordance with one of the following three processes, namely:

either a scrambling circuit of known type and a formatting circuit whose input defines a permutation over a binary word of length n and weight d,

either a scrambling circuit of known type and a formatting circuit whose input defines in one way a linary word of length and of weight d,

or a single scrambling and permuting circuit whose input and secret key define a pseudo-random generator biased such that the output word of length n is of weight d or thereabouts with a very high probability.

The subject of the present invention is also the use of the method described above to generate a control word in access control systems and in particular in the case of a subscription television system in order to generate the control word or words by using the same one-way function at sender level and at receiver(s) level.

Other characteristics and advantages of the present invention will emerge on reading the detailed description of various embodiments, the description being given with reference to the appended drawings in which:

FIG. 1 already described represents diagrammatically the use of a one-way function when transmitting a digital signal between a sender and a receiver;

FIG. 2 is a diagram representing a device making it possible to obtain a digital signal at output which cannot be deduced from the digital signal at input;

FIG. 3 is a diagrammatic representation of another device making it possible to obtain a digital signal at output which cannot be deduced from the digital signal at input;

FIG. 4 is a diagrammatic representation of still another device making it possible to obtain a digital signal at output which cannot be deduced from the digital signal at input ;

FIG. 5 is a diagrammatic view of a device making it possible starting from a digital signal at input to obtain several digital signals at output which cannot be deduced from the digital input signal;

FIGS. 6 and 7 are diagrammatic representations using one of the devices described above to carry out cryptographic verification;

FIG. 8 is a diagram showing the use of the device of FIGS. 2, 3 and 4 to construct a random generator.

The method and the device according to the present invention are based on the problem of syndrome decoding (SD) described in French Patent Application No. 92 15915in the name of Jacques Stern which can be explained as follows: consider a binary matrix M and a binary vector y, it is required to find a binary vector x of relatively high or relatively low weight such that Mx=y. Weight is understood to mean the number of 1bits in the relevant vector. The problem posed above is in fact very difficult to solve by presently known computational means if the dimensions n.times.m of the matrix M and the Hamming weight of the vector x are chosen judiciously. It has been proven that with current computational means the problem is very difficult when the digital signal x at input has a low Hamming weight d. Generally, the parameters d, n, m giving the Hamming weight and the dimensions of the matrix M are chosen substantially below the Gilbert-Warshamov bound giving a theoretical limit value for the minimum weight d of a random code (n, m), namely:

where H.sub.2 (x) is the entropy function H.sub.2 (x)=-x.Log.sub.2 (x)-(1-x).

Represented diagrammatically in FIG. 2 is a device making it possible to implement a first method of processing a digital signal such that the digital signal at output cannot be deduced from the digital signal at input.

In this device, the digital signal at input (x) is dispatched to a scrambling circuit (1) of a type known to those skilled in the art. This digital signal is a signal consisting of binary words of dimension k. A digital signal (x') defining a permutation which is dispatched to a permuting circuit (2) is obtained at output.

This circuit has two inputs: one accepts the definition of the permutation, the other the binary word to which this permutation is applied; the permuted word is obtained at output. The circuit receives the signal (x') on the first input and on the second input a secret key (S) which, in the embodiment described, consists of a binary digital signal of n bits having a weight d such as defined earlier. Hence, a random digital signal (x") containing n bits and having a weight d is obtained at the output of the permuting circuit (2).

This signal (x") is dispatched to a multiplier circuit (3) which undertakes the matrix multiplication of the n-bit binary word at input with a fixed binary matrix of dimensions n.times.m bits. An m-bit digital signal (y) is obtained at output.

In the scheme described above, the digital signal at input (x) is used to permute the secret key (S). For reasons of security, the digital signal at input is firstly scrambled and the result is used to define a permutation over n bits. The scrambling may be relatively simple, since it is sufficient for the bits to be well spread, that is to say for the value of a bit of the signal at input to affect the value of many bits at output. Numerous possibilities are available here to those skilled in the art, for example the use of correspondence tables or pseudo-random generators.

The definition of a permutation over n bits can be undertaken by defining the image of each bit or else by using a permutation generator of a type known to those skilled in the art, such as described for example in the article by M. Luby & C. Rackoff, "How to construct pseudo random permutation from pseudo random functions", SIAM.J of computing 17(2) April 1988, this requiring less data at input. The need to store the whole of the secret key can be avoided by using an n-bit key in which the first few bits are 1s and all the others 0s. In this case, the key is no longer secret and the entire "secrecy" of the scheme lies in the scrambling of the digital signal at input which must be sufficiently good for the security required.

The matrix of dimensions mxn bits consists of coefficients a.sub.ij which have been chosen randomly once and for all. This matrix is stored in a memory. To avoid storing the whole of the matrix M, it is possible, in a known manner, to generate each coefficient a.sub.ij by way of a pseudo-random function.

The digital signal (y) at output having a dimension of m bits can be used as control word in all access control systems. In the case of a subscription television system, the digital signal (y) at output can equally well be generated at sender level as at receiver(s) level.

Another method of processing a digital signal of dimension k such that the digital signal at output cannot be deduced from the digital signal at input will now be described with reference to FIG. 3, together with a device for implementing this method. In the case of FIG. 3, the digital signal (x) at input is sent on a scrambling circuit (1) of a known type to those skilled in the art. This digital signal is a signal constituted by binary words of dimension k. A digital signal (x') giving in one way the index of a word in a lexicographic sorting of all possible words of weight d and length n is obtained on the output.

A preferred method for formatting the signal (x') into a word of weight d and length n is to used a lexicographic sorting well known by those skilled in the art. Thus, it is possible to define a word of weight d and length n with a minimum of bits, i.e. the logarithm in base 2 of the number of combinations of d amongst n. k will have this value.

The following algorithm is a lexicographic sorting method.

Input

V : value of the index

n : length of the word

d : weight of the word

Output :

Series of bits of length n and weight d

1. C=number of combinations of d amongst n

2. if n > 0

a) C'=C (n-d)/n

b) if V.ltoreq.C'

c) If not

d) n=n-1

Another method of processing a digital signal of dimension k such that the digital signal at output cannot be deduced from the digital signal at input will now be described with reference to FIG. 4, together with a device for implementing this method. In the case of FIG. 4, the digital signal (x.sub.1) at input, which is a signal containing k bits, is dispatched to a pseudo-random generator (4) at the same time as a secret key consisting of a digital signal (S).

The pseudo-random generator is chosen in such a way that for a dimension n the digital signal at output has a fixed Hamming weight d with high probability, n depending on the circuit which effects the unidirectional function. Thus, a random digital signal (x'.sub.1) of length n bits and having a weight of around d is obtained at the output of the pseudo-random generator. The signal (x'.sub.1) is next dispatched to a multiplier circuit (5) where it is multiplied by the coefficients of a fixed matrix having dimensions mxn bits so as to give at output a digital signal (Y.sub.1) having a length of m bits. The fixed matrix is a matrix identical to that described with reference to FIG. 2.

The use of a pseudo-random generator of good quality to obtain the random digital signal affords a spread which is sufficient for our application. Therefore, if the key remains secret, the scrambling is sufficiently good to afford good security even if the digital signal at input is known.

However, the use of a pseudo-random generator to define the binary settings of the digital signals causes a problem. Indeed, certain settings may be produced more than once. In the case in which the memory for storing the binary settings of the signals is adequate, it is possible simply to eliminate the redundant value and draw out another, but if it is not possible to store them, in particular when the computation is performed in a smart card, then the weight of the random digital signal can be smaller than the number of settings drawn. This must be taken into account and it is necessary to draw more items of information than the weight in order to obtain the desired value on average. When the weight of the words input to the unidirectional function need not be exactly d, but perhaps a value which is close thereto, this method is then valid provided that the statistical distribution of the non-redundant values is calculated. Thus, if it is sought to obtain an average value of 56 non-redundant settings, it will be appreciated that 59 settings must be drawn and 25% of the draws come out at exactly 56, 66% between 55 and 57 and 98% between 53 and 59.

Another embodiment of the system will now be described making it possible to implement a method of processing a digital signal such that the digital signal at output cannot be deduced from the digital signal at input, in which starting from a single digital signal at input it is possible to obtain several digital signals at output which meet the said criteria.

As represented in FIG. 5, the digital signal at input (x.sub.2) is dispatched to a pseudo-random generator (6) at the same time as a secret key (S) . If the signal at input is a digital signal of length k bits used to produce signals at output (x'.sub.2.1), (x'.sub.2.2), . . . , (X'.sub.2.i), . . . , (x'.sub.2.N) having lengths of n bits and approximate weights d.sub.i, it is possible to produce Nxn bits thereby feeding N matrix multipliers (M.sub.1), (M.sub.2), (M.sub.3), . . . , (M.sub.N) , in such a way so as to obtain N digital signals (Y.sub.21, Y.sub.22, . . . Y.sub.2N) at output each having a length of m bits. The matrix used at the level of the multipliers (M.sub.1, M.sub.2, M.sub.3, . . . M.sub.N) has the same characteristics as the matrix described with reference to FIGS. 2 to 4. The production of such signals according to a preferential mode requires the use of a reliable pseudo-random generator allowing the generation of around N.times.n bits. The devices described above can be used in numerous applications. Thus, as represented in FIGS. 6 and 7, the devices described above can be used to calculate a cryptographic error detection code with shared secret keys. This implies that the sender and the receiver share a secret key and the error detection code is calculated and verified using this key. As represented in FIG. 6, a message (M) is divided into blocks containing k bits labelled (B.sub.i), i varying from 1to n. We define (C.sub.0) to be a fixed digital signal having a length of k bits, it being possible for (C.sub.0) to be uniformly null, and the error detection code is defined as (C.sub.n,) where (C.sub.i) is obtained as represented in FIG. 6. In this case, a device corresponding to all of the circuits of FIGS. 2 to 4 is referenced (7). The circuit is defined in such a way that k=m (size of the signal at input is identical to that of the signal at output). At input it receives a digital signal (X.sub.3) of k bits from an adder (8) which receives one of the blocks (B.sub.i) on one input and on the other input k bits of a digital signal (C.sub.i-1) which is in fact the signal from the circuit (7) at the previous step so as to give the signal (C.sub.i).

If k is greater than m, there is another way of adjoining k-m bits of a message to an output word. In this case, the message (M) which is a binary word is divided into blocks of k-m bits, (B'.sub.1), (B'.sub.2), . . . , (B'.sub.n,). As represented in FIG. 7, (B'.sub.i) is input to a concatenation circuit (9) together with (C.sub.i-1) which is a signal of size m bits, the binary word (x'.sub.3) from the concatenation circuit is dispatched to a circuit (7) such as defined above in order to obtain the word (C.sub.i).

Moreover, the circuit described in FIGS. 2, 3 and 4 can also be used as a pseudo-random binary generator when the signal at input is of smaller size than the signal at output. For example, as represented in FIG. 8, if the input signal consists of binary words of k bits, with k<m the following scheme may be used: calculate the image of the input, take the first m-k bits for the random sequence at output, and use the succeeding k bits for create a new input word. This is represented in FIG. 8. In this figure, an input word 10 is dispatched to the circuit 7. The m-bit output word from the circuit 7 is separated into two, the m-k bits at the start being dispatched to the output, as forming the output of a pseudo-random generator, the remainder being fed back in as seen earlier. In the embodiment represented, k=m-k=128 bits. It is obvious that k may be different from m-k.

In the case of such use as, pseudo-random generator, the scrambling system may be omitted.

It is obvious to those skilled in the art that the system described above can be used in numerous ways in the field of cryptography applied to secure systems, such as subscription television, banking systems, secure access systems, etc.