Features
User Manual for AZ110 Broadcast Satellite Modulator with ASI interface
version 3.2
89
SHAPING THE FUTURE SATELLITE OF COMMUNICATIONS
8.3.2.4
Use of Group Key
The group key can be used in two ways:
•
A unique group key is defined for each device. In that case, a different
encrypted content key needs to be sent to each device. This key is unique and
the operator is guaranteed that if the key is intercepted, it cannot be used on
another device (unless the group key is known).
•
A group key is defined for a group of devices. Devices from region A share the
same group key, while devices from region B share another group key. In this
case, the same encrypted content key (let’s say protected with the group key of
region A) can be broadcasted to all devices. Only devices of region A will be
able to receive the content. The same procedure can be used to separate
receivers from two different sub-networks and it can also be used to separate
receivers dedicated to different purposes.
For 64-bits keys, some restriction applies. As the DES encryption is used to protect
the encrypted content key, it is not possible to use a weak DES key as a group
key. Weak DES keys are listed in Appendix E at the back of this manual.
8.3.2.5
Seamless Key Change
The AES key management system is designed to allow the change of an
encryption key during a transmission without interrupting the stream, if the
demodulator stores the same content keys than the modulator.
Demodulators can detect which key (odd or even key) is currently in use. When the
modulator switches from one key to another, the demodulator automatically detects
the change and switches to the other key in a frame-synchronous way. This way,
the demodulator always uses the proper key to decrypt the baseband frames. No
interruption or glitch appears at the output of the demodulator.
By changing the unused key on the modulator and demodulators, it is possible to
switch again the key in the network.
8.3.2.6
Protection
DVB-S2 allows the transmission of several streams over satellite at the same time.
The different streams are all encapsulated in baseband frames and each stream is
linked to a different input stream identifier or ISI. The ISI-values are used to
separate all streams again at the reception site.
The AES encryption mechanism works as follows:
All different DVB-S2 streams are encrypted with the same content key. One pair of
odd and even content keys or one pair of odd and even encrypted content keys
can be entered in the modulator.
