Conditional Access and SMS in a Digital Headend

A free-to-air lineup and a pay-TV lineup are built from the same boxes until the moment money changes hands. Once channels are sold rather than redistributed, two systems appear beside the headend: a conditional access system that scrambles the streams, and a subscriber management system that decides who is allowed to descramble them. Buyers often shop for one and find they need both, because neither works alone. A CAS with no subscriber database cannot know who has paid, and an SMS with no CAS can record a payment but cannot enforce it.

This guide follows the order an operator actually builds the pair in: what each system does, how they exchange commands, where scrambling physically sits in the chain, which deployments genuinely need them, and which published figures in this catalogue decide the hardware. Every value below is printed on the product page of the model it belongs to, and where a parameter is not published we say so instead of estimating it.

Where this pair sits in the receive-to-scramble chain, and what comes before and after it, is set out in the headend core guide.

What Does a Conditional Access System Do in a Digital Headend?

A conditional access system encrypts the transport stream so that only authorised receivers can watch it. It generates the control words that scramble each service, wraps them into entitlement messages addressed to individual set-top boxes or cards, and keeps the key material together with the logs that show who was authorised at a given moment.

Two message types carry that work, and the difference between them explains most support calls on a pay-TV headend.

A receiver opens a channel by combining the two: the EMM tells it that it owns the product, and the ECM hands over the key. That is why a subscriber whose payment lapses can keep watching until the next EMM is processed, and why an operator who needs a fast cut-off has to know how quickly the CAS pushes bulk entitlements rather than how quickly the invoice was raised.

Inside the headend the CAS behaves as a server beside the chain, not as a card in a rack. The scrambling stage asks it for keys, and the SMS writes entitlements into it. Both of those connections are standardised interfaces, which is what makes a multi-vendor headend possible: scrambling hardware from one supplier runs against a CAS server from another as long as the interface versions match, and that match is a question to settle at quotation time.

One implementation choice follows from the receivers you already own. A card-based CAS keeps the keys in a smartcard inside each set-top box. A cardless CAS keeps them in the receiver's secure chip and identifies the device by chip ID or virtual card number. Cardless removes card logistics and card cost, and it depends entirely on the chipsets in your fleet, so the receiver list belongs in the first conversation rather than the last.

What Does a Subscriber Management System Take Care Of?

A subscriber management system is the business layer of the same arrangement. It holds the customer record, the package that customer bought, the payment history and the status of the receiver. It is the only system allowed to activate or deactivate a subscriber, and it passes that instruction to the CAS as an entitlement change.

Most of its functions are back-office, but each one shows up in the field:

• Subscriber records and packages. Who the customer is, which services and bouquets they hold, the tariff applied to each, and the start and end date of every entitlement.
• Activation and deactivation. The command that creates, suspends or resumes a receiver, one at a time or in bulk.
• Device pairing. Binding a set-top box to its viewing card, or to the chip ID in a cardless system, so a card cannot be moved into another receiver.
• Stock and dealer accounts. Warehouse stock, units held by dealers, and sub-accounts so a local operator or a hotel can activate its own receivers inside limits you set.
• Billing and reporting. Invoices, prepaid and postpaid cycles, payment-gateway integration, and the subscriber and revenue reports that feed settlements with channel owners.
• Logs. A date-stamped record of who changed what, which is the part auditors and content owners ask for.

The name collides with text messaging, so it is worth reading the two uses apart. In broadcast work, SMS means subscriber management system. The FUQ-SMS platform page also lists SMS-based mobile charging among its features, which is the payment side rather than the naming side: prepaid top-ups and charging tied to a mobile number.

Where a property sells a paid in-room package, the SMS usually has to talk to the property management system as well, so that a guest's entitlements appear at check-in and expire at check-out. That integration is the reason hotel projects ask for APIs early, and it is the same reason a billing platform matters as much as the headend hardware in a hospitality quotation.

How the Two Systems Stay in Sync on One Subscriber

Every entitlement starts on the business side and ends inside the receiver. The SMS writes the change into the CAS, the CAS addresses it to one receiver inside the broadcast stream, and that receiver opens the service when the next control word arrives. Six steps, one audit trail.

Two rules make that trail verifiable, and in some markets both are written into regulation.

The first is separation. CAS and SMS run as separate applications with separate databases, and activation or deactivation is never executed straight from the CAS terminal, bypassing the SMS. The second is logging. Each command is recorded in the CAS logs with a date and time stamp, the logs cannot be altered afterwards, and the SMS can produce a synchronisation report that traces a mismatch between the two databases.

India is the market where this is set out most completely, and it is a useful model even where it does not apply to you. The regulator's addressable-system rules require CAS and SMS to be separately identifiable, forbid commands that bypass the SMS, require the synchronisation report between the two databases, and require the head-end to queue messages that fail in transit and retry them. Certification runs through the national test agency against published test guides, and ITU-T J.1036 states the equivalent requirements for factual subscriber reporting internationally. If your network operates under such a regime, the certification status of the CAS you buy is a procurement question, not a footnote.

Where Scrambling Sits in the Headend Chain

Scrambling is a processing stage, not a separate cabinet. It happens inside the multiplexer, or inside the combined multiplexer-scrambler-modulator chassis, between the point where the streams are grouped and the point where they are placed on a carrier. The CAS server stands beside the chain and supplies the keys it uses.

Two practical consequences follow from putting the stage there.

• You choose which services are scrambled, not the whole network. A lineup normally mixes free-to-air channels with a paid tier, and the free channels are simply left in the clear.
• The scrambling standard is a datasheet line, and it is the first thing a CAS vendor asks for. The rows that matter in this catalogue are ETR289 for the common scrambling algorithm, with ETSI 101 197 and ETSI 103 197 for the DVB head-end interfaces.

Units that publish a scrambling function also publish how that scrambled connection is reached, local or remote, which is the difference between commissioning the box from its own front panel and driving it from the CAS server over the network. On a single headend the distinction rarely matters; across several sites managed from one CAS, it decides the design.

Which Deployments Need the CAS and the SMS?

A free-to-air redistribution needs neither system. The pair becomes necessary as soon as an operator sells access to channels or events, restricts viewing by room or account, or has to show a channel owner who received the signal. The table below is the decision most projects actually face.

The rows that answer yes have two things in common: money changes hands per receiver, and a third party wants a report. That is the pair's real job - enforcement for you, and evidence for the channel owner.

Scrambling-Capable Hardware Published in This Catalogue

The shortlist can be built from published spec rows rather than promises. Every model below prints its scrambling standard, its input and output counts and its capacity on its own product page, and the standard published across the range is ETR289 with ETSI 101 197 and ETSI 103 197.

Two rows deserve a note before either goes on a quotation.

• The FUQ-4455B publishes ETSI 101 197 and ETSI 103 197 but not ETR289 on its page. Where a CAS vendor insists on the full set on the datasheet, specify a model that prints all three, and confirm the interface version in writing either way.
• BISS is a contribution scrambling method rather than a CAS with subscriber entitlements. It protects a feed between two known points; it does not meter households. Projects that need both run BISS on the link and a CAS on the retail side.

In the multiplexer range, the FUQ-4823C is a third option with tuner inputs and 5 MPTS outputs. Its page does not print a scrambling standard, so ask us for the datasheet before it is specified into a CAS project rather than assuming it.

The CAS and the SMS as Products

Two entries in the catalogue are the systems themselves rather than the boxes they drive. The FUQ-1.0 is a conditional access system with a companion smartphone app for subscriber management, published as supporting DVB standards, remote authorization and scalable operations, with broadcast operators and interactive TV service providers named as its deployments.

The FUQ-SMS platform is the subscriber side, published for million-level user bases with CAS-compatible interfaces, batch entitlement distribution, SMS-based mobile charging and a modular client-server architecture that runs across an IP network.

Neither page publishes a numeric specification table, and we will not invent one. Sizing a CAS and an SMS - concurrent activations, database size, redundancy model, the interface version with the scrambling hardware - is a datasheet and engineering conversation, so those figures come from us on request rather than from this page.

If the network already runs a CAS from another vendor, the practical question is whether the scrambling hardware in this catalogue can be commissioned against it. That is answered from the interface version and from the local or remote connection the unit publishes, and it is worth settling before a chassis is ordered rather than after it is on site.

The stages that feed the CAS and sit alongside it in the same rack are described in the transport stream multiplexer guide and the IRD and decoder guide.

Compliance, Certification and Interoperability

Content owners ask two questions before they license premium channels: whether the system is certified where the network operates, and whether it can run beside another CAS. Certification is a market-by-market matter, while interoperability is handled by simulcrypt and by the head-end interfaces between the CAS server and the scrambling equipment.

• Simulcrypt. One scrambled service carries entitlement messages for two or more CASs at the same time, so a network can migrate receivers gradually instead of swapping every set-top box on one date. The multiplexer has to hold several entitlement generators at once, so ask for the number explicitly.
• Interface version. The ECMG and EMMG connections between CAS and scrambling hardware are versioned. ETSI 101 197 and ETSI 103 197 are the published rows in this catalogue, and the CAS vendor's supported version is the other half of the match.
• Behaviour when the link drops. Receivers keep running on the last control words they hold, so ask how long that lasts and whether the head-end queues messages for retry when the connection returns.
• Log fields and retention. In a regulated market these are specified rather than optional: what is stamped, what cannot be edited, and how long it is kept.
• Device coverage. Card-based and cardless clients live in different set-top boxes. A chipset list, or a compatibility test on one receiver of each type you already own, costs less than discovering the gap after the order.

What to Ask a CAS and SMS Supplier Before You Buy

• How many concurrent activations can the SMS push, and how fast do bulk entitlement changes reach the subscriber base?
• Card-based, cardless, or both, and on which set-top box chipsets?
• Does the CAS support simulcrypt, and how many entitlement generators can run at once?
• Which ECMG and EMMG interface versions does it publish, and against which scrambling vendors is that verified?
• What happens to receivers when the CAS link fails, and how long do they keep working?
• What is the redundancy model for the CAS server and for the SMS database?
• How do the CAS and SMS databases stay in sync, and what report proves it?
• Which log fields, retention periods and export formats are available for an audit?
• How does the SMS integrate with the property management or billing platform you already run?
• What migration path exists from the CAS in place today, and what does it cost per receiver?
• What does support cover, and who answers at the head-end when an entitlement does not arrive?

FAQ

What is the difference between a CAS and an SMS in a digital headend?

The conditional access system scrambles the transport stream and issues the keys, so only authorised receivers can watch a service. The subscriber management system holds the customer record, the package, the payment and the device status, and it is the only system that may activate or deactivate a subscriber. The CAS enforces the decision, the SMS makes it.

Does a hotel IPTV system really need a conditional access system?

Not for a free lineup that redistributes channels the property already licences, where a plain multiplexer and modulator are enough. It becomes necessary as soon as rooms are sold a paid film package or pay-per-view: access has to stop when the guest account closes, and the film licence usually requires per-room metering and reporting.

What is the difference between scrambling and encryption in a DVB headend?

Scrambling is the process that makes the transport stream unreadable without the current control word, and it runs as a stage inside the multiplexer or the combined multiplexer-scrambler-modulator chassis. Encryption is how the CAS protects the control words and the entitlement messages themselves as they travel to each receiver. The two work together; one without the other protects nothing.

Can scrambling be added to a headend that is already running?

Yes, if the multiplexer or the mux-scrambler-modulator in the rack can talk to a CAS server, which is why the published scrambling standard and the local or remote connection matter. Where the installed chassis cannot, the multiplexing and scrambling stage is replaced or added in front of the existing modulation, and the receivers are updated with entitlements rather than replaced.

Which scrambling standards do the units in this catalogue publish?

The published rows across the multiplexer, mux-scrambler-modulator and IP QAM modulator ranges are ETR289, ETSI 101 197 and ETSI 103 197. The FUQ-4455B publishes ETSI 101 197 and ETSI 103 197 without ETR289, so confirm the interface version with the CAS vendor before that model is specified into a project.

What information do you need to quote a CAS and an SMS?

Send the network type, roughly how many receivers have to be served, whether a CAS is already installed or still to be chosen, whether the receivers are card or cardless, how many activations you expect at peak, and the scrambling hardware you plan to use. We reply with the model list, the datasheets and the factory-direct price, and we say plainly which figures have to come from the platform datasheet.

Next Step

Send the network type, roughly how many receivers have to be served, whether a CAS is already installed, whether the receivers are card or cardless, and the scrambling hardware you plan to use, through our contact page. We reply with the model list, the datasheets and the factory-direct price.

The product lines behind this guide are the multiplexer and scrambler range, the software and systems range where the CAS and SMS platforms sit, and the modulator range for the RF side of the same chain. Where the headend is being built from scratch, the headend equipment guide covers the encoder, gateway and set-top box stages, and the IP to QAM modulator guide covers the point where an IP lineup meets an existing coax plant.

Where entitlement sits in the chain: the headend core guide covers the receiver, multiplexer and scrambling stages that a CAS and an SMS control.