Last time, this column summarized the high points (and there are plenty) of the Federal Communications Commission’s St. Patrick’s Day rules about “navigational devices” — meaning digital cable set-tops, or other devices, like TVs, that contain them.
The big surprise was the optimism, albeit guarded, over a new way to protect video programming. It was surprising because it hadn’t really been discussed outside of small, very brainy technical circles — until the FCC’s new rules came out.
The new thing: Downloadable security, which also appeared in the ruling as “downloadable conditional access,” “downloadable CA,” “software-based conditional access,” “a software-oriented conditional-access solution,” and “a software downloadable security system.”
Two things climb out of that jumble of terms. One, it’s about making sure that certain video programming is contained to customers who pay extra for it. Two, it’s a software thing, electronically delivered to devices.
Which seems to beg the question: How did we get here? What is so devilish about current implementations that a do-over is in the works?
This translation will focus on the origins and rudiments of conditional access and encryption.
HOW WE GOT HERE
Once upon a time, in the early ’90s, cable technologists started noodling about how to go digital with video. In my memory, the early work on digital video roughly coincided with the moment in time when music stores moved all the cassette tapes into the corner, because everything was CDs.
Video started to go digital partly because it was the next logical progression, after audio. Then there were the obvious quality drivers — pristine digital. No squiggles, no snow. Plus, the satellite guys were gearing up to do it. And, most importantly, digital brought the ability to compress, which meant “more, more, more.”
My notes from a technical event in 1992 contain plenty of remarks about the “more, more, more” part. Technologists pointed out that most Americans, given a choice of whether to use their VCRs to record more material or to record the same material at better quality, usually picked “more” over “better.” Digital gave both: More and better.
GETTING SCRAMBLED
In those days, as now, cable providers offered scrambled services. The unscrambling, for premium customers who paid extra, was handled by an equipment duo: The “addressable” set-top box, and the headend part.
Going digital mapped that same path. Traditional set-top suppliers cooked up digital headend devices — the “DNCS,” or “digital-network control system,” in the case of Scientific-Atlanta, and the “DAC” or (digital addressable controller) in the case of Motorola.
At the time, nobody was thinking, “Gee, if we do it this way, we’re going to be locked into these vendors for the rest of our lives.” Or, if they were, the excitement of getting a digital package to market won out.
It is that tight coupling between digital-video headends and digital boxes that thumped a big headache onto anyone else wanting to come into the market with a box. In order for new boxes to do anything other than provide “basic” services, they needed a latch into the headends of the incumbents. (And the latches are considerably different, from one to the next.)
There are roughly ten thousand headends in the United States, and 70-some million cable customers, most of whom own more than one TV. If you’re in the business of making the gear that provides digital cable, the math is pretty easy: The business is in the boxes, and the headend keeps that business yours.
That’s a simplified version of how we got here, in terms of the two incumbent box suppliers, and the tight coupling between headends and devices; the blessing and the curse.
WHAT’S IN A CA SYSTEM
If you were to take apart a digital conditional-access system and peer into its constituent parts, you’d be looking at four chunks of stuff.
The first is the “authentication.” That’s the initial conversation between a set-top box and a headend controller. If it were done in words, not bits, and if you could hear it, you’d hear something like this.
Headend to box: Are you who you say you are?
Box: Yes.
Headend: Prove it.
Box: Are you who you say you are?
Headend: Yes.
Box: Prove it.
The second chunk is the authorization: The headend resolving what services a customer is set up to see or hear. If you’ve ever overheard engineers talking about “ECMs” and “EMMs” — tech-speak for “entitlement control messages” and “entitlement management messages” — you’ve landed in the conversational zone of authorization mechanisms.
SET-TOP GATEWAY
The third chunk is the encryption itself — the scrambling of the digits that comprise the pictures and sound, in a way that can only be sorted out by the box. It’s the secret sauce.
Lastly, there’s a signal path — usually “out-of-band,” meaning that it isn’t associated with any particular 6 MHz channel. These days, technologists tend to equate the signal path for conditional access with “DSG,” which is shorthand for “DOCSIS Set-top Gateway.” It’s an embedded cable modem that’s fundamentally used for “command and control” mechanisms, like conditional access.
That’s how we got here, and how the rudiments of a conditional-access system fit together. Next time, more on how that set of tasks morphs into “downloadable security.”
