smartcard theory & ECM EMM?

Status
Not open for further replies.
B

bengaltiger

Member
Messages
21
Likes
0
My Satellite Setup
Humax
My Location
FR
#1
Hi, I want to smartcard technology (used in Digital Receiver) in detailed. Is there any books/tuto available? I want to know how a encrypted channel is decrypted also how a subscription is managed. I guess I need to learn HMK,PMK,MK ECM EMM etc. If you anyone can give this info in detailed..... Thanks, Bye BT
 
rolfw

rolfw

Believe it when I see it Admin.
Staff member
Messages
37,727
Likes
1,291
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
#2
Have a look here for some good basics.
 
T

tesla

Regular Member
Messages
120
Likes
0
My Satellite Setup
?
My Location
Lost in the night
#3
DVB protocol describes a scarmbling lagorithm. This algorithm is called CSA, Common Scrambling Algorithm. Every provider uses this algorithm.

In it's simplest way of implementing scrambled transmission, the operators scarmbls the service with a fixed key. Every one who is supposed to receive this service gets the fiexed key and he receives the service.
This method is used for connections from one partner to another. It is not convenient for operator to use it for their broadcasting.

In order to broadcast, they use one encryption system: Irdeto2, Viaccess etc How it works? Firstly, the encryption system generates a random key for CSA. The service is scrambled with the key. Then, the key is encrypted by the proprietary (and also TOP SECRET) algorithm of the encryption system. ECM contains the encrypted key.The CAM/smartcard decrypts the key. Then, the receiver gets the key and descrambls the service.

It is possible for an operator to use more than one scrambling systems. The service is scrambled, the encryption system encrypt the key. Finally, different ECMs are transmitted, one for every scrambling system.
 
B

bengaltiger

Member
Messages
21
Likes
0
My Satellite Setup
Humax
My Location
FR
#4
thanks,

then how its managed for different subscriber with different dates.

thanks,
BT
 
T

tesla

Regular Member
Messages
120
Likes
0
My Satellite Setup
?
My Location
Lost in the night
#5
When a new customer subscribes, the technical staff of the operator sends a command to the smartcard. This command assigns the appropriate products to the smartcard. When the customer stops his subscription, then the technical staff sends another command to the smartcard. This commands removed any asigned product from the smartcard.
 
D

De Fault

Member
Messages
1
Likes
0
My Satellite Setup
ARM Developer Suite
AXD Debugger
ARM processor emulator
My Location
Thailand
#6
The CAM/smartcard decrypts the key. Then, the receiver gets the key and descrambls the service.
Well, in this case the decrypted key can probably be found in the receiver's RAM memory?

To be more precise, I believe the decrypted key can probably be found in the CAM's RAM memory?

Please correct me if I am wrong.

Are there any Irdeto CAM's based on the ARM processor? Is there a JTAG interface test points available in the CAM? Did anyone try to examine the CAM's PCB? Can we have access to the CAM's PCB and JTAG test points?

Please e-mail me at REMOVED

:cool:
 
S

Shash

Member
Messages
7
Likes
0
My Satellite Setup
insat4-A and high end computer with tv tuner card.
My Location
india
#7
I don't think there are any jtag communication thing . Why would they give it in first place (security issue.). the cam has 2 modules 1. the pcmcia card 2 the smart card together they make the CAM . I am not sure if the control word(Decrypted key) goes out of the cam.So it would never come to the RAM.The Jtag interface is usually present on the STB hardware board. used to load the linux image onto the board.u can access by opening the STB. but would not be much of use.
 
T

tesla

Regular Member
Messages
120
Likes
0
My Satellite Setup
?
My Location
Lost in the night
#8
Shash said:
I am not sure if the control word(Decrypted key) goes out of the cam.So it would never come to the RAM.
Actually it does. This is the weak point of the whole system and some programmers tookadvantage of it. Otherwise, there whould be no key sharing and dreamboxes whould not be so popular.
 
B

bellesdad

Member
Messages
2
Likes
0
My Satellite Setup
nokia 9500, 5 dishes
My Location
Eastern Australia
#9
bengaltiger said:
thanks,

then how its managed for different subscriber with different dates.

thanks,
BT
Thanks for the infomation but what pid is used to address the card?
please and thank you
 
G

gbrowne

Member
Messages
44
Likes
0
My Satellite Setup
CM1.2m
Relook receiver
My Location
South coast of Devon
#10
Hi Tesla,

Why would the key ever leave the CAM as the decryption takes place inside the CAM smartcard, not in the receiver ?

Cheers,
GB

tesla said:
Actually it does. This is the weak point of the whole system and some programmers tookadvantage of it. Otherwise, there whould be no key sharing and dreamboxes whould not be so popular.
 
BombedOne

BombedOne

Regular Member
Messages
1,107
Likes
7
My Satellite Setup
Covering 30W-105.5E range, two motors, C and Ku band. Various receivers/cards/cams/etc.
My Location
Republic of Georgia
#11
SMiT (smit.com.cn) modules do have certain point of JTAG connector inside. But require proprietary software, since rom image is encrypted.
 
B

bellesdad

Member
Messages
2
Likes
0
My Satellite Setup
nokia 9500, 5 dishes
My Location
Eastern Australia
#12
Well I feel that they must have a way of addressing the smart card, that has never been shown to us. It would be nice if we could find out the pid that is used to address the card with info to make it work, this would be other than the EMM's, ECM's, Card files and cam keys. Something in the data stream looks at the card through the cam and knows if it is ok and what channels are allowed to be recieved.
Even if that part of the data stream is incripted FM Card has a program to change a cripted number to clear.
Am I making any sense to any one at all? The system I'm looking at is irdeto 2.
 
G

gbrowne

Member
Messages
44
Likes
0
My Satellite Setup
CM1.2m
Relook receiver
My Location
South coast of Devon
#13
Sorry Tesla, I was wrong. As you correctly said, the Control Word is passed to the reciver to enable it to unscramble the scrambled stream.
 
C

cannon_29

Member
Messages
4
Likes
0
My Satellite Setup
DM 500 &
worldinboxII
My Location
Pakistan
#14
I used to work for a channel which was working on Irdeto II.and i know that each subscription card has a unique number which has to be entered in the mcrypt system.after that we have to activate the card then the card starts working.if you try to activate any other card it wont work unless it has been added in the mcrypt system.and the system keeps sending emm & ecms via a generator every 3 to 5 seconds to the card.
 
Topper

Topper

Amo Amas Amant Admin
Staff member
Messages
21,913
Likes
3,346
My Satellite Setup
IDD CI24 ECONO MM Penta 1.20 Galaxy II
1.2Mtr Polar MTG yes it has been on the arc for 25 years and is now fixed on 13 East using two pairs of rusty molegrips. Unlike me they never groan but always perform.
My Location
Blackburn, Lancashire
Status
Not open for further replies.
Top