1. Method for processing packets with encrypted data received by a client (3; 78-81) from a head-end (1; 4; 74, 83) connected to the client (3; 78-81) through at least one network (2; 77, 82), wherein the data packets comprise at least an encryption header (54, 55; 69) and an encrypted payload (52, 53; 70), comprising
extracting the encryption header (54, 55; 69) from a data packet;
extracting and decrypting the encrypted payload (52, 53; 70) to form clear data (71);
generating a clear data packet header (72); and
generating a clear data packet fragment comprising the clear data packet header (72) and the clear data (71);
2. Method according to claim 1, further is comprising providing the clear data packet fragment as input to a network protocol stack (29) on the client (3; 78-81) that is capable of buffering clear data packet fragments and assembling them into a clear data packet.
3. Method according to claim 1 or 2, wherein the encryption header (54, 55; 69) of the packet with encrypted data comprises information allowing assembly in the stack (29) of a clear data packet from related clear data packet fragments, which method further comprises extracting the information from the encryption header (54, 55; 69) and including it with the clear data packet fragment.
4. Method according to claim 3, wherein the information is used to generate a transport layer protocol header (73), which is included with the clear data packet fragment.
5. Method according to claim 3, wherein the information comprises an offset value relative to a first bit of the clear data (71) generated from a related encrypted data packet, wherein the offset value is included in the clear data packet fragment.
6. Method according to any one of claims 1-5, further comprising retrieving decryption information (60) specified in the encryption header (54, 55; 69), wherein said information (60) is used to decrypt the encrypted payload (52, 53; 70).
7. Method according to claim 6, wherein a decryption key is retrieved from among a plurality of valid decryption keys according to a key indicator specified in the encryption header (54, 55; 69).
8. Method for secure packet-based transmission of content data from a head-end (1; 4; 74, 83) to at least one client (3; 78-81), through at least one network (2; 77, 82) to which the head-end (1; 4; 74, 83) and the client (3; 78-81) are connected, comprising:
retrieving a clear data packet comprising an unencrypted payload;
dividing the unencrypted payload into one or more fragments (50, 51);
applying an encryption algorithm to each fragment (50, 51) to generate encrypted fragments (52, 53);
generating an encryption header (54, 55) for each encrypted fragment (52, 53);
composing a packet with encrypted data for each encrypted fragment (52, 53), comprising the fragment (52, 53), the encryption header (54, 55) for the fragment (52, 53) and a data packet header (56, 57); and
transmitting each of the thus composed packets to the client (3; 78-81).
9. Method according to claim 8, wherein, in dividing the unencrypted payload into fragments (50, 51), the fragment size is chosen to keep the size of the packets with encrypted data below a maximum transmission unit of the network (2; 77, 82).
10. Method according to claim 8 or 9, further comprising retrieving conditional access data specified in the clear data packet wherein the conditional access data is used to generate the encrypted fragments (52, 53).
11. Method according to any one of claims 8-10, wherein information is encoded in the encryption header (54, 55; 69) for each fragment (52, 53) regarding the length of the fragment (52,53) before encryption and the extra length added by the encryption algorithm.
12. Method according to any one of claims 8-11, wherein the encryption header (54) for at least one fragment (52) is provided with information regarding the length of the clear data packet and information regarding a checksum of the unencrypted payload, to allow re-assembly of the clear data packet at the client (3; 78-81).
13. Method according to any one of claims 8-12, wherein the encryption header (54, 55, 69) comprises a flag to distinguish data packets composed from a first encrypted fragment (52) from data packets composed from further encrypted fragments (53) generated from the same unencrypted payload as the first encrypted fragment (52).
14. Method according to any one of claims 8-13, wherein information comprising an offset of an unencrypted fragment (51) with respect to a first fragment (50) of the unencrypted payload is provided in the encryption header (55) for the encrypted fragment (53) generated from the unencrypted fragment (51).
15. Method according to any one of claims 8-13, wherein information specifying the encryption algorithm applied to the fragment (50, 51) is encoded in the encryption header (54, 55).
16. Method according to any one of claims 8-15, further comprising transmitting as data packets Entitlement Management Messages, for authorising a client (3; 78-81) to make use of a particular service.
17. Method according to any one of claims 8-16, further comprising transmitting as data packets Entitlement Control Messages, comprising decryption information, for selectively authorising a client (3; 78-81) to receive data belonging to a particular service.
18. Method according to any one of claims 8-17, further comprising transmitting as data packets Information Messages identifying a service and comprising information for receiving messages belonging to the service.
19. Method according to any one of claims 15-18, wherein each packet with encrypted data is provided with an address andor a port, wherein a header is provided for each message data packet, which header comprises a different address andor a port.
20. Application of a method according to any one of the preceding claims for multicasting, broadcasting or unicasting digital video.
21. System for secure packet-based transfer of content data, comprising a head-end (1; 4; 74, 83) that is connected to a network (2; 77, 82) and comprises a receiver for receiving clear data packets from a source (7; 76), an encryption unit (6) for encrypting at least part of the data packets and generating data packets comprising the encrypted part of the clear data packets and a network interface (25) for sending the data packets through the network (2; 77, 82), which system further comprises at least one client (3; 78-81) connected to the network (2; 77, 82), with a network interface (27) for receiving data packets sent through the network (2; 77, 82), capable of composing data packets from data packet fragments, wherein the client (3; 78-81) comprises a decryption unit (30) for generating clear data (71) by decrypting encrypted data (52, 53; 70) comprised in the received data packets and for generating data packet fragments from the clear data (71).
22. Client (3; 78-81), connected to a head-end (1; 4; 74, 83) through a network (2; 77, 82), comprising:
a data packet receiver (27), capable of receiving data packets transmitted from the head-end (1; 4; 74, 83) through the network (2; 77, 82);
a buffer (29) for storing data packet fragments and composing a data packet from them;
an application program interface (28) for passing data packet fragments to the buffer (29); and
a decryption unit (30), for generating unencrypted data packet fragments by decrypting encrypted data (52, 53; 70) in a data packet, wherein the application program interface (28) is programmed to transfer received data packets comprising encrypted data (52, 53; 70) to the decryption unit (30) and to pass unencrypted data packet fragments to the buffer (29).
23. Client according to claim 22, comprising a decryption manager (31) for processing conditional access messages comprised in the data-packets transmitted from the head-end (1; 4; 74, 83) and for transferring decryption keys to the decryption unit (30).
24. Client according to claim 22 or 23, further comprising an interface (35) to a secure element (33) for transferring conditional access messages to the secure element (33) and receiving decryption keys generated by the secure element (33).
25. Client according to claim 24, suitable for connection to a smart card reader (34), so that a smart card (33) inserted into the smart card reader (34) forms the secure element.
26. Client according to any one of claims 22 to 25, wherein the decryption unit (30) comprises a database (62) that can be updated using information (60) comprised in conditional access messages received by the client (3, 78-81).
27. Client according to claim 26, wherein the database (62) links addresses andor ports specified in received data packets to keys for decrypting encrypted data (52, 53; 70) comprised in the received data packets.
28. Smart card suitable for use with a smart card reader (34) connected to a client (3; 78-81) according to any one of claims 23-28 for generating decryption keys using conditional access messages sent to it from the client (3; 78-81).
29. Data packet, suitable for transmission over a network (2; 77, 82), comprising a first header (56, 57; 67), an encrypted payload (52, 53; 7.0), generated by encrypting a data fragment (50, 51) using an encryption algorithm and a key, and an encryption header (54, 55; 69) comprising information detailing the algorithm and key used to encrypt the payload (52, 53; 70).
30. Data packet according to claim 29, wherein the encryption header (54, 55; 69) further comprises data specifying the length of the data fragment (50, 51) before encryption.
31. Data packet according to claim 29 or 30, wherein the destination address is a multicast address, for transmitting the data packet to a plurality of clients (3; 78-81) connected to the network (2; 77, 82).
32. Data packet according to any one of claims 29-31, wherein the first header (56, 57; 67) conforms to the Internet Protocol standard.
33. Program suitable for loading onto a computer (1, 3; 74, 78-81), so that the computer (1, 3; 74, 78-81) running the program is capable of carrying out a method according to any one of claims 1 to 20.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A disposable assembly for separating blood or the washing of a blood component by centrifugation, comprising a circular centrifuge chamber made of a rigid plastic, comprising, at an end lying on its axis of rotation, an element shaped in order to mesh with a drive member of a centrifuge machine and, at an opposite end, a member for interaction of said chamber with the outside made of a rigid plastic, connected to said centrifuge chamber by a rotary joint and passed through by a tube to supply this chamber and by at least one outlet tube for draining at least one of the separate constituents, a support made of a rigid plastic in which a network of channels is formed in order to connect said tubes respectively to a supply reservoir for the blood to be separated and to at least one reception reservoir for a separated constituent, elements for laterally closing this network of channels in a sealed manner and means for circulating the fluids through this network of channels from the supply reservoir to the reception reservoirs wherein the ends of said tubes passing through said member causing said chamber to interact with the outside, concentric with said axis of rotation, are adjacent to the respective ends of said channels, in that the ends of said tubes have surfaces complementary to the surfaces of the ends of said respective channels, and in that these complementary surfaces are fixed to each other by joints in a sealed manner so that said support and said member for causing said chamber to interact with the outside form a rigid assembly.
2. The assembly as claimed in claim 1, in which the fixings between the surfaces of the respective ends of said tubes and said channels are non-removable fixings.
3. The assembly as claimed in claim 2, in which said support is formed in a single piece with a case.
4. The assembly as claimed in claim 3, having an opening for at least partly receiving the centrifuge chamber, the part of this case opposite that which is adjacent to said support having a second opening to allow the passage of said element shaped to mesh with drive means of the centrifuge machine.
5. The assembly as claimed in claim 4, in which said support is a planar support.
6. The assembly as claimed in claim 3, in which said support is a planar support.
7. The assembly as claimed in claim 2, in which said support is a planar support.
8. The assembly as claimed in claim 7, in which said planar support is inclined relative to the axis of rotation of said centrifuge chamber.
9. The assembly as claimed in claim 7, in which said planar support is perpendicular to the axis of rotation of said centrifuge chamber.
10. The assembly as claimed in claim 1, in which said support is formed in a single piece with a case.
11. The assembly as claimed in claim 10, having an opening for at least partly receiving the centrifuge chamber, the part of this case opposite that which is adjacent to said support having a second opening to allow the passage of said element shaped to mesh with drive means (11a) of the centrifuge machine.
12. The assembly as claimed in claim 11, in which said support is a planar support.
13. The assembly as claimed in claim 12, in which said planar support is inclined relative to the axis of rotation of said centrifuge chamber.
14. The assembly as claimed in claim 12, in which said planar support is perpendicular to the axis of rotation of said centrifuge chamber.
15. The assembly as claimed in claim 10, in which said support is a planar support.
16. The assembly as claimed in claim 15, in which said planar support is inclined relative to the axis of rotation of said centrifuge chamber.
17. The assembly as claimed in claim 15, in which said planar support is perpendicular to the axis of rotation of said centrifuge chamber.
18. The assembly as claimed in claim 1, in which said support is a planar support.
19. The assembly as claimed in claim 18, in which said planar support is inclined relative to the axis of rotation of said centrifuge chamber.
20. The assembly as claimed in claim 18, in which said planar support is perpendicular to the axis of rotation of said centrifuge chamber.