CM5000 User Manual
UM-CM5000-FW3.5.2.0-REV0.0
2019-07-08
www.ateme.com
Page 116
Appendix F. BISS-CA
F.1. Overview
BISS-CA (EBU Tech 3292-s1) is a conditional access system based on open cryptographic standards. It uses a com-
bination of symmetric and asymmetric ciphers to protect the transmitted content and entitle or revoke, in real-time,
any targeted receivers in an interoperable manner.
Figure F.1. Overview
How it works:
Basically a decoder will be able to descramble the TS stream if it can decrypt a table within the TS with its private
key (pem file).
This can be done only if the table has been encrypted by the encoder with the corresponding public key.
Encoder side:
• The TS stream is scrambled using the DVB-CISSA algorithm with a randomly generated Session Word (SW). The
SW is periodically modified to improve the stream's security.
• The SW is encrypted with a symmetric cipher (AES-128) using a randomly generated Session Key (SK). The
encrypted SW (ESW) is transmitted to the IRD via Entitlement Control Messages (ECM).
• The SK is encrypted individually with an asymmetric cipher (RSA-2048) using the public key of each registered
receiver. The set of encrypted SK (ESK) is transferred to receivers via Entitlement Management Messages (EMM).
Each time a decoder is added or revoked to the entitlement list, the session key is regenerated.
Decoder side:
• Using its private key, the decoder can descramble its corresponding EMM section and recover the SK key.
