APPROACHES TO SECURITY AND ACCESS CONTROL FOR DIGITAL CABLE TELEVISION Claude T. Baggett Cable Television Laboratories, Inc. Louisville, CO 80027-1266 Abstract cable system size, services, operating philosophy, and access to capital. This paper addresses the several design trade-offs which should be considered by a system operator in selecting a security and In analog television, there is basically only access control sub-system for protecting digital one decision which must be made for access television signals on cable television systems. control; that is, whether to descramble the Factors are discussed which have a strong incoming signal or not. The same descrambler impact on the strength, adaptability, and cost in the set-top converter is used whether the of such systems. The principles discussed in system has one scrambled channel or many. this paper apply whether the primary source of The sophistication and depth of the scrambling security and access control in the subscriber mechanism is limited because the analog signal home is found in a set-top decoder, a decoder is very difficult to reconstruct without leaving interface unit, a home server, or as an insertion unacceptable artifacts in the visible picture. in an MPEG-capable computer or television Therefore, with only one, very limited, receiver. process to protect the analog television signal, meaningful security is difficult. Some later systems, which use line shuffling under the SCOPE control of a modem cryptographic system and hard-encrypted audio, are much superior in This paper will address the options which this aspect, but are costly and have come too system operators should consider in choosing late relative to the advent of digital television. a security and conditional access system for their digital television signals. It will not address cryptographic and key handling To protect digital signals, four basic processes in depth, but only as required to mechanisms are utilized. First, a explain the trade-offs in system selection. cryptographic algorithm is defined for the headend which will take the digital signal and scramble the binary characters so thoroughly BACKGROUND that no practical amount of analysis will regain the original signal. This same mechanism is There are a number of options and design used to reconstruct the signal in the subscriber trade-offs which must be considered in order home. If this were all that was possible with to optimize the digital security and access digital scrambling it would still be of great control functionality to cable system needs. benefit because of the depth of the obfuscation Some of these decisions have only minor of the signal and the fact that it can be restored impact on the quality of the security sub­ to its original, pre-scrambled, condition system, but others will have a pronounced without degradation. However, digital affect on the robustness, integrity, usefulness, security is much more versatile than that. cost, and extendibility of the chosen system and its deployment. A "one size fits all" approach to the functionality and features of The second basic mechanism is the the security and access control system is not electronic key-literally a long binary word­ appropriate because of the great variation in which controls the scrambling and descrambling processes in the cryptographic 1997 NCT A Technical Papers -58- unit. The cryptographic algorithm itself is DEFINITION OF TERMS useless without the electronic key. Furthermore, unlike analog scrambling, a The following terms are either used in this different electronic key can be used for paper or are considered important to the differentiated services. Multiple keys can be understanding of digital security systems. used to protect a tier of services, a single digital channel, or a specific string of digital Algorithm: A mathematical process which can data such as a control channel, a pay-per-view be used for the scrambling and descrambling event or a multimedia display. Keys can be of a data stream. symmetric, meaning that the same exact binary word is used to scramble and descramble the Authentication: The process by which one digital data; or they can be asymmetric, party can ascertain with certainty the meaning that the key used to descramble the identification of another party. signal is different from the one used to scramble it. Keys must be generated, Authorization Coding: A digital word which managed, protected, transmitted, and utilized, describes the personality or service access thus forming the key management and capability of the subscriber decoder unit. This distribution system which is the most critical code word, which is based on the service part of the security process. access authorized by the billing system, determines which keys are distributed to each customer, and is required at the subscriber The third basic part of this system is called decoder to authorize the descrambling of any the entitlement/authorization message or specific program. matrix. Originally, this was just a matrix of two columns by the number of rows equal to Conditional Access System (CA): The the number of occupied channels on the cable complete system for ensuring that cable system. If a given channel had a binary one in services are accessible only to those who are the second column it was authorized for entitled to receive them, and that the ordering descrambling, and if a zero was placed there of such services is not subject to modification the customer was not authorized to receive it. or repudiation. This matrix was encrypted for transmission and stored in the secure microprocessor in the Cryptanalysis: The science of recovering the access control system. Now, a cryptographic plain text of a message without access to the system, somewhat like the master key systems key (or electronic key in electronic used in buildings, can be devised which cryptographic systems). convert the simple authorization matrix into a cryptographic process, thus making it much Cryptographic Duty Cycle: The maximum more difficult to defeat. secure capacity of a cryptographic process, based on total data throughput on a single key vector. The fourth part of the system is a secure signature mechanism. Secure signatures make Descrambling: The process of reversing the it possible to guarantee the identity of the scrambling to yield usable pictures, sound, and sender of the digital message and to verify that data services on a cable system. the message has not been modified en route. This is especially useful in key distribution, Electronic Key: The term for data signals certain control messages, and in purchasing. which are used to control the descrambling process in subscriber decoders. There are at least three types of electronic keys referenced The specification of these four mechanisms in this Recommendation, including those used involves the consideration of the intended for television signal streams, those used for application, technology issues, threats and protecting control system operations, and those countermeasures, governmental policy and used for the distribution of electronic keys on regulation, costs, and desirable additional the cable system. While the Authorization features. 1997 NCT A Technical Papers -59- Coding is effectively a key, it is treated Knowing the public key does not reveal the separately in this section. private key. Therefore, Party A would devise such a private and public key, and send the Encryption: The process of scrambling digital public key openly to all who might wish to signals to avoid unauthorized access. communicate with Party A, but retain the private key in secret. Then, while any who Host: A device with generalized functionality have the public key can encrypt a message for where modules containing specialized Party A, only Party A with the private key can functionality can be connected. decrypt the messages. Also known as a Private-Public Key (PPK) system. Integrity: The ability of a function to withstand being usurped for unauthorized Scrambling: The process of using an usage, or modified to yield unauthorized encryption function to render television and results. data signals carried on a cable system unusable to unauthorized subscribers. Intrusion Resistance: The ability of a hardware object to deny physical, electrical, or Secure Signature: A mathematical process by irradiation-based access to internal which the origin and integrity of a transmitted functionality by unauthorized parties. message can be ascertained. This means that the originator cannot deny having sent the Module: A small device, not working by message, and the receiver can determine if the itself, designed to run specialized tasks in message has been modified. association with a host. Transport Stream: An MPEG-2 (Moving National Class Laboratory: The primary Pictures Expert Group) or other data digital source for cryptanalysis in a national transport stream. government. Non-Repudiation: A process by which the DESIGN CONSIDERATIONS sender of a message cannot deny having sent AND TRADE-OFFS the message. Since this paper will not address One-Way Hash: A mathematical process or cryptographic algorithms in depth, it appears algorithm whereby a variable-length message useful to dispose of this topic first. For many is changed into a fixed-length digital word, years now, the approved civilian cryptographic such that it is very difficult to calculate the process in the United States has been the original message from the word, and also very Digital Encryption Standard, or DES. DES difficult to find a second message with the has several operational modes in order to be as same word. widely applicable as possible. The National Institute of Standards and Technology (NIST), Pay-Per-View: A payment system whereby the government agency responsible for civilian the subscriber can pay for an individual cryptography, has approved DES for use program or programming period, rather than through approximately 2003, but plans to have for a full-period terminated service. a new encryption standard in operation by that time.