Conditional Access Firmware Integrity via Memory Probe

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Modified receiver firmware is used to intercept and redistribute control words for unauthorized descrambling of content, as attackers exploit shared secrets stored in the firmware, leading to security breaches in conditional access systems.

Innovation Solution

A receiver and smartcard configuration that includes a probe module to read data from specific firmware memory locations, forming a response used to decrypt encrypted control words, ensuring that modified firmware alters the shared secret, making it impossible for pirate devices to decrypt and redistribute control words.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the shared secret is stored in the firmware to enable decryption of control words, then the receiver can securely obtain control words for descrambling content, but the firmware can be modified by attackers to intercept and redistribute control words

Engineering Contradiction:

Improvesecure control word decryptionVSAvoidfirmware modification attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The shared secret is segmented into multiple parts distributed across different firmware memory locations. The probe module reads specific segments at challenge-indicated locations and combines them to form the complete shared secret. This segmentation prevents attackers from obtaining the full shared secret by modifying or analyzing a single firmware location, as each segment alone is insufficient for decryption.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary verification by issuing challenges to the probe module before allowing control word decryption. The challenge-response mechanism verifies that the firmware is authentic and has not been modified. Only after successful verification is the shared secret used for decryption, preventing attackers from using modified firmware to intercept control words.

Inventive Principle:

Principle #10Preliminary action

2Difficulty of detecting and measuring

If code obfuscation and data transformation are used to hide the shared secret, then it becomes difficult for attackers to obtain the shared secret from firmware, but modified firmware can still alter the shared secret to enable unauthorized access

Engineering Contradiction:

Improveshared secret extraction difficultyVSAvoidcontrol word security

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The challenge-response mechanism provides feedback verification to ensure firmware authenticity. The probe module responds to challenges by reading from specific firmware locations, and the system verifies the response matches the expected value. This feedback loop detects firmware modifications before decryption occurs, maintaining control word security even when obfuscation is bypassed.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system performs preliminary authentication through challenge-response verification before allowing any decryption operations. This preliminary action ensures that even if obfuscation techniques are compromised, modified firmware cannot be used to obtain control words because the authentication step fails first.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If the shared secret is used to establish a secured session between secure device and receiver, then control words can be transmitted securely, but attackers with modified firmware can intercept control words on the communication channel

Engineering Contradiction:

Improvesecured communication channelVSAvoidcontrol word interception

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The challenge-response verification is performed as a preliminary action before establishing the secured communication channel. This ensures that only authentic firmware can participate in the secure session, preventing attackers from establishing intercepted communication channels with modified firmware.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The challenge-response mechanism provides continuous feedback verification during the communication session. Any attempt to intercept or modify control words would require altering the shared secret, which would cause the verification to fail and terminate the secure session, preventing interception attacks.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS9077854B2Preventing the use of modified receiver firmware in receivers of a conditional access system

Publication Date: 2015.07.07 IRDETO BV

AI summary

The invention enables the shared secret, which is used for encrypting the communication of CWs from a smartcard to a receiver, to cover at least a part of a binary image of firmware that is executing in the receiver. Preferably the shared secret covers the entire binary image of the firmware. Hereto, data from one or more predefined firmware memory locations are read, the set of data forming the shared secret.