smartcard theory & ECM EMM?

bengaltiger

Hi, I want to smartcard technology (used in Digital Receiver) in detailed. Is there any books/tuto available? I want to know how a encrypted channel is decrypted also how a subscription is managed. I guess I need to learn HMK,PMK,MK ECM EMM etc. If you anyone can give this info in detailed..... Thanks, Bye BT

rolfw

Have a look here for some good basics.

Rolf If you enjoy our site, you can help support it by wearing our unique branded merchandise, you can do this by clicking on my baseball cap, making a direct donation with Paypal by clicking on the Donation button below, or using our site supporting advertisers, to do this, click on the central image below. Follow us on Twitter, click on the twitter image.

tesla

DVB protocol describes a scarmbling lagorithm. This algorithm is called CSA, Common Scrambling Algorithm. Every provider uses this algorithm.

In it's simplest way of implementing scrambled transmission, the operators scarmbls the service with a fixed key. Every one who is supposed to receive this service gets the fiexed key and he receives the service.
This method is used for connections from one partner to another. It is not convenient for operator to use it for their broadcasting.

In order to broadcast, they use one encryption system: Irdeto2, Viaccess etc How it works? Firstly, the encryption system generates a random key for CSA. The service is scrambled with the key. Then, the key is encrypted by the proprietary (and also TOP SECRET) algorithm of the encryption system. ECM contains the encrypted key.The CAM/smartcard decrypts the key. Then, the receiver gets the key and descrambls the service.

It is possible for an operator to use more than one scrambling systems. The service is scrambled, the encryption system encrypt the key. Finally, different ECMs are transmitted, one for every scrambling system.

bengaltiger

thanks,

then how its managed for different subscriber with different dates.

thanks,
BT

tesla

When a new customer subscribes, the technical staff of the operator sends a command to the smartcard. This command assigns the appropriate products to the smartcard. When the customer stops his subscription, then the technical staff sends another command to the smartcard. This commands removed any asigned product from the smartcard.

De Fault

Well, in this case the decrypted key can probably be found in the receiver's RAM memory?

To be more precise, I believe the decrypted key can probably be found in the CAM's RAM memory?

Please correct me if I am wrong.

Are there any Irdeto CAM's based on the ARM processor? Is there a JTAG interface test points available in the CAM? Did anyone try to examine the CAM's PCB? Can we have access to the CAM's PCB and JTAG test points?

Please e-mail me at REMOVED

Shash

I don't think there are any jtag communication thing . Why would they give it in first place (security issue.). the cam has 2 modules 1. the pcmcia card 2 the smart card together they make the CAM . I am not sure if the control word(Decrypted key) goes out of the cam.So it would never come to the RAM.The Jtag interface is usually present on the STB hardware board. used to load the linux image onto the board.u can access by opening the STB. but would not be much of use.

tesla

Actually it does. This is the weak point of the whole system and some programmers tookadvantage of it. Otherwise, there whould be no key sharing and dreamboxes whould not be so popular.

bellesdad

Thanks for the infomation but what pid is used to address the card?
please and thank you

gbrowne

Hi Tesla,

Why would the key ever leave the CAM as the decryption takes place inside the CAM smartcard, not in the receiver ?

Cheers,
GB

BombedOne

SMiT (smit.com.cn) modules do have certain point of JTAG connector inside. But require proprietary software, since rom image is encrypted.

bellesdad

Well I feel that they must have a way of addressing the smart card, that has never been shown to us. It would be nice if we could find out the pid that is used to address the card with info to make it work, this would be other than the EMM's, ECM's, Card files and cam keys. Something in the data stream looks at the card through the cam and knows if it is ok and what channels are allowed to be recieved.
Even if that part of the data stream is incripted FM Card has a program to change a cripted number to clear.
Am I making any sense to any one at all? The system I'm looking at is irdeto 2.

gbrowne

Sorry Tesla, I was wrong. As you correctly said, the Control Word is passed to the reciver to enable it to unscramble the scrambled stream.

cannon_29

I used to work for a channel which was working on Irdeto II.and i know that each subscription card has a unique number which has to be entered in the mcrypt system.after that we have to activate the card then the card starts working.if you try to activate any other card it wont work unless it has been added in the mcrypt system.and the system keeps sending emm & ecms via a generator every 3 to 5 seconds to the card.

Topper

The recent posts have been moved to their own new thread

Can I reveal the transmission rate of ECMs/EMMs?

War does not determine who is right, it determines who is left!

Formerly toppervte33h
whose six pack has turned into a keg

Help support this web site by making a donation
Or use other options to help support Sats UK
Show Your Support
by clicking the button

Thank you.
Freddie Flintoff is back