CDCAS3 0 en SMS Interface Specification V1.8.1

CDCAS3.0_EN_SMS Interface Specificationv1.8.
Classification:
Confidential
Scope of Distribution:
Beijing Novel-Super Digital TV Technology Co., Ltd. and SMS Manufacturers
Method of Distribution:
PDF with watermark
a l )
n ti
d e
n fi
(c o
T M
CDCAS3.0_EN_SMS Interface
rP
Specification
fo <V1.8.1>
n l y
O
Beijing Novel-Super Digital TV Technology Co., Ltd.
Beijing Novel-Supertv Digital TV Technology Co., Ltd. Page 1 2013-12-18

CDCAS3.0_EN_SMS Interface Specificationv1.8.1
Statement
This document describes in detail the interfaces of CDCAS3.0 with SMS, and aims to
provide both integration sides with guidance and basis for successful integration.
This document will be only disclosed in Beijing Novel-Super Digital TV Technology
Co., Ltd. as well as authorized SMS manufacturers. No person will be allowed to
disclose it to others without prior permission.
Either person who gets this document via non-legal way shall use it or disclose it to any
third party, otherwise may bear legal responsibilities.
This document shall be subject to the interpretation by Beijing Novel-Super Digital TV
Technology Co., Ltd. (hereinafter referred to as NSTV).
a l )
n ti
d e
n fi
(c o
TM
r P
fo
n l y
O
Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 2

Table of Contents
STATEMENT ................................................................................................................ 2
1 OVERVIEW .......................................................................................................... 6
1.1 INTRODUCTION TO CDCAS3.0 ....................................................................... 6
1.2 DEFINITION ..................................................................................................... 6
1.3 ABBREVIATIONS ............................................................................................. 6
1.4 MATTERS NEED ATTENTION ........................................................................... 7
2 COMMUNICATION PROTOCOL....................................................................... 7
2.1 BASIC WORKFLOW ......................................................................................... 7
2.2 TCP CONNECTION .......................................................................................... 8
2.3 CREATE SESSION ............................................................................................. 8
2.4 DATA EXCHANGE ........................................................................................... 9
2.5 ENCRYPTION SCHEME ................................................................................... 11
2.6 REQUIREMENTS FOR SMS COMMANDS PROCESSING .................................... 14
3 DESCRIPTION OF MESSAGES........................................................................ 15
3.1
3.1.1 SMS_CA_CREATE_SESSION_REQUEST .......................................... 15
a l )
CREATE SESSION ........................................................................................... 15
3.2
3.1.2 CA_SMS _CREATE_SESSION_RESPONSE ....................................... 15
n ti
OPEN ACCOUNT ............................................................................................ 16
3.2.1 SMS_CA_OPEN_ACCOUNT_REQUEST ............................................ 16
d e
3.3
n fi
3.2.2 CA_SMS_OPEN_ACCOUNT_RESPONSE .......................................... 16
CLOSE ACCOUNT .......................................................................................... 17
3.4
o
3.3.1 SMS _CA_STOP_ACCOUNT_REQUEST ............................................ 17
(c
3.3.2 CA_SMS _STOP_ACCOUNT_RESPONSE .......................................... 17
LOCK CARD .................................................................................................. 17
TM
3.4.1 SMS _CA_SET_LOCK_REQUEST ....................................................... 17
3.4.2 CA_ SMS _SET_LOCK_ RESPONSE ................................................... 17
3.5
r P
UNLOCK CARD(OPTIONAL FUNCTION) ......................................................... 18
fo
3.5.1 SMS _CA_SET_UNLOCK_REQUEST ................................................. 18
3.5.2 CA_SMS _SET_UNLOCK_ RESPONSE .............................................. 18
3.6
l y
SET PROPERTIES............................................................................................ 18
n
3.6.1 SMS _CA_SET_CHARACTER_REQUEST .......................................... 18
3.7 O
3.6.2 CA_SMS _SET_CHARACTER_RESPONSE........................................ 19
STB-CARD PAIRING ..................................................................................... 19
3.7.1 SMS _CA_REPAIR_REQUEST ............................................................. 19
3.7.2 CA_SMS _REPAIR_RESPONSE ........................................................... 20
3.8 RESET PIN .................................................................................................... 20
3.8.1 SMS _CA_RESETCARDPIN_REQUEST ............................................. 20
3.8.2 CA_SMS _RESETCARDPIN_RESPONSE ........................................... 20
3.9 CHARGE E-SLOT(OPTIONAL FUNCTION) ....................................................... 20
3.9.1 SMS _CA_SETSLOTMONEY_REQUEST ........................................... 21
3.9.2 CA_SMS _SETSLOTMONEY_RESPONSE ......................................... 21
3.10 EXTENDED ENTITLEMENT ............................................................................. 21
3.10.1 SMS _CA_ENTITLEEXT_REQUEST ............................................... 21
3.10.2 CA_SMS _ENTITLEEXT_RESPONSE ............................................. 22
3.11 ENTITLEMENT ............................................................................................... 22
3.11.1 SMS_CA_ENTITLE_REQUEST........................................................ 23
3.11.2 CA_SMS _ENTITLE_RESPONSE..................................................... 23
3.12 SET CHILD CARD (OPTIONAL FUNCTION) ..................................................... 23

3.12.1 SMS _CA_SET_CHILD_REQUEST .................................................. 24

3.12.2 CA_SMS _SET_CHILD_RESPONSE................................................ 24
3.13 RELEASE CHILD CARD(OPTIONAL FUNCTION).............................................. 24
3.13.1 SMS _CA_CANCEL_CHILD_REQUEST ......................................... 24
3.13.2 CA_SMS _CANCEL_CHILD_RESPONSE ....................................... 24
3.14 SEND MAIL ................................................................................................... 25
3.14.1 SMS _CA_SEND_EMAIL_REQUEST .............................................. 25
3.14.2 CA_SMS _SEND_EMAIL_RESPONSE ............................................ 26
3.15 SEND OSD(OPTIONAL FUNCTION) ................................................................ 26
3.15.1 SMS _CA_SEND_OSD_REQUEST................................................... 26
3.15.2 CA_SMS _SEND_OSD_RESPONSE................................................. 27
3.16 SEND SUPER OSD (OPTIONAL FUNCTION) .................................................... 27
3.16.1 SMS_CA_SEND_SUPEROSD_REQUEST ....................................... 27
3.16.2 CA_SMS_SEND_SUPEROSD_RESPONSE ..................................... 30
3.17 SEND FINGERPRINT(OPTIONAL FUNCTION) .................................................. 30
3.17.1 SMS_CA_SEND_FINGER_PRINT_REQUEST................................ 30
3.17.2 CA_SMS_SEND_ FINGER_PRINT_RESPONSE............................. 32
3.18 SWITCH/LOCK CHANNEL (OPTIONAL FUNCTION) ......................................... 33
a l )
3.18.1
3.18.2
SMS _CA_LOCK_SERVICE_REQUEST ......................................... 33
CA_SMS _LOCK_SERVICE_RESPONSE ....................................... 34
n ti
e
3.19 RELEASE LOCK (OPTIONAL FUNCTION) ........................................................ 34
d
3.19.1
3.19.2
n fi
SMS _CA_UNLOCK_SERVICE_REQUEST .................................... 34
CA_SMS _UNLOCK_SERVICE_RESPONSE .................................. 35
3.20.1
3.20.2
o
3.20 HIGH ADVANCE AND CONTROLLABLE PREVIEW(OPTIONAL FUNCTION) ........ 35
(c
SMS_CA_SET_ADV_CONTROL_PREVIEW_REQUEST.............. 35
CA_SMS_SET_ADV_CONTROL_PREVIEW_RESPONSE............ 35
3.21.1 TM
3.21 STB NOTIFICATION(OPTIONAL FUNCTION) .................................................. 36
SMS_CA_SET_STBNotify_REQUEST ............................................. 36
3.21.2
r P
CA_SMS_SET_STBNotify_RESPONSE ........................................... 37
3.22.1
fo
3.22 FORCE STB-CARD PAIRING(OPTIONAL FUNCTION) ...................................... 37
SMS_CA_SET_FORCEREPAIR_REQUEST .................................... 37
3.22.2
n l y
CA_SMS_ SET_ FORCEREPAIR _RESPONSE ............................... 37
3.23 CANCEL FORCE STB-CARD PAIRING(OPTIONAL FUNCTION)........................ 37
3.23.1
3.23.2 O SMS_CA_SET_CANCELFORCEREPAIR_REQUEST .................... 38
CA_SMS_ SET_ CANCELFORCEREPAIR _RESPONSE ............... 38
3.24 CONTINUOUS VIEWING RESTRICTION (OPTIONAL FUNCTION) ...................... 38
3.24.1 SMS_CA_SET_WORKTIME_LIMIT_REQUEST ............................ 38
3.24.2 CA_SMS_WORKTIME_LIMIT_RESPONSE ................................... 39
3.25 SET CCK ...................................................................................................... 39
3.25.1 SMS_CA_SET_CCK_REQUEST ....................................................... 39
3.25.2 CA_SMS_SET_CCK_RESPONSE..................................................... 39
4 SUGGESTIONS FOR SMS IMPLEMENTATION............................................ 40
4.1 REDUCING THE NUMBER OF COMMANDS ...................................................... 40
4.2 RECHARGING FOR IPPV SERVICE ................................................................. 40
4.3 PACKAGE OF SERVICES ................................................................................. 41
APPENDIX 1 MESSAGE ID ...................................................................................... 42
APPENDIX 2 ERROR CODES .................................................................................. 44
APPENDIX 3 PROPERTY ITEMS ............................................................................ 46
APPENDIX 4 ADDRESSING EXPRESSION ........................................................... 47
1 ADDRESSING ELEMENTS IN CDCAS3.0 ............................................................ 47

2 OPERATORS ...................................................................................................... 47
3 EXPRESSION ...................................................................................................... 47
4 ADDRESSING ELEMENTS SUPPORTED IN COMMANDS........................................ 48
5 OPERATORS SUPPORTED BY ADDRESSING ELEMENTS ....................................... 48
APPENDIX 5 MD5 CODES ....................................................................................... 49
1 MD5.H FILE ...................................................................................................... 49
2 MD5.C .............................................................................................................. 50
APPENDIX 6 3DES CODES ...................................................................................... 55
1 D3DES.H FILE ..................................................................................................... 55
2 D3DES.C ............................................................................................................ 57
APPENDIX 7 CORRESPONDING TABLE OF COLOR NUMBER........................ 65
a l )
n ti
d e
n fi
(c o
TM
r P
fo
n l y
O

1 Overview
1.1 Introduction to CDCAS3.0
Digital TV has led a new revolution in the information industry in the world. NSTV, as
a leading team in China, is dedicated to technical research of the digital TV industry,
and has invested lots of human resources and materials in recent years. CDCAS3.0 is
the main product of NSTV, which has been successfully deployed by many operators in
China and has won praise and recognition from the customers such as SARFT, CCTV,
Beijing TV, etc. The product hs also been deployed in overseas markets, such as,
Thailand, Malaysia, Indonesia, Venezuela, Myanmar, Mongolia, etc.
CDCAS3.0 is a conditional access system (CAS) provided by NSTV with independent
intellectual property rights.The system offers a platform for digital TV operators to
a l )
subscribers.
n ti
guarantee the security of their contents and distribute the entitlements to their authentic
d e
NSTV is ready to work together with SMS vendors of powerful technical strength. The
fi
CDCAS3.0_SMS interface would be easy for the SMS vendor to integrate the SMS
n
system with CDCAS3.0.
(c o
1.2 Definition
TM
P
CDCAS3.0: NSTV’s CAS with independent intellectual property right;
r
fo
Integration: CDCAS3.0 exchanges data with SMS via this interface to implement
l y
the management of the subscribers.
n
O
1.3 Abbreviations
CAS: Conditional Access System;

SMS: Subscriber Management System;
BOSS: Business Operation & Support System;
STB: Set-Top-Box;
OSD: On Screen Display
IPPV: Impulse Pay Per View
MAC: MessageAuthenticationCode;
3DES: Triple Data Encryption Standard;
MD5: Message Digest5

1.4 Matters Need Attention
If the interface is marked with Optional Function, it means the function of the interface is not
supported by every CAS system. Whether it can be used at actual project will be determined by the
actual user of CAS system.
2 Communication Protocol
2.1 Basic Workflow
CDCAS3.0_SMS interface adopts the C/S architecture, where CDCAS3.0 works as

server and SMS works as client. In order to reduce the resource usage and improve the
system security, CDCAS3.0_SMS interface will create a session on TCP connection,
a l )
and exchange data on the session level.
Fig 2.1 illlustrates the basic workflow of CDCAS3.0_SMS interface.
n ti
d e
n fi
(c o
TM
r P
fo
n l y
O
Figure 2.1 Basic Workflow
CDCAS3.0 supports multiple TCP connections from one or more SMS system.
However, only one session can be created on one TCP connection simultaneously.

2.2 TCP Connection
Principles for TCP connection are as follow:

1. To setup the TCP connection, SMS should specify the IP address and the port
number of the CDCAS3.0 server.
---------------------------------------------------------------------------------------------------
Note:
The IP address specified in the deployment CDCAS by the operator.
The port fixed for 7364.
---------------------------------------------------------------------------------------------------
2. Heartbeat packets should be sent every 15 minutes to check if the TCP connection is
still active. The data sent by SMS are {0x00, 0x04, 0xff, 0xff, 0xff, 0xff, 0x00,
a l )
0x00}, while the response from CDCAS3.0 are {0x01, 0x06, 0xff, 0xff, 0xff, 0xff,
0x00, 0x00}.
n ti
d e
---------------------------------------------------------------------------------------------------
Note:
n fi
(c o
The disconnection might be because of the bad network performance, or because
that the firewall cuts off the connection due to the long-time silence on it.
M
---------------------------------------------------------------------------------------------------
T
r P
3. While the TCP connection is broken (no heartbeat response received), SMS should
re-setup the TCP connection, and re-setup the session then.
fo
4. While exchanging data, SMS should check whether the TCP packet has been
l y
successfully received by CDCAS3.0 (TCP connection level). If not, SMS should
n
re-send the data.
O
2.3 Create Session
Every time after setting up the TCP connection, SMS should firstly create a session
with the CDCAS3.0. Then they could exchange the data. A main function of creating
the session is to generate a session key, which will be used to protect the data for the
consequent data exchange.
The steps to create a session are as follow:
1. SMS sends ‘SMS_CA_CREATE_SESSION_REQUEST’ to CDCAS3.0 in
plaintext.
2. CDCAS3.0 replies ‘CA_SMS_CREATE_SESSION_RESPONSE’ to SMS, in

which the data is encrypted by the SMS root key. The session key would be
involved in the packet if the request from SMS is correct.
3. SMS will use the SMS root key to decrypt and check the data.
4. For the normal response packet, SMS will obtain the session key then, which is
used for encrypting consequent data change for business operations (such as
account opening, entitlement, etc.)
-------------------------------------------------------------------------------------------------------
Note:
It is a mistake to re-create a new session after one time data exchange. The session link
should be kept until SMS complete all the requests and will not connect CDCAS3.0 for
a long time.
a l )
ti
--------------------------------------------------------------------------------------------------------
n
d e
fi
2.4 Data Exchange
o n
(c
After creating the session, SMS could send the request packet (command) to
CDCAS3.0 via this session link, while CDCAS3.0 will handle the received command
M
and reply the response packet to SMS with the execution result of the command. This
T
r
response are called ‘Message’. P
process is called ‘Data Exchange’, and both the request command and the result
fo
For different scenarios, every time SMS could send one request command or a batch of
l y
commands to CDCAS3.0 via the session link. CDCAS3.0 will process all the
n
commands and then reply the results to SMS.
O
As CDCAS3.0 supports multiple connections from SMS, it has the mechanism to
concurrently handle messages from multiple SMS.
The data structure of the ‘Message’ packet is shown as Table 2.1. Please be noted that:
1. The maximum length of the packet is 4096 bytes.
2. Big-endian is applied for both byte-order and bit-order.
Table 2.1 CDCAS3.0_SMS Message Packet

SYNTAX BITS NOTES
Data_Section(){
Proto_Ver 8 Protocol version number
Crypt_Ver 6 Encryption version number
Key_Type 2 Key Type
OPE_ID 16 Operator ID
SMS _ID 16 SMS ID
DB_Len 16 Length of Data_Body

Data_Body() Data
}
Proto_Ver: Protocol version number for ‘Data Exchange’, which is defined by NSTV.
Currently the version number should be ‘1’.
Crypt_Ver: The version number for the encryption scheme, which is defined by NSTV.
Currently the version number should be ‘1’.
Key_Type: The type of the key applied for encrypting the message, which is defined as
follow (refer to ‘Encryption Scheme’ section for details):
“00”: root key
“01”: current session key
“10”: no key (plaintext for this message)
“11”: reserved
a l )
OPE_ID: Operator ID in Hex, which is assigned by NSTV for different network
operators.
n ti
e
SMS _ID: SMS ID is used to specify different SMS systems connecting to CDCAS3.0,
d
DB_Len: The length of the ‘Data_Body’ in bytes.
n fi
which is assigned by CDCAS3.0. Each SMS system would have its own root key.
(c o
Data_Body(): The detail of the ‘Message’ with the data structure as Table 2.2.
Table 2.2 CDCAS3.0_SMS Data_Body
SYNTAX
TM BITS NOTES
Data_Body(){
DB_ID
r P 16 Data_Body ID
Msg_ID
Data_Len
fo 16
16
Message ID
Data length
n l
Data_Cont()
y
For(i=0; i<N; i++){
Padding_Byte 8
Data
Padding bytes
}
}
MACO 128 Checksum
DB_ID: Data_Body ID is generated by SMS, which is a unique number in one session

to identity the data exchange on current session.
Msg_ID: Message ID indicates the type (function) of this message. The values of the
message types are defined in Appendix 1 ‘Message ID’.
Data_Len: Refers to the length of Data_Cont() in bytes.
Data_Cont: The contents of the message, where the parameters are carried. The details
are described in next section.
Padding_Byte: For encryption requirement, the Data_Body length should be multiples
of 8 bytes. When the length does not match multiples of 8 bytes, the padding bytes
should be applied to meet the requirement.

MAC(MessageAuthenticationCode): The checksum against all data (excluding the

MAC field) in Data_Body(). The algorithm for calculating the MAC is defined by
NSTV. For this version, MD5 (Message Digest 5) is applied.
--------------------------------------------------------------------------------------------------------
Notes:
1. An example of the MAC field is shown in ‘Encryption Scheme’ section.
2. For MD5 algorithm, the reference code in C++ is offered by NSTV in Appendix 5,
where the following function could be called to generate the MAC.
unsigned char TFCA_MD5
(unsigned char *pInPut, uint4 dwInput_Length, unsigned char *pOutPut)
pInPut: pointer addressing to the first byte of the data for calculating MAC.
dwInput_Length: length of the data for calculating MAC, in bytes.
pOutPut: pointer addressing to the first byte of the returned MAC.
-------------------------------------------------------------------------------------------------------
There might be two types of transmission error happen on CDCAS3.0_SMS interface:

a l )
unpacking failed (e.g, format un-match) and decryption failure. In such cases,
n ti
CDCAS3.0 will return the packet with following format:
d e
fi
Table 2.3 Format of Response to Illegal Data Packet
on
SYNTAX BITS NOTES
Data_Section(){
Proto_Ver
( c8 interface protocol version number
Crypt_Ver
Key_Type
TM 6
2
encryption scheme version number
encryption key type
Reserved
Reserved
r P 16
16
fixed to be 0xFFFF
fixed to be 0xFFFF
}
Reserved
fo 16 fixed to be 0x0000
n l y
O Scheme
2.5 Encryption
To guarantee the security and the integrity of data transmission, the Data_Body() field
of the Message (packet) should be encrypted and attached with digit-digest.
There are two types of keys to be used for this interface: the root key and the session
key.
The root key is used to encrypt the session key while creating a session. Each SMS
connected to CDCAS3.0 would be assigned a unique root key by NSTV. Generally, the
root key would be configured in both CDCAS3.0 and SMS, and is relatively fixed.
The session key is generated by CDCAS3.0 while creating the session. It is used to
encrypt Data_Body() of all Messages except SMS _CA_CREATE_SESSION_REQUEST.
In this version protocol, 3DES (Data Encryption Standard) algorithm is applied while

using root key, and DES algorithm is applied while using session key. Refer to
Appendix 6 for the algorithm implementation. The two functions below could be
directly called for 3DES and DES encryption.
bool TFCA_3DES(bool bEnspot, unsigned char* pbyKey,int nLength, unsigned
char* pbySource, unsigned char* pbyTarget)
bool TFCA_DES(bool bEnspot, unsigned char* pbyKey,int nLength, unsigned
char* pbySource, unsigned char* pbyTarget)
Parameters:
bEnspot: true means encryption, false means decryption
pbyKey: point to encryption key
nLength: length of data for encryption (with unit of bytes) should be multiples of 8
pbySource: point to data first pointer for encryption
pbyTarget: point to first pointer of returned encrypted data
Here we take ‘create session’ as an example to illustrate the encryption scheme,

a l )
including the MAC check.
1. Firstly, ‘Create Session’ request will be in plaintext as follow: n ti
d e
unsigned char session[32] =
{0x01,0x06,0x00,0x01,0x00,0x01,0x00,0x18,
n fi
(c o
0x00,0x01,0x00,0x01,0x00,0x00,0xf0,0xf0,0xe1,0xee,0x84,0x14,0x74,
0xbb,0x8e,0x30,0xad,0xd7,0xe8,0xb1,0xbd,0x52,0x0b,0xd7};
TM
2.3.
r P
The details of the packet header and the Data_Body() are illustrated as Fig. 2.2 and Fig.
fo
n l y
O
Figure 2.2 ‘Create Session’ Request Packet Header
Figure 2.3 ‘Create Session’ Request Data_Body()

2. The response to this request will be as follow. Here, supposing the root key is
‘ABCDEFGHIJKLMNOP’ and the returned session key is ‘12345678’. Then,
1) The packet header of the response will in plaintext as follow:
unsigned char head[8] =
{0x01,0x04,0x00,0x01,0x00,0x01,0x00,0x28}
Figure 2.4 ‘Create Session’ Response Packet Header
2) The Data_Body() of the response will be in cipher-text as follow:
a l )
Part of returned data packet Data_Body() is ciphertext with the following contents:
n ti
unsigned char enbody[40] =
d e
n fi
{0x0c,0xb8,0x8c,0x3f,0x86,0xce,0x15,0x0d,0xb5,0x22,0x65,0x9a,0x56,0xee,0x40,
0xa5,0xef,0xab,0xec,0x4b,0x71,0xf0,0xa7,0xe5,0x7b,0x0a,0xd4,0xcd,0x65,0xc4,
0xd3,0xe1,0xa3,0x54,0x28,0x16,0x07,0xfa,0x13,0x02}
(c o
M
3) Decrypting it with the root key ‘ABCDEFGHIJKLMNOP’, we could got the
T
P
plaintext Data_Body() as follow, including MAC field.
r
fo
unsigned char plainbody[40] =
{0x00,0x01,0x80,0x01,0x00,0x0E,0x00,0x00,0x00,0x00,0x00,0x08,0x31,0x32,
l y
0x33,0x34,0x35,0x36,0x37,0x38,0xF0,0xF0,0xF0,0xF0,0x2c,0x90,0x85,0x0d,
n
0xf3,0xfa,0x1a,0x64,0x93,0xcc,0xad,0xa2,0xb4,0x30,0x72,0xb2}
O

Figure 2.5 ‘Create Session’ Response Data_Body() in plaintext
--------------------------------------------------------------------------------------------------------
Note:
For details of ‘Create Session’ request and response, please refer to Section 3.1.
--------------------------------------------------------------------------------------------------------
2.6 Requirements for SMS Commands Processing
To ensure the SMS commands could be successfully processed, some requirements

should be followed.
a
1. SMS should send ‘Open Account’ at first to activate a smart card. Before the card is l )
activated, CDCAS3.0 will reject to conduct any other commands, such as
n ti
entitlement, OSD, mail, etc., against this card.
d e
fi
2. SMS could use ‘Close Account’ to deactivate a smart card. In the case, CDCAS3.0
n
‘Open Account’ to it again.
(c o
will clear all entitlement information for this card. SMS could use it until sending
TM
3. The DB_ID is used to identify the Data_Body() of the request and its response.
SMS should ensure the uniqueness of DB_ID of the message pack within the same
r P
SMS connection (session). For different SMS connections, the DB_ID might be
overlapped.
fo
l y
4. SMS will get the command processing result from the CDCAS3.0 response. If the
n
response shows the command has been successfully executed, SMS can confirm
O
that this command has become effective. If the response shows the command is not
successful, SMS should have a mechanism to re-send this command manually or
automatically.

3 Description of Messages
For ‘Data Exchange’, all messages will follow the syntax described in last section, but
with the difference contents in Data_Cont() field. So, in this section, only the contents
of Data_Cont() are described for each message.
The Message_ID is used to indicate messages for different functions, and the request
and response messages will be described in pairs in this section.
3.1 Create Session
After setting up the TCP connection, SMS and CDCAS3.0 will use this pair of
messages to create a session.
a l )
3.1.1 SMS_CA_CREATE_SESSION_REQUEST
n ti
e
For this message, the Data_Cont() is empty and the Data_Body() structure is shown in
d
fi
Table 3.1.1. The data in Data_Body() will not be encrypted, and will be sent in
n
plaintext.
(c o
Table3.1.1 Data Body Structure of SMS_CA_CREATE_SESSION_REQUEST
Data_Body(){
SYNTAX
TM BITS NOTES
DB_ID
Msg_ID
r P 16
16
Data_Body ID
SMS
Data_Len
fo 16
_CA_CREATE_SESSION_REQUEST
Data length is 0
}
l y
For(i=0; i<N; i++){
n
Padding_Byte 8 padding bytes
}
MAC
O 128 checksum
Msg_ID: SMS _CA_CREATE_SESSION_REQUEST, refers to Appendix 1.

Data_Len: length of Data_Cont(), ‘0’ for this message.
3.1.2 CA_SMS _CREATE_SESSION_RESPONSE

Data_Body() is encrypted with the SMS root key. Data_Cont() of this message is
shown in Table:
Table 3.1.2 Data_Cont() of CA_SMS_CREATE_SESSION_RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
Erro_Code 32 Error codes
Key_Len 16 Key length

For(i=0; i< Key_Len; i++){

Key_Char 8 Session key
}
}
Key_Len: length of session key, in bytes.

Key_Char: session key.
3.2 Open Account
Open Account is to setup the relationship between the subscriber and the smart card. It
is an initialization process should be conducted before the smart card could be used.
3.2.1 SMS_CA_OPEN_ACCOUNT_REQUEST
Data_Cont() of this message is shown in Table:
a l )
Table 3.2.1 Data_Cont() of SMS_CA_OPEN_ACCOUNT_REQUEST
n ti
SYNTAX BITS
d e
NOTES
fi
Data_Cont(){
CARD_SN 128 smart card serial number
}
o n
(c
CARD_SN: The smart card serial number with following coding rule:
M
8XXXXQQ YYYYYYYYZ
Checksum
P T
o
Serial number
f r
Operator code
n lConstanty
O
The CARD_SN is expressed in ASCII with hexadecimal system. For example, if the
CARD_SN is 800……751, it would be expressed as {0x38 0x30 0x30 ……0x37 0x35
0x31}.
--------------------------------------------------------------------------------------------------------
Note:
The CARD_SN mentioned in following sections will use the same rules.
--------------------------------------------------------------------------------------------------------
3.2.2 CA_SMS_OPEN_ACCOUNT_RESPONSE
Table 3.2.2Data_Cont() of CA_SMS_OPEN_ACCOUNT_RESPONSE

SYNTAX BITS NOTES

Data_Cont(){
Erro_Code 32 error codes
}
3.3 Close Account
Close Account is to stop the service against the subscriber, which is equal to revoking
all entitlements of the subscriber.
3.3.1 SMS _CA_STOP_ACCOUNT_REQUEST

Table 3.3.1 Data_Cont() of SMS _CA_STOP_ACCOUNT_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
CARD_SN 128
a
smart card serial number
l )
}
n ti
d e
fi
3.3.2 CA_SMS _STOP_ACCOUNT_RESPONSE
o n
SYNTAX (c
Table 3.3.2 Data_Cont() of CA_SMS _ STOP_ACCOUNT _RESPONSE
M BITS NOTES
Data_Cont(){
Erro_Code
P T 32 error codes
r
}
fo
n
3.4 Lock Card l y
O
Lock card is to disable the smart card and forbid it to decrypt the data until the card is
unlocked. If the card is locked, the subscriber could not watch scrambled programs any
more.
3.4.1 SMS _CA_SET_LOCK_REQUEST

Table 3.4.1 Data_Cont() of SMS _CA_SET_LOCK_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
}
3.4.2 CA_ SMS _SET_LOCK_ RESPONSE


Table 3.4.2 Data_Cont() of CA_ SMS _SET_LOCK _RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
}
3.5 Unlock Card(Optional Function)
Unlock card is to resume the disabled smart card.
3.5.1 SMS _CA_SET_UNLOCK_REQUEST

a l )
Table 3.5.1 Data_Cont() of SMS _CA_SET_UNLOCK_REQUEST
SYNTAX BITS NOTES
n ti
Data_Cont(){
CARD_SN 128
d e
smart card serial number
}
n fi
3.5.2 CA_SMS _SET_UNLOCK_ RESPONSE
(c o
M
T
SYNTAX P
Table 3.5.2 Data_Cont() of CA_ SMS _SET_UNLOCK _RESPONSE
r BITS NOTES
Data_Cont(){
fo
n l y}
O
3.6 Set Properties
There are 10 property items could be set for the smart card with different values. These
properties could be used by the system to address the card.
In CAS system, the setting of area value and Bouquet value are all realized by the
setting of subscriber characteristics.
3.6.1 SMS _CA_SET_CHARACTER_REQUEST

Table 3.6.1 Data_Cont() of SMS _CA_ SET_CHARACTER _REQUEST
SYNTAX BITS NOTES
Data_Cont(){


No 8 property index, from 0 to 9
Cha 32 Property value
}
No: Property Index, scope from 0-9. Refer to Appendix 3 for details.
Ø The characteristic of No. 0 is used for area value setting;
Ø The characteristic of No. 1 is used for Bouquet value setting;
Ø The characteristic of No. 2 is NSTV reserved;
Ø The characteristics of No. 3 to No. 9 are customized by operator.
Please refer to Appendix 3 for the detailed usage of all the characteristic value.
Cha: Value of the specified property item, which could be set via this message. Default
value is zero for each property.
3.6.2 CA_SMS _SET_CHARACTER_RESPONSE

a l )
Table 3.6.2 Data_Cont() of CA_SMS _ SET_CHARACTER_RESPONSE
n ti
SYNTAX BITS
d e
NOTES
fi
Data_Cont(){
}
o n
3.7 STB-Card Pairing M (c
P T
fo r
This message is to pair the specified STBs with the specified smart card, so that the card
could only do decryption when it is used in the pairing STB.
n l y
3.7.1 SMS _CA_REPAIR_REQUEST
O
Table 3.7.1 Data_Cont() of SMS _CA_REPAIR_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
Card_SN 128 Smart card serial number
for (i=0; i<5; i++)
{
STBID 48 STB serial number
}
}
--------------------------------------------------------------------------------------------------------
Notes:
1. The Card_SN field is required to specify which smart card would be paired.
2. The STBID field must be 30 bytes, each 6 bytes refer to a STB. Maximum 5 STBs

could be paired with the card. When the number of STBs is less than 5, the
specified STBIDs should be listed in front, and the unused bytes should be set to 0.
3. While the smart card receives this message, the old pairing list will be replaced by
the new received one totally.
--------------------------------------------------------------------------------------------------------
3.7.2 CA_SMS _REPAIR_RESPONSE

Table 3.7.2 Data_Cont() of CA_SMS _REPAIR_RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
}
a l )
3.8 Reset PIN
n ti
d e
fi
The smart card has PIN codes to protect some operations, which could be changed by
n
the user. This message is to reset PIN codes to factory default value in case the user
o
(c
forgets the PIN.
3.8.1 SMS _CA_RESETCARDPIN_REQUEST
TM
r P
Table 3.8.1 Data_Cont() of SMS _CA_RESETCARDPIN_REQUEST
fo SYNTAX BITS NOTES
n l y
Data_Cont(){
CARD_SN 128
smart card
number
serial
O }
3.8.2 CA_SMS _RESETCARDPIN_RESPONSE

Table 3.8.2 Data_Cont() of CA_SMS _RESETCARDPIN_RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
}
3.9 Charge E-Slot(Optional Function)
This message is to set the credit-limit value for the E-slot (electric wallet)of the card.

3.9.1 SMS _CA_SETSLOTMONEY_REQUEST

Table 3.9.1 Data_Cont() of SMS _CA_SETSLOTMONEY_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
Slot_ID 8 E-slot ID, range from 1 to 4
Cred_Lim 16 Value of credit limit
}
Cred_Lim: The credit sum of the E-slot, which is the total points being recharged into
this E-slot. The maximum value of credit-limit is 65535.
3.9.2 CA_SMS _SETSLOTMONEY_RESPONSE

a l )
Table 3.9.2 Data_Cont() of CA_SMS _SETSLOTMONEY_RESPONSE
SYNTAX BITS NOTES
n ti
Data_Cont(){
d e
fi
}
o n
3.10 Extended Entitlement
M (c
P T
SMS can authorize product to designated subscriber via this message.
fo r
--------------------------------------------------------------------------------------------------------
Note:
n l y
O
The below authorization interface is replaced by this interface; please give priority to it
in integration.
-------------------------------------------------------------------------------------------------------
Comparing with Entitlement message, this message extends the value scope of product
ID from ‘1-1023’ to ‘1-65533’.
3.10.1 SMS _CA_ENTITLEEXT_REQUEST

Table 3.10.1 Data_Cont() of SMS _CA_ENTITLEEXT_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
ProdCount 8 number of product
for(I=0;I<ProdCout;I++) {

Enti_Type 1 entitlement type

TF_Reserved 7 NSTV reserved
Prod_ID 16 product ID, range from 1-65533
Tape_Ctrl 8 video control
Start_Time 32 start time
End_Time 32 end time
}
}
Enti_Type: Entitlement type, ‘0’ for detitle, ‘1’ for entitle, others are reserved. While it
is ‘0’ (detitle), Tape_Ctrl, Start_Time and End_Time fields are invalid.
TF_Rerserved: NSTV reserved.
Prod_ID: ID of product for entitlement, with value scope of: 1~65533. The products
with the product ID 1~15000 and 30001~65533 are allocated to CATV operator. Other
products are reserved by NSTV.
Tape_Ctrl: Video control flag, 0x00 for un-recordable, 0x01 for recordable, and others
are reserved not to be used.
Start_Time/ End_Time: The start time and the end time of the entitlement in ‘time_t’
a l )
format. the value is determined with reference to local time of the region where CAS
n ti
system locates. The scope is from 2000-Jan-1-0:0:0 to 2030-Dec-31-23:59:59.
d e
fi
The samples for ‘time_t’:
42 2D 4D D4 refers to 2005-03-08-15:01:40
72 BB 4A 00 refers to 2030-12-31-00:00:00
o n
M (c
T
3.10.2 CA_SMS _ENTITLEEXT_RESPONSE
P
fo r
Table 3.10.2 Data_Cont() of CA_SMS _ENTITLEEXT_RESPONSE
n l y
Data_Cont(){
SYNTAX BITS NOTES
O }
3.11 Entitlement
This message is to send entitlements to the smart card.

--------------------------------------------------------------------------------------------------------
Note:
This message has already been replaced by the extended authorization message, so you
are not recommended to use it.
--------------------------------------------------------------------------------------------------------

3.11.1 SMS_CA_ENTITLE_REQUEST
Table 3.11.1 Data_Cont() of SMS _CA_ENTITLE _REQUEST
SYNTAX BITS NOTES
Data_Cont(){
ProdCount 8 Number of products
for(I=0;I<ProdCout;I++) {
Enti_Type 1 Entitlement type
TF_Reserved 5 NSTV reserved
Prod_ID 10 product ID
Tape_Ctrl 8 Video control
Start_Time 32 Start time
End_Time 32 End time
}
}
a l )
ProdCount: The number of products, the maximum is 190.
n ti
Enti_Type: Entitlement type, ‘0’ for detitle, ‘1’ for entitle, others are reserved. While it
is ‘0’ (detitle), Tape_Ctrl, Start_Time and End_Time fields are invalid.
d e
TF_Rerserved: NSTV reserved.
n
Prod_ID: ID of product for entitlement, with value scope of: 1-1023. fi
(c o
Tape_Ctrl: Video control flag, 0x00 for un-recordable, 0x01 for recordable, and others
are reserved not to be used.
TM
Start_Time/ End_Time: The start time and the end time of the entitlement in ‘time_t’
r P
format. The value is determined with reference to local time of the region where CAS
system locates. The scope is from 2000-Jan-1-0:0:0 to 2030-Dec-31-23:59:59.
The samples for ‘time_t’:
fo
l y
42 2D 4D D4 refers to 2005-03-08-15:01:40
n
72 BB 4A 00 refers to 2030-12-31-00:00:00
O
3.11.2 CA_SMS _ENTITLE_RESPONSE
Table 3.11.2 Data_Cont() of CA_SMS _ENTITLE _RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
}
3.12 Set Child Card(Optional Function)
This message is to appoint a smart card to be the child card of another.

3.12.1 SMS _CA_SET_CHILD_REQUEST

Table 3.12.1 Data_Cont() of SMS _CA_SET_CHILD_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
Smart card serial number of the
Card_SN 128
child
Smart card serial number of the
Parent_Card_SN 128
parent
Feed_Interval_Hour 16 Feed interval (hours)
}
Feed_Interval_Hour: Define the feed interval in hours. The child card is required to be
fed with the data from the parent card periodically. If it has not been fed after the feed
interval expires, the child card will be disabled.
a l )
3.12.2 CA_SMS _SET_CHILD_RESPONSE
n ti
d e
n
Table 3.12.2 Data_Cont() of CA_SMS _SET_CHILD_RESPONSE fi
Data_Cont(){
Erro_Code
SYNTAX
(c
32
oBITS NOTES
error codes
}
TM
r P
3.13 Release Child Card(Optional Function)
fo
n l y
This message is to release a card not to be a child card any more.
O
3.13.1 SMS _CA_CANCEL_CHILD_REQUEST
Table 3.13.1 Data_Cont() of SMS _CA_CANCEL_CHILD_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
smart card serial number of
CARD_SN 128
the child card
}
3.13.2 CA_SMS _CANCEL_CHILD_RESPONSE

Table 3.13.2 Data_Cont() of CA_SMS _CANCEL_CHILD_RESPONSE
SYNTAX BITS NOTES

Data_Cont(){
}
3.14 Send Mail
Send mails to specified subscribers addressed by the addressing expression.

--------------------------------------------------------------------------------------------------------
Note:
Addressing expression could be used for grouping subscribers in Messages, such as,
‘Send Mail’, ‘Send OSD’, ‘Switch Channel’, ‘Release Lock’. Refer to Appendix 4 for
the details of addressing expression.
a l )
3.14.1 SMS _CA_SEND_EMAIL_REQUEST
n ti
--------------------------------------------------------------------------------------------------------
d e
fi
n
Table 3.14.1 Data_Cont() of SMS _CA_SEND_EMAIL_REQUEST
o
(c
SYNTAX BITS NOTES
Data_Cont(){
Exp_Len
For(i=0; i< Exp_Len; i++){
TM 8 expression length
}
Exp_Char
r P 8 expression
Title_Len
fo
For(i=0; i< Title_Len;i++){
8 Title length
n l
} y
Title_Char
Cont_Len
8
8
title
Text length
O For(i=0; i< Cont_Len; i++){
}
Cont_Char 8 text
Importance 8 Importance
}
Exp_Len: length of the addressing expression.

Exp_Char: addressing expression, maximum 40 char, should NOT be null.
Title_Len: length of the mail title.
Title_Char: mail title, maximum 30, should NOT be null.
Cont_Len: length of the mail text.
Cont_Char: mail text bytes, maximum 160, should NOT be null.
Importance: mail importance, ‘0’ for ordinary, ‘1’ for important, others reserved.

3.14.2 CA_SMS _SEND_EMAIL_RESPONSE

Table 3.14.2 Data_Cont() of CA_SMS _SEND_EMAIL_RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
}
3.15 Send OSD(Optional Function)
Send OSD to specified subscribers addressed by the addressing expression.

--------------------------------------------------------------------------------------------------------
Note:
a l )
In actual use, choose either this message or super OSD message; please refer to the
n ti
detailed requirement of the operator for selection.
d e
fi
--------------------------------------------------------------------------------------------------------
n
3.15.1 SMS _CA_SEND_OSD_REQUEST
(c o
TM
Table 3.15.1 Data_Cont() of SMS _CA_SEND_OSD_REQUEST
r
SYNTAX P BITS NOTES
Data_Cont(){
Exp_Len
fo 8 expression length
n}
l
Exp_Char y
8 expression
O Cont_Len
For(i=0; i< Cont_Len; i++){
Cont_Char
8
8
text length
text
}
Style 8 Display method
Duration 32 duration
}

Cont_Len: length of the OSD text.
Cont_Char: OSD text, maximum 180 char, should NOT be null.
Style: Define the display method,
‘1’ - display on top of screen and left to right scrolling;
‘2’ - display on botom of screen and left to right scrolling;

Others - reserved
Duration: Duration of the OSD display on the screen, in seconds (s), with value scope
of 1~900.
3.15.2 CA_SMS _SEND_OSD_RESPONSE

Table 3.15.2 Data_Cont() of CA_SMS _SEND_OSD_RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
}
3.16 Send Super OSD (Optional Function)
a l )
Via this message, SMS can send OSD with several attributes, which can specify
font, background color, display area, duration, etc.
n ti
e
--------------------------------------------------------------------------------------------------------
d
Note:
n fi
detailed requirement of the operator for selection.
(c o
In actual use, choose either this message or OSD message; please refer to the
M
--------------------------------------------------------------------------------------------------------
T
P
3.16.1 SMS_CA_SEND_SUPEROSD_REQUEST
r
fo
Data contents are shown in Table:
Table 3.16.1 Data_Cont() of SMS_CA_SEND_SUPEROSD_REQUEST
n
Data_Cont(){ l SYNTAX y BITS NOTES
Exp_Len
O
Exp_Char
8
8
Length of expression
Expression
}
Enable 8 Cancel or not
If(Enable== 1){
CancleType 8 Type of cancellation
}
Else{
Cont_Len 16 Length of content
For(i=0; i< Cont_Len; i++){
Cont_Char 8 Content
}
StartTime 32 Start time
EndTime 32 End time
Interval 32 Display interval
Repetition 8 Display repetition
Display duration at a
Duration 32
time

FontColor 8 Font color

BackgroundColor 8 Background color
DisplayMode 8 Display mode
if(DisplayMode == 0)
{
ForcedDisplay 8 Forced display or not
FontSize 8 Font size
BackgroundArea 8 Display area
DisplayCardNo 8 Display card number
}
}
}
Exp_Len: Length of expression. (Up to 40char, and can not be empty)
Exp_Char: Bytes of expression.
Enable: Cancel or not, 0 refers to Display, 1 refers to Cancel
CancelType: Type of cancellation, it is valid when Enable is 1, 0xff is to cancel all the
super OSD, 1 is to cancel the forced super OSD.
a l )
Note:
n ti
--------------------------------------------------------------------------------------------------------
The following paremeters are valid when Enable value is 0.

d e
fi
--------------------------------------------------------------------------------------------------------
n
(c o
Cont_Len: OSD content length. (The maxlength is 256 char and can not be empty)
Cont_Char: OSD content character. (The maxlength is 256 char and can not be empty)
TM
StartTime: Start time, time_t format, the value is determined with reference to local
time of the region where CAS system locates, the scope limitation of CAS system is
P
0:00:00 on January 1, 2000 to 23:59:59 on December 31st, 2030.
r
o
e.g. 42 2D 4D D4 refers to 2005-03-08 15:01:40
f
n l y
72 BB 4A 00 refers to 2030-12-31 00:00:00
EndTime: End time, time_t format, the value is determined with reference to local time
O
of the region where CAS system locates, the scope limitation of CAS system is 0:00:00
on January 1, 2000 to 23:59:59 on December 31st, 2030.
Duration: Display duration a time, the unit is second, the value range is [1, 65535].
Interval: Display interval, that is the interval between the last display start time and the
next display start time, the unit is second (s), the value range is 1~86400.
-------------------------------------------------------------------------------------------------------
Note:
‘Interval’ shall be greater than ‘Duration’ value.
--------------------------------------------------------------------------------------------------------
Repetition: Display repetition times, the value range is 0~255.
1) When DisplayMode is 1 or 2, that is to say, the display mode is scrolling from the
right to the left at upward side or the downward side, the Repetition shall be 0, the
start time and end time are valid time, which means in the time range from start time
to end time, it will be automatically circular scroll display at the terminal with
reference to the duration and interval.

2) When DisplayMode is 0, that is to say, the display mode is central area display.
When super OSD displays with reference to Repetition, and the value of start time
and end time is 0 (i.e. without setting start time and end time), then the value range
of Reprtition is 1~255.
3) When DisplayMode is 0, that is to say, the display mode is central area display.
Super OSD will display with reference to both Repetition and time range.
A. If Repetition value is 0, that is to say, in the time range from start time to end
time, it will be automatically circular scroll display at the terminal with
reference to the duration and interval.
B. If Repetition value is 1~255, it will display with reference to time range first,
and when end time is up, it will not display; when end time isn't up, is will
display with reference to Repetition. So, Repetition value shall be set in
accordacne with the following requirement, if not, return an error.
a) If the value of EndTime – StartTime is the integral multiple of Interval
Then: Repetition<= ((EndTime – StartTime) / Interval)
e.g.: StartTime is 2013-08-01 02:00:00
a l )
EndTime is 2013-08-01 06:00:00
n ti
Interval is 1 hour
d e
Duration is 30 minutes
Then the time range is 4 hours,
n fi
(c o
Repetition <= (4 hours / 1 hour) = 4.
As shown in the figure:
BeginTime Duration
TM EndTime
r P
fo
n l y Interval
O In the above figure, each yellow bar refers to one time of super OSD
display, there are 4 times in total, then Repetition value is 4.
b) If the value of EndTime – StartTime is not the integral multiple of
Interval
then: Repetition<= (EndTime – StartTime) / Interval + 1
e.g.: StartTime is 2013-08-01 02:00:00
EndTime is 2013-08-01 06:09:00
Interval is 1 hour
Duration is 40 minutes
Then the time range is 4 hours and 9 minutes,
Repetition <= (4 hours and 9 minutes / 1 hour) + 1= 5.
As shown in the figure:

BeginTime Duration EndTime
Interval
In the above figure, each yellow bar refers to one time of super OSD display, there are 5
times in total (the last time only lasts for a short time), then Repetition value is 5.
FontColor: Font color, the value range is [0, 255]. Please refer to Appendix 7 for the
corresponding relation between color value and RGB.
BackgroundColor: Background color, the value range is [0, 255]. Please refer to
Appendix 7 for the corresponding relation between color value and RGB.
DisplayMode: Display mode, 0 is central area display, 1 refers to scroll display from
a l )
ti
the right to the left on the upward side, 2 refers to scroll display from the right to the left
on the downward side.
n
d e
fi
ForcedDisplay: It is valid when DisplayMode is 0, 0: Non-forced display, 1: Forced
display.
o n
FontSize: Font size, it is valid when DisplayMode is 0, the value range is [0, 255], 0
M (c
refers to default value, 1 refers to big font, 2 refers to small font, 3~255 refer to the
actual font size; the unit is pixel, e.g. font size 9 refer to 9*9 pixel.
T
BackgroundArea: It refers to the area percentage of the screen central area. It is valid
P
fo r
when DisplayMode is 0, the default value is 80, and the value range is (20-100).
DisplayCardNo: It is valid when DisplayMode is 0, 0: Not display card number, 1:
Display card number.
n l y
O
3.16.2 CA_SMS_SEND_SUPEROSD_RESPONSE
Table 3.16.2 Data_Cont() of CA_SMS_SEND_SUPEROSD_RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
Erro_Code 32 Error code
}
3.17 Send FingerPrint(Optional Function)
Send Fingerprint to the specified user group.

3.17.1 SMS_CA_SEND_FINGER_PRINT_REQUEST
Data content is shown in Table:
Table 3.17.1 Data_Cont() of SMS_CA_SEND_FINGER_PRINT_REQUEST

SYNTAX BITS NOTES

Data_Cont(){
Exp_Len 8 Expression Length
Exp_Char 8 Expression
}
Whether to Display
Enable 8
Fingerprint
if(Enable == 0)
{
8 Cancel Type
CancelType
}
Else if(Enable == 1)
{
Type 8 Type
EncryptNum 8 Encryption Type
Whether to Forced to
ForcedDisplay 8
StartTime 32
Display
Start Time
a l )
EndTime
FontSize
32
8
End Time
Size of Font
n ti
FontColor
BackgroundColor
8
8
d e
Color of Font
Background Color
X-position
Y-position
8
8
n fi
X Coordinates
Y Coordinates
Duration
ShowMode
(c o
8
32
Show Type
Display duration at a
time
PauseTime
CharPos
TM 32
128
Pause duration at a time
Character Coordinates
}
}
r P
fo
Exp_Len: Addressing expression length. (Limited to a maximum of 48char, not null)
Exp_Char: Addressing expression character.
l y
Enable: Whether to display fingerprint, value between 0 and 1, 0 (Disable); 1 (Enable).
n
CancelType:Type of cancellation. 0 refers to cancel all the fingerprints, 1 refers to
O
cancel the fingerprint of forced type (ForcedDisplay=1).
Type: Type, the value scope is 0 and 1, and 0 refers to display according to the STB
number, and 1 refers to display according to the card number.
EncryptNum: Encryption mode, 0 means not encryption, 1 means encryption.
ForcedDisplay: 0: Not Forced Display; 1: Forced Display
StartTime: Start Time; in time_t format, the value is determined with reference to local
time of the region where CAS system locates. the scope of CAS System is limited from
“at 0:00:00 on January 1, 2000 to at 23:59:59 on December 31, 2030”.
For example: 42 2D 4D D4 indicates 2005-03-08 15:01:40
72 BB 4A 00 indicates 2030-12-31 00:00:00
EndTime: End Time; in time_t format, the value is determined with reference to local
time of the region where CAS system locates. the scope of CAS System is limited from
“at 0:00:00 on January 1, 2000 to at 23:59:59 on December 31, 2030”.

FontSize: Size of Font, with the Value Interval being [0,255]. 0 refers to default value,
1 refers to large font, 2 refers to small font, 3~255 refers to the actual value of the font
size, in pixels. For example, the font size is 9, and then the pixel of the font is 9*9.
FontColor: Color of Font, with the Value Interval being [0,255]. See Appendix 7 for
the corresponding relation between the color value and RGB value.
BackgroundColor: Background Color, with the Value Interval being [0,255]. See
Appendix 7 for the corresponding relation between the color value and RGB value.
X-position: X Coordinate, with the Value Interval being [0,100].
Y-position: Y Coordinate, with the Value Interval being [0,100].
-------------------------------------------------------------------------------------------------------
Note:
When any value in X, Y coordinate is 100, it means that position selective-access
display mode is opened, in this mode, fingerprint display will jump randomly on the TV
screen.
a l )
ti
--------------------------------------------------------------------------------------------------------
ShowMode: Show Mode, 0 indicates the dominant display mode of characters, 1
n
d e
indicates the recessive display mode of characters, 2 indicates the dominant dot matrix
fi
display mode, 3 indicates the recessive dot matrix display mode, 4 indicates the
n
(c o
dominant matrix display mode, and 5 indicates the recessive matrix display mode.
Duration: Display duration at a time, in second, the value range is [1, 65535].
TM
PauseTime: Duration of each pause, in seconds, with the Value Interval being
[0,65535]. When the value is 0, indicating not pause and the ‘FlashTime’ is invalid at
the moment.
r P
fo
CharPos: Character coordinates which will be valid when ShowMode is 4 or 5, and
y
each byte shows the coordinates of the character with the same card number or STB
l
number positions (the offset relative to the position of first character, and 4 bits higher
n
represents the X-coordinate offset and 4 bits lower represents the Y-coordinate offset).
O
For the STB number without encryption, the first 12 coordinates are valid; for the card
number or STB number with encryption, the 16 coordinates are all valid.
--------------------------------------------------------------------------------------------------------
Note:
when setting the display position, the character display order must be from left to right
and top to bottom.
--------------------------------------------------------------------------------------------------------
3.17.2 CA_SMS_SEND_ FINGER_PRINT_RESPONSE
Table 3.17.2 CA_SMS_SEND_FINGER_PRINT_RESPONSE Data Content
SYNTAX BITS NOTES
Data_Cont(){
Erro_Code 32 Error Code
}

3.18 Switch/Lock Channel(Optional Function)
Force the specified subscribers, addressed by the addressing expression, to switch to a

specified channel. The parameters of the channel, such as the frequency, the symbol
rate, the modulation mode, the component number, the component type (audio and
video), the respectively PID and ECM PID, etc., should be defined in the message.
3.18.1 SMS _CA_LOCK_SERVICE_REQUEST

Table 3.18.1 Data_Cont() of SMS _CA_ LOCK_SERVICE_REQUEST
SYNTAX BITS NOTES
a l )
Data_Cont(){
Exp_Len
8 expression length
n ti
Exp_Char 8 expression
d e
}
LockFlag 8
n fi
0: means only switching but not locking. 1:
Reserved
Frequency
16
32
(c o
means locking.
reserved field
frequency
Reserved
fec_outer
TM
12
4 Forward Error Correction outer codes
Modulation
symbolrate
r P 8
28
modulation method
symbol rate
fec_inner
PCR PID
fo 4
16
Forward Error Correction inner codes
clock synchronization PID code
ComponentNum
n l
For(int I=0;i<
ComponentNum;i++){
y 8 Number of programs components
O
CompType
CompPID
ECMPID
8
16
16
underlying stream type
underlying stream PID
PID of ECM pack of descrambled underlying
stream CW
}
Reserved 8 fixed to be 0x00
}

LockFlag: Lock mode, ‘0’ for just switching the channel but not locking the control
panel, ‘1’ means switching and locking the control panel.
Reserved: NSTV reserved field.

Frequency: Channel frequency in MHz, with value scope of 0-9999.9999. 4-bytes

BCD code is used to indicate this value, the first 2 bytes are for integer part, and the last
2 bytes are for decimal part. If the valid bits are less than 4 bytes, use 0 to make up the
relevant bits. For example:
For frequency 4358.59MHz, the code is 0x43585900;
For frequency 879.564MHz, the code is 0x08795640.
Reserved: NSTV reserved field.
fec_outer: Forward Error Correction Outer codes.
Modulation: modulation mode, with value scope of 0-255. For detailed definitions, see
below:
0: Reserved;
1: QAM16;
2: QAM32;
3: QAM64;
4: QAM128;
5: QAM256;
6-255: Reserved.
symbolrate: Symbol rate in MB with value scope of 0-999.9999. 4-bytes BCD code is
a l )
used to indicate this value just as the ‘frequency’ field.
fec_inner: Forward Error Correction inner codes.
n ti
PCR PID: clock synchronization PID code.
d e
ComponentNum: Number of component streams
CompType: type of component underlying stream.
n fi
CompPID: PID of component underlying stream.
ECMPID: PID of ECM pack of descrambled underlying stream CW.
(c o
TM
3.18.2 CA_SMS _LOCK_SERVICE_RESPONSE
r P
fo
Table 3.18.2 Data_Cont() of CA_SMS _ LOCK_SERVICE_RESPONSE
n l y
Data_Cont(){
SYNTAX BITS NOTES
O }
3.19 Release Lock(Optional Function)
Release the control panel lock (set by ‘Switch Channel’ message) for the specified
subscribers, addressed by the addressing expression.
3.19.1 SMS _CA_UNLOCK_SERVICE_REQUEST

Table 3.19.1 Data_Cont() of SMS _CA_UNLOCK_SERVICE_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
Exp_Len 8 expression length


Exp_Char 8 expression
}
}

3.19.2 CA_SMS _UNLOCK_SERVICE_RESPONSE

Table 3.19.2 Data_Cont() of CA_SMS _UNLOCK_SERVICE_RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
}
a l )
n ti
i d e
3.20 High advance and controllable preview(Optional
Function)
n f
( c o
Through this command, SMS can set the Advanced Preview-related parameters of
function is canceled.
T M
the specified card. When the parameters are 0, then the advanced preview control
r P
3.20.1 SMS_CA_SET_ADV_CONTROL_PREVIEW_REQUES
fo
n l y T
O
Table 3.20.1 Data_Cont() of SMS_CA_SET_ADV_CONTROL_PREVIEW_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
CARD_SN 128 Smart card No.
Free preview time
PreviewDuration 8
unit
WatchTime 8 Watch time unit
Total number of
TotalCount 8 times allowed for
watch every day
Total time allowed
TotalTime 16
for watch every day
}
3.20.2 CA_SMS_SET_ADV_CONTROL_PREVIEW_RESPON
SE

Table 3.20.2 Data_Cont() of CA_SMS_SET_ADV_CONTROL_PREVIEW _RESPONSE

SYNTAX BITS NOTES
Data_Cont(){
}
PreviewDuration: Free preview time unit. The watch time unit is from initial switch
by the user to the current channel, where it is allowed for watch all or part, depending
on the contents of WatchTime. The unit is minute, ranging from 0 to 255. ;
WatchTime: Watch time unit. Watch time allowed at a PreviewDuration or
TotalCount. The unit is minute, ranging from 0 to 255;
TotalCount: Total number of times allowed for watch every day. It is counted as 1
from the user's first time to channel switching, and if the switching happens during the
time interval represented by [WatchTime, PreviewDuration), it will not be counted; if
channel switching is not done, but the continuous watch time reaches the WatchTime,
a
then it will be counted as 1 when it is longer than PreviewDuration. The unit is 4 times, l )
ranging from 0 to 63;
n ti
e
--------------------------------------------------------------------------------------------------------
d
Note:
n fi
(c o
when TotalCount = 1, in fact, 4 times is allowed for watch; when it is 2, 8 times is
allowed, and so on.
TM
--------------------------------------------------------------------------------------------------------
r P
TotalTime: Total time allowed for watch every day in minute ranging from 0 to 1023.
fo
n l y
3.21 STB Notification(Optional Function)
O
Send STB notification to the specified user group.
3.21.1 SMS_CA_SET_STBNotify_REQUEST
Table 3.21.1 Data_Cont() of SMS_CA_SET_STBNotify_REQUEST
SYNTAX BITS NOTES
Data_Cont(){
Expression
Exp_Len 8
Length
}
Notification
Action 8
Action

}
Exp_Len: Expression length. (Limited to a maximum of 40char, not null)
Exp_Char: Expression character.
Action: Notification action. 0: Restart the set-top box, 1: Lock the set-top box, 2:
Re-search, 3: Upgrade the set-top box, 4: Unlock the set-top box, 5: Initialize the
set-top box, 6: Display the system information of set-top box.
3.21.2 CA_SMS_SET_STBNotify_RESPONSE
Table 3.21.2 Data_Cont() of CA_SMS_SET_STBNotify_RESPONSE
SYNTAX BITS NOTES
Data_Cont(){
}
3.22 Force STB-Card Pairing(Optional Function)
a l )
Through this message, SMS can set a specified card to conduct forced STB-Card
n ti
e
Pairing. After receiving this command, the card will immediately check whether it has
d
fi
been paired with the current set-top box, and if not, proceed to the STB-Card Pairing,
n
and the whole process does not need any human intervention.
3.22.1 SMS_CA_SET_FORCEREPAIR_REQUEST (c o
Data content is as shown in Table:
TM
P
Table 3.22.1 SMS_CA_SET_FORCEREPAIR_REQUEST Data Content
r
Data_Cont(){ o
SYNTAX
f
BITS NOTES
n l
} y
CARD_SN 128 Smart Card Number
O
3.22.2 CA_SMS_ SET_ FORCEREPAIR _RESPONSE
Table 3.22.2 CA_SMS_SET_FORCEREPAIR_RESPONSE Data Content
SYNTAX BITS NOTES
Data_Cont(){
}
3.23 Cancel Force STB-Card Pairing(Optional Function)
Through this message, SMS can set a specified card to conduct forced STB-Card
Pairing. After receiving this command, the card will immediately cancel the detection
whether it has been paired with the current set-top box.

3.23.1 SMS_CA_SET_CANCELFORCEREPAIR_REQUEST
Table 3.23.1 SMS_CA_SET_CANCELFORCEREPAIR_REQUEST Data Content
SYNTAX BITS NOTES
Data_Cont(){
CARD_SN 128 Smart Card Number
}
3.23.2 CA_SMS_ SET_ CANCELFORCEREPAIR _RESPONSE

Table 3.23.2 CA_SMS_ SET_CANCELFORCEREPAIR_RESPONSE Data Content
SYNTAX BITS NOTES
Data_Cont(){
}
a l )
ti
3.24 Continuous Viewing Restriction (Optional Function)
n
i d e
Via this message, SMS can set or cancel the long time continuous viewing function
of the same channel.
n f
( c o
3.24.1 SMS_CA_SET_WORKTIME_LIMIT_REQUEST
T M
P
Table 3.24.1 SMS_CA_SET_WORKTIME_LIMIT_REQUEST Data Content
r SYNYAX BITS NOTES
fo
Data_Cont(){
n l y Exp_Len
8
Length of the
expression
O }
Exp_Char
Enable
8
8
Expression
Enable or not
If(Enable==1) {
IsCancel 8 Cancel or not
If(IsCancel == 0) {
WorkingTime 8 Working time
StopTime 16 Stop time
}
}
}
Exp_Len: Length of expression. (The maxlength is 40 char and can not be empty)
Exp_Char: Character of expression.
Enable: If or not enable continuous viewing, 0 refers to not enable, 1 refers to
enable. The following parameters are valid when Enable value is 1.
IsCancel: If or not cancel, 0 refers to set the parameter of continuous viewing, 1
refers to activate the terminal device in inoperation mode, which can realize

continuous viewing.
WorkingTime: Working time, the value range is 1~255, the unit is hour. It is valid
when IsCancel is 0, which refers to the maximum-continuous viewing time of the
same channel.
StopTime: Stop time, the value range is 30~1440, the unit is mimnute. It is valid
when IsCancel is 0, which refers to the required inoperation time when continuous
working time is exceeded.
3.24.2 CA_SMS_WORKTIME_LIMIT_RESPONSE
Data content is shown in Figure:
Table 3.24.2 CA_SMS_WORKTIME_LIMIT_RESPONSE Data Content
SYNTAX BITS NOTES
Data_Cont(){
a l )
}
n ti
3.25 Set CCK
d e
n fi
or immediately refresh CCK.
(c o
Through this message, SMS can set the CCK lifetime refresh time of CICAM card
3.25.1 SMS_CA_SET_CCK_REQUEST
TM
r P
Data content is shown in Table 3.25.1:
Table 3.25.1 SMS_CA_SET_CCK_REQUEST Data Content
SYNTAX
fo BITS NOTES
n l Exp_Leny
Data_Cont(){
8
Expression
length
O }
Action 8 CCK action

If(Action==0) {
Lifetime 16 lifetime
}
}
Exp_Len: Expression length. (upper limit is 40char, cannot be empty)
Exp_Char: Expression characters.
Action: CCK action, 0 indicates setting CCKlifetime,and 1 indicates immediate CCK
refresh. The following parameters are valid when Action is 0.
Lifetime: CCKlifetime in seconds, and value range is 60~3600.
3.25.2 CA_SMS_SET_CCK_RESPONSE

Data content is shown in table 3.25.2:

Table 3.25.2 CA_SMS_SET_CCK_RESPONSE Data Content
SYNTAX BITS NOTES
Data_Cont(){
}
4 Suggestions for SMS Implementation
4.1 Reducing the Number of Commands
In some cases, SMS could reduce the number of commands to improve the efficiency of
a l )
CDCAS3.0_SMS interface, such as, the case of the subscriber renewing his
subscription.
n ti
d e
Here is an example. A subscriber purchases product 1 with service period from January
fi
1st, 2007 to December 31st 2007. He renews his service on December 25th, 2007 to
n
(c o
order the service until end of next year, that is, service period is renewed to January 1st
2008 to December 31st 2008. In this case, SMS only needs to send one command to
TM
update the service period of product 1 (January 1st 2008 to December 31st 2008). It’s
no necessary to send two commands: canceling the entitlement on December 31st 2007
P
and then sending a new entitlement on January 1st 2008.
r
fo
n l y
4.2 Recharging for IPPV Service
O
Recharging operation is used for IPPV service. In CDCAS3.0, recharging is a process
that SMS sets up the credit limit in the E-Slot of the smart card, using the message
‘Charge E-slot’ (Section 3.9). The value in this message is the total credit of the E-slot,
including which has been consumed. So, SMS should make sure that the credit limit
value here should be the total amount of the history recharges.
The credit limit is indicated in points, and the exchange rate between the points and the
real money could be defined by the operator.
Take an example here. Provided 1 dollar equal to 1 point, a card has the credit limit of
200 points currently, and the subscriber recharges 800 dollars. Then, the subscriber has
totally recharged 1000 dollar, SMS should set credit limit value in the ‘Charge E-slot’
message to 1000, and the smart card will change the value of credit limit to 1000 after
receiving the command.

4.3 Package of Services
CDCAS3.0 supports flexible programs package strategy. The operator can freely pack
different services into one package, and pack one service into different packages as well.
The services could be sold based on the packages .
For example: Services 1, 3, 5 & 8 could be packed into Product package 1, and Services
8, 1 & 21 could be packed into Product package 2, and Services 1, 21, & 25 could be
packed into Product package 3. See figure below:
a l )
n ti
d e
n fi
(c o
TM
r P
fo
n l y
-------------------------------------------------------------------------------------------------------
Note: O
SMS send the entitlement commands based on the products rather than the services.
--------------------------------------------------------------------------------------------------------
For the above example, provided the subscribers want to watch Services 3, 5, and 8,
SMS just needs to send entitlement of Product 1. Provided the subscribers want to
watch Services 1, SMS could send the entitlement either of Product 1, 2 or 3.

Appendix 1 Message ID
Table A1.1 Message ID List
Message ID Value
SMS _CA_CREATE_SESSION_REQUEST 0x0001
CA_SMS _CREATE_SESSION_RESPONSE 0x8001
SMS _CA_OPEN_ACCOUNT_REQUEST 0x0201
CA_SMS _OPEN_ACCOUNT_RESPONSE 0x8201
SMS _CA_STOP_ACCOUNT_REQUEST 0x0202
CA_SMS _STOP_ACCOUNT_RESPONSE 0x8202
SMS _CA_SET_LOCK_REQUEST 0x0203
CA_ SMS _SET_LOCK_ RESPONSE 0x8203
SMS _CA_SET_UNLOCK_REQUEST 0x0204
CA_ SMS _SET_UNLOCK_ RESPONSE 0x8204
SMS _CA_REPAIR_REQUEST 0x0206
a l )
CA_SMS _REPAIR_RESPONSE
SMS _CA_RESETCARDPIN_REQUEST
CA_SMS _RESETCARDPIN_RESPONSE
0x8206
t
0x0207
n
0x8207
i
SMS _CA_SETSLOTMONEY_REQUEST
d e 0x0208
CA_SMS _SETSLOTMONEY_RESPONSE
SMS _CA_SET_CHARACTER_REQUEST
n fi 0x8208
0x020C
CA_SMS _ SET_CHARACTER_RESPONSE
SMS _CA_ENTITLE_REQUEST
CA_SMS _ENTITLE_RESPONSE
(c o 0x820C
0x020D
0x820D
SMS _CA_ENTITLEEXT_REQUEST
TM
CA_SMS _ENTITLEEXT_RESPONSE
0x020E
0x820E
ST
r P
SMS_CA_SET_ADV_CONTROL_PREVIEW_REQUE
0x020F
fo
CA_SMS_SET_ADV_CONTROL_PREVIEW_RESPO
NSE
0x820F
n l y
SMS _CA_SEND_EMAIL_REQUEST
CA_SMS _SEND_EMAIL_RESPONSE
0x0301
0x8301
O SMS _CA_SEND_OSD_REQUEST
CA_SMS _SEND_OSD_RESPONSE
SMS _CA_LOCK_SERVICE_REQUEST
0x0304
0x8304
0x0306
CA_SMS _LOCK_SERVICE_RESPONSE 0x8306
SMS _CA_UNLOCK_SERVICE_REQUEST 0x0307
CA_SMS _UNLOCK_SERVICE_RESPONSE 0x8307
SMS_CA_SEND_SUPEROSD_REQUEST 0x0308
CA_SMS_SEND_SUPEROSD_ RESPONSE 0x8308
SMS_CA_SEND_ FINGER_PRINT_ REQUEST 0x0309
CA_SMS_SEND_ FINGER_PRINT_RESPONSE 0x8309
SMS_CA_SET_WORKTIME_LIMIT_REQUEST 0x030b
CA_SMS_ SET_WORKTIME_LIMIT_RESPONSE 0x830b
SMS _CA_SET_CHILD_REQUEST 0x0402
CA _SMS _SET_CHILD_RESPONSE 0x8402
SMS _CA_CANCEL_CHILD_REQUEST 0x0403
CA_SMS _CANCEL_CHILD_RESPONSE 0x8403
SMS_CA_SET_FORCEREPAIR_REQUEST 0x0409
CA_SMS_ SET_ FORCEREPAIR _RESPONSE 0x8409
SMS_CA_SET_CANCELFORCEREPAIR_REQUEST 0x040a

CA_SMS_SET_CANCELFORCEREPAIR_RESPONSE 0x840a
SMS_CA_SET_STBNotify_REQUEST 0x040C
CA_SMS _SET_STBNotify_RESPONSE 0x840C
SMS_CA_SET_CCK_REQUEST 0x040E
CA_SMS_SET_CCK_RESPONSE 0x840E
a l )
n ti
d e
n fi
(c o
TM
r P
fo
n l y
O

Appendix 2 Error Codes

Table A2.1 Error Codes List
Codes Value Meaning
TFCA_OK 0x0000 Successful execution
CARD_NOT_EXIST 0x0002 Card not exists
CARD_NOT_OPEN 0x0003 Account not opened yet
BATCH_ENTITLE_PID_REPEAT Batch entitle instruction has repeated product
0x000A
numbers
SLOT_NOT_EXIST 0x000B wallet to recharge does not exist
INVILID_PROD 0x000C illegal product number
INVILID_TIME 0x000D Illegal time
a l )
When de-entitle, it’s found that entitle does not
i
ENTITLE_NOT_EXSIT 0x000E
ENTITLE_EXCEED_SECTION_LIMIT 0x000F
exist
n t
Reaching upper limit of entitle records
ADDRCMD_EXPRESSION_TOO_LONG
d e
fi
0x0014 addressing expression too long
CONENT_TOO_LONG
TITLE_TOO_LONG
0x0016
0x0017
o n
contents too long
Title too long
DURATION_TOO_LONG
M
0x0018
(c OSD duration out of range
expression error (including number of left and
ADDRCMD_EXPRESSION_WRONG
INVALID_OSD_STYLE
P T 0x001D
right brackets not correct)
PERSONALMAP_TYPE_INVALID
fo r 0x0020
0x0027
Invalid OSD display style
illegal personal information
TFCAERR_MSG_INVILID
n l y
INTERFACE_UNDER_CONSTRUCTION
0xBBBB illegal message
0xCCCC interface under construction
O
CASSERVER_INNER_ERROR
SETCHILD_PARENT_ERR
0xDDDD CAS internal error
0x0029 setting child card error: parent card is child card
SETCHILD_CHILD_ERR_HAVEBEPARENT setting child card error: child card is parent card
0x002A
of other card
SETCHILD_ CHILD_ERR_HAVEBECHILD setting child card error: child card is child card of
0x002B
other card
CANCELCHILD_ERR 0x002C canceling child card error: child card canceled
CARD_NOT_SUPPORT 0x002D Card not supporting current operation

INVALID_ TOTALCOUNT Total number of times allowed for watch the
0x0031
controllable preview error
INVALID_ TOTALTIME Total time allowed for watch the controllable
0x0032
preview error
INVALID_ FORCEDISPLAY 0x0033 Forced display OSD error
INVALID_ FONTSIZE 0x0034 OSD font size error

INVALID_ BACKGROUNDAREA 0x0035 OSD background area error

SYSTEM_NOT_SUPPORT 0x003C System not supporting current operation
INVALID_FINGER_PRINT_ENABLE 0x003D Fingerprint operation error
INVALID_FINGER_PRINT_DISPLAY_MODE 0x003E Fingerprint display error
INVALID_STB_NOTIFY_ACTION 0x003F Invalid set-top box to inform action
INVALID_FP_POSITION 0x0040 Invalid fingerprint coordinates
INVALID_FP_VISIBLE 0x0041 Invalid figerprint display information
INVALID_INTERVAL 0x0042 Invalid time interval
INVALID_REPETITION 0x0043 Invalid times of repetition
INVALID_ISCANCEL 0x0044 Invalid cancel tag
INVALID _CANCELTYPE 0x0045 Invalid cancel type
INVALID_ENCRYPTNUM 0x0046 Invalid encryption type
INVALID_DISPLAYDATA 0x0049 Invalid display data
INVALID_WATCHLIMIT_ENABLE 0x004a Continuous viewing operation error
)
INVALID_CCK_ACTION 0x004b Invalid CCK action
i a l
n t
d e
n fi
(c o
TM
r P
fo
n l y
O

Appendix 3 Property Items
The usage of property items is shown as below:
Property Index Index Usage

0 Area Area code
1 Bouquet Identify that the smart card belongs to
which bouquet. Different services
might be offered for different bouquets.
2 Reserved Reserved for NSTV.
3 character 0 User defined
6
7
character 3
character 4
User defined
l )
User defined. It can be the high 4 bytes
a
8 character 5
of STB No. if necessary.
n ti
User defined. It can be the low 4 bytes
e
of STB No. if necessary.
d
n fi
(c o
TM
r P
fo
n l y
O

Appendix 4 Addressing Expression
1 Addressing Elements in CDCAS3.0
Elements Type Label Remarks

Subscriber card number “card” Inner ID of the smart card
ordered product number “prod” Against subscribers who has ordered
certain products
current service number “serv” Against subscribers who are currently
watching certain services
character 0 (area) “area” User area
Bouquet “bouq” Users can be divided into different
a l )
bouquets to realize different demands, for
example, display of different channel list.
character 1
character 2
“cha1”
“cha2”
n ti
character 3 “cha3”
d e
character 4
character 5
“cha4”
“cha5”
n fi
character 6 “cha6”
(c o
2 Operators
TM
r P
The character list for the operators is shown as below:
fo
n l y Type Contents
bitwise AND
bitwise OR
Character
*
+
O Arithmetic
operation operator
Greater than
Less than
>
<
Be equal to =
AND &
OR |
Logical operation
NOT ~
operator
Left bracket (
Right bracket )
3 Expression
1) The addressing expression is represented with character strings, which consists of
addressing elements and operators.
2) The value in the expression could be represented in hexadecimal or decimal. If the
value is in hexadecimal, ‘0x’ prefix must be added.

3) For ‘subscriber card number’ element, the value should be either 0, or an existing
card number, and it should be represented in decimal.
[Examples]
Example 1: area code equal to 20
“area=20”
“area=0x14”
Example 2:
“(~(cha2<234))&(cha3>675)”
Example 3:
“card>0”
“card>8000302100016651”
4 Addressing Elements Supported in Commands

a l )
CommandsAddressing
n ti
Switch Channel
Elements OSD E-Mail
d e/ Release Lock
subscriber card number
ordered product number
√
√
√
n
× fi √
×
current service number
characters
√
√
(c o ×
√
×
×
T M
5 P
Operators Supported
r
by Addressing Elements
fo
n l y Addressing
Operators
* + > < =
O Elements
subscriber card number
ordered product number
√
×
√
×
√
×
√
×
√
√
current service number × × × × √
characters √ √ √ √ √

Appendix 5 MD5 Codes
1 MD5.h file
#ifndef CDCAS3.0_MD5_H
#define CDCAS3.0_MD5_H
#define S11 7
#define S12 12
#define S13 17
#define S14 22
#define S21 5
#define S22 9
a l )
#define S23 14
#define S24 20
n ti
#define S31 4
d e
#define S32 11
#define S33 16
n fi
#define S34 23
#define S41 6
(c o
#define S42 10
#define S43 15
TM
#define S44 21
typedef unsigned long uint4;
r P
fo
typedef unsigned short uint2;
typedef unsigned char uint1;
n l
#ifdef __cplusplus
y
#endif O
extern "C" {
unsigned char TFCA_MD5(unsigned char *pInPut,uint4 dwInput_Length,unsigned char

*pOutPut);
/*
TFCA_MD5 performs data summary. Parameter meaning as follows:
pInPut: point to first address of data to have data summary
dwInput_Length:length of data for summary, with unit of bytes
pOutPut: point to first pointer of returned MAC data
*/
#ifdef __cplusplus
}
#endif
#endif //CDCAS3.0_MD5_h

2 MD5.c
#include <stdio.h>
#include <string.h>
#include "md5.h"
void encode (uint1 *output, uint4 *input, uint4 len)

{
uint4 i, j;
for (i = 0, j = 0; j < len; i++, j += 4)

{
output[j] = (uint1) (input[i] & 0xff);
output[j+1] = (uint1) ((input[i] >> 8) & 0xff);
}
}
void decode(uint4 *output, uint1 *input, uint4 len)
a l )
{
uint4 i, j;
n ti
d e
fi
for (i = 0, j = 0; j < len; i++, j += 4)
output[i] = ((uint4)input[j]) | (((uint4)input[j+1]) << 8) |
}
(((uint4)input[j+2]) << 16) | (((uint4)input[j+3]) << 24);
o n
uint4 rotate_left(uint4 x, uint4 n)
{
M (c
}
return (x << n) | (x >> (32-n)) ;
P T
fo r
uint4 F(uint4 x, uint4 y, uint4 z)
{
} l y
return (x & y) | (~x & z);
n
O
void FF(uint4 * a, uint4 b, uint4 c, uint4 d, uint4 x,uint4 s, uint4 ac)
{
*a += F(b, c, d) + x + ac;
*a = rotate_left (*a, s) +b;
}
uint4 G(uint4 x, uint4 y, uint4 z)

{
return (x & z) | (y & ~z);
}
void GG(uint4 *a, uint4 b, uint4 c, uint4 d, uint4 x, uint4 s, uint4 ac)
{
*a += G(b, c, d) + x + ac;
}
uint4 H(uint4 x, uint4 y, uint4 z)

{

return x ^ y ^ z;
}
void HH(uint4 *a, uint4 b, uint4 c, uint4 d, uint4 x, uint4 s, uint4 ac)
{
*a += H(b, c, d) + x + ac;
}
uint4 I(uint4 x, uint4 y, uint4 z)

{
return y ^ (x | ~z);
}
void II(uint4 *a, uint4 b, uint4 c, uint4 d, uint4 x, uint4 s, uint4 ac)
{
*a += I(b, c, d) + x + ac;
}
void transform (uint1 block[64],uint4 *pstate,uint1 *pfinalized){
a l )
uint4 a = pstate[0], b = pstate[1], c = pstate[2], d = pstate[3], x[16];
decode (x, block, 64);
n ti
d e
fi
/* Round 1 */
FF(&a, b, c, d, x[ 0], S11, 0xd76aa478); /* 1 */
FF(&d, a, b, c, x[ 1], S12, 0xe8c7b756); /* 2 */
o n
(c
FF(&c, d, a, b, x[ 2], S13, 0x242070db); /* 3 */
FF(&b, c, d, a, x[ 3], S14, 0xc1bdceee); /* 4 */
TM
FF(&a, b, c, d, x[ 4], S11, 0xf57c0faf); /* 5 */
FF(&d, a, b, c, x[ 5], S12, 0x4787c62a); /* 6 */
r P
FF(&c, d, a, b, x[ 6], S13, 0xa8304613); /* 7 */
FF(&b, c, d, a, x[ 7], S14, 0xfd469501); /* 8 */
fo
FF(&a, b, c, d, x[ 8], S11, 0x698098d8); /* 9 */
FF(&d, a, b, c, x[ 9], S12, 0x8b44f7af); /* 10 */
y
FF(&c, d, a, b, x[10], S13, 0xffff5bb1); /* 11 */
l
FF(&b, c, d, a, x[11], S14, 0x895cd7be); /* 12 */
n
FF(&a, b, c, d, x[12], S11, 0x6b901122); /* 13 */
O
FF(&d, a, b, c, x[13], S12, 0xfd987193); /* 14 */
FF(&c, d, a, b, x[14], S13, 0xa679438e); /* 15 */
FF(&b, c, d, a, x[15], S14, 0x49b40821); /* 16 */
/* Round 2 */
GG(&a, b, c, d, x[ 1], S21, 0xf61e2562); /* 17 */
GG(&d, a, b, c, x[ 6], S22, 0xc040b340); /* 18 */
GG(&c, d, a, b, x[11], S23, 0x265e5a51); /* 19 */
GG(&b, c, d, a, x[ 0], S24, 0xe9b6c7aa); /* 20 */
GG(&a, b, c, d, x[ 5], S21, 0xd62f105d); /* 21 */
GG(&d, a, b, c, x[10], S22, 0x2441453); /* 22 */
GG(&c, d, a, b, x[15], S23, 0xd8a1e681); /* 23 */
GG(&b, c, d, a, x[ 4], S24, 0xe7d3fbc8); /* 24 */
GG(&a, b, c, d, x[ 9], S21, 0x21e1cde6); /* 25 */
GG(&d, a, b, c, x[14], S22, 0xc33707d6); /* 26 */
GG(&c, d, a, b, x[ 3], S23, 0xf4d50d87); /* 27 */
GG(&b, c, d, a, x[ 8], S24, 0x455a14ed); /* 28 */
GG(&a, b, c, d, x[13], S21, 0xa9e3e905); /* 29 */
GG(&d, a, b, c, x[ 2], S22, 0xfcefa3f8); /* 30 */

GG(&c, d, a, b, x[ 7], S23, 0x676f02d9); /* 31 */

GG(&b, c, d, a, x[12], S24, 0x8d2a4c8a); /* 32 */
/* Round 3 */
HH(&a, b, c, d, x[ 5], S31, 0xfffa3942); /* 33 */
HH(&d, a, b, c, x[ 8], S32, 0x8771f681); /* 34 */
HH(&c, d, a, b, x[11], S33, 0x6d9d6122); /* 35 */
HH(&b, c, d, a, x[14], S34, 0xfde5380c); /* 36 */
HH(&a, b, c, d, x[ 1], S31, 0xa4beea44); /* 37 */
HH(&d, a, b, c, x[ 4], S32, 0x4bdecfa9); /* 38 */
HH(&c, d, a, b, x[ 7], S33, 0xf6bb4b60); /* 39 */
HH(&b, c, d, a, x[10], S34, 0xbebfbc70); /* 40 */
HH(&a, b, c, d, x[13], S31, 0x289b7ec6); /* 41 */
HH(&d, a, b, c, x[ 0], S32, 0xeaa127fa); /* 42 */
HH(&c, d, a, b, x[ 3], S33, 0xd4ef3085); /* 43 */
HH(&b, c, d, a, x[ 6], S34, 0x4881d05); /* 44 */
HH(&a, b, c, d, x[ 9], S31, 0xd9d4d039); /* 45 */
HH(&d, a, b, c, x[12], S32, 0xe6db99e5); /* 46 */
HH(&c, d, a, b, x[15], S33, 0x1fa27cf8); /* 47 */
HH(&b, c, d, a, x[ 2], S34, 0xc4ac5665); /* 48 */
a l )
/* Round 4 */
II(&a, b, c, d, x[ 0], S41, 0xf4292244); /* 49 */
n ti
II(&d, a, b, c, x[ 7], S42, 0x432aff97); /* 50 */
d e
fi
II(&c, d, a, b, x[14], S43, 0xab9423a7); /* 51 */
II(&b, c, d, a, x[ 5], S44, 0xfc93a039); /* 52 */
II(&a, b, c, d, x[12], S41, 0x655b59c3); /* 53 */
o n
(c
II(&d, a, b, c, x[ 3], S42, 0x8f0ccc92); /* 54 */
II(&c, d, a, b, x[10], S43, 0xffeff47d); /* 55 */
TM
II(&b, c, d, a, x[ 1], S44, 0x85845dd1); /* 56 */
II(&a, b, c, d, x[ 8], S41, 0x6fa87e4f); /* 57 */
r P
II(&d, a, b, c, x[15], S42, 0xfe2ce6e0); /* 58 */
II(&c, d, a, b, x[ 6], S43, 0xa3014314); /* 59 */
fo
II(&b, c, d, a, x[13], S44, 0x4e0811a1); /* 60 */
II(&a, b, c, d, x[ 4], S41, 0xf7537e82); /* 61 */
y
II(&d, a, b, c, x[11], S42, 0xbd3af235); /* 62 */
l
II(&c, d, a, b, x[ 2], S43, 0x2ad7d2bb); /* 63 */
n
II(&b, c, d, a, x[ 9], S44, 0xeb86d391); /* 64 */
O
pstate[0] += a;
pstate[1] += b;
pstate[2] += c;
pstate[3] += d;
memset ( (uint1 *) x, 0, sizeof(x));
}
void update (uint1 *input, uint4 input_length,uint4 *pstate,uint1 *pfinalized,uint4 *pcount,uint1
*pbuffer) {
uint4 input_index, buffer_index;

uint4 buffer_space;
if (*pfinalized)
return;
buffer_index = (uint4)((pcount[0] >> 3) & 0x3F);
if ( (pcount[0] += ((uint4) input_length << 3))<((uint4) input_length << 3) )

pcount[1]++;

pcount[1] += ((uint4)input_length >> 29);
buffer_space = 64 - buffer_index;
if (input_length >= buffer_space)

{
memcpy (pbuffer + buffer_index, input, buffer_space);
transform (pbuffer,pstate,pfinalized);
for (input_index = buffer_space; input_index + 63 < input_length; input_index += 64)

transform (input+input_index,pstate,pfinalized);
buffer_index = 0;
}
else
input_index=0;
memcpy(pbuffer+buffer_index, input+input_index, input_length-input_index);

}
a l )
ti
void finalize(uint4 *pstate,uint1 *pfinalized,uint4 *pcount,uint1 *pbuffer,uint1 *pOutPut)
{
n
unsigned char bits[8];
d e
fi
uint4 index, padLen;
uint1 PADDING[64]=
{
o n
(c
0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
};
TM
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
if (*pfinalized)
r P
return;
fo
y
encode (bits, pcount, 8);
l
index = (uint4) ((pcount[0] >> 3) & 0x3f);
n
padLen = (index < 56) ? (56 - index): (120 - index);
O
update (PADDING, padLen,pstate,pfinalized,pcount,pbuffer);
update (bits, 8,pstate,pfinalized,pcount,pbuffer);
encode (pOutPut, pstate, 16);
memset (pbuffer, 0, sizeof(*pbuffer));
*pfinalized=1;
}
unsigned char TFCA_MD5(unsigned char *pInPut,uint4 dwInput_Length,unsigned char

*pOutPut)
{
uint4 state[4];
uint4 count[2];
uint1 buffer[64];
uint1 finalized;
finalized=0;
count[0] = 0;
count[1] = 0;

state[0] = 0x67452301;
state[1] = 0xefcdab89;
state[2] = 0x98badcfe;
state[3] = 0x10325476;
update(pInPut, dwInput_Length,state,&finalized,count,buffer);
finalize(state,&finalized,count,buffer,pOutPut);
return 0x00;
}
a l )
n ti
d e
n fi
(c o
TM
r P
fo
n l y
O

Appendix 6 3DES Codes
1 d3des.h file
#define EN0 0 /* MODE == encrypt */
#define DE1 1 /* MODE == decrypt */
#ifdef __cplusplus
extern "C"{
#endif
/* A useful alias on 68000-ish machines, but NOT USED HERE. */
typedef union {
unsigned long blok[2];
unsigned short word[4];
a l )
unsigned char byte[8];
} M68K;
n ti
extern void deskey(unsigned char *, short);
d e
/* hexkey[8] MODE
n
* Sets the internal key register according to the hexadecimal fi
* for encryption or decryption according to MODE.
*/
(c o
* key contained in the 8 bytes of hexkey, according to the DES,
extern void usekey(unsigned long *);

TM
/* cookedkey[32]
r P
* Loads the internal key register with the data in cookedkey.
*/
fo
/*
n l y
extern void cpkey(unsigned long *);
cookedkey[32]
* Copies the contents of the internal key register into the storage
O
* located at &cookedkey[0].
*/
extern void des(unsigned char *, unsigned char *);

/* from[8] to[8]
* Encrypts/Decrypts (according to the key currently loaded in the
* internal key register) one block of eight bytes at address 'from'
* into the block at address 'to'. They can be the same.
*/
extern void des2key(unsigned char *, short);

/* hexkey[16] MODE
* Sets the internal key registerS according to the hexadecimal
* keyS contained in the 16 bytes of hexkey, according to the DES,
* for DOUBLE encryption or decryption according to MODE.
* NOTE: this clobbers all three key registers!
*/
extern void Ddes(unsigned char *, unsigned char *);

/* from[8] to[8]
* Encrypts/Decrypts (according to the keyS currently loaded in the
* internal key registerS) one block of eight bytes at address 'from'
* into the block at address 'to'. They can be the same.
*/
bool TFCA_3DES(bool bEnspot, unsigned char* pbyKey,int nLength, unsigned char* pbySource,
unsigned char* pbyTarget)
bool TFCA_DES(bool bEnspot, unsigned char* pbyKey,int nLength, unsigned char* pbySource,
/*
TFCA_3DES performs 3DES encryption, and TFCA_DES performs DES encryption. Parameter
meaning as follows:
bEnspot: truemeans encryption, falsemeans decryption
pbyKey: point to key for encryption
nLength: length of encryption data, with unit of bytes, should be multiples of 8
pbySource: point to data first pointer for encryption
pbyTarget: point to first pointer of returned encrypted data
*/
#ifdef __cplusplus
a l )
}
#endif
n ti
d e
n fi
(c o
TM
r P
fo
n l y
O

2 d3des.c
#include "d3des.h"
static void scrunch(unsigned char *, unsigned long *);

static void unscrun(unsigned long *, unsigned char *);
static void desfunc(unsigned long *, unsigned long *);
static void cookey(unsigned long *);
static unsigned long KnL[32] = { 0L };

static unsigned long KnR[32] = { 0L };
static unsigned long Kn3[32] = { 0L };
static unsigned char Df_Key[24] = {
0x01,0x23,0x45,0x67,0x89,0xab,0xcd,0xef,
0xfe,0xdc,0xba,0x98,0x76,0x54,0x32,0x10,
0x89,0xab,0xcd,0xef,0x01,0x23,0x45,0x67 };
static unsigned short bytebit[8] = {

0200, 0100, 040, 020, 010, 04, 02, 01 };
a l )
static unsigned long bigbyte[24] = {
n ti
0x800000L, 0x400000L, 0x200000L,
e
0x100000L,
d
fi
0x80000L, 0x40000L, 0x20000L, 0x10000L,
0x8000L, 0x4000L, 0x2000L, 0x1000L,
0x800L,
0x80L,
0x400L,
0x40L,
0x200L,
0x20L,
o n 0x100L,
0x10L,
0x8L, 0x4L,
M
0x2L,
(c 0x1L };
/* Use the key schedule specified in the Standard (ANSI X3.92-1981). */
static unsigned char pc1[56] = {

P T
f r
56, 48, 40, 32, 24, 16, 8, 0, 57, 49, 41, 33, 25, 17,
o
9, 1, 58, 50, 42, 34, 26, 18, 10, 2, 59, 51, 43, 35,
62, 54, 46, 38, 30, 22, 14, 6, 61, 53, 45, 37, 29, 21,
l y
13, 5, 60, 52, 44, 36, 28, 20, 12, 4, 27, 19, 11, 3 };
n
O
static unsigned char totrot[16] = {
1,2,4,6,8,10,12,14,15,17,19,21,23,25,27,28 };
static unsigned char pc2[48] = {

13, 16, 10, 23, 0, 4, 2, 27, 14, 5, 20, 9,
22, 18, 11, 3, 25, 7, 15, 6, 26, 19, 12, 1,
40, 51, 30, 36, 46, 54, 29, 39, 50, 44, 32, 47,
43, 48, 38, 55, 33, 52, 45, 41, 49, 35, 28, 31 };
void deskey(key, edf) /* Thanks to James Gillogly & Phil Karn! */

unsigned char *key;
short edf;
{
register int i, j, l, m, n;
unsigned char pc1m[56], pcr[56];
unsigned long kn[32];
for ( j = 0; j < 56; j++ ) {

l = pc1[j];
m = l & 07;

pc1m[j] = (key[l >> 3] & bytebit[m]) ? 1: 0;

}
for( i = 0; i < 16; i++ ) {
if( edf == DE1 ) m = (15 - i) << 1;
else m = i << 1;
n = m + 1;
kn[m] = kn[n] = 0L;
for( j = 0; j < 28; j++ ) {
l = j + totrot[i];
if( l < 28 ) pcr[j] = pc1m[l];
else pcr[j] = pc1m[l - 28];
}
for( j = 28; j < 56; j++ ) {
l = j + totrot[i];
if( l < 56 ) pcr[j] = pc1m[l];
else pcr[j] = pc1m[l - 28];
}
for( j = 0; j < 24; j++ ) {
if( pcr[pc2[j]] ) kn[m] |= bigbyte[j];
if( pcr[pc2[j+24]] ) kn[n] |= bigbyte[j];
a l )
}
cookey(kn);
}
n ti
return;
d e
fi
}
static void cookey(raw1)

o n
(c
register unsigned long *raw1;
{
unsigned long dough[32];

TM
register unsigned long *cook, *raw0;
register int i;
r P
cook = dough;
fo
for( i = 0; i < 16; i++, raw1++ ) {
n l y
raw0 = raw1++;
*cook = (*raw0 & 0x00fc0000L) << 6;
*cook |= (*raw0 & 0x00000fc0L) << 10;
O *cook |= (*raw1 & 0x00fc0000L) >> 10;

*cook++ |= (*raw1 & 0x00000fc0L) >> 6;
*cook = (*raw0 & 0x0003f000L) << 12;
*cook |= (*raw0 & 0x0000003fL) << 16;
*cook |= (*raw1 & 0x0003f000L) >> 4;
*cook++ |= (*raw1 & 0x0000003fL);
}
usekey(dough);
return;
}
void cpkey(into)
register unsigned long *into;
{
register unsigned long *from, *endp;
from = KnL, endp = &KnL[32];

while( from < endp ) *into++ = *from++;
return;

void usekey(from)
register unsigned long *from;
{
register unsigned long *to, *endp;
to = KnL, endp = &KnL[32];

while( to < endp ) *to++ = *from++;
return;
}
void des(inblock, outblock)

unsigned char *inblock, *outblock;
{
unsigned long work[2];
scrunch(inblock, work);
desfunc(work, KnL);
unscrun(work, outblock);
a l )
return;
}
n ti
static void scrunch(outof, into)
d e
fi
register unsigned char *outof;
register unsigned long *into;
{
o n
(c
*into = (*outof++ & 0xffL) << 24;
*into |= (*outof++ & 0xffL) << 16;
*into |= (*outof++ & 0xffL) << 8;
*into++ |= (*outof++ & 0xffL);
TM
*into
P
= (*outof++ & 0xffL) << 24;
r
*into |= (*outof++ & 0xffL) << 16;
fo
*into |= (*outof++ & 0xffL) << 8;
*into |= (*outof & 0xffL);
return;
}
n l y
O
static void unscrun(outof, into)
register unsigned long *outof;
register unsigned char *into;
{
*into++ = (*outof >> 24) & 0xffL;
*into++ = (*outof >> 16) & 0xffL;
*into++ = (*outof >> 8) & 0xffL;
*into++ = *outof++ & 0xffL;
*into++ = (*outof >> 24) & 0xffL;
*into++ = (*outof >> 16) & 0xffL;
*into++ = (*outof >> 8) & 0xffL;
*into = *outof & 0xffL;
return;
}
static unsigned long SP1[64] = {

0x01010400L, 0x00000000L, 0x00010000L, 0x01010404L,
0x01010004L, 0x00010404L, 0x00000004L, 0x00010000L,
0x00000400L, 0x01010400L, 0x01010404L, 0x00000400L,

0x01000404L, 0x01010004L, 0x01000000L, 0x00000004L,

0x00000404L, 0x01000400L, 0x01000400L, 0x00010400L,
0x00010400L, 0x01010000L, 0x01010000L, 0x01000404L,
0x00010004L, 0x01000004L, 0x01000004L, 0x00010004L,
0x00000000L, 0x00000404L, 0x00010404L, 0x01000000L,
0x00010000L, 0x01010404L, 0x00000004L, 0x01010000L,
0x01010400L, 0x01000000L, 0x01000000L, 0x00000400L,
0x01010004L, 0x00010000L, 0x00010400L, 0x01000004L,
0x00000400L, 0x00000004L, 0x01000404L, 0x00010404L,
0x01010404L, 0x00010004L, 0x01010000L, 0x01000404L,
0x01000004L, 0x00000404L, 0x00010404L, 0x01010400L,
0x00000404L, 0x01000400L, 0x01000400L, 0x00000000L,
0x00010004L, 0x00010400L, 0x00000000L, 0x01010004L };

0x80108020L, 0x80008000L, 0x00008000L, 0x00108020L,
0x00100000L, 0x00000020L, 0x80100020L, 0x80008020L,
0x80000020L, 0x80108020L, 0x80108000L, 0x80000000L,
0x80008000L, 0x00100000L, 0x00000020L, 0x80100020L,
0x00108000L, 0x00100020L, 0x80008020L, 0x00000000L,
a l )
0x80000000L, 0x00008000L, 0x00108020L, 0x80100000L,
0x00100020L, 0x80000020L, 0x00000000L, 0x00108000L,
0x00008020L, 0x80108000L, 0x80100000L, 0x00008020L,
n ti
0x00000000L, 0x00108020L, 0x80100020L, 0x00100000L,
d e
fi
0x80008020L, 0x80100000L, 0x80108000L, 0x00008000L,
0x80100000L, 0x80008000L, 0x00000020L, 0x80108020L,
o
0x00108020L, 0x00000020L, 0x00008000L, 0x80000000L,
n
(c
0x00008020L, 0x80108000L, 0x00100000L, 0x80000020L,
0x00100020L, 0x80008020L, 0x80000020L, 0x00100020L,
TM
0x00108000L, 0x00000000L, 0x80008000L, 0x00008020L,
0x80000000L, 0x80100020L, 0x80108020L, 0x00108000L };
r
static unsigned long SP3[64] = { P
fo
0x00000208L, 0x08020200L, 0x00000000L, 0x08020008L,
0x08000200L, 0x00000000L, 0x00020208L, 0x08000200L,
y
0x00020008L, 0x08000008L, 0x08000008L, 0x00020000L,
l
0x08020208L, 0x00020008L, 0x08020000L, 0x00000208L,
n
0x08000000L, 0x00000008L, 0x08020200L, 0x00000200L,
O
0x00020200L, 0x08020000L, 0x08020008L, 0x00020208L,
0x08000208L, 0x00020200L, 0x00020000L, 0x08000208L,
0x00000008L, 0x08020208L, 0x00000200L, 0x08000000L,
0x08020200L, 0x08000000L, 0x00020008L, 0x00000208L,
0x00020000L, 0x08020200L, 0x08000200L, 0x00000000L,
0x00000200L, 0x00020008L, 0x08020208L, 0x08000200L,
0x08000008L, 0x00000200L, 0x00000000L, 0x08020008L,
0x08000208L, 0x00020000L, 0x08000000L, 0x08020208L,
0x00000008L, 0x00020208L, 0x00020200L, 0x08000008L,
0x08020000L, 0x08000208L, 0x00000208L, 0x08020000L,
0x00020208L, 0x00000008L, 0x08020008L, 0x00020200L };

0x00802001L, 0x00002081L, 0x00002081L, 0x00000080L,
0x00802080L, 0x00800081L, 0x00800001L, 0x00002001L,
0x00000000L, 0x00802000L, 0x00802000L, 0x00802081L,
0x00000081L, 0x00000000L, 0x00800080L, 0x00800001L,
0x00000001L, 0x00002000L, 0x00800000L, 0x00802001L,
0x00000080L, 0x00800000L, 0x00002001L, 0x00002080L,

0x00800081L, 0x00000001L, 0x00002080L, 0x00800080L,

0x00002000L, 0x00802080L, 0x00802081L, 0x00000081L,
0x00800080L, 0x00800001L, 0x00802000L, 0x00802081L,
0x00000081L, 0x00000000L, 0x00000000L, 0x00802000L,
0x00002080L, 0x00800080L, 0x00800081L, 0x00000001L,
0x00802001L, 0x00002081L, 0x00002081L, 0x00000080L,
0x00802081L, 0x00000081L, 0x00000001L, 0x00002000L,
0x00800001L, 0x00002001L, 0x00802080L, 0x00800081L,
0x00002001L, 0x00002080L, 0x00800000L, 0x00802001L,
0x00000080L, 0x00800000L, 0x00002000L, 0x00802080L };

0x00000100L, 0x02080100L, 0x02080000L, 0x42000100L,
0x00080000L, 0x00000100L, 0x40000000L, 0x02080000L,
0x40080100L, 0x00080000L, 0x02000100L, 0x40080100L,
0x42000100L, 0x42080000L, 0x00080100L, 0x40000000L,
0x02000000L, 0x40080000L, 0x40080000L, 0x00000000L,
0x40000100L, 0x42080100L, 0x42080100L, 0x02000100L,
0x42080000L, 0x40000100L, 0x00000000L, 0x42000000L,
0x02080100L, 0x02000000L, 0x42000000L, 0x00080100L,
a l )
0x00080000L, 0x42000100L, 0x00000100L, 0x02000000L,
0x40000000L, 0x02080000L, 0x42000100L, 0x40080100L,
0x02000100L, 0x40000000L, 0x42080000L, 0x02080100L,
n ti
0x40080100L, 0x00000100L, 0x02000000L, 0x42080000L,
d e
fi
0x42080100L, 0x00080100L, 0x42000000L, 0x42080100L,
0x02080000L, 0x00000000L, 0x40080000L, 0x42000000L,
o
0x00080100L, 0x02000100L, 0x40000100L, 0x00080000L,
n
(c
0x00000000L, 0x40080000L, 0x02080100L, 0x40000100L };
TM
0x20000010L, 0x20400000L, 0x00004000L, 0x20404010L,
r P
0x20400000L, 0x00000010L, 0x20404010L, 0x00400000L,
0x20004000L, 0x00404010L, 0x00400000L, 0x20000010L,
fo
0x00400010L, 0x20004000L, 0x20000000L, 0x00004010L,
0x00000000L, 0x00400010L, 0x20004010L, 0x00004000L,
y
0x00404000L, 0x20004010L, 0x00000010L, 0x20400010L,
l
0x20400010L, 0x00000000L, 0x00404010L, 0x20404000L,
n
0x00004010L, 0x00404000L, 0x20404000L, 0x20000000L,
O
0x20004000L, 0x00000010L, 0x20400010L, 0x00404000L,
0x20404010L, 0x00400000L, 0x00004010L, 0x20000010L,
0x00400000L, 0x20004000L, 0x20000000L, 0x00004010L,
0x20000010L, 0x20404010L, 0x00404000L, 0x20400000L,
0x00404010L, 0x20404000L, 0x00000000L, 0x20400010L,
0x00000010L, 0x00004000L, 0x20400000L, 0x00404010L,
0x00004000L, 0x00400010L, 0x20004010L, 0x00000000L,
0x20404000L, 0x20000000L, 0x00400010L, 0x20004010L };

0x00200000L, 0x04200002L, 0x04000802L, 0x00000000L,
0x00000800L, 0x04000802L, 0x00200802L, 0x04200800L,
0x04200802L, 0x00200000L, 0x00000000L, 0x04000002L,
0x00000002L, 0x04000000L, 0x04200002L, 0x00000802L,
0x04000800L, 0x00200802L, 0x00200002L, 0x04000800L,
0x04000002L, 0x04200000L, 0x04200800L, 0x00200002L,
0x04200000L, 0x00000800L, 0x00000802L, 0x04200802L,
0x00200800L, 0x00000002L, 0x04000000L, 0x00200800L,
0x04000000L, 0x00200800L, 0x00200000L, 0x04000802L,

0x04000802L, 0x04200002L, 0x04200002L, 0x00000002L,

0x00200002L, 0x04000000L, 0x04000800L, 0x00200000L,
0x04200800L, 0x00000802L, 0x00200802L, 0x04200800L,
0x00000802L, 0x04000002L, 0x04200802L, 0x04200000L,
0x00200800L, 0x00000000L, 0x00000002L, 0x04200802L,
0x00000000L, 0x00200802L, 0x04200000L, 0x00000800L,
0x04000002L, 0x04000800L, 0x00000800L, 0x00200002L };

0x10001040L, 0x00001000L, 0x00040000L, 0x10041040L,
0x10000000L, 0x10001040L, 0x00000040L, 0x10000000L,
0x00040040L, 0x10040000L, 0x10041040L, 0x00041000L,
0x10041000L, 0x00041040L, 0x00001000L, 0x00000040L,
0x10040000L, 0x10000040L, 0x10001000L, 0x00001040L,
0x00041000L, 0x00040040L, 0x10040040L, 0x10041000L,
0x00001040L, 0x00000000L, 0x00000000L, 0x10040040L,
0x10000040L, 0x10001000L, 0x00041040L, 0x00040000L,
0x00041040L, 0x00040000L, 0x10041000L, 0x00001000L,
0x00000040L, 0x10040040L, 0x00001000L, 0x00041040L,
0x10001000L, 0x00000040L, 0x10000040L, 0x10040000L,
a l )
0x10040040L, 0x10000000L, 0x00040000L, 0x10001040L,
0x00000000L, 0x10041040L, 0x00040040L, 0x10000040L,
0x10040000L, 0x10001000L, 0x10001040L, 0x00000000L,
n ti
0x10041040L, 0x00041000L, 0x00041000L, 0x00001040L,
d e
fi
0x00001040L, 0x00040040L, 0x10000000L, 0x10041000L };
static void desfunc(block, keys)

o n
(c
register unsigned long *block, *keys;
{
register int round;

TM
register unsigned long fval, work, right, leftt;
leftt = block[0];
r P
right = block[1];
fo
work = ((leftt >> 4) ^ right) & 0x0f0f0f0fL;
right ^= work;
l y
leftt ^= (work << 4);
n
work = ((leftt >> 16) ^ right) & 0x0000ffffL;
O
right ^= work;
work = ((right >> 2) ^ leftt) & 0x33333333L;
leftt ^= work;
right ^= (work << 2);
work = ((right >> 8) ^ leftt) & 0x00ff00ffL;
leftt ^= work;
right = ((right << 1) | ((right >> 31) & 1L)) & 0xffffffffL;
work = (leftt ^ right) & 0xaaaaaaaaL;
leftt ^= work;
right ^= work;
leftt = ((leftt << 1) | ((leftt >> 31) & 1L)) & 0xffffffffL;
for( round = 0; round < 8; round++ ) {

work = (right << 28) | (right >> 4);
work ^= *keys++;
fval = SP7[ work & 0x3fL];
fval |= SP5[(work >> 8) & 0x3fL];

fval |= SP3[(work >> 16) & 0x3fL];

fval |= SP1[(work >> 24) & 0x3fL];
work = right ^ *keys++;
fval |= SP8[ work & 0x3fL];
fval |= SP6[(work >> 8) & 0x3fL];
fval |= SP4[(work >> 16) & 0x3fL];
fval |= SP2[(work >> 24) & 0x3fL];
leftt ^= fval;
work = (leftt << 28) | (leftt >> 4);
work ^= *keys++;
fval = SP7[ work & 0x3fL];
fval |= SP5[(work >> 8) & 0x3fL];
fval |= SP3[(work >> 16) & 0x3fL];
fval |= SP1[(work >> 24) & 0x3fL];
work = leftt ^ *keys++;
fval |= SP8[ work & 0x3fL];
fval |= SP6[(work >> 8) & 0x3fL];
fval |= SP4[(work >> 16) & 0x3fL];
fval |= SP2[(work >> 24) & 0x3fL];
right ^= fval;
a l )
}
right = (right << 31) | (right >> 1);

n ti
work = (leftt ^ right) & 0xaaaaaaaaL;
d e
fi
leftt ^= work;
right ^= work;
leftt = (leftt << 31) | (leftt >> 1);
o n
(c
work = ((leftt >> 8) ^ right) & 0x00ff00ffL;
right ^= work;
TM
work = ((leftt >> 2) ^ right) & 0x33333333L;
right ^= work;
r
leftt ^= (work << 2); P
leftt ^= work;
fo
work = ((right >> 16) ^ leftt) & 0x0000ffffL;
y
l
work = ((right >> 4) ^ leftt) & 0x0f0f0f0fL;
n
leftt ^= work;
O
*block++ = right;
*block = leftt;
return;
}
void des2key(hexkey, mode) /* stomps on Kn3 too */

unsigned char *hexkey; /* unsigned char[16] */
short mode;
{
short revmod;
revmod = (mode == EN0) ? DE1: EN0;

deskey(&hexkey[8], revmod);
cpkey(KnR);
deskey(hexkey, mode);
cpkey(Kn3); /* Kn3 = KnL */
return;
}

void Ddes(from, into)

unsigned char *from, *into; /* unsigned char[8] */
{
unsigned long work[2];
scrunch(from, work);
desfunc(work, KnL);
desfunc(work, KnR);
desfunc(work, Kn3);
unscrun(work, into);
return;
}
bool TFCA_3DES(bool bEnspot, unsigned char* pbyKey,int nLength, unsigned char* pbySource,
{
if(nLength==0 || nLength%8)
return false;
int section = nLength/8;
a l )
des2key(pbyKey,bEnspot?0:1);
for(int i = 0 ;i<section;i++)
Ddes(pbySource+8*i,pbyTarget+8*i);
n ti
return true;
d e
fi
}
o n
bool TFCA_DES(bool bEnspot, unsigned char* pbyKey,int nLength, unsigned char* pbySource,
(c
{
if(nLength==0 || nLength%8)
return false;
TM
int section = nLength/8;
r
deskey(pbyKey,bEnspot?0:1); P
fo
for(int i = 0 ;i<section;i++)
des(pbySource+8*i,pbyTarget+8*i);;
}
return true;
n l y
* O
/* Validation sets:
* Single-length key, single-length plaintext -

* Key : 0123 4567 89ab cdef
* Plain: 0123 4567 89ab cde7
* Cipher: c957 4425 6a5e d31d
*
* Double-length key, single-length plaintext -
* Key : 0123 4567 89ab cdef fedc ba98 7654 3210
* Plain: 0123 4567 89ab cde7
* Cipher: 7f1d 0a77 826b 8aff
* d3des V5.0a rwo 9208.07 18:44 Graven Imagery
**********************************************************************/

Appendix 7 Corresponding Table of Color
Number
1. Basic Color Chart

--------------------------------------------------------------------------------------------------------
Note:
The following colors are required to be supported by terminal device.
--------------------------------------------------------------------------------------------------------
RGB Value Color No.
0x000000 0
a l )
0x000080
0x0000ff
3
6
n ti
0x008000
0x008080
19
20
d e
0x00ff00
0x00ffff
33
38
n fi
0x800000
0x800080
111
112
(c o
0x808000
0x808080
113
114
TM
0xc0c0c0
0xff0000
r
151
188 P
0xff00ff
0xffff00
fo 193
218
2.
0xffffff
n l y
Extended Color Chart
223
O
RGB Value
0x000000
0x000033
Color No.
0
1
0x000066 2
0x000080 3
0x000099 4
0x0000cc 5
0x0000ff 6
0x003300 7
0x003333 8
0x003366 9
0x003399 10
0x0033cc 11
0x0033ff 12
0x006600 13
0x006633 14
0x006666 15

0x006699 16
0x0066cc 17
0x0066ff 18
0x008000 19
0x008080 20
0x009900 21
0x009933 22
0x009966 23
0x009999 24
0x0099cc 25
0x0099ff 26
0x00cc00 27
0x00cc33 28
0x00cc66 29
0x00cc99 30
0x00cccc 31
0x00ccff 32
a l )
i
0x00ff00 33
0x00ff33
0x00ff66
34
35
n t
0x00ff99 36
d e
0x00ffcc
0x00ffff
37
38
n fi
0x330000
0x330033
39
40
(c o
0x330066
0x330099
41
42
TM
0x3300cc
0x3300ff
r
43
44P
0x333300
fo 45
0x333333
l
0x333366
n
0x333399
y 46
47
48
O
0x3333cc
0x3333ff
49
50
0x336600 51
0x336633 52
0x336666 53
0x336699 54
0x3366cc 55
0x3366ff 56
0x339900 57
0x339933 58
0x339966 59
0x339999 60
0x3399cc 61
0x3399ff 62
0x33cc00 63
0x33cc33 64

0x33cc66 65
0x33cc99 66
0x33cccc 67
0x33ccff 68
0x33ff00 69
0x33ff33 70
0x33ff66 71
0x33ff99 72
0x33ffcc 73
0x33ffff 74
0x660000 75
0x660033 76
0x660066 77
0x660099 78
0x6600cc 79
0x6600ff 80
0x663300 81
a l )
i
0x663333 82
0x663366
0x663399
83
84
n t
0x6633cc 85
d e
0x6633ff
0x666600
86
87
n fi
0x666633
0x666666
88
89
(c o
0x666699
0x6666cc
90
91
TM
0x6666ff
0x669900
r
92
93P
0x669933
fo 94
0x669966
l
0x669999
n
0x6699cc
y 95
96
97
O
0x6699ff
0x66cc00
98
99
0x66cc33 100
0x66cc66 101
0x66cc99 102
0x66cccc 103
0x66ccff 104
0x66ff00 105
0x66ff33 106
0x66ff66 107
0x66ff99 108
0x66ffcc 109
0x66ffff 110
0x800000 111
0x800080 112
0x808000 113

0x808080 114
0x990000 115
0x990033 116
0x990066 117
0x990099 118
0x9900cc 119
0x9900ff 120
0x993300 121
0x993333 122
0x993366 123
0x993399 124
0x9933cc 125
0x9933ff 126
0x996600 127
0x996633 128
0x996666 129
0x996699 130
a l )
i
0x9966cc 131
0x9966ff
0x999900
132
133
n t
0x999933 134
d e
0x999966
0x999999
135
136
n fi
0x9999cc
0x9999ff
137
138
(c o
0x99cc00
0x99cc33
139
140
TM
0x99cc66
0x99cc99
r
141
142P
0x99cccc
fo 143
0x99ccff
l
0x99ff00
n
0x99ff33
y 144
145
146
O
0x99ff66
0x99ff99
147
148
0x99ffcc 149
0x99ffff 150
0xc0c0c0 151
0xcc0000 152
0xcc0033 153
0xcc0066 154
0xcc0099 155
0xcc00cc 156
0xcc00ff 157
0xcc3300 158
0xcc3333 159
0xcc3366 160
0xcc3399 161
0xcc33cc 162

0xcc33ff 163
0xcc6600 164
0xcc6633 165
0xcc6666 166
0xcc6699 167
0xcc66cc 168
0xcc66ff 169
0xcc9900 170
0xcc9933 171
0xcc9966 172
0xcc9999 173
0xcc99cc 174
0xcc99ff 175
0xcccc00 176
0xcccc33 177
0xcccc66 178
0xcccc99 179
a l )
i
0xcccccc 180
0xccccff
0xccff00
181
182
n t
0xccff33 183
d e
0xccff66
0xccff99
184
185
n fi
0xccffcc
0xccffff
186
187
(c o
0xff0000
0xff0033
188
189
TM
0xff0066
0xff0099
r
190
191P
0xff00cc
fo 192
0xff00ff
l
0xff3300
n
0xff3333
y 193
194
195
O
0xff3366
0xff3399
196
197
0xff33cc 198
0xff33ff 199
0xff6600 200
0xff6633 201
0xff6666 202
0xff6699 203
0xff66cc 204
0xff66ff 205
0xff9900 206
0xff9933 207
0xff9966 208
0xff9999 209
0xff99cc 210
0xff99ff 211

0xffcc00 212
0xffcc33 213
0xffcc66 214
0xffcc99 215
0xffcccc 216
0xffccff 217
0xffff00 218
0xffff33 219
0xffff66 220
0xffff99 221
0xffffcc 222
0xffffff 223
a l )
n ti
d e
n fi
(c o
TM
r P
fo
n l y
O

CDCAS3 0 en SMS Interface Specification V1.8.1

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

CDCAS3 0 en SMS Interface Specification V1.8.1

Caricato da

Copyright:

Formati disponibili

CDCAS3.0_EN_SMS Interface Specificationv1.8.

Beijing Novel-Super Digital TV Technology Co., Ltd.

Beijing Novel-Supertv Digital TV Technology Co., Ltd. Page 1 2013-12-18

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 2

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 3

3.12.1 SMS _CA_SET_CHILD_REQUEST .................................................. 24

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 4

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 5

1.1 Introduction to CDCAS3.0

CAS: Conditional Access System;

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 6

1.4 Matters Need Attention

2.1 Basic Workflow

CDCAS3.0_SMS interface adopts the C/S architecture, where CDCAS3.0 works as

Figure 2.1 Basic Workflow

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 7

2.2 TCP Connection

Principles for TCP connection are as follow:

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 8

Table 2.1 CDCAS3.0_SMS Message Packet

DB_Len 16 Length of Data_Body

DB_ID: Data_Body ID is generated by SMS, which is a unique number in one session

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 10

MAC(MessageAuthenticationCode): The checksum against all data (excluding the

There might be two types of transmission error happen on CDCAS3.0_SMS interface:

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 11

Here we take ‘create session’ as an example to illustrate the encryption scheme,

Figure 2.3 ‘Create Session’ Request Data_Body()

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 12

Figure 2.4 ‘Create Session’ Response Packet Header

2) The Data_Body() of the response will be in cipher-text as follow:

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 13

Figure 2.5 ‘Create Session’ Response Data_Body() in plaintext

2.6 Requirements for SMS Commands Processing

To ensure the SMS commands could be successfully processed, some requirements

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 14

3.1 Create Session

Msg_ID: SMS _CA_CREATE_SESSION_REQUEST, refers to Appendix 1.

3.1.2 CA_SMS _CREATE_SESSION_RESPONSE

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 15

For(i=0; i< Key_Len; i++){

Key_Len: length of session key, in bytes.

3.2 Open Account

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 16

SYNTAX BITS NOTES

3.3 Close Account

3.3.1 SMS _CA_STOP_ACCOUNT_REQUEST

3.4.1 SMS _CA_SET_LOCK_REQUEST

3.4.2 CA_ SMS _SET_LOCK_ RESPONSE

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 17

Data_Cont() of this message is shown in Table:

3.5 Unlock Card(Optional Function)

Unlock card is to resume the disabled smart card.

3.5.1 SMS _CA_SET_UNLOCK_REQUEST

3.6.1 SMS _CA_SET_CHARACTER_REQUEST

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 18

CARD_SN 128 smart card serial number

3.6.2 CA_SMS _SET_CHARACTER_RESPONSE

Beijing Novel-Supertv Digital TV Technology Co., Ltd Page 19

3.7.2 CA_SMS _REPAIR_RESPONSE

3.8.1 SMS _CA_RESETCARDPIN_REQUEST

fo SYNTAX BITS NOTES

3.8.2 CA_SMS _RESETCARDPIN_RESPONSE

3.9 Charge E-Slot(Optional Function)