DVB SimulCrypt conditional access¶

media.access.cas

Sapsan supports DVB SimulCrypt scrambling of live MPEG-TS output. Media is protected with DVB-CSA2, while an external conditional access system — CAS — generates the messages that allow a receiver to obtain the keys.

The setting applies to one stream and its common SPTS output: one program in the transport stream. This is the media.access.cas feature. Encryption of a multi-program multiplex, listed in the tariff feature set as media.mux.simulcrypt, is a separate capability; the implementation described here does not imply that it is available in Sapsan.

How the system works¶

Communication with CAS components uses the ECMG–SCS and EMMG–MUX interfaces from ETSI TS 103 197.

A CW — control word — is a scrambling key for a particular crypto period. In this implementation, Sapsan generates the CW; the ECMG uses it to generate an ECM message according to the supplied access criteria.

Operation repeats in a cycle:

1. Sapsan establishes a TCP connection to the ECMG and opens a session for the stream.
2. Sapsan generates CW in advance and sends them with access_criteria in CW_provision messages.
3. The ECMG returns ECM for the corresponding crypto periods.
4. Sapsan scrambles media PID payloads and inserts ECM into the transport stream. A CA descriptor appears in the PMT, identifying the conditional access system and ECM PID.
5. At crypto period boundaries, the next CW are used with alternating even/odd indicators. Rotation timing follows the stream's PCR.

ECM and EMM serve different purposes. ECM allows an authorized receiver to obtain the CW for a program. EMM delivers entitlements to the subscriber's conditional access facilities. Sapsan accepts ready-made EMM from the CAS vendor; subscriptions and message content are managed by the external system.

Which outputs are scrambled¶

The mpegts.encryption section is configured at stream level. Scrambling runs once before the common MPEG-TS output is distributed to consumers:

• UDP, including RTP encapsulation — outgoing MPEG-TS push.
• SRT — MPEG-TS push and live SRT delivery.
• RIST — MPEG-TS push.
• HTTP MPEG-TS — continuous live delivery of the common TS output.

Multiple such destinations share one CAS context. This section cannot configure a separate ECMG or key for each push: encryption inside output channel settings is rejected. Selecting individual tracks with tracks on an encrypted stream's MPEG-TS push is also unsupported.

Output PID and PSI settings can be applied on top of the common scrambled stream.

Scrambling this output does not enable protection for other delivery methods. In particular, it does not encrypt DASH/fMP4 or HLS segments, protect RTMP output, or encrypt DVR recordings. A separate DRM feature protects HLS/DASH. Access to other outputs must be configured separately.

ECMG configuration¶

Configuration is supplied through the central API. The following YAML fragment defines a stream with a UDP input and scrambled UDP output:

streams:
  - name: tv1
    inputs:
      - udp:
          host: 239.0.0.1
          port: 5000
    mpegts:
      pnr: 1
      pmt_pid: 1020
      pids:
        v1: 101
        a1: 102
      service_name: TV1
      encryption:
        type: simulcrypt
        ecmg: "192.0.2.10:2222"
        cas_id: "4ae10006"
        ecm_pid: 100
        ecm_id: 1
        access_criteria: "0303010000000000"
        ecm_private_data: "15"
        nominal_cp_duration: 15
    pushes:
      encrypted-out:
        udp:
          host: 239.1.1.1
          port: 5500

Replace addresses and CAS values with those agreed with your vendor. The v1 and a1 identifiers in the example must match your stream's tracks. The subscriber device's entitlement to the selected program must be configured in the CAS.

Supply hexadecimal values as quoted strings. Explicitly assigned PIDs must be in the range 32–8190 and must not conflict: media, PMT, ECM, and EMM PIDs must be distinct.

The current ECMG client uses protocol version 3. Agree on crypto period parameters and compatibility with the specific ECMG with your vendor: receiving its channel_status does not imply support for every advertised timing variant. In particular, lead_cw, min_cp_duration, and delay_start/delay_stop do not constitute a fully implemented automatic timing configuration mechanism.

EMM delivery¶

If entitlements must be delivered through this transport stream, add the following fields to the same mpegts.encryption section, retaining the ECMG settings:

emmg_listen: "0.0.0.0:2233"
emm_pid: 200
emm_private_data: "15"
emm_bitrate: 500

The connection direction is reversed here: Sapsan listens on a TCP port, and the vendor's EMM injector connects and sends ready-made messages. Sapsan inserts them into the specified PID and announces it through a CA descriptor in the CAT.

Each stream with EMM creates its own listener. Choose available addresses and ports without conflicts for streams running simultaneously. ECMG connectivity requires outbound TCP access; EMM delivery requires inbound TCP access from the injector.

The EMM path is optional: scrambling can work when entitlements reach the device by another method. ECM availability without valid entitlements does not guarantee decoding at the subscriber's device.

Message insertion and failure behavior¶

ECM and EMM replace null packets. The filter preserves the number and order of TS packets and the position of PCR. ECM takes priority over EMM. Timely delivery requires sufficient null packet capacity; if it is insufficient, ECM insertion is deferred.

Check CBR generation and stuffing when sizing the output stream. A successful ECMG session alone does not confirm that ECM is already entering the transport stream at the required rate.

When no valid CW is available, Sapsan blanks media packet payloads, retaining headers and adaptation fields containing PCR. ECMG failure does not switch this MPEG-TS output to clear media delivery. PSI/SI and conditional access messages remain unscrambled so the receiver can parse the transport stream.

The client reconnects to the ECMG automatically with an increasing delay. Prepared keys may cover a brief connection outage. If keys for subsequent crypto periods run out, playback is interrupted until key delivery resumes.

Changing the ECMG address or CAS session parameters recreates the session and may cause a pause until new ECM arrives. Removing the encryption section disables scrambling — a configuration change distinct from an ECMG network failure.

Monitoring¶

On the streamer performing scrambling, request statistics for one stream:

curl -fsS -u "$ADMIN_USER:$ADMIN_PASSWORD" \
  http://streamer:8080/streamer/api-v4/streams/stats/tv1 \
  | jq '{name, cas}'

The cas section provides three cumulative counters:

Compare values over an interval. Counters survive CAS component recreation, and the cas section may remain after encryption is disabled. Its presence alone does not confirm that scrambling is currently enabled. Compact central statistics do not replace a request to the streamer performing scrambling for these detailed counters.

When metric export is available, /streamer/api-v4/live-metrics contains:

• stream_cas_scrambled_packets_total — scrambled packets.
• stream_cas_ecm_received_total — received ECM.
• stream_cas_ecmg_errors_total — ECMG errors.

Details of CW rotation and ECM insertion delays are available in the streamer logs. Media blanking and EMM counters are also reported there. These additional indicators are not included in the public cas section.

Verification before deployment¶

1. Agree on identifiers and access criteria with the CAS vendor. Check support for the ECMG protocol version and selected crypto period.
2. Apply the configuration and confirm that ecm_received_total increases and that ECMG errors are absent or their cause is understood.
3. Capture the output MPEG-TS and check the PMT CA descriptor and ECM on the announced PID. When delivering EMM, check the CAT and corresponding PID.
4. Check media PID scrambling and actual playback on an authorized receiver. Server counters alone are insufficient for this check.
5. Interrupt the ECMG connection in a controlled way. Check media blanking after prepared keys run out and playback recovery after the ECMG returns.
6. For multiple delivery destinations, check every output, including overridden PIDs and PSI settings.

The current configuration defines one CAS context and one ECMG per stream; there is no list of simultaneously connected CAS providers. DVB-CSA2 is supported; this section does not offer CSA3 or AES selection. Compatibility with a specific vendor's ECMG and subscriber equipment must be verified in an end-to-end test.