smartcard theory & ECM EMM?

Status
Not open for further replies.

bengaltiger

Member
Joined
Mar 21, 2006
Messages
21
Reaction score
0
Points
0
Age
76
My Satellite Setup
Humax
My Location
FR
Hi, I want to smartcard technology (used in Digital Receiver) in detailed. Is there any books/tuto available? I want to know how a encrypted channel is decrypted also how a subscription is managed. I guess I need to learn HMK,PMK,MK ECM EMM etc. If you anyone can give this info in detailed..... Thanks, Bye BT
 

rolfw

Believe it when I see it Admin.
Staff member
Joined
May 1, 1999
Messages
38,292
Reaction score
1,615
Points
113
My Satellite Setup
Technomate 5402 HD M2 Ci, DM7000s, Transparent 80cm Dish, Moteck SG2100 DiseqC motor, lots of legacy gear. Meters: Satlook Digital NIT, Promax HD Ranger+ spectrum analyser.
My Location
Berkshire
Have a look here for some good basics.
 

tesla

Regular Member
Joined
Apr 20, 2006
Messages
120
Reaction score
0
Points
0
Age
48
Website
www.bloka.com
My Satellite Setup
?
My Location
Lost in the night
DVB protocol describes a scarmbling lagorithm. This algorithm is called CSA, Common Scrambling Algorithm. Every provider uses this algorithm.

In it's simplest way of implementing scrambled transmission, the operators scarmbls the service with a fixed key. Every one who is supposed to receive this service gets the fiexed key and he receives the service.
This method is used for connections from one partner to another. It is not convenient for operator to use it for their broadcasting.

In order to broadcast, they use one encryption system: Irdeto2, Viaccess etc How it works? Firstly, the encryption system generates a random key for CSA. The service is scrambled with the key. Then, the key is encrypted by the proprietary (and also TOP SECRET) algorithm of the encryption system. ECM contains the encrypted key.The CAM/smartcard decrypts the key. Then, the receiver gets the key and descrambls the service.

It is possible for an operator to use more than one scrambling systems. The service is scrambled, the encryption system encrypt the key. Finally, different ECMs are transmitted, one for every scrambling system.
 

bengaltiger

Member
Joined
Mar 21, 2006
Messages
21
Reaction score
0
Points
0
Age
76
My Satellite Setup
Humax
My Location
FR
thanks,

then how its managed for different subscriber with different dates.

thanks,
BT
 

tesla

Regular Member
Joined
Apr 20, 2006
Messages
120
Reaction score
0
Points
0
Age
48
Website
www.bloka.com
My Satellite Setup
?
My Location
Lost in the night
When a new customer subscribes, the technical staff of the operator sends a command to the smartcard. This command assigns the appropriate products to the smartcard. When the customer stops his subscription, then the technical staff sends another command to the smartcard. This commands removed any asigned product from the smartcard.
 

De Fault

Member
Joined
May 13, 2008
Messages
1
Reaction score
0
Points
0
Age
62
My Satellite Setup
ARM Developer Suite
AXD Debugger
ARM processor emulator
My Location
Thailand
The CAM/smartcard decrypts the key. Then, the receiver gets the key and descrambls the service.

Well, in this case the decrypted key can probably be found in the receiver's RAM memory?

To be more precise, I believe the decrypted key can probably be found in the CAM's RAM memory?

Please correct me if I am wrong.

Are there any Irdeto CAM's based on the ARM processor? Is there a JTAG interface test points available in the CAM? Did anyone try to examine the CAM's PCB? Can we have access to the CAM's PCB and JTAG test points?

Please e-mail me at REMOVED

:cool:
 

Shash

Member
Joined
Jan 12, 2009
Messages
7
Reaction score
0
Points
0
Age
40
My Satellite Setup
insat4-A and high end computer with tv tuner card.
My Location
india
I don't think there are any jtag communication thing . Why would they give it in first place (security issue.). the cam has 2 modules 1. the pcmcia card 2 the smart card together they make the CAM . I am not sure if the control word(Decrypted key) goes out of the cam.So it would never come to the RAM.The Jtag interface is usually present on the STB hardware board. used to load the linux image onto the board.u can access by opening the STB. but would not be much of use.
 

tesla

Regular Member
Joined
Apr 20, 2006
Messages
120
Reaction score
0
Points
0
Age
48
Website
www.bloka.com
My Satellite Setup
?
My Location
Lost in the night
Shash said:
I am not sure if the control word(Decrypted key) goes out of the cam.So it would never come to the RAM.
Actually it does. This is the weak point of the whole system and some programmers tookadvantage of it. Otherwise, there whould be no key sharing and dreamboxes whould not be so popular.
 

bellesdad

Member
Joined
Jun 21, 2007
Messages
2
Reaction score
0
Points
0
Age
77
My Satellite Setup
nokia 9500, 5 dishes
My Location
Eastern Australia
bengaltiger said:
thanks,

then how its managed for different subscriber with different dates.

thanks,
BT

Thanks for the infomation but what pid is used to address the card?
please and thank you
 

gbrowne

Member
Joined
Jan 30, 2007
Messages
44
Reaction score
0
Points
0
Age
66
My Satellite Setup
CM1.2m
Relook receiver
My Location
South coast of Devon
Hi Tesla,

Why would the key ever leave the CAM as the decryption takes place inside the CAM smartcard, not in the receiver ?

Cheers,
GB

tesla said:
Actually it does. This is the weak point of the whole system and some programmers tookadvantage of it. Otherwise, there whould be no key sharing and dreamboxes whould not be so popular.
 

BombedOne

Regular Member
Joined
Sep 9, 2008
Messages
1,107
Reaction score
6
Points
0
Age
57
My Satellite Setup
Covering 30W-105.5E range, two motors, C and Ku band. Various receivers/cards/cams/etc.
My Location
Republic of Georgia
SMiT (smit.com.cn) modules do have certain point of JTAG connector inside. But require proprietary software, since rom image is encrypted.
 

bellesdad

Member
Joined
Jun 21, 2007
Messages
2
Reaction score
0
Points
0
Age
77
My Satellite Setup
nokia 9500, 5 dishes
My Location
Eastern Australia
Well I feel that they must have a way of addressing the smart card, that has never been shown to us. It would be nice if we could find out the pid that is used to address the card with info to make it work, this would be other than the EMM's, ECM's, Card files and cam keys. Something in the data stream looks at the card through the cam and knows if it is ok and what channels are allowed to be recieved.
Even if that part of the data stream is incripted FM Card has a program to change a cripted number to clear.
Am I making any sense to any one at all? The system I'm looking at is irdeto 2.
 

gbrowne

Member
Joined
Jan 30, 2007
Messages
44
Reaction score
0
Points
0
Age
66
My Satellite Setup
CM1.2m
Relook receiver
My Location
South coast of Devon
Sorry Tesla, I was wrong. As you correctly said, the Control Word is passed to the reciver to enable it to unscramble the scrambled stream.
 

cannon_29

Member
Joined
Dec 22, 2006
Messages
4
Reaction score
0
Points
0
Age
51
My Satellite Setup
DM 500 &
worldinboxII
My Location
Pakistan
I used to work for a channel which was working on Irdeto II.and i know that each subscription card has a unique number which has to be entered in the mcrypt system.after that we have to activate the card then the card starts working.if you try to activate any other card it wont work unless it has been added in the mcrypt system.and the system keeps sending emm & ecms via a generator every 3 to 5 seconds to the card.
 
Status
Not open for further replies.
Top