Satellite Signal Encryption
By Mark Long
© copyright 1996 MLE INC. All rights Reserved.
THE DIGITAL SATELLITE TV HANDBOOK is an entire course in digital satellite TV technology, complete with self-grading exams and supporting IBM-PC compatible software on CD-ROM.
Encryption is an electronic method of securing the video and audio portions of any TV program so that satellite, cable, and broadcast TV services can maintain control over the distribution of their signals. To receive encrypted or scrambled TV services, cable and SMATV system operators, hotel chains, private satellite networks and home dish owners must employ a device called a descrambler to sense the presence of an encrypted TV signal and then automatically decode the picture and sound.
Premium program services purchase the rights to movies from film production companies with the understanding that every individual will pay for the right to view them. Programmers are also very concerned about theft of their signals by hotels, bars, and other commercial establishments who derive monetary benefit from their piracy.
Scrambling protects local cable and DTH operators from losing potential customers who might otherwise purchase a dish in order to avoid paying monthly subscription fees. Private business networks also must scramble their signals to ensure the confidentiality of information that is transmitted via satellite to corporate members attending videoconferences or other non-public meetings.
Within a particular region, program producers may license their programs to more than one broadcast outlet. The program producer may require that broadcaster encrypt its signals whenever the broadcaster airs the producer's copyrighted material. This strictly limits reception of the programming to the market for which each broadcaster is licensed. Satellite TV viewers often will encounter this phenomenon the on Palapa C2 satellite. Broadcasters such as RTM-1 and RTM-3 (Malaysia), GMA (Philippines) and Indosiar (Indonesia) periodically will switch from a free-to-air to an encrypted transmission mode whenever required under their respective agreements with the program copyright owners.
How Encryption Works
All encryption or scrambling systems have three main components: the encoder, a computerized authorization center, and a network of descramblers. The encoder converts standard TV signals into separate scrambled video and digitally-encrypted audio components.
The authorization center uses a computer to control all descramblers in the system. Each integrated receiver-decoder (IRD) is assigned a unique address code. The authorization center uses this code to turn individual decoders on or off and even selectively control large groups of decoders. Regional sports networks, for example, use selective group control to black out specific programs for those regions of the country where the programmer does not own the rights to the material being aired. Private business networks may also use tiering to control the distribution of information within a corporation or among a group of corporations all sharing the same satellite capacity.
Inside The Video Waveform
PAL television cameras divide each televised scene into 625 horizontal lines. Any one line is made up of a number of dots called pixels. Each pixel is assigned a distinct level of luminance (brightness) and chrominance (color). Every televised scene or frame of video is transmitted in two alternating fields of 312.5 horizontal lines. These interlaced fields are scanned at a rate of 50 times per second. The rate of change happens so fast (more than 31,000 lines are being scanned each and every second) that the human eye interprets the two fields as a single picture.
The horizontal blanking interval which takes place at the end of each line, contains a sync pulse, a kind of control signal that turns off the TV picture tube's electron gun while the beam is repositioned to start the next line. The vertical blanking interval, which takes place at the end of each complete field, also contains a sync pulse that commands the electron gun to move back to the top of the screen before scanning the next field of 312.5 lines.
Soft Video Encryption Systems
The analogue (i.e., non-digital) scrambling systems developed for satellite transmission most often encrypt the video by stripping away the vertical and horizontal sync pulses prior to uplinking the signal. Without these control signals, conventional TV sets are unable to determine just when to begin tracing each new line within a field or when a new field begins. The satellite uplink's encoder also creates a negative image by inverting the video signal. Examples of analogue encryption include the E-PAL system used by Indosiar and various Australian broadcasters.
As another security precaution, some analogue scrambling systems relocate the chroma color burst signal to a non-standard frequency which only the IRD's descrambler module can detect. A special digital sync pattern transmitted by the uplink also commands the IRD to regenerate the proper horizontal and vertical sync pulses internally, so that the unencrypted video can be displayed on conventional TV screens.
In some encryption systems, such as the one used by GMA on Palapa C1, an optional Scene Change Detector can be used to detect scene changes and alternate the scrambling mode during intervals when the video content changes abruptly. Multiple inversion modes are available, with the video inverted on either a field-by-field or individual line-by-line basis. A random inversion mode also is available, where the video is inverted at non-standard intervals from a positive to a negative image and back again.
Security Features. Every descrambler module is assigned a multi-digit unit address number that has been pre-programmed into its electronic circuitry. This unique address code is displayed on the TV screen whenever the 'set up' 1 mode (or manufacturer's equivalent) is selected from the IRD's handheld control. Commercial users such as a cable system operator, as well as consumers in the case of DTH systems, must supply the programmer with the units address number whenever ordering a scrambled service.
Some video encryption systems also feature a security smart card that is about the size of a typical credit card. In the case of a system using a smart card, the IRD's descrambler module will have a corresponding security card reader slot on its chassis. The smart card itself, however, may only be distributed if the encryption system is compromised and programmers elect to migrate to a higher level of security.
The security card consolidates multiple encryption features into a single, high-security electronic Super Chip which contains a special set of mathematical algorithms that must reside within a decoder's circuitry before encrypted signals can be unscrambled. Each encryption system operator is provided with a computer system and software which can only address those decoders assigned to their respective networks. The decoders for other services using a specific system cannot be readily addressed without first obtaining access to the appropriate software.
Signal Authorization. The subscriber's IRD address number is forwarded on to the programmer's Authorization Access Center. From there, a specific authorization message is sent over the satellite which activates the individual IRD and instructs it to decode the particular service or services. The entire authorization process can be completed in a matter of seconds. The programmer also can remove each IRD's unique authorization message from the data stream at any time. Without the authorization code, the IRD will no longer be able to decode the encrypted signal.
Some of the latest encryption system also includes electronic countermeasures that can be used to shut off illegally-modified descramblers if the system ever is compromised in the future. Most encryption systems employ tiers: special encrypted data codes which are allotted to each program provider. Each program provider within a program package is assigned one or more unique tier bits, with each bit capable of authorizing reception of either a single pay TV event or full-time subscription service or an entire package of subscription services. The Conditional Access data is inserted into the vertical blanking interval of the video signal. The more lines allocated to this data stream, the greater the number of decoders which can be addressed in a given authorization period.
During the authorization process, if the program doesn't automatically appear on the screen, the service representative will ask the subscriber to press a 'SET-UP' button (or manufacturer equivalent) to display an informational chart, called the Diagnostic Data chart, on the screen of the TV set. The service representative asks the subscriber to read off these 'hidden' codes to determine just why the subscriber is not receiving the transmission.
Audio Encryption
Many satellite TV encryption systems rely on video encryption as a deterrent to unauthorized reception. The audio portion of the TV program remains accessible to anyone with a satellite TV receiver. Programmers may even prefer to have the audio unencrypted as a way to make satellite TV viewers aware of the potential availability of their services.
Scrambling systems which digitally encrypt the audio signals have been developed for those programmers who may require secure transmission of both the video and audio components of their programming. At the uplink, the audio encoder converts the sound portion of each TV program from an analogue to a digital signal expressed as binary numbers which correspond to the 'off' (0) and on (1) logic states of computer circuits. Audio pitch and intensity are therefore expressed as a stream of binary digits or bits. While standard analogue audio signals are sent in real time, digital signals are sent in bursts of pulses, then stored and released over time to recreate the original sound. The horizontal blanking interval of the video signal transmits the digital audio channels and one or more utility data channels.
This digital audio bit stream is encrypted according to a kind of formula known as an algorithm. Each digital audio sample is added to a key: a random sequence of binary numbers created by the algorithm. Only those downlinks which possess the correct key can translate the binary digits into the original signal.
Digital audio represents the ultimate method for delivering superb sound directly to homes and cable head-end systems. The conversion of the sound to a digital signal prior to encryption allows satellite system to receive an unparalleled level of fidelity which approaches the dynamic range (S/NR of 90 to 95 dB) achieved by the compact disc player.
Compact discs use a 16-bit pulse code modulation (PCM) source to deliver a theoretical dynamic range of 98 dB. VCRs uses a 15-bit PCM source code with a theoretical dynamic range of 92 dB. IRDs typically achieve a minimum dynamic range of 75 dB, with most achieving an 80 dB dynamic range.
Special error coding information also is included in the digital bit stream which allow the IRD to detect and correct errors caused by the introduction of noise during the transmission process. These pulses are sent at a high bit rate in each video line's the horizontal sync pulse. All single-bit errors can be detected and corrected and all double-bit errors concealed. Since only signal is detected, noise is eliminated.
With audio spectrum inversion, the audio baseband is reversed, i.e., high frequencies become low frequencies and vice versa.
In analogue systems, the noise is amplified along with the signal. The removal of audio subcarriers from the satellite transmissions also results in more of the transponder's power being supplied to the video signal, thereby significantly improving the overall performance of the receiving system.
Analogue audio encryption systems also are available. In this case, the sound information may be superimposed on a low frequency sine wave or the audio spectrum inverted to deprive audio access to conventional satellite TV receivers and IRDs. Audio scrambling, however, has proven to be very popular as most programmers prefer to give unauthorized viewers a taste of what they are missing.
Hard Encryption Systems
Satellite TV broadcasters such as STAR TV (VideoCrypt and STARCrypt), TNT/Cartoon Channel (VideoCrypt on Apstar 1), RTM-1 and RTM-3 use a hard encryption format which digitally encrypts both the video and audio components of the TV signal. Through a process known as line translation, segments of each digitized line of video are sampled by the encoder and converted into digital values. The digitized line segments are then cut and rotated so that the segments within each line are shuffled out of order and reassembled at either side of the cut points. Each line has different cut points; all vertical information in the picture is broken up: stepped back and forth across the screen with each line and in a sequence that changes from field to field. The audio may also be digitally encrypted if required along the lines previously mentioned in this chapter.
The cut points for each line are chosen at random by a Pseudo Random Binary Sequence (PBRS) generator which is synchronous with both the uplink transmitter encoder and downlink receiver decoder. As the uplink encoder periodically interrupts and restarts the final control algorithm, the encoder must send a special seed code to the decoder to tell it just when and where to re-start. This keeps the decoder dynamically locked to the uplink PBRS. New seeds are generated and transmitted periodically to each authorized decoder in the system. This seed, which also is encrypted, is transmitted within the TV signal's vertical blanking interval. The algorithms needed to unlock the encrypted seeds are either embedded in a tamper-proof medium within each decoder or supplied by the subscribers security card. They can be changed at any time to thwart piracy.
The decoder performs the complementary cut-and-rotate operation, patching each line back together at the correct point to reconstruct the original picture. Data for the cut points is derived from data transmitted in the video's vertical blanking interval.
B-MAC
Scientific-Atlanta's B-MAC (Multiple Analogue Component, Type B) scrambling system is used by numerous satellite programmers and service providers. Within the Asia-Pacific region, users of B-MAC include HACBSS and RCTS service providers in Australia, the Indovision DTH program package on Palapa C2 (HBO, ESPN, Discovery Channel, and TNT/Cartoon Network) various program providers using the Apstar 1 satellite (Discovery Channel, Disney Channel, ESPN, and HBO) Channel 9 Australia and Hong Kong/Macao horseracing service providers.
B-MAC encryption offers hard video security through a technique known as line translation scrambling. Each line of video information is delayed by several microseconds, creating B-MAC's characteristic diamond-hatched pattern. Only those terminals equipped with decoders that are addressed by a packet of data contained in the vertical blanking interval of the B-MAC signal can descramble the signal. B-MAC's horizontal blanking interval contains up to six digitally-encrypted audio channels and one utility data channel.
While B-MAC does supply customers with relatively-secure and addressable communications signals, it is not just another scrambling system. B-MAC provides the additional benefit of increased signal performance at low carrier-to-noise levels when compared to an NTSC video transmission. B-MAC's improvements over NTSC equates to savings for users, since they can use smaller, less expensive ground stations on the receive portion of the network. B-MAC sequentially transmits the color information in one-third the active scanning time of each frame and the monochrome information in two-thirds the active scanning time. This prevents the chrominance and luminance signals from interacting with each other, thereby generating unwanted artifacts in the video. The video performance is further improved by the use of a digital sync pulse.
| color information | | monochrome information |
By displaying the video's vertical blanking interval, the individual lines which carry various signals can be displayed. Line one transports the digital clock recovery signal, line two carries the digital sync recovery signal, line three sends the system data, lines four through nine handle the address data packets and lines 10 through 15 hold teletext packets. The horizontal blanking interval can contain as many as six 204 kb/s digital audio channels and one 63 kb/s utility data channel.
Display of B-MAC Vertical Blanking Internal (right)
The digital encryption standard key to the line delay pattern for any service can be changed at frequent intervals, precluding a one-time cracking of the code. Only those terminals equipped with B-MAC decoders which are addressed via a packet of data contained in the vertical blanking interval can switch on and decode the signal.