For most digital TV operators, the Conditional Access system is a vital component in a successful and profitable operation. Without the ability to encrypt the signals and thereby limit access to paying customers that a conditional access system provides, a broadcaster can’t generate the revenue potential locked up in the content. But while most operators have personnel with traditional broadcasting skillsets, and knowledge of MPEG, DVB, and networking, conditional access systems tend to be proprietary, and surrounded by a lot of secrecy.

They are also complex and inevitably cause problems for DTV operators — problems that in-house staff find difficult to diagnose and remedy, partly due to the pervasive use of encryption in the system. The situation isn’t helped by the typical symptoms reported by the subscribers: the black screen, or the ‘no access’ message. There’s a dearth of specific information that can help trace the fault from the user end.

While most analyzers and monitoring systems follow the ETSI TR 101 290 standard promoted by the DVB organization, conditional access systems aren’t covered by this specification at all. It’s a recipe for buck-passing: is the problem with the Conditional Access system, or the STBs? The smart cards or the multiplexer? Maybe the descrambling at the input of the headend has failed, or perhaps there is a network problem? Without the right tool, it is difficult for the engineers to know. And unfortunately, until recently, the tools to debug Conditional Access systems have been lacking.

A monitoring product which identifies faults with the Conditional Access system long before the customers notice them can save the operator money and prevent problems with dissatisfied customers. And by relatively simple means it is now possible to monitor and detect common problems that are likely to occur in a digital TV system.

But why do Conditional Access systems cause operators problems? In Europe, systems for satellite, terrestrial, and cable broadcast use the Common Scrambling Algorithm (CSA) to perform the actual encryption and decryption (scrambling and descrambling) of the TV signals. The unencrypted signal is fed into a scrambler that encrypts the signal using a random key called the Control Word (CW) according to the CSA algorithm. The descrambler decrypts the scrambled signals by using the same Control Word to reproduce the clear signal. For security reasons, the Control Word used for scrambling is changed regularly, usually every 10 seconds. The transport stream header contains two scrambling control bits that indicate which Control Word is to be used for descrambling, normally denoted Odd and Even. This allows the Control Words to be changed without causing any descrambling problems.

The Control Word is placed in an message called an Entitlement Control Message (ECM), which is encrypted in a proprietary way and then inserted into the Transport Stream. Most Conditional Access systems use smart cards that are inserted into the STB to handle the security, and the smart card receives the ECM associated with the TV channel, decrypts the ECM, and sends the Control Word to the STB so that it can be used to descramble the signal.


Entitlement Management Messages (EMM) are used to send entitlements to the smart card, so that it knows to “allow the user to view this group of channels the next month” or “allow the user to watch this Video on Demand movie”. The set-top box receives the EMMs and forwards them to the smart card for processing. The smart card uses the information in the EMMs to update its internal access control database containing a list of channels and VoD movies the user is allowed to watch.

The EMM can authorize the smart card to allow viewing of a VoD movie for a couple of hours, or one or more TV channels for one or several months to come. When the smart card receives ECMs it will use the information in the smart card’s internal access control database to decide if the user has access to the channel or not. If the user has access to the channel the decrypted Control Word will be sent to the STB which can then descramble the signal. EMMs are encrypted with a proprietary encryption method known only by the CA vendor.

If what you’ve read so far is making you think this is a pretty cloak-and-dagger world we operate in, sit tight, as the levels of encryption are still piling up! Most IPTV and cable TV operators receive a significant portion of their input signals in encrypted form, often over satellite. The various channels will come from different providers which all have different CA Systems. The first part in the turn-around of digital TV (DTV) signals is to descramble the incoming signals, but if the input signal for some reason cannot be descrambled the signal will still be encrypted with the original CA system. Then, later in the turn-around process, the signal will be encrypted with the operator’s own Conditional Access system, causing the signal to be encrypted twice, usually leading to a black screen for end-users.

And there’s more. Most content is normally scrambled in the headend, but scrambling in the edges of the network is becoming more popular. Scrambling in the edges are most commonly used to insert different local content in different regions and to scramble VoD sessions. No matter where the signals are scrambled, there are many potential problems along the way. The solution to problems caused by encryption/decryption failures is to monitor the signals after descrambling and before they are re-encrypted. To get effective monitoring, it is necessary to analyze the incoming signal in detail, especially the video PIDs.


For the best possible results, the system should check that the audio and video can be decoded. Ideally, the monitoring product should be able to extract thumbnail information from all streams and check audio levels. The ability to detect picture freeze and “black screens” is also highly useful, as these are problems which often occur when the digital signal is decoded and there are CA errors. This is normally done in a decode-recode process to change the bitrate/resolution of the input signal.


EMMs can also go missing for a variety of reasons. The first indicators of this scenario are if the operator does not have CA system monitoring and the would be customer calls to report no access to new channels they have ordered. First line support is likely to identify the fault as being with the smart card, and mail out new cards, until enough calls have been received for the support staff to identify a pattern and pass the problem to another level.


By the first day of the new month, if EMMs are still not being sent out, all subscribers will be denied access, and as the calls flood in, the CA expert is finally summoned. Contrast what happens with an operator equipped with CA system monitoring: here, as soon as the EMMs go missing the monitoring equipment raises alarms for all affected transport streams. The shift operator calls up the CA expert who fixes the problem in a matter of minutes — before any customers are affected by this short period without EMMs.

There are many other entry points through which faults can creep in to disrupt the smooth operation of the service, but the example above illustrates the difference a CA monitoring system can make in nearly all cases: it’s the difference between a slowly unfolding disaster, the full extent of which is only known by the time it has inflicted most damage on the confidence of the subscriber base — and a quick correction that fixes the fault before it becomes a problem. Until now there have not been solutions available for monitoring the Conditional Access system and raising alarms — operators have either relied on manual inspection routines to detect problems or have let their subscribers act as the monitoring system. There’s a high cost to pay for this approach though, in terms of maintenance staffing costs, and in customer dissatisfaction.

To be truly effective, Conditional Access system monitoring should be integrated with the overall monitoring solution, coupled with full ETSI TR 101 290 monitoring and monitoring of IP and RF transmissions to provide a powerful and complete monitoring system for Digital TV. The monitoring solution should also include an NMS system which aggregates errors from all the different analyzers placed in the network and displays not only a list of alarms, but also pinpoints where in the network the problem occurred and generates reports showing quality, jittering and other parameters so that the operator can see trends over time.

CA system monitoring is so important that Bridge Technologies has implemented it in all our ETSI TR 101 290 monitoring products and include it free of charge. We recommend all operators monitor their CA systems and add the missing link to their monitoring system.