smartcard theory & ECM EMM?

[bengaltiger]

Hi, I want to smartcard technology (used in Digital Receiver) in detailed. Is there any books/tuto available? I want to know how a encrypted channel is decrypted also how a subscription is managed. I guess I need to learn HMK,PMK,MK ECM EMM etc. If you anyone can give this info in detailed..... Thanks, Bye BT

[rolfw]

Have a look here for some good basics.

[tesla]

DVB protocol describes a scarmbling lagorithm. This algorithm is called CSA, Common Scrambling Algorithm. Every provider uses this algorithm.

In it's simplest way of implementing scrambled transmission, the operators scarmbls the service with a fixed key. Every one who is supposed to receive this service gets the fiexed key and he receives the service.
This method is used for connections from one partner to another. It is not convenient for operator to use it for their broadcasting.

In order to broadcast, they use one encryption system: Irdeto2, Viaccess etc How it works? Firstly, the encryption system generates a random key for CSA. The service is scrambled with the key. Then, the key is encrypted by the proprietary (and also TOP SECRET) algorithm of the encryption system. ECM contains the encrypted key.The CAM/smartcard decrypts the key. Then, the receiver gets the key and descrambls the service.

It is possible for an operator to use more than one scrambling systems. The service is scrambled, the encryption system encrypt the key. Finally, different ECMs are transmitted, one for every scrambling system.

[bengaltiger]

thanks,

then how its managed for different subscriber with different dates.

thanks,
BT

[tesla]

When a new customer subscribes, the technical staff of the operator sends a command to the smartcard. This command assigns the appropriate products to the smartcard. When the customer stops his subscription, then the technical staff sends another command to the smartcard. This commands removed any asigned product from the smartcard.

[De Fault]

The CAM/smartcard decrypts the key. Then, the receiver gets the key and descrambls the service.

Well, in this case the decrypted key can probably be found in the receiver's RAM memory?

To be more precise, I believe the decrypted key can probably be found in the CAM's RAM memory?

Please correct me if I am wrong.

Are there any Irdeto CAM's based on the ARM processor? Is there a JTAG interface test points available in the CAM? Did anyone try to examine the CAM's PCB? Can we have access to the CAM's PCB and JTAG test points?

Please e-mail me at REMOVED

[Shash]

I don't think there are any jtag communication thing . Why would they give it in first place (security issue.). the cam has 2 modules 1. the pcmcia card 2 the smart card together they make the CAM . I am not sure if the control word(Decrypted key) goes out of the cam.So it would never come to the RAM.The Jtag interface is usually present on the STB hardware board. used to load the linux image onto the board.u can access by opening the STB. but would not be much of use.

[tesla]

I am not sure if the control word(Decrypted key) goes out of the cam.So it would never come to the RAM.

Actually it does. This is the weak point of the whole system and some programmers tookadvantage of it. Otherwise, there whould be no key sharing and dreamboxes whould not be so popular.

[bellesdad]

thanks,

then how its managed for different subscriber with different dates.

thanks,
BT

Thanks for the infomation but what pid is used to address the card?
please and thank you

[gbrowne]

Hi Tesla,

Why would the key ever leave the CAM as the decryption takes place inside the CAM smartcard, not in the receiver ?

Cheers,
GB

Actually it does. This is the weak point of the whole system and some programmers tookadvantage of it. Otherwise, there whould be no key sharing and dreamboxes whould not be so popular.

[BombedOne]

SMiT (smit.com.cn) modules do have certain point of JTAG connector inside. But require proprietary software, since rom image is encrypted.

[bellesdad]

Well I feel that they must have a way of addressing the smart card, that has never been shown to us. It would be nice if we could find out the pid that is used to address the card with info to make it work, this would be other than the EMM's, ECM's, Card files and cam keys. Something in the data stream looks at the card through the cam and knows if it is ok and what channels are allowed to be recieved.
Even if that part of the data stream is incripted FM Card has a program to change a cripted number to clear.
Am I making any sense to any one at all? The system I'm looking at is irdeto 2.

[gbrowne]

Sorry Tesla, I was wrong. As you correctly said, the Control Word is passed to the reciver to enable it to unscramble the scrambled stream.

[cannon_29]

I used to work for a channel which was working on Irdeto II.and i know that each subscription card has a unique number which has to be entered in the mcrypt system.after that we have to activate the card then the card starts working.if you try to activate any other card it wont work unless it has been added in the mcrypt system.and the system keeps sending emm & ecms via a generator every 3 to 5 seconds to the card.

[Topper]

The recent posts have been moved to their own new thread

http://www.satellites.co.uk/satellit...ecms-emms.html