SasGwyDLK2 1Spe010000Approved

Nagravision SMS Gateway
Interface Definition: HE DLK 2.1STD CAS (EIS 2.7)

Version 1.0.0
Status: Draft
Filename SasGwyDLK2 1Spe010000A.docx

Date November 18, 2014
Author(s) Enno Hofmann
Information Domain
Client/Project
Owner Fabiano Galimberti
CONFIDENTIAL
Nagravision is a member of the Kudelski Group of Companies.
This document is the intellectual property of Nagravision and contains confidential and privileged information.
The reproduction, modification, or communication to third parties (or to other than the addressee) of any part of this
document is strictly prohibited without the prior written consent from Nagravision.
CONFIDENTIAL

Version 1.0.0 Draft
Copyright © 2014 Nagravision. All rights reserved.

CH-1033 Cheseaux, Switzerland.
Tel: +41 21 7320311 Fax: +41 21 7320100
www.nagra.com
All trademarks and registered trademarks are the property of their respective owners.
This document is supplied with an understanding that the notice(s) herein or any other contractual
agreement(s) made that instigated the delivery of a hard copy, electronic copy, facsimile or file transfer
of this document are strictly observed and maintained.
The information contained in this document is subject to change without notice.
Security Policy of Nagravision Kudelski Group
Any recipient of this document, without exception, is subject to a Non-Disclosure Agreement (NDA) and
access authorization.
Copyright © 2014 Nagravision. All rights reserved. Confidential and privileged information. 2
CONFIDENTIAL
Owner: Fabiano Galimberti
Contents
Contents........................................................................................................3
List of tables..................................................................................................5
List of figures.................................................................................................6
Preface..........................................................................................................7
1. Introduction...........................................................................................9
2. System overview..................................................................................11
2.1 Purpose of the SMSgw......................................................................................11
2.2 Communication protocols..................................................................................11
2.2.1 Layers........................................................................................................11
2.2.2 TCP/IP protocol...........................................................................................11
2.2.3 Device_IO protocol......................................................................................12
2.2.4 SMSgw protocol...........................................................................................12
2.3 Device_IO communication.................................................................................12
2.3.1 Overview....................................................................................................12
2.3.2 Establishing a connection with a Device_IO server...........................................13
2.3.3 Data exchange between client and server.......................................................14
2.3.4 Closing a connection with a Device_IO server..................................................14
2.3.5 Rules of use................................................................................................14
2.3.6 Messages format.........................................................................................14
2.3.7 Message_1 (connect to the CAS)...................................................................14
2.3.8 Message_2 (answer 1 from the CAS).............................................................14
2.3.9 Message_3 (answer from the CAS)................................................................15
2.3.10 Message_5 (Cmd message from the SMS or the CAS)......................................15
3. SMS-SMSgw connections......................................................................16
3.1 Overview.........................................................................................................16
3.2 EMM/Control command flow...............................................................................16
3.3 Usage.............................................................................................................17
3.3.1 Source identifier..........................................................................................17
3.3.2 Transaction number.....................................................................................17
3.3.3 Keeping the SMS connection alive..................................................................17
3.3.4 Establishing the SMS connection....................................................................17
4. SMS commands.....................................................................................18
4.1 Specification....................................................................................................18
4.1.1 Commands and responses............................................................................18
4.1.2 Asynchronous by nature...............................................................................18
4.2 Metrics............................................................................................................18
4.3 Time and date..................................................................................................18
4.4 Identifiers........................................................................................................19
4.5 Special notes...................................................................................................19
4.5.1 event_name and product_name filler rule......................................................19
4.5.2 event_name and product_name overwriting rule.............................................20
4.5.3 Price overwriting rule...................................................................................20
4.6 Addressing modes usage...................................................................................20
4.7 Command handling...........................................................................................22
4.7.1 Products.....................................................................................................22
4.8 Headers..........................................................................................................24
4.8.1 Root header................................................................................................25
4.8.2 Address header – EMM cmd..........................................................................26
4.8.3 Address header – Control cmd.......................................................................30
4.8.4 Address header – Operation cmd...................................................................30
4.8.5 Errors due to abnormal operational conditions.................................................31
4.9 EMM commands (0nn).......................................................................................32
4.9.1 Command 2: Add Product.............................................................................32
4.9.2 Command 4: Product Suspension..................................................................34
4.9.3 Command 5: Product Reactivation.................................................................35
4.9.4 Command 6: Product Cancellation.................................................................36
4.9.5 Command 7: All Products Cancellation............................................................37
4.9.6 Command 10: Add Event Product..................................................................38
4.9.7 Command 20: Suspend Subscriber ICC..........................................................40
4.9.8 Command 21: Reactivate Subscriber ICC........................................................41
4.9.9 Command 23: Suspend All ICC Features.........................................................42
4.9.10 Command 24: Reactivate All ICC Features......................................................43
4.9.11 Command 25: Suspend All ICC Features With Delay........................................44
4.9.12 Command 35: Create Operator......................................................................45
4.9.13 Command 36: Cancel Operator.....................................................................46
4.9.14 Command 46: Set Segments.........................................................................47
4.9.15 Command 47: Set Alphanum Zip Code...........................................................48
4.9.16 Command 48: Set Zip Code..........................................................................49
4.9.17 Command 50: Cancel ICC.............................................................................50
4.9.18 Command 51: Initialize Smart Card...............................................................51
4.9.19 Command 52: Pair the ICC With the STB........................................................52
4.9.20 Command 53: Clear PIN Code.......................................................................53
4.9.21 Command 69: Send Generic IRD Command....................................................54
4.9.22 Command 79: Force Tune.............................................................................57
4.9.23 Command 84: Send PRM Credentials..............................................................59
4.9.24 Command 96: Purge PPV and IPPV Records....................................................61
4.9.25 Command 99: Send Generic IRD Command II.................................................62
4.9.25.1 Example: an STB with a Nagravision CAK..................................................63
4.9.25.2 Example: an STB with a native MG CAK....................................................63
4.10 CONTROL commands (1nn)...............................................................................65
4.10.1 Command 104: Create ICC in Call Collector....................................................66
4.10.2 Command 105: Cancel ICC in Call Collector....................................................67
4.10.3 Command 110: EMM Cleanup........................................................................68
4.10.4 Command 122: Set Network.........................................................................69
4.10.5 Command 123: Trigger Broadcast of Conditional EMM......................................71
4.10.6 Command 125: Set Subscriber Private Data....................................................72
4.10.7 Command 126: Assign Virtual UA to NUID......................................................73
4.10.8 Command 127: Get all products....................................................................74
4.11 Internal CAS commands (7nn)...........................................................................75
4.12 MACRO EMM commands (9nn)...........................................................................75
4.12.1 Command 902: Activate Smart card Without Return Path.................................76
4.12.2 Command 903: Add List of Products...............................................................78
4.12.3 Command 904: Cancel List of Products...........................................................80
4.12.4 Command 905: Add Enhanced List of Products................................................81
4.12.5 Command 908: Set Families of Products.........................................................85
4.12.6 Command 909: A-la-carte management.........................................................87
4.12.7 Commands 910 to 919: Reserved for Internal CAS Actions...............................90
4.12.8 Command 925: Set a-la-carte services...........................................................91
4.13 OPERATION commands (10nn and 20nn)............................................................93
4.13.1 Command 1000: Acknowledge Command.......................................................93
4.13.2 Command 1001: Non-acknowledged Command...............................................94
4.13.3 Command 1002: No Command......................................................................95
4.13.4 Command 1003: Acknowledge Command with Virtual UA.................................96
4.13.5 Command 1004: Acknowledge command with data..........................................97
4.13.6 Command 2000: EMM via Portal Acknowledge command..................................99
4.13.7 Command 2001: EMM via Portal Negative-Acknowledge command...................100
5. Error codes.........................................................................................101
5.1 Table of Error codes........................................................................................101
5.2 Table of Error code extensions..........................................................................104
6. UA and CA-S/N checksum...................................................................108

6.1 Definitions.....................................................................................................108
6.2 Pairing operation............................................................................................108
6.3 Data files.......................................................................................................109
6.4 CA-S/N – Pairing keys.....................................................................................109
6.5 Checksum algorithm.......................................................................................109
7. ASCII Table........................................................................................110
8. Examples............................................................................................113
8.1 Device_IO connection establishment.................................................................113
8.2 Example of command 52.................................................................................117
Glossary.....................................................................................................119
Data formats..............................................................................................120
List of tables
Table 4-1: Identifiers....................................................................................................19
Table 5-1: Error codes................................................................................................103
Table 5-2: Error code extensions..................................................................................107
Table 7-1: ASCII Table................................................................................................112
Listing 8-1: Device_IO connection................................................................................113
Listing 8-2: Example of command 52............................................................................117
List of figures
Figure 2-1: CAS overview..............................................................................................11
Figure 2-2: SMSgw protocol – communication layers........................................................11
Figure 2-3: Device_IO connection establishment and data exchange phases........................13
Figure 3-1: Connections between the SMS and the SMSgw................................................16
Figure 3-2: Multi SMS connections..................................................................................16
Figure 4-1: Buffer of command 69 sent by the SMS..........................................................56
Figure 8-1: Entire network packet.................................................................................118
Preface
Audience
This guide is directed at the following persons:
 The customer’s personnel involved in the management of the SMS – CAS interface
 SMS vendors’ personnel involved in the development of the interface between the SMS and
the CAS
 Nagravision’s personnel involved in the CAS (marketing, customer support, developer, test
team)
Related Documents
[1] “Information technology – Syntactic meta-language – Extended BNF” (ISO/IEC
14977:1996)
[2] “Conditional Access Kernel – IRD Command Specification” (Nagravision)
Document History
Change logs
Version 2.1 – Issue 1.0.0, October 2014
 Added error code NUID_BLACKLISTED for sms 126
Version 1.1 - Issue 1.1.0, June 2013
 Added SMS 123 to trigger the broadcast of conditional offers (defined with CAS Console).
Version 1.1 - Issue 1.0.0, February 2013
 Replaced family products with ‘a-la-carte’ products
 Added SMS 127, 1004, 909, 925
 Updated description of SMS 908
Version 1.0 - Issue 1.3.0, January 2012
 Remove SMS 909
 Rework descriptions related to 'A-la-carte' products
Version 1.0 - Issue 1.2.2, January 2012
 Add a new error code 79 indicating that a command is not supported.
Version 1.0 - Issue 1.2.1, October 2011
 Update SMS operation command ‘1003-Acknoledge Command with Virtual UA’ to return NUID
in addition of VUA.
Version 1.0 - Issue 1.2.0, October 2011
 Add SMS control command ‘126-Assign Virtual UA to NUID’.
 Add SMS operation command ‘1003-Acknoledge Command with Virtual UA’.
 Update the definition of SMS commands 51 and 52.
 Add new error codes for SMS commands 51, 902 and 122.
Version 1.0 - Issue 1.1.0, August 2011
 Remove all references to callbacks, IPPV and credit.
 Remove the broadcast modes and SA address sizes not supported by DLK
Version 1.0 – Issue 1.0.0, July 2011
 First version based on Merlin 3.0 SMS Gateway Interface. Compared to Merlin 3.0, DLK system
supports a subset of SMS commands and product types.
Document Reviewers
Reviewer’s Name Function Review Date Reviewed Version
Paul-Jean Cagnard System Architect
Document Approvers
Name Function Approval Approved Version
Date
Jordi Porta Head of SAS 04.06.2013 1.0.0P
1. Introduction
This document presents the interface that interconnects an SMS and the Nagravision conditional
access system (CAS). It provides the connection specifications, the communication protocol and
the commands used in the interface. This issue illustrates only the set of commands fully
supported and tested by the DLK CAS standard delivery.
How to use this document

You do not need to read all of this specification as some information is reference material only.
Therefore, depending on your needs chose from the following:
Chapter 2: System overview and communication protocols

Chapter 2 gives an overview of the SMS Gateway and introduces you to the communication
protocols it uses.
Chapter 3: SMS-SMSgw connection

Chapter 3 covers communication between the SMS and the SMS Gateway.
Chapter 4: SMS commands

Chapter 4 covers the individual SMS commands.
Chapter 5: Error codes

Chapter 5 provides reference information on error codes.
Chapter 6: UA and CA-S/N checksum

Chapter 6 describes the procedure to manage unique addresses (UAs) and conditional access
serial numbers (CA-S/Ns) at the customer site.
Chapter 7: ASCII Table

Chapter 7 provides a reference table covering the ASCII characters table.
Chapter 8: Error! Reference source not found.

Chapter 8 explains the process by which a subscriber’s request is carried out.
Chapter 8: Examples
Chapter 8 provides listings demonstrating a Device_IO connection process and a command
transmitted in a network packet.
A note on licenses
This document lists and describes all the commands supported by the Nagravision CAS
interface. However, the use of individual commands depends on the business licenses acquired
by the customer (i.e. the site operator). Make sure you have the appropriate license before
using a command.
2. System overview
This chapter presents different aspects of the system related to the SMS Gateway interface.
2.1 Purpose of the SMSgw

The figure below illustrates the location of the SMS Gateway (SMSgw). The SMSgw is an
internal component of the Nagravision CAS system. From the outside world, it can be seen as a
gate to the CAS. Through this gate, one or several SMS entities send instructions or commands
to the CAS.
SMS Set-Top-Box
SMS SMS Set-Top-Box

Gateway
SMS
CAS Set-Top-Box
Figure 2-1: CAS overview
2.2 Communication protocols
2.2.1 Layers
There are three communication layers. The lowest is the TCP/IP level and the most abstract is
the level of the SMSgw protocol. Between those two is the Device IO layer whose role is to
gather commands from the TCP/IP stream.
S M S g a te w a y c o m m a n d
D e v ic e IO
T C P / IP
Figure 2-2: SMSgw protocol – communication layers
2.2.2 TCP/IP protocol
TCP/IP is a stream-based protocol. The application-oriented messages are joined together and
there is no separator between these messages. When reading an application-oriented message
using OS primitives from a stream like TCP/IP, we may face one of the following three
possibilities:
 The message is incomplete (only n bytes of the data have been read).
 The message is complete (only the expected message has been read).
 More than the expected message has been read.
The diagrams below show these three possibilities. We assume that the TCP/IP stream contains
two application-oriented messages M1 and M2:
M1 M2 TCP/IP stream
Reading an incomplete message:
M1’ M1’’ M2
Reading one complete message:
M1 M2
Reading more than one message:
M1 M2’ M2’’
2.2.3 Device_IO protocol
Device_IO is a protocol used above TCP/IP to exchange data as a buffer of known size. It
consists of a fixed-size header followed by the application data. The header has a size of two
bytes and the application data is a stream of n bytes.
Header section Length (2 bytes) Payload section Application data (n bytes)
The header is a two-byte hexadecimal value that corresponds to the number of bytes in the
payload section.
The content of the payload section is described in the following chapters.
Warning
 The header indicates only the length of the payload section. The first transmitted byte
is the most significant byte of the “Length” value”.
2.2.4 SMSgw protocol
The SMSgw protocol defines the application-oriented message. It is a high-level protocol in

which user data consists of human-readable ASCII characters (from ASCII code 32 to ASCII
code 127) used to describe the value of the command attributes.
2.3 Device_IO communication
2.3.1 Overview
Communication is established through entry points called services. An application establishes

communication with another application by specifying the service name of the target.
For Device_IO communication between applications running on different machines,

communication must first be established at the TCP/IP transport level.
To manage communication between two systems, the following points must be addressed:
 How to establish communication with a Device_IO server and how to indicate the internal
client for which the communication is intended.
 How to transmit and receive data to and from the Device_IO server.
In the following description, the commands involved (open, send, receive, listen, and close)
are those of the underlying transport protocol used (TCP/IP). Device_IO does not redefine these
commands. The names used below (open, send, receive, listen, and close) are generic
names representing the corresponding available system calls. Consequently, the calls described
below only show their Device_IO parameters. The transport protocol parameters (such as
socket pointers) are not shown in the generic description of the calls.
2.3.2 Establishing a connection with a Device_IO server
To open a communication with a Device_IO server, an application must call the Device_IO
server. Two parameters must be provided:
 The name of the machine on which the server is running;
 The (TCP/IP) port number corresponding to the Device_IO server.
Once TCP communication with the server has been established, the name of the target service
must be communicated (message_1) to the Device_IO server in order to establish a link
between the calling client and the requested service.
As a reply, the server must send one or two messages. The first message (message_2) contains
the connection status and, when the communication attempt has been successful, a second
message (message_3) specifies whether the call has been accepted or rejected.
SMS computer CAS computer
SMS DeviceIO server

SMSgw process
process
TCP connection
Connec
Message_1
tion
establis
Message_2 h.
phase
Message_3
Ti
m
e
Data
exchan
ge
Message_5 (ex: cmd 51)
phase
Message_5 (cmd 1000-ACK)
Figure 2-3: Device_IO connection establishment and data exchange phases
An example of a Device_IO connection can be found in section 8 Examples (page 113).

2.3.3 Data exchange between client and server
After the communication link is established, messages can be exchanged (message_5) between
the client (here: the SMS) and the Device_IO server.
2.3.4 Closing a connection with a Device_IO server
The connection is closed when communication is closed at TCP level.
2.3.5 Rules of use
If, for any reason, the SMS does not receive either message_2 or message_3 within a specified
time-out period (e.g.: 30 seconds) when the communication is established, the SMS should
close the communication and retry later. The same rule applies if the connection status returned
by message_2 is different than “SUCCESS” or if the answer code returned by message_3
indicates that the call is rejected.
2.3.6 Messages format
There are four different message types in the Device_IO protocol. The next sections present the
different messages and the way they should be used.
2.3.7 Message_1 (connect to the CAS)
This is the first message sent by the client (the SMS) to the Device_IO server.
Message_1
Syntax Size (byte) Format Description
Len 2 hex Message length in bytes (see section 2.2.3).
op_mode 1 r_hex Data transfer operation mode
0 = Normal data transfer
ob_name_len 1 hex Length of the object name attribute (in bytes).
ob_name ob_name_len text Name of the applicative service with which the
connection should be established.
Ob_name is a string of bytes at least one byte long
and at most 32 bytes long:
1 <= ob_name_len <= 32. This name is compulsory
but its content is up to the client (ex: “SMS_GWY”).
2.3.8 Message_2 (answer 1 from the CAS)
This message is a response from the Device_IO server to the client (in this case: the SMS); the
message validates the connection.
Message_2
Len 2 hex Message length in bytes. In this case, the
length is always 1 byte.
connect_status 1 r_hex Connection status. Refer to the table below for
applicable values.
Connect_status
Value Identifier Description
0 CONNECT_FAILURE The connection has failed for any unexpected reason
6 SUCCESS The operation has been successfully completed.
2.3.9 Message_3 (answer from the CAS)
This message is a response from the Device_IO server, which validates the connection with the
other process (in our case: the SMSgw).
Message_3
len 2 hex Message length in bytes. In this case, the
length is always 1 byte.
answer_code 1 r_hex 0: call accepted
1: call rejected
2.3.10 Message_5 (Cmd message from the SMS or the CAS)
This message must contain only one SMSgw command.

Message_5
len 2 hex Message length in bytes (see section 2.2.3).
data len See note SMSgw command data.
The data section of message_5 follows the structure shown below:

Common to allroot header– see section 4.6.
commands
addresstype
Depends on command header
(EMM, CTRL, Operation) – see sections 4.8.2 to 4.8.4.
Depends on command type – see sections 4.9 to 4.12.5.
command body
Note
 The content of this section is command–specific: refer to the format described in
sections 4.9 to 4.12.8.
3. SMS-SMSgw connections
3.1 Overview
The figure below illustrates the connections used by the SMS and the Nagravision SMSgw. As
depicted in the figure, a connection can be seen as a data channel. On the same channel,
commands follow one direction, while the opposite direction is followed by the corresponding
responses (ack or nack). An ack response means that the incoming command is correctly
formatted and it has been successfully processed. A nack response means that either the
format or the data structure of the command is not appropriate or that the command has
encountered problems during processing in the system.
SMS Nagra SMSgw

EMM/Control channel EMM/Control or 1002 commands
Ack or Nack Command port
Figure 3-1: Connections between the SMS and the SMSgw
Several SMS may be connected to the same port, as shown in the following figure:
EMM & Control channel Nagra SMSgw
SMS 1
Command port
SMS 2
SMS 3
Figure 3-2: Multi SMS connections
3.2 EMM/Control command flow

EMM/Control commands are the commands sent by the SMS to the CAS. Some examples of
such commands are “Add product”, “Initialization”, and “Pairing”.
3.3 Usage
3.3.1 Source identifier
Each connection established between the SMS and the Nagravision CAS has a source identifier.
Each connection must have its own source identifier and it is not possible for two connections to
share the same source identifier at any given time. The source identifier of a connection is given
by field source_id in the header of each message sent from the SMS to the CAS.
3.3.2 Transaction number
Each transaction number used must be unique during the life of the corresponding connection.
The transaction number is given by a field in the header of each message sent from the SMS to
the CAS. Transaction numbers are necessary to determine which commands have been
processed successfully (ack, command 1000) and which commands have not (nack, command
1001).
3.3.3 Keeping the SMS connection alive
During periods of inactivity on the SMS-CAS interface, the SMS must periodically send command
1002 on command port (EMM/Control) to the CAS. The main reason for that recommendation is
that intelligent network devices (such as switches or firewalls) may not keep idle TCP
connections open indefinitely. Nagravision recommends that command 1002 be sent every 5
minutes on command port.
3.3.4 Establishing the SMS connection
Each time the SMS opens a connection on either the EMM/Control port, it must first generate
command 1002.
4. SMS commands
4.1 Specification
4.1.1 Commands and responses
The SMS sends commands to the CAS. In response, the CAS sends acknowledgment messages
back to the SMS. Of course, the acknowledgment messages are reported on the same
communication channel as the corresponding commands.
Note
 The system will not behave as expected if the following values are not handled
correctly:
– transaction_id
– source_id
– dest_id
4.1.2 Asynchronous by nature
The protocol used between the SMS and the CAS is asynchronous. Several SMS commands may
be sent before acknowledgement messages are received. In other words, there is no need to
wait for the acknowledgement of a command before sending the next commands to the CAS.
Important
 The SMS may receive the acknowledgement messages in a different order than the
order in which the corresponding commands have been sent. However, for an
individual smart card, the sequence of EMMs follows the sequence of SMS commands.
 Please also note that at the end of the transmission chain, i.e. at the device (smart
card or Set Top Box / CAK), the sequence of commands is not guaranteed.
4.2 Metrics
Metric Value range (typical)
Connection The EMM/Control port may accept up to 10 connections each.
SMS commands The CAS can process from 4 up to 10 SMS EMM and control commands
per second over the EMM/Control channel, with actual figures depending
on the capacity of the CAS hardware.
Note
 Those metrics depend on factors such as system architecture and processing power;
they are provided here merely as an order of magnitude.
4.3 Time and date

All dates are expressed in UTC, except product validity dates.
Although product validity dates are generally expressed in UTC, if the IMS product definition
specifies that validity dates are in local time and if the validity dates are specified by the SMS,
then the validity dates provided by the SMS will be interpreted in the subscriber’s local time.
Therefore, for fields begin_date and end_date in SMS commands 2, 902, 903 and 905, the
comment must be changed so as to specify generally in UTC rather than UTC.
4.4 Identifiers
This section contains descriptions of all identifiers used throughout this document.
ID Definition
circuit_id A number uniquely identifying a video/audio/data stream.
command_id The identifier of an SMS command. The content of this field forms part of the
command. The value of command_id is covered by the SMS documentation
for all commands, which is covered by the IMS or CC documentation.
Conditional_add_id Identifier of the conditional add product to be broadcast.
dest_id The identifier of the addressed SMS command. It is entered at system
configuration.
Host_id STB id for a point of development (POD).
IMS_event_id An IMS-generated identifier for individual events. It is entered using the IMS
editor or generated when the EPG data feed is processed.
IMS_product_id The identifier of a product in the IMS. It is the only product identifier known
to the IMS.
MOP_PPID The identifier of the management operator (MOP). This identifier is provided
by Nagravision at system configuration.
Network_id DVB network identifier.
POD_id Point of development identifier (i.e. PCMCIA module).
Service_id DVB service identifier.
SMS_product_id A product identifier for use by the SMS. It is provided and managed by the
SMS. It is entered into the system by the SMS Gateway through commands
300, 303, 305 or 307.
source_id An identifier specifying the source of SMS commands. This identifier is
entered into the system at system configuration.
STB serial number The hardware serial number of the STB.
STU_number This Nagravision STB number is used to identify the STB in the CA system,
for pairing purposes.
Transport_id DVB transport identifier.
Table 4-1: Identifiers
4.5 Special notes
4.5.1 event_name and product_name filler rule
The event_name or product_name field is characterized by its fixed size length. The useful
section of the field is a string of (ASCII printable) characters. The remaining part of the field
must be padded with space characters (value: 0x20).
Because the previous version of the SMS Gateway document indicated that the field must be
padded with series of 0x00 bytes, the CAS will continue to accept incoming SMS commands
that follow the 0x00-padded format. However, any new development in the SMS must follow the
rule regarding the space characters.
When the SMS uses filler character 0x00, the drawback for the CAS system is that the traces of
the incoming SMS command become corrupted in the log file are corrupted. This is because the
value 0x00 is considered as an end-of-string indicator.
On the other hand, the 0x00 byte does not affect the individual CAS applications processing the
SMS commands.
4.5.2 event_name and product_name overwriting rule
The purpose of the event_name or product_name data provided in the SMS command is for the
STB menu to show a description of the available product.The CAS shall be configured to work in
one of the two following modes:
 Mode 1, in which the SMS controls the product name:
 The event or product name provided by the SMS (commands 10, 902, 903 and 905)
is used to prepare the EMM data. If the length of the product name is equal to 0, the
product name will be taken from the CAS database.
 Note that for SMS command 2 and for subscription products in commands 902, the
event name cannot be specified and it is therefore always taken from the IMS.
 Mode 2, in which the IMS controls the product name:
 The product name provided by the SMS is ignored. It is overwritten by the
corresponding value that is available in the CAS database.
4.5.3 Price overwriting rule
The price of a product is usually provided by the SMS (as in command 10 for instance).
Remember: this price is a value that will be displayed by the STB to inform the end user about
the cost of a given product, i.e. it is for information purposes only. However, when the SMS
cannot provide the price value, the CAS can replace it with a value set in the IMS database. The
operational mode is configurable in the CAS.
Note
 This is not applicable to subscription products.
4.6 Addressing modes usage

Unique addressing is supported for all SMS commands, whereas shared and global addressing
are reserved for special operations with a restricted list of SMS commands. See below for
details.
Important
 For SMS commands in global addressing mode, the smart card records are not
updated in the CAS database, except if a special feature is enabled to update the
CAS database under global addressing. If this feature is enabled, only a subset of the
SMS commands accepted with global addressing will trigger a CAS database update.
The table below provides the addressing modes supported for each SMS command.
Addressing mode
CID Description Unique Shared Global
EMM commands (0nn)
2 Add Product X X X
4 Product Suspension X
5 Product Reactivation X
6 Product Cancellation X X X
7 All Products Cancellation X X
Addressing mode
CID Description Unique Shared Global
10 Add Event Product X X X
20 Suspend Subscriber ICC X X
21 Reactivate Subscriber ICC X X
23 Suspend all ICC features X X
24 Reactivate all ICC features X X
25 Suspend all ICC features with Delay X X
35 Create Operator X
36 Cancel Operator X
46 Set Segments X X
47 Set Aphanum Zip Code X
48 Set Zip Code X
50 Cancel ICC X
51 Initialize Card X
52 Pair the ICC with the STB X
53 Clear PIN Code X
69 Send Generic IRD Command X X
79 Force Tune X X
84 Send PRM Credentials X X
96 Purge PPV and IPPV Records X
99 Send Generic IRD Command II X X
Control commands (1nn)
104 Create ICC On Call Collector X
105 Cancel ICC On Call Collector X
110 EMM cleanup X
122 Set Network X
123 Trigger Broadcast of Conditional EMM X X
125 Set Subscriber Private Data X
126 Assign Virtual UA to NUID X
127 Get all products X
Macro EMM commands (9nn)
902 Activate Smart Card Without Return Path X
903 Add List of Products X X X
904 Cancel List of Products X X X
905 Add Enhanced List of Products X X X
908 Set Families of Products X
909 A-la-carte management X
925 4.6.1 Set a-la-carte services 4.6.2
Note
 If the SMS Gateway receives an SMS command it does not supported either generally
or for the given addressing mode (shared or global), the SMS command will be
rejected with a ‘BAD_COMMAND_SYNTAX’ error code and an
‘EXTERNAL_SYSTEM_ERROR’ error code extension.
Additionally, the following restrictions apply:

 Shared addressing is refused (the SMS command is rejected) in the following cases:
 With SMS commands 2, 6, 903, 904 and 905 for products under PA per Operator
and for coins;
 With SMS commands 10, 904 and 905 for coins, for Rental products and for Rental
PPV products;
 With SMS command 905 if the purchase mode is set to ‘Re-hit’.
 With SMS 7, 20 and 21 if the system is configured to support the PA by operator.
 You can configure the SAS to disable support for global addressing, to enable it for all SMS
source IDs, or to enable it only for one source ID.
 Global addressing is refused (the SMS command is rejected) in the following cases:
 With SMS commands 2, 6, 903, 904 and 905 for products under PA per Operator
and for coins;
 With SMS commands 10, 903, 904 and 905 for coins, as well as for Rental and for
Rental PPV products;
 With SMS commands 905 if purchase mode is set to ‘Re-hit’.
Note
 The SMS command will be rejected with a ‘BAD_PRODUCT_TYPE’ error code and a
‘NO_EXTENDED_ERROR_CODE’ error code extension in the following cases:
• The product type is not supported for the SMS command (e.g.: PPV products
cannot be added using SMS command 2).
• The product type is incompatible with the addressing mode (e.g.: rental PPV
products cannot be added in shared or global addressing mode).
Note
 The SMS command will be rejected with a ‘NOT_AUTHORIZED’ error code and a
‘NO_EXTENDED_ERROR_CODE’ error code extension in the following cases:
• The product PA type is not consistent with the MOP PA type (e.g.: subscription
products under PA per Operator cannot be added to a MOP to which PA per Operator
does not apply).
• The product PA type is incompatible with the addressing mode (e.g.: subscription
products under PA per Operator cannot be added in shared or global addressing
mode).
4.7 Command handling
4.7.1 Products
The table below shows the different kinds of products available in DLK and the commands that
can be used to handle each of them.
SMS commands Product
Cmd Label
SUB
Flexible Sub
PPV
Short term sub
A la carte
ID
2 Add Product X X
SMS commands Product
Cmd Label
SUB
Flexible Sub
PPV
Short term sub
A la carte
ID
4 Product Suspension X X
5 Product Reactivation X X
6 Product Cancellation X X X X
7 All Products Cancellation X X X X X
10 Add Event Product X X
78 Refresh Smart Card X X
902 Activate Smart Card Without Return P V V
Path
903 Add List of Products P V
904 Cancel List of Products X X X X
905 Add Enhanced List of Products P P V V
908 Set Families of Products X 1
909 A-la-carte management X

925 4.7.2 Set a-la-carte services 4.7.3
P: applicable to loop product (subscription) V: applicable to loop PPVs
1
Only available for subscription products associated to a family before the migration to the ‘a-la-carte’
product. After the migration, only the SMS commands 909 and 925 should be used to manage ‘a-la-carte’
product.
4.8 Headers
Any message has the following structure:
Root header common to all commands
(see section 4.8.1 Root header below)
Address EMM CTRL Operation
header 4.8.2 4.8.3 4.8.4
Command body cmd 0nn cmd 1nn cmd 10nn and 20nn
4.9 4.9.25 4.12.5
The next section details the internal structure of the three modules (root header, address
header and command body).
4.8.1 Root header
Field Size Format Description

transaction_number 9 num Number used to uniquely identify a
transaction across the interface, for each
source.
Range: 000000000 to 999,999,999.
command_type 2 r_num 01: EMM
02: CONTROL
05: OPERATION
source_id 4 num A number that identifies a source, such as the
SMS or the IMS (this number is provided by
Nagravision).
Range: 0000 to 9999
dest_id 4 num Identifier of the addressed SMS. This number
is defined at system configuration.
Range: 0000 to 9999
MOP_PPID 5 num Identifier of the technical MOP. This number is
provided by Nagravision at system
configuration.
Range: 00000 to 65,535
creation_date 8 YYYYMMDD Creation date of the command (in UTC).
Note: the CAS does not use this date to apply
any rule or constraint.
The error codes (nack messages) applicable to this part of the command are listed below.
Field Error codes Error code extensions

any BAD_ROOT_HEADER_SYNTAX NO_EXTENTED_ERROR
transaction_number BAD_HEADER_SYNTAX BAD_TRANSACTION_NUMBER_FORMAT
transaction_number BAD_USAGE TRANS_NR_ALREADY_IN_USE
command_type BAD_HEADER_SYNTAX BAD_COMMAND_TYPE
source_id BAD_HEADER_SYNTAX BAD_SOURCE_ID
source_id BAD_USAGE SOURCE_NOT_AUTHORIZED
source_id BAD_USAGE SOURCE_ALREADY_IN_USE
dest_id BAD_HEADER_SYNTAX BAD_DEST_ID
dest_id BAD_USAGE DEST_NOT_AUTHORIZED
MOP_PPID BAD_HEADER_SYNTAX BAD_MOP_PPID
MOP_PPID INVALID_PPID MOP_NOT_AUTHORIZED
creation_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
creation_date BAD_USAGE DATE_IN_THE_FUTURE
4.8.2 Address header – EMM cmd

broadcast_mode 1 r_text A value of N or B means that the EMMs
are delivered in-band (i.e. in the transport
stream) with the default broadcast profile
associated with the SMS command.
Values 1 to 9 specify alternative broadcast
profiles to be used instead of the default
profile. If the alternative profile specified by
the SMS does not exist in the CAS
database, then the default broadcast profile
is used.
A value of E means that the EMMs are
returned via the Portal (i.e. through
acknowledgment SMS command 2000) and
therefore delivered neither in-band nor out-
of-band when the STB calls back. No
contradiction is handled for these EMMs.
A value of W means that the CAS
database is updated – but without EMM
generation.
broadcast_start_date 8 YYYYMMDD Broadcast start date (in UTC). The
command must be sent to the smart card
starting from this date.
See the Note below.
broadcast_end_date 8 YYYYMMDD Broadcast end date (in UTC). The command
must be sent to the smart card up until this
date.
See the Note below.
address_type 1 r_text EMM addressing mode for EMM commands:
U = unique
G = addresses all smart cards of an
individual MOP
S = Shared
U UA 10 r_num The unique address (UA) of the device
Address type
(smart card or Set Top Box / CAK) for

which the command is intended.
Range: 0000000000 to 4,294,967,295
G UA 0 – –
S SA 8 r_num The shared address (SA), which is the first

UA of the group divided by the group size.
Range: 00000000 to 16777215.
ADF mode 1 r_text Address Field mode (for future use).

B = Bitmap.
For the time being, ADF mode must be set
to B.
Bitmap 3 r_num The length (in bytes) of the bitmap.

length
It is 064 for DLK system.
Bitmap 2x r_text The bitmap of the UA for which the

bitmap_ (see note below) command is intended.
length The first bit of the bitmap from the left (i.e.
the most significant bit) represents the first
UA of the SA (it is equal to SA x group
size), whereas the last bit on the right (i.e.
the least significant bit) represents the last
UA of the SA (equal to SA x [group size] +
[group size] – 1).
The bitmap field contains a string of
characters representing hexadecimal data
coded in the ASCII format (two characters
for one byte).
Important
 As indicated in the table above, the format of the bitmap field is r_text. However, it
does not contain a regular string: it is not a text field, such as “this is a sentence with
characters and 1 2 3 4 numerical values”. The data in the bitmap field is a sequence
of hexadecimal numbers encoded in a text format. Consequently, the field will only
accept alpha characters A, B, C, D, E, F representing the numbers 10 to 15 in a
hexadecimal form.
 As an example – the CAS will accept the following bitmap value:
A0BCD12A29327B9F. In this example, bitmap_length is equal to 8.
Note
 The broadcast_start_date is always used by the SAS, except when handling family
products (in which case it is replaced by the current start date). If it is in the past
then it is set to the current date and time, otherwise it is used as is. The
broadcast_end_date is always ignored (unless the SAS has been explicitely configured
to use it) and rather computed using the broadcast_start_date and adding the
duration specified in the broadcasting profile associated to the SMS command
(association between SMS command and broadcasting profile is configurable at SAS
level). It is recommended to set the broadcast_start_date in the past or to the
current date and time. This allows a better control of the EMM bandwidth. Please do
not confuse the broadcast period that specifies the period when the EMM are
broadcasted, with the right validity period that specifies when a right is valid. The error
codes (nack messages) applicable to this part of the command are listed below.

any BAD_HEADER_SYNTAX BAD_DATA_FORMAT
broadcast_mode BAD_HEADER_SYNTAX BAD_BROADCAST_MODE
broadcast_start_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
broadcast_end_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
broadcast_end_date BAD_HEADER_SYNTAX BAD_DATE_SEQUENCE
broadcast_end_date BAD_HEADER_SYNTAX DATE_IN_THE_PAST
address_type BAD_HEADER_SYNTAX BAD_ADDRESS_TYPE
address_type BAD_USAGE ADDRESS_TYPE_NOT_AUTHORIZED
UA BAD_HEADER_SYNTAX BAD_UA_FORMAT
SA BAD_HEADER_SYNTAX BAD_UA_FORMAT
ADF_mode BAD_HEADER_SYNTAX BAD_FLAG_VALUE
bitmap_length BAD_HEADER_SYNTAX BAD_NUMBER_FORMAT
bitmap BAD_HEADER_SYNTAX BAD_DATA_FORMAT
Example of shared addressing: consider the following list of UAs:
0200769712, 0200769715, 0200769787, 0200769789.
The address header will look as follows:

N2007050220070502S00784256B06400000000000000000000000000000000000000000000900000000000
000000140000000000000000000000000000000000000000000000000000000000000000
Breaking down this example into fields:

Field value Field name / Interpretation
N broadcast_mode
Normal
20070502 broadcast_start_date
May 2nd, 2007
20070502 broadcast_end_date
May 2nd, 2007
S address_type
Shared
00784256 SA
Shared address for this group of card is
392128
B ADF_mode
Bitmap
064 Bitmap_length
64 bytes
Bitmap
0000000000000000000000000000000000000000000090 Card 200769712 is the 177th card with
0000000000000000140000000000000000000000000000 shared address 392128
000000000000000000000000000000000000 Card 200769715 is the 180th card with
shared address 392128
Card 200769787 is the 252nd card with
Field value Field name / Interpretation
Card 200769789 is the 254nd card with
4.8.3 Address header – Control cmd

broadcast_mode 1 r_text A value of ‘N’ or ‘B’ means that the mode used is
the default broadcast profile associated with the
SMS command.
Warning: The description of Address header –
EMM cmd (section 4.8.2) also applies to
command 122 – Set Network.
broadcast_start_date 8 YYYYMMDD Current date (today, in UTC)
broadcast_end_date 8 YYYYMMDD Current date (today, in UTC)
address_type 1 r_text EMM addressing mode for EMM commands.
U = unique
G = addresses all smart cards of the MOP
Type U UA 10 num UA is the unique address of the device (smart

card or Set Top Box / CAK) for which the
command is intended.
Range: 0 to 4,294,967,295
G UA 0 – –

broadcast_mode BAD_HEADER_SYNTAX BAD_BROADCAST_MODE
broadcast_start_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
broadcast_end_date BAD_HEADER_SYNTAX BAD_DATE_FORMAT
broadcast_end_date BAD_HEADER_SYNTAX BAD_DATE_SEQUENCE
broadcast_end_date BAD_HEADER_SYNTAX DATE_IN_THE_PAST
address_type BAD_HEADER_SYNTAX BAD_ADDRESS_TYPE
UA BAD_HEADER_SYNTAX BAD_UA_FORMAT
4.8.4 Address header – Operation cmd

none There is no header for this command type.

4.8.5 Errors due to abnormal operational conditions

not applicable BAD_ROOT_HEADER_SYNTAX NO_EXTENTED_ERROR
not applicable FATAL_ERROR EXTERNAL_SYSTEM_ERROR
not applicable NO_RTM_PRESENT NO_EXTENDED_ERROR_CODE
not applicable NO_SERVER_AVAILABLE NO_EXTENDED_ERROR_CODE
not applicable SMS_NOT_IDENTIFIED NO_EXTENDED_ERROR_CODE
not applicable TM_SERVER_ERROR CORBA_EXCEPTION
MOP_PPID NOT_AUTHORIZED NO_EXTENDED_ERROR_CODE
source_id SOURCE_ID_ALREADY_USED NO_EXTENDED_ERROR_CODE
source_id SMS_NOT_AUTHORIZED NO_EXTENDED_ERROR_CODE
source_id NOT_AUTHORIZED NO_EXTENDED_ERROR_CODE
4.9 EMM commands (0nn)
In this section, we present the structure of all commands related to the alteration of the device
(smart card or Set Top Box / CAK). These commands are generated by the SMS. For each
command, there are two tables. The first table illustrates the data structure of the command.
The second table provides the different types of error messages that the CAS could return.
4.9.1 Command 2: Add Product

SAS replaces original MOP by smart card operator (SOP) no
Usage Note
 For new development, it is advised to use SMS command 905 (Add Enhanced List of
Products) instead of SMS command 2.
The SMS uses this command to add a service entitlement in a smart card for a certain product.
Important
 Command 2 must not be used to authorize a PPV. Command 10 should be used
instead.
 SMS command 2 will be rejected if the MOP is suspended (by means of SMS
command 20) or if the SOP is suspended (by means of SMS command 23).
Command 2: Add Product

command_id 4 r_num command_id = 0002
IMS_product_id 12 num IMS product ID
Range: 000000000000 to 004294967295
begin_date 8 YYYYMMDD Subscription begin date (in UTC). The subscription
is not valid before this date.
end_date 8 YYYYMMDD Subscription end date (in UTC). The subscription is
not valid after this date.
List of error codes:
command_id BAD_COMMAND_SYNTAX EXTERNAL_SYSTEM_ERROR
command_id BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_product_id BAD_COMMAND_SYNTAX BAD_IMS_PRODUCT_ID_FORMAT
IMS_product_id PRODUCT_NOT_FOUND NO_EXTENDED_ERROR_CODE
IMS_product_id BAD_PRODUCT_TYPE PPV_PRODUCT
IMS_product_id BAD_PRODUCT_STATUS CANCELLED_PRODUCT
IMS_product_id BAD_PRODUCT_STATUS SUSPENDED_PRODUCT
IMS_product_id BAD_PRODUCT_STATUS INVALID_PURCHASE_DATE
IMS_product_id BAD_PRODUCT_TYPE DRAFT_PRODUCT
IMS_product_id PRODUCT_INCONSISTENT NO_EXTENDED_ERROR_CODE
begin_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
begin_date BAD_COMMAND_SYNTAX BAD_DATE_SEQUENCE
end_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
end_date BAD_COMMAND_SYNTAX BAD_DATE_SEQUENCE
UA UA_NOT_FOUND NO_EXTENDED_ERROR_CODE
UA CANCELLED_CARD NO_EXTENDED_ERROR_CODE
UA SUSPENDED_CARD NO_EXTENDED_ERROR_CODE
UA UA_LOCKED_WHILE_EXCHANGED NO_EXTENDED_ERROR_CODE
UA EXCHANGED_CARD NO_EXTENDED_ERROR_CODE
None DATABASE_ERROR BAD_PARAM_IN_CASDB
MOP_PPID INVALID_PPID ISD_MOP_NOT_FOUND
MOP_PPID SUSPENDED_MOP NO_EXTENDED_ERROR_CODE
MOP_PPID DATABASE_ERROR DATA_ERROR
4.9.2 Command 4: Product Suspension
SAS replaces original MOP by SOP no
Usage Note
 It is not advised to use this command for new developments. Use command 20
(Suspend Subscriber ICC) instead.
The SMS uses this command to suspend a service or PPV entitlement in a smart card for a
certain product.
The end user will not be able to watch the corresponding services or PPVs until the SMS sends a
product reactivation command. Command 4 may be used when there is a payment problem
with the end user.
Important
 This command shall not be used for A-la-carte subscription products.
Command 4: Product Suspension

Range: 000000000000 to 004294967295

CONFIDENTIAL

Version 1.0.0 Draft
4.9.3 Command 5: Product Reactivation

Usage Note
 It is not advised to use this command for new developments. Use command 21
(Reactivate Subscriber ICC) instead.
The SMS uses this command to reactivate a service or PPV entitlement in a smart card in cases
where the entitlement has previously been suspended with command 4 (Product Suspension).
The end user will then be able to watch the corresponding services or PPVs again.
Important
 This command shall not be used for A-la-carte subscription products.
Command 5: Product Reactivation

IMS_product_id 12 num IMS Product ID
Range: 000000000000 to 004294967295

IMS_product_id RIGHT_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.4 Command 6: Product Cancellation

Usage Note
 It is not advised to use this command to cancel more than one product at once. Use
command 904 (Cancel List of Products) instead.
The SMS uses this command to remove an entitlement from a smart card for a certain product.
This command is applicable to entitlements that have been purchased through the SMS.
Important
 When several instances of the same product are created on the smart cards,
command 6 cancels all instances of this product.
 This SMS command will be rejected if the MOP is suspended (by means of SMS
command 20) or if the SOP is suspended (by means of SMS command 23). This
important fact applies only to products within a product family (A la carte subscription
products).
Command 6: Product Cancellation

Range: 000000000000 to 004294967295

CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.5 Command 7: All Products Cancellation

The SMS uses this command to remove all types of entitlements from a smart card.
Command 7: All Products Cancellation


CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.6 Command 10: Add Event Product

Usage Note
 For new development, it is advised to use SMS command 905 – Add Enhanced List of
Products – instead of SMS command 10.
The SMS uses this command to add an entitlement to an event product in a smart card. Event
products are typically movies showing on a certain channel at a certain date and time.
Important
 The purge mechanism will delete event products when the event product date meets
the purge date condition.
 PPV entitlements recorded in the end user’s smart card should be deleted using either
a background EMM cleanup command or SMS command 96 (Purge PPV and IPPV
Records).
 The CAS does not alter the data in the event_name field of the command. The data
is transmitted as it is in the smart card. The STB then displays the data as it displays
the EIT (Event Information Table) data. Consequently, the SMS must format this
string in accordance with the specification of the character set used by the STB.
 The event_name string must also include control characters. Consequently,
the number of displayable characters is reduced accordingly.
Command 10: Add Event Product

Range: 000000000000 to 004294967295
length_event_name 2 r_num Length of the valid data in the event_name
field. It must not exceed 30 bytes. This is due to
storage limitations in the smart card.
event_name 32 text The event name as displayed in the PPV
purchase history of the STB user interface. The
number of characters must match the length set
in length_event_name. The remaining bytes
should be filled up with space characters. See
the special note in section 4.5.1.
price 5 num The price of the product, from 000.00 to 999.99.

IMS_product_id PPV_IN_THE_PAST NO_EXTENDED_ERROR_CODE
IMS_product_id BAD_PRODUCT_TYPE REGULAR_PRODUCT
CONFIDENTIAL
IMS_product_id PPV_PURCHASE_NOT_ALLOWED NO_EXTENDED_ERROR_CODE
length_event_name BAD_COMMAND_SYNTAX LENGTH_TOO_LONG
length_event_name BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
price BAD_COMMAND_SYNTAX BAD_PRICE_FORMAT
4.9.7 Command 20: Suspend Subscriber ICC
The SMS uses this command to suspend all entitlements in a smart card for an individual MOP.
However, depending on the configuration of the head end, viewing the “free access” services
may or may not be possible once the relevant MOP is suspended.
Important
 In order to reactivate a MOP, the SMS must use command 21.
The SMS can still continue to send EMM command to a deactivated smart card (no error will be
returned).
Command 20: Suspend Subscriber ICC


CONFIDENTIAL

Version 1.0.0 Draft
4.9.8 Command 21: Reactivate Subscriber ICC

The SMS uses this command to reactivate all entitlements for an individual MOP.
Command 21: Reactivate Subscriber ICC


CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.9 Command 23: Suspend All ICC Features

SAS replaces original MOP by SOP yes
The SMS uses this command to suspend all features in a smart card, i.e. all entitlements to
services and PPVs, as well as entitlements to free access services.
Important
 In order to reactivate smart card features, the SMS should use command 24.
The SMS can still continue to send EMM commands to a deactivated smart card (this will not
cause any errors).
Command 23: Suspend All ICC Features


UA EXPIRED_CARD NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.10 Command 24: Reactivate All ICC Features

The SMS uses this command to reactivate all entitlements to services and PPVs in a smart card,
as well as the entitlements to the free access services.
Command 24: Reactivate All ICC Features


CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.11 Command 25: Suspend All ICC Features With Delay

The SMS uses this command to schedule a smart card suspension. At the date and time
specified, command 25 suspends all features in a smart card, i.e. all entitlements to services
and PPVs, as well as the entitlements to free access services.
Important
 To reactivate smart card features, the SMS should use command 24.
The SMS can still continue to send EMM commands to a deactivated smart card (this will not
cause any errors).
Command 25: Suspend All ICC Features With Delay

suspension_date 8 YYYYMMDD Suspension date (generally in UTC).
suspension_time 6 HHMMSS Suspension time (generally in UTC).
For Aladin smart cards, the time is set to 23:59:56
and the time provided by the SMS is ignored.


suspension_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
suspension_date BAD_COMMAND_SYNTAX BAD_DATE_SEQUENCE
suspension_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.12 Command 35: Create Operator

The SMS uses this command to add a new MOP zone in a smart card.
This command is used only when there are several operators sharing device (smart card or Set
Top Box / CAK) for independent Pay-TV operations.
For the relevant operator, this command must precede any other command such as command 2
(Add Product).
The SMS can send this command several times without damaging the entitlements already
stored in the smart card.
Important
 In a single-MOP environment, this command should not be used because each new
smart card already contains a pre-defined MOP zone for the unique operator.
 The purpose of this command is not to render a smart card pristine: this
command does not perform any cleanup in the smart card.
 With a foreign smart card, SMS command 35 will be rejected.
Command 35: Create Operator

MOP_PPID 5 num Identifier of the MOP to be created.
Range: 00000 to 99999

UA FOREIGN_SC NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.13 Command 36: Cancel Operator

The SMS uses this command to remove a MOP zone and all its associated data from a smart
card.
Important
 This command will indirectly remove all entitlements and the entire record currently
stored in the device (smart card or Set Top Box / CAK) for a given operator.
Command 36: Cancel Operator

MOP_PPID 5 num Identifier of the MOP to be deleted.
Range: 00000 to 99999

UA FOREIGN_SC NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.14 Command 46: Set Segments

The SMS use this command to set or update the segments in the device (smart card or Set Top
Box / CAK).
Note
 The segments can be used to address a subset of all the subscribers.
 This command contains only the segment changes, and therefore the segments not
specified in the command remain unchanged.
 The method to reset a segment is to set to 0 the segment subcategory of the given
segment category.
Command 46: Set Segments

nb_of_segments 2 r_num The number of segments provided in this
command.
Range: 00 to 56
for(i=0;i< A counter.
nb_of_segments;i++) {
segment_category 2 r_num Segment category.
Range: 00 to 55
segment_subcategory 3 r_num Segment subcategory.
Range: 000 to 255
}

command_id BAD_COMMAND_SYNTAX NO_EXTENDED_ERROR_CODE
UA BAD_COMMAND_SYNTAX BAD_UA_FORMAT
nb_of_segments BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
segment_category BAD_COMMAND_SYNTAX BAD_CATEGORY_FORMAT
segment_category SEGMENT_NOT_FOUND NO_EXTENDED_ERROR_CODE
segment_subcategory BAD_COMMAND_SYNTAX BAD_SUBCATEGORY_FORMAT
segment_subcategory SEGMENT_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.15 Command 47: Set Alphanum Zip Code

SAS replaces original MOP by SOP Yes
The SMS uses this command to set or update the zip code on the device (smart card or Set Top
Box / CAK). Command 47 is also used when the subscriber moves to a different location.
Note
 The zip code is used for blackouts.
Command 47: Set Alphanum Zip Code

zip_code 9 r_text The subscriber’s zip code.
The range is restricted to alphanumeric values.
The value is right-padded with trailing space
characters.
num The subscriber’s zip code.
The range is restricted to numeric values.
The value is left-padded with zeros.
List of error codes sent by the CAS (nack messages):

zip_code BAD_COMMAND_SYNTAX BAD_ZIP_CODE_FORMAT
zip_code ZIP_CODE_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.16 Command 48: Set Zip Code

The SMS uses this command to set or update the zip code of the smart card. The zip code
information is primarily used for blackout.
Important
 For countries that use a different zip code scheme (such as zip codes with more than
five digits or alphanumeric zip codes), the operator should create a lookup table that
translates the local zip code format into zip code format of the SMS.
Command 48: Set Zip Code

zip_code 5 num The end-user’s zip code. Range: 00000 to 99999

zip_code ZIP_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.17 Command 50: Cancel ICC

The SMS uses this command to permanently disable a device (smart card or Set Top Box /
CAK). Command 50 is sent when a device is taken out of operation (for instance, when a device
is reported to be stolen, lost, or damaged).
The SMS is not allowed to use a cancelled device again because the device is not recoverable
after the cancellation operation.
The UA is flagged as cancelled and deactivated in the CAS database. For that reason, any
incoming commands addressed to this device will remain unacknowledged by the CAS system.
Important
 The effect of this command in the smart card is not reversible. In other words, the
device will be permanently decommissioned.
Command 50: Cancel ICC


CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.18 Command 51: Initialize Smart Card

The SMS uses this command to initialize the MOP zone of a new device.
The SMS must issue this command prior to any other command except in the 2 following cases:
 SMS targets a virtual UA: SMS ‘126-Assign Virtual UA to NUID’ shall first issue to link
virtual UA to NUID.
 System manages multiple networks: SMS ‘122-Set Network’ shall be issued before this
command to allow routing generated EMM on the network of the targeted device (UA or
virtual UA).
The CAS will reject all other commands it receives before processing of command 51
successfully completes.
The initialization of a device can occur several times and has no effect on the entitlements
stored in the device.
Important
 The purpose of this command is not to reset the device content, i.e. this command
does not perform any cleanup in the device.
 This command does not refurbish a smart card in any way.
 This command creates the MOP specified in its header. Therefore, even when the
command has SOP privileges, the PPID of the MOP must be specified in the header of
the command (rather than the PPID of the SOP).
Command 51: Initialize Smart Card


UA UA_OUT_OF_RANGE NO_EXTENDED_ERROR_CODE
UA SC_SET_ID_NOT_FOUND NO_EXTENDED_ERROR_CODE
UA CARD_REFURBISHMENT_FAILED NO_EXTENDED_ERROR_CODE
UA VUA_NOT_LINKED_TO_NUID NO_EXTENDED_ERROR_CODE
MOP_PPID CB_PROFILE_NOT_FOUND NO_EXTENDED_ERROR_CODE
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.19 Command 52: Pair the ICC With the STB

The SMS uses this command to pair a smart card with the STB.
This command is mandatory and must be sent before any services can be authorized.
Before pairing can take place, the smart card must have been previously initialized with
command 51.
Important
 For virtual UA, this command was no effect on the device. IRDSN will be stored in
CAS database only.
 STU_number is a 14-digit string representing a decimal value.
 STU_number can be in one of the following formats:
– A 10-digit string followed by 4 space characters, ranging from “0000000000 ” to
“4294967295 ”
– A 14-digit string ranging from 00000000000000 to 00004294967295
 The un-pairing action is performed with the same command, with STU_number set
to “0000000000” or 00000000000000.
 The value of STB_number as provided in the command coming from the SMS must
not include any checksum.
Command 52: Pair the ICC With the STB

STU_number 14 r_num The serial number of the conditional access (CA) STB,
in a decimal form.
Range: see the Important note above

STU_number BAD_COMMAND_SYNTAX BAD_STU_NUMBER_FORMAT
CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.20 Command 53: Clear PIN Code

The SMS uses this command to reset the PIN code of the STB to its default factory value. In
other words, the new PIN code value to which this command forces the STB is not always 0000.
Also, note that it is the design of individual STBs that determine which features or menus will be
protected by the PIN code.
Important
 For STBs with a Nagravision CAK and when strong pairing is used:
– Unlike the other commands described in this document, command 53 is sensitive to
the pairing status of the smart card and the STB: when the SMS sends command 53 to
an individual STB, it will only work if the STB is paired with its smart card.
– The pairing function is achieved with command 52.
Command 53: Clear PIN Code


CONFIDENTIAL
CONFIDENTIAL

Version 1.0.0 Draft
4.9.21 Command 69: Send Generic IRD Command

The SMS uses this command to send an IRD command to a decoder. The decoder will execute
an operation based on the instruction in the IRD command (e.g.: set the network ID, force
tune, etc.). In other words, this command is not intended to modify the data in the device
(smart card or Set Top Box / CAK), but rather to have the decoder execute an action. To
complement command 69, the CAS provides a secure transport mechanism between the head
end and the STB.
Important
 This command is applicable to native Nagravision STBs with a CAK. For other STBs,
refer to command 99 (section 4.9.25).
 For STBs with a Nagravision CAK when strong pairing used: unlike the other
commands described in this document, command 69 takes into consideration the
pairing status of the smart card and the STB: command 69, when sent to an
individual STB, will work only if the STB is paired with its smart card. The pairing
takes place using command 52.
The data structure that the CAS sends to the STB is described below. The SMS Gateway
computes fields “sequence_number” and “checksum” for the convenience of the SMS: the SMS
does not provide these two parameters.
command_body{
sequence_number 32 uimsbf
command_id 8 uimsbf
operation 8 uimsbf
for (i=0;i<N;i++){
data 8 uimsbf
}
checksum 8 uimsbf
}
As explained above, the purpose of an IRD command is to provide the decoder with a message
that will instruct the decoder to execute an action (e.g.: reset the PIN code). The command_id
and operation parameters provided to the decoder contain two indexes that indicate which
subroutine the decoder should execute.
Nagravision provides STB manufacturers with a list of command_id and operation values for
a list of specific actions. This document is entitled “Conditional Access Kernel – IRD Command
Specification” (see reference [2]).
CONFIDENTIAL
Command 69: Send Generic IRD Command
IRD_command_id 3 r_num The command_id field of IRD command_body.
Range: 000 to 255
IRD_operation 3 r_num The operation field of IRD command_body.
Range: 000 to 255
IRD_data_length 2 r_num Length of the useful portion of the IRD_data
field, in bytes. Range: 00 to 48
IRD_data 96 r_text Hexadecimal data coded in the ASCII format.
The string must be transferred in full
(96 characters representing 48 bytes).
However, only the first IRD_data_length bytes
on the left will be included in the data field of
the IRD
command_body.

IRD_command_id BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_operation BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_data_length BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_data BAD_COMMAND_SYNTAX BAD_DATA_FORMAT
Below is an example on how IRD_data should be formatted. In this example, IRD command
Force Tune is sent to the STB. In the IRD command specification document (reference [2]),
the data structure is as follows:
Parameter Value in a decimal Value in a hexadecimal Size in bytes
form form
command_id 193 – 3
operation 001 – 3
network_id – 05 11 2
transport_id – 00 09 2
service_id – 00 0C 2
In this example, IRD_data_length is 6. The following figure shows the detailed string of
bytes in the buffer that should be sent by the SMS. Note that the remaining byte of field
IRD_data must be filled with zero characters (0x30 in a hexadecimal form).
Figure 4-1: Buffer of command 69 sent by the SMS

4.9.22 Command 79: Force Tune
The SMS uses this command to force the STB to tune to a given TV program (i.e. a service).
The SMS identifies this service using three parameters. For a detailed description, refer to the
DVB specifications.
 network: the DVB network of the service
 transport: the transport ID of the service within the network
 service: the program number to which the STB must tune within the transport
Important
 For backward compatibility, the CAS supports the following fields in both a decimal
and a hexadecimal data format:
– Network_id
– Transport_id
– Service_id
 The SMS provides data in either a decimal (mode 1 as illustrated below) or a
hexadecimal format (mode 2). The default CAS package complies with mode 1. For
mode 2, a special CAS package should be installed.
Important
 For STB with a Nagravision CAK when strong pairing used: unlike the other
commands described in this document, command 79 takes into account the pairing
status of the smart card and the STB: command 79 will work only if the STB is paired
with its smart card.
Command 79: Force Tune – Mode 1 (Decimal Format)

network_id 5 r_num Range: 00000 to 65535
transport_id 5 r_num Range: 00000 to 65535
service_id 5 r_num Range: 00000 to 65535
Command 79: Force Tune – Mode 2 (Hexadecimal Format)

network_id 4 hex Range: 0000 to FFFF
transport_id 4 hex Range: 0000 to FFFF
service_id 4 hex Range: 0000 to FFFF
4.9.23 Command 84: Send PRM Credentials
The SMS uses this command to send credentials to the PRMLib hosted on a decoder. The PRMLib
will execute an operation based on the credentials instruction (ex: provide a VOD license to
STB, etc.). In other words, this command is not intended to modify the data of the device
(smartcard or Set Top Box / CAK), but it is intended to start an action executed by the decoder.
The CAS provides with this command a secure transport mechanism between the head-end and
the STB.
Important
 This command can only be used to send a PRM credentials to a STB having a
Nagravision CAK (i.e. it cannot be used with MediaGuard STB without Nagravision
CAK). The CAS does check the STB context to accept or reject this SMS command.
 This command carries the credentials using IRD commands. Thus this command can
only be processed once the STB is correctly paired with the device (smart card or Set
Top Box / CAK). The pairing means either “strong pairing” or “secured channel”.
 The pairing function is achieved with command 52.
Command 84: Send PRM Credentials

credentials_op_id 3 r_num The operation identifier of the credentials.
Range: 000 to 063
The values currently supported are:
000 = VOD license
credentials_len 5 r_num Length of the credentials in bytes.
Range: 00000 to 16065
credentials 2x r_text This field contains a string of characters
credentials_len (see note representing hexadecimal data encoded in the
below) ASCII format (two characters for one byte).
Important
 As indicated in the table above, the format of the credentials field is r_text. However,
it does not contain a regular string: it is not a text field, such as “this is a sentence
with characters and 1 2 3 4 numerical values”. The data in the bitmap field is a
sequence of hexadecimal numbers encoded in a text format. Consequently, the field
will only accept alpha characters A, B, C, D, E, F representing the numbers 10 to 15
in a hexadecimal form.
 As an example – the CAS will accept the following credential value:
A0BCD12A29327B9F. In this example, credentials_len is equal to
8.
credentials_op_id BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
credentials_len BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
credentials BAD_COMMAND_SYNTAX BAD_DATA_FORMAT
4.9.24 Command 96: Purge PPV and IPPV Records
The SMS uses this command to purge individual smart cards from PPV, SUB, EPR or IND record
data that match a deletion condition. The two examples below illustrate how this command
works:
Example 1: to purge old PPV records stored in device (smart card or Set Top Box / CAK) when
end users complain that their device is full.
Example 2: to prevent useless PPV records from filling up the device (smart card or Set Top Box
/ CAK). This can be seen as a preventive cleanup task. In this example, each time an end user
calls the SMS center for additional credit, the SMS will issue command 96.
The SMS provides the following two parameters:

 cleanup_date: the date according to which PPV records are deleted (records older than
cleanup_date will be deleted).
 condition_date = cleanup_date (because no return path)
The SMS is responsible for correctly managing these parameters: the CAS system cannot verify
the coherence of these parameters.
Command 96: Purge PPV and IPPV Records

cleanup_date 8 YYYYMMDD Purge the smart card of all PPV records for which the
PPV expiration date antedates cleanup_date.
condition_date 8 YYYYMMDD condition_date = cleanup_date

cleanup_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
cleanup_date BAD_COMMAND_SYNTAX DATE_NOT_IN_THE_PAST
condition_date BAD_COMMAND_SYNTAX BAD_DATE_FORMAT
CONFIDENTIAL

Version 1.0.0 Draft
4.9.25 Command 99: Send Generic IRD Command II

The SMS uses this command to send an IRD command to a decoder. The decoder will execute
an operation based on the instruction in the IRD command (e.g.: set the network ID, force
tune, etc.). In other words, this command is not intended to modify the data in the device
(smart card or Set Top Box / CAK), but rather to have the decoder execute an action. To
complement command 99, the CAS provides a secure transport mechanism between the head
end and the STB.
Important
 Use this command to send an IRD command to an STB with a CAK.
 For native Nagravision STBs with a CAK, IRD commands can only be processed once
the STB is correctly paired with the smart card (here the term “pairing” means either
“strong pairing” or “secure channel”).
 For STBs with a Nagravision CAK when strong pairing is used: unlike the other
commands described in this document, command 99 takes into consideration the
pairing status of the smart card and the STB: command 99 will work only if the STB
is paired with its smart card.
Examples are provided below (see sections 4.9.25.1 to 4.9.25.2).
Command 99: Send Generic IRD Command II

IRD_command_id 3 r_num The command_id field of the IRD command_body.
Value 254 is reserved for specifying that the
command targets an MG STB without CAK.
Range: 000 to 255
# 3 r_num The Operation field of the IRD
command_body (for STBs with a CAK) or the
Type field of the IRD action (for MG STBs
without CAK).
Range: 000 to 255
IRD_data_length 3 r_num Length of IRD_data, in bytes.
Range: 000 to 255 – the following restrictions
may apply depending on the STB context:
 000 to 048 for DNASP-2 Nagravision CAKs
 000 to 064 for DNASP-3 Nagravision
CAKs (Aladin)
 000 to 128 for DNASP-4 Nagravision
CAKs (Merlin)
 000 to 142 for cardless Nagravision CAKs
 000 to 088 for STBs with a native MG
CAK (IRD action)
The CAS does not perform any consistency check
between IRD_data_length and the STB context.
IRD_data 2x r_text This field contains a string of characters
IRD_data_length (see note representing hexadecimal data encoded in the
below) ASCII format (two characters for one byte).
Important
 As indicated in the table above, the format of the IRD_data field is r_text. However, it
CONFIDENTIAL
does not contain a regular string: it is not a text field, such as “this is a sentence with
characters and 1 2 3 4 numerical values”. The data in the IRD_data field is a
will only accept alpha characters A, B, C, D, E, F representing the numbers 10 to 15
in a hexadecimal form.
 As an example – the CAS will accept the following IRD_data_byte value:
A0BCD12A29327B9F. Therefore, the value of IRD_data_length is 8.

IRD_command_id BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_operation BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_data_length BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IRD_data BAD_COMMAND_SYNTAX BAD_DATA_FORMAT
4.9.25.1 Example: an STB with a Nagravision CAK

The IRD_command_id field has a value different from 254.
The following describes the structure of the data sent to the STB. The SMS gateway computes
fields sequence_number and checksum for the SMS: the SMS does not provide these two
parameters.
command_body{
command_id 8 uimsbf
operation 8 uimsbf
for (i=0;i<N;i++){
data 8 uimsbf
}
checksum 8 uimsbf
}
As explained above, the purpose of an IRD command is to provide a message that will instruct
the decoder to execute an action (e.g.: set the network ID). The command_id and operation
parameters provided to the decoder contain two indexes that indicate which subroutine the
decoder should execute.
Nagravision provides STB manufacturers with a list of command_id and operation values for
a list of specific actions. This document is entitled “Conditional Access Kernel – IRD Command
Specification” (see reference [2]).
4.9.25.2 Example: an STB with a native MG CAK

The IRD_command_id field is set to 254.
The following describes the structure of the data sent to the STB. The SMS Gateway computes
field sequence number (named index in the MG terminology) for the SMS: the SMS does not
provide this parameter.
command_body{
type 8 uimsbf
for (i=0;i<N;i++){
data 8 uimsbf
}
}
As explained above, the purpose of an IRD command is to provide a message that will instruct
the decoder to execute an action (e.g.: reset the PIN code). The type parameter provided to
the decoder contain an index that indicate which subroutine the decoder should execute.
Nagravision provides STB manufacturers with a list of type values for a list of specific actions.
This document is entitled “Mediaguard DVB Header Specification & Clear EMM Specification”.
4.10 CONTROL commands (1nn)
Commands of the 1nn series are used to set the data that is related to a subscriber but not sent
to the device (smartcard or Set Top Box / CAK). The data provided in 1nn commands is stored
in the CAS database. This means that the data is persistent.
4.10.1 Command 104: Create ICC in Call Collector
The SMS uses this command to create a new ICC record in the CAS database.
Important
 This command is redundant with respect to command 51: Initialize Smart Card. This
command is supported solely for the sake of backward compatibility with SMS
packages operating under DN2 systems. Consequently, new SMS–CAS interfaces
should not use this command.
Command 104: Create ICC in Call Collector

command_id 4 0104 command_id = 0104
STU_number 14 num The Nagravision STB serial number in a decimal form: 10
digits with 4 trailing space characters.
E.g.: “1234567890 ”

STU_number STU_ALREADY_EXISTS NO_EXTENDED_ERROR_CODE
4.10.2 Command 105: Cancel ICC in Call Collector
The SMS uses this command to cancel an existing device record in the CAS database. This
command should be issued when the device is deleted from the SMS database.
Important
 The end user’s records in the CAS database are cancelled. As a result of this
command, the CAS will accept no more SMS commands.
Command 105: Cancel ICC in Call Collector


MOP_PPID ACCOUNT_NOT_FOUND NO_EXTENDED_ERROR_CODE
4.10.3 Command 110: EMM Cleanup
The SMS uses this command to delete all EMMs in the CAS and EMM broadcaster for an
individual device (smart card or Set Top Box / CAK). This command should be used when a
discrepancy is suspected between the SMS customer data and the EMMs for this customer.
Command 110: EMM Cleanup


4.10.4 Command 122: Set Network
Command 122 sets or updates the CAS network ID and the STB context associated with the
ICC.
In an advanced broadcast system, there are several data paths for the EMMs. The CAS network
ID is one of the CAS parameters that allow setting this data path.
In non-Nagravision native STBs, the external format of the EMMs is different. The STB context
value allows the CAS system to specify the appropriate EMM external format.
Note
 If the device does not yet exist in the SAS database, this command will create an
entry for the device.
 When several CAS networks or STB contexts are applicable to a single head end, this
command must be the first command issued by the SMS for a new device. Otherwise,
the EMMs generated by the SMS commands will either not be routed to the
appropriate CAS network or not be processed by the STB (the EMMs will be in the
wrong external format).
 If the CAS network changes, the EMMs that are still broadcast over the previous CAS
network will not move to the new CAS network.
Command 122: Set Network

CAS_network_id 3 r_num The CAS network identifier.
Range: 000 to 999
STB_context 2 r_num The STB context. A combination of STB types

(e.g.: native Nagravision STBs or MediaGuard
STBs) and CAK types (e.g.: Merlin or
MediaGuard).
Range: 00 to 99
Currently supported values:
 00 = Undefined
 01 = CAK DN2
 02 = CAK DN3
 03 = CAK DN4
 10 = MG (MediaGuard) STB
 11 = MG STB, downloadable with a CAK
 20 = BetaCrypt STB
UA SC_SET_ID_NOT_FOUND NO_EXTENDED_ERROR_CODE
CAS_network_id BAD_COMMAND_SYNTAX BAD_NETWORK_FORMAT
CAS_network_id NETWORK_NOT_FOUND NO_EXTENDED_ERROR_CODE
STB_context BAD_COMMAND_SYNTAX BAD_STB_CONTEXT_FORMAT
STB_context STB_CONTEXT_NOT_FOUND NO_EXTENDED_ERROR_CODE
4.10.5Command 123: Trigger Broadcast of Conditional EMM
This command triggers the start of the broadcast of a conditional add product previously built
using a tool such as CAS Console.
Note
 The conditional add product must previously be defined using a tool such as CAS
Console.
 The conditional add product is tested in U and S addressing modes using CAS
Console; CAS Console then builds the EMM in G (global) addressing mode. The EMM
is not broadcast until this SMS command triggers the start of the broadcast.
Command 123: Trigger Broadcast of Conditional EMM

conditional_id 20 r_num The identifier of the conditional add product.
The range is restricted to alphanumeric values.
This field must be right-padded with trailing
space characters.

address_type BAD_USAGE BAD_ADDRESS_TYPE
conditional_id BAD_COMMAND_SYNTAX BAD_CONDITIONAL_ID_FORMAT
conditional_id CONDITIONAL_ID_NOT_FOUND NO_EXTENDED_ERROR_CODE
4.10.6 Command 125: Set Subscriber Private Data
The SMS uses this command to store subscribers’ private data in the CAS database. The data is
provided in a string. The format of that string is specified by the SMS. The CAS is only used for
storing the data: it does not check the format or content of the data, neither does it process on
the data in any way. This command is typically used to store the account number.
Important
 When the SMS issues this command, any previous value stored in the CAS database
is overwritten by the new value.
 The subscriber data is not altered by the CAS. The data is stored as it is in the CAS
database.
 The subscriber data must only contain printable characters.
 There is no SMS command provided for retrieving the subscribers’ private data.
Command 125: Set Subscriber Private Data

sub_data_length 3 r_num The number of characters forming the subscriber
data.
Range: 000 to 064
sub_data sub_data_length r_text A string of characters representing the subscriber
data (this string must only contain printable
characters).

sub_data_length BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
sub_data BAD_COMMAND_SYNTAX BAD_DATA_FORMAT
4.10.7 Command 126: Assign Virtual UA to NUID
The SMS uses this command to associate a Virtual UA to NUID and get this one in the
acknowledgment command returned by CAS (see SMS ‘1003-Acknoledge Command with Virtual
UA’).
The CAS assigns a virtual UA to NUID (and stores the link into CAS database) if NUID is not
already linked to virtual UA. Else, it returns the virtual UA already linked to NUID.
Important
 This command shall be sent for the devices without smart card only. And it shall be
the first SMS command sent. The device could not be initialized if this command is
not sent before.
Command 126: Assign Virtual UA to NUID

NUID 10 r_num Identifier of the STB chipset.
Range: 0000000001 to 4,294,967,295

Command_id NO_VUA_AVAILABLE NO_EXTENDED_ERROR_CODE
NUID BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
NUID NUID_BLACKLISTED NO_EXTENDED_ERROR_CODE
4.10.8 Command 127: Get all products
The SMS uses this command to request a list of all the products owned by a subscriber for the
MOP indicated in the root header field MOP_PPID.
That information comes from the CAS database. If the command can be executed successfully,
the acknowledgement and result is provided with SMS command 1004 "Acknowledge command
with data".
The data returned by this acknowledgement contains:
 The device suspended flag (type 0x00). Only present if the device is suspended.
 One product properties block for each product (type 0x01). This block contains:
o The product ID (type 0x02)
o The product suspended flag (type 0x03). Only present if the product is
suspended.
o The a-la-carte product services (type 0x04). Only present if the product is an
a-la-carte product.
o The start date (type 0x05). Only present for a-la-carte products.
o The end date (type 0x06). Only present for a-la-carte products.
The example of SMS command 1004 shows a typical answer for this SMS command.
Command 127: Get all products


None MESSAGE_NOT_FOUND BAD_SOURCE_ID
None TOO_MANY_ITEMS NO_EXTENDED_ERROR_CODE
MOP_PPID INVALID_PPID NO_EXTENDED_ERROR_CODE
4.11 Internal CAS commands (7nn)
The series of command 701 to 799 is reserved for private CAS commands.
4.12 MACRO EMM commands (9nn)

This chapter describes the data of the command section for the 9nn SMS command series.
Those commands are the same kind as the 0nn SMS command series (see previous chapter).
The aim of this series is to optimize the overall command message bandwidth of the SMS – CAS
interface. Indeed, for a large volume of end users, the amount of transactions (EMM command
messages) is very high. Thus the use of the interface should be optimized. The solution adopted
here is to concatenate several commands of the 0nn series into one macro command.
4.12.1 Command 902: Activate Smart card Without Return Path
SAS replaces original MOP by SOP Please refer to individual commands (0nn)
This command is a ‘one-shot’ initialization command designed to improve the performances of

the CAS when initializing a new device in the CAS database.
Important
 Read the Important note under command 2, 10, 13, 48, 49, 52, 61, 100, 101
 If the CAS must generate a negative acknowledgement (i.e. nack) upon processing
this SMS command, the body of the command will be truncated to 999 characters
long before being inserted in field ‘command_section’ of the negative
acknowledgement.
Command 902: Activate Smart card Without Return Path

zip_code 5 num The end user’s zip code. Range: 00000 to 99999
STU_number 14 r_num The serial number of the CA STB in a decimal form.
Range: see Important note in section 4.9.19.
nb_of_products 2 r_num Number of products provided in this command.
Range: 00 to 99
for(i=0; i<nb_of_products; i++) { A counter.
Range: 000000000000 to 004294967295
begin_date 8 YYYYMMDD Subscription begin date (in UTC). The subscription
is not valid before this date.
end_date 8 YYYYMMDD Subscription end date (in UTC). The subscription is
not valid after this date.
}
nb_of_ppv 2 num Number of PPV products provided in the command.
Range: 00 to 99
for(i=0; i<nb_of_ppv; i++) { A counter.
IMS_product_id 12 num IMS product ID.
Range: 000000000000 to 004294967295
length_event_name 2 r_num The length of valid data in the event_name field. It
must not exceed 30 bytes. This is due to storage
limitations in the smart card.
event_name 32 text Event name as displayed in the PPV purchase
history in the STB user interface. The number of
characters must match length length_event_name.
The remaining bytes should be filled-up with space
characters. See special note in section 4.5.1.
price 5 num Price of the product, representing 0.00 to 999.99
}
UA CARD_REFURBISHMENT_FAILED NO_EXTENDED_ERROR_CODE
MOP_PPID DATABASE_ERROR DATA_ERROR (invalid parent MOP)
zip_code ZIP_NOT_FOUND NO_EXTENDED_ERROR_CODE
nb_of_products BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_product_id BAD_PRODUCT_TYPE RECULAR_PRODUCT
4.12.2 Command 903: Add List of Products
Usage Note
 For new development, it is advised to use SMS command 905 (Add Enhanced List of
Products) instead of SMS command 903.
The SMS uses this command to add a list of new products (service products, non-impulsively
purchasable event products and package products) in a smart card.
Important
 Read the Important note under command 2, 10, 13, 48, 49, 52, 61, 100, 101
acknowledgement.
Command 903: Add List of Products

Range: 00 to 99
Range: 000000000000 to 004294967295
begin_date 8 YYYYMMDD Subscription begin date (in UTC). The
subscription is not valid before this date.
end_date 8 YYYYMMDD Subscription end date (in UTC). The subscription
is not valid after this date.
}
nb_of_ppv 2 r_num Number of PPV product provided in this
command. Range: 00 to 99
Range: 000000000000 to 004294967295
length_event_name 2 r_num Length of valid data in the event_name field. It
event_name 32 text Event name as displayed in the PPV purchase
history in the STB user interface. The number of
characters must match the length
length_event_name. The remaining bytes should
be filled-up with space characters. See special
note in section 4.5.1.
price 5 num Price of the product. Range: 0.00 to 999.99
}
MOP_PPID DATABASE_ERROR DATA_ERROR (invalid parent MOP)
4.12.3 Command 904: Cancel List of Products
The SMS uses this command to cancel a list of products (entitlements of services or/and PPV)
from a device (smart card or Set Top Box / CAK).
Important
 Read the Important note under command 6.
Command 904: Cancel List of Products

nb_of_products 2 r_num Number of products provided in this command. The
range is 00 to 99
Range: 000000000000 to 004294967295
}

CONFIDENTIAL

Version 1.0.0 Draft
4.12.4 Command 905: Add Enhanced List of Products

The SMS uses this command to add a list of new products (service products, non-impulsively
purchasable event products and package products) into a device (smart card or Set Top Box /
CAK).
Important
 Read the Important note under commands 2, 10 and 903.
 A “re-hit purchase” is a case where customers purchase a product through the SMS,
and later complain that they do not have access to the requested product. The SMS
command is issued a second time. The SMS/SAS must make sure that the subscriber
will only have access to the same content and validity period as initially granted by
the first SMS command.
acknowledgement.
CONFIDENTIAL
Command 905: Add Enhanced List of Products
Range: 00 to 99
Range: 000000000000 to 004294967295
purchase_mode 1 r_text A flag specifying whether the product purchase is a new
purchase (P) or a re-hit of the product ®.
This flag is only used with Merlin smart cards: it is ignored
with Aladin smart cards (the value is overwritten as P).
This flag is only applicable to multi-instance products
where the validity dates are specified by the SMS (Flexible
Subscription and PPT by points products). With other
product types (regular subscriptions and PPT by coins
products), the flag is ignored.
With Flexible Subscription and PPT by points, the SMS
command handling is as follows:
 A new purchase creates a new instance of
the product.
 A re-hit retrieves the active instances of the product
in the smart card and recreates the latest
purchased instance of the product. If no active
instance is found, then the SMS command will be
handled as a new purchase.
begin_date 8 YYYYMM Subscription begin date (generally in UTC). The
DD subscription is not valid before this date.
begin_time 6 HHMMSS Subscription begin time (generally in UTC). The
subscription is not valid before this time.
end_date 8 YYYYMM Subscription end date (generally in UTC). The subscription
DD is not valid after this date.
end_time 6 HHMMSS Subscription end time (generally in UTC). The subscription
is not valid after this time.
length_product_name 2 r_num The length of valid data in the product_name field. It
product_name 32 Text The product name as displayed in the PPV purchase history
in the STB user interface. The number of characters must
match the length specified in length_product_name. The
remaining bytes should be padded with space characters.
See special note in section 4.5.1.
price 5 num The price of the product. Range: 000.00 to 999.99
}
nb_of_ppv 2 r_num The number of PPV products included in this command.
Range: 00 to 99
Continued…
Command 905: Add Enhanced List of Products (continued)
IMS_product_id 12 Num The IMS product ID.
Range: 000000000000 to 004294967295
purchase_mode 1 r_text A flag specifying whether the product purchase is a new
purchase (P) or a re-hit of the produ®(R).
This flag is only used with Merlin smart cards: it is ignored
with Aladin smart cards (the value is overwritten as P).
This flag is only applicable to multi-instance products
where the validity dates are specified by the IMS (N of M
products) or computed by the SAS at purchase time
(rental PPVs and PPFPs), as well as to coin products. With
rental DVR products, the flag is ignored and the SMS
command is handled as a new purchase. With other
product types (short-term subscriptions and PPVs), the
flag is ignored.
With N of M products, the SMS command is handled as
follows:
the product.
 A re-hit retrieves the latest purchased instance in
the smart card and recreates the same instance
of the product. If no instance is found, then the
SMS command will be handled as a new purchase.
With rental PPV and PPFP products, the SMS command is
handled as follows:
the product.
 A re-hit retrieves the active instance of the product
in the smart card and recreates the same instance
of the product. If no active instance is found, then
the SMS command will be handled as a new
purchase.
With coin products, the SMS command is handled as
follows:
 A new purchase adds the amount of credit
associated with the product to the credit level in
the smart card.
 A re-hit sets the credit figure in the smart card to
the current absolute value of the smart card credit
level.
length_product_name 2 r_num The length of valid data in the product_name field. It
product_name 32 text The product name as displayed in the PPV purchase history
in the STB user interface. The number of characters must
match the length specified by length_product_name. The
remaining bytes should be padded with space characters.
See special note in section 4.5.1.
price 5 num The price of the product. Range: 000.00 to 999.99
}
IMS_product_id PPV_PURCHASE_NOT_ALLOWED NO_EXTENDED_ERROR_CODE
purchase_mode BAD_COMMAND_SYNTAX BAD_PURCHASE_MODE
begin_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
end_time BAD_COMMAND_SYNTAX BAD_TIME_FORMAT
length_product_name BAD_COMMAND_SYNTAX LENGTH_TOO_LONG
length_product_name BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
4.12.5 Command 908: Set Families of Products
This command is for managing a-la-carte products but using the syntax of the subscription
family products as they were defined in Merlin 3.0 or earlier..
The SMS uses this command to specify an exhaustive list of services (identified by their
products ID) for a subscriber. The subscriber will only be granted access to products listed
within the relevant product family. In other words, if a subscriber previously had access to a
product and the product was later removed from the list, the customer would then be denied
access to this product.
No dates are supported for this command: the services are immediately available and will be
available until a cancel command is issued (either another 908 with less services or one of SMS
commands supporting a-la-carte products such as SMS 7, 909 or 925).
Important
Command 908: Set Families of Products

nb_of_families 2 r_num The number of product families included in this command.
Range: 01 to 64
for(i=0;i<nb_of_families;i++) { A counter.
IMS_family_index 2 r_num The IMS family index.
Range: 00 to 63
nb_of_products 3 r_num The number of products included in this family.
Range: 000 to 256
for(i=0;i<nb_of_products;i++) { A counter.
IMS_product_id 12 num The IMS product ID.
Range: 000000000000 to 004294967295
}
}
command_id BAD_COMMAND_SYNTAX BAD_COMMAND_ID
nb_of_families BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_family_index BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_product_id BAD_PRODUCT_FAMILY NO_EXTENDED_ERROR_CODE
IMS_product_id BAD_PRODUCT_TYPE NO_EXTENDED_ERROR_CODE
4.12.6 Command 909: A-la-carte management
This command is used to manage a-la-carte subscriptions attributed to subscribers. It has an

effect only on a-la-carte subscriptions (it is rejected if used on other types of products) and can
contain several operations.
Note that each "service" (also called service_index in this command) may represent one or
several channels, depending on how the services were configured in IMS.
The supported operations are:
 Set expiration date
This operation works in two different ways, depending on whether the renew field is set
to Y or N. If renew option is set to N:
o Define or modifies the expiration date of an a-la-carte product. It applies to all

services of the product.
o If the new expiration date is the same as the previous one and renew is not set,
this operation has no effect.
o If the new expiration date is earlier than (or equal to) the schedule date, all
scheduled services are immediately cancelled.
o If the new expiration date is earlier than (or equal to) the current date, all
services (scheduled or not) are immediately cancelled.
If the renew option is set, two use cases are supported (other cases are rejected):
o Case 1: The previous TE is expired. in that case the new TE is in the future and
all services that belonged to the subscriber before this expiration, the expired
services (if any) re immediately renewed and will be available until the new
expiration date.
o Case 2: The previous TE is not expired and the new TE is the same. This case
means that a 'rehit' operation is done, resending the full a-la-carte
 Set schedule date
Define or modifies the scheduled date of an a-la-carte product. This determines the date
when the next product updates (add/cancel scheduled) will occur.
If the new schedule date is earlier than (or equal to) the current date and the expiration
date is in the future, all scheduled services become immediately available.
If the new schedule date is later (or equal to) the expiration date, all scheduled services
are cancelled.
 Add service immediate
Add a service immediately. The service will be available immediately and will be
available until the expiration date defined with the 'Set expiration date' operation.
If the expiration date is in the past, the command is rejected.
The command is always sent to the subscriber (rehit).

 Cancel service immediate
Cancel a service immediately. The service will immediately be cancelled. It will also be
cancelled if it was scheduled to start at the date defined by the 'Set schedule date'
operation.
 Add service scheduled
Add a service at the schedule date. The subscriber will only be able to access the service
at the scheduled date, and it will be available until the expiration date is reached (which
is infinite if it has never been defined).
If the schedule is earlier than or equal to the current date, the command is rejected.
 Cancel service scheduled
The service will be cancelled at the schedule date.
If the schedule date is earlier than or equal to the current date, the operation is
rejected.
The order of operations is important and the result will be the same as if each operation had
been issued sequentially in consecutive SMS 909 commands. It is however much more efficient
to regroup multiple operations for the same UA in a single command.
Notes
 if the expiration date has never been set, any add/cancel operation will be rejected. The
value 1.1.2038 00:00:00 defines an infinite product duration.
 if the schedule date has never been set, any schedule command will be rejected. The
value 1.1.2038 00:00:00 cancels the schedule date.
 if at least one operation is rejected, the whole command is rejected.
Command 909: A-la-carte management

command_id 4 num command_id = 0909
IMS_product_ID 12 num The ID of the IMS a-la-carte product.
Range: 000000000000 to 004294967295
nb_operations 3 num The number of operations listed in this SMS
command
For each operation [1..nb_operations]
operation_id 2 num The operation ID
01 = Set expiration date
02 = Set schedule date
03 = Add service immediate
04 = Add service scheduled
05 = Cancel service immediate
06 = Cancel service scheduleds
Command 909: A-la-carte management
01 expiration_date 8 YYYYMMDD Expiration date
expiration_time 6 HHMMSS Expiration time
renew 1 r_text Y or N. See above description
02 schedule_date 8 YYYYMMDD Schedule date
schedule_time 6 HHMMSS Schedule time
03 service_index 4 num Index of the service in a-la-carte product
Range: 0001 to 2048
Range: 0001 to 2048
Range: 0001 to 2048
Range: 0001 to 2048
}

<operations> DATE_MISMATCH EXPIRATION_DATE
<operations> DATE_MISMATCH SCHEDULE_DATE
4.12.7 Commands 910 to 919: Reserved for Internal CAS Actions
4.12.8 Command 925: Set a-la-carte services
This command defines completely and exhaustively the contents of the a-la-carte product of a
subscriber, including the dates.
Note that each "service" may represent one or several channels, depending on how the services
were configured in IMS.
Important
 An expiration date of 1.1.2038 00:00:00 means 'infinite duration'
 A schedule date of 1.1.1992 00:00:00 means there is no schedule date. In that case
there must not be any services listed as scheduled
 If the schedule date is higher than or equal to the expiration date, it is considered as
1.1.1992, i.e. schedule date is disabled
Command 925 : Set a-la-carte services

IMS_product_ID 12 num The a-la-carte IMS product ID
expiration_date 8 YYYYMMDD Expiration date
expiration_time 6 HHMMSS Expiration time
schedule_date 8 YYYYMMDD Schedule date
schedule_time 6 HHMMSS Schedule time
length_services = N 4 num Length of the services field (=N, in bytes)
services N hex Contains 2 bits for each service, starting at service 1.
00 = The service is not available
01 = The service will be available at schedule date and
will end at expiration date
10 = The service is available immediately but will end
at schedule date
11 = The service is available immediately until the
expiration date
The bitmap can be truncated at the last hexadecimal

byte with a service that is not a 00, hence the variable
length. If the full bitmap (2048 services) is provided,
the length is 2048 / 2 = 1024 (1 hexadecimal digit
represents 4 bits, i.e. 2 services).
For example, a subscriber who has currently services 2,3 and 4 and who will has replaced
service 4 with service 5 starting next month (i.e. he will have services 2,3 and 5 next month)
has the following bitmap:
Bitmap =
3E4 Length_bitmap = 0003
3 E 4
Bitmap 00 11 11 10 01 00
12 34 56
Service Nr 7 8 ….
Subscriber has the service

Subscriber will have the service at schedule date

nb_of_families BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_family_index BAD_COMMAND_SYNTAX BAD_NUMBER_FORMAT
IMS_product_id BAD_PRODUCT_FAMILY NO_EXTENDED_ERROR_CODE
4.13 OPERATION commands (10nn and 20nn)
4.13.1 Command 1000: Acknowledge Command
The CAS and the SMS use this command to acknowledge a command issued by the other side of
the interface. Field “transaction_number” identifies the corresponding command that has been
processed successfully.
Important
 Fields IMS_product_id and SMS_product_id are no longer applicable since the
series of cmd 3nn is not supported by the interface. Consequently, these fields will
be set to 000000000000 and 000000000000 respectively.
Command 1000: Acknowledge Command

transaction_ number 9 num Transaction number acknowledged.
Range: 000000000 to 999999999
IMS_product_id 12 num IMS product ID is always 000000000000
SMS_product_id 12 num SMS product ID is always 000000000000
4.13.2 Command 1001: Non-acknowledged Command
The command specified could not be completed because it is either REJECTED or POSTPONED. A
rejected command is a consequence of a mistake in the command format or in the command
processing. A postponed command is a consequence of a CAS system that is busy.
Important
 When a command is POSTPONED, the SMS should resubmit the command after a
delay of 60 min. Note that the resubmitted command should be identified with a new
transaction id.
Command 1001: Non-Acknowledge Command

command_id 4 r_num command_ID = 1001
transaction_ number 9 num transaction_number
acknowledged Range: 000000000
to 999999999
nack_status 1 r_num 1 = REJECTED means that the command has
been rejected because an error has been
detected.
2 = POSTPONED means that the command
could not be completed because the system is
busy.
error_code 4 r_num Main error code, refers to section 5.1
error_code_ext 4 r_num Extension error code, refers to section 5.2
length_of_command_body 3 num Length of the following section
command_section n Command section of the command that caused
the error, where n = length_of_command_body
4.13.3 Command 1002: No Command
The SMS should send this command in the following two conditions:
 While the SMS opens a channel.
 While there is no activity, i.e. no command to send or receive. The period should be 5 min.
Command 1002: No Command

4.13.4 Command 1003: Acknowledge Command with Virtual UA
The CAS uses this command to acknowledge the SMS command ‘126-Assign Virtual UA to NUID’
issued by the SMS and to return the virtual UA that SAS has linked to given NUID.
Field “transaction_number” identifies the corresponding command that has been processed
successfully.
Command 1003: Acknowledge Command with Virtual UA

transaction_ number 9 num Transaction number acknowledged.
Range: 000000000 to 999999999
VUA 10 num Virtual UA associated to NUID given in SMS
command 126.
Range: 0000000001 to 4,294,967,295

NUID 10 r_num Identifier of the STB chipset.
Range: 0000000001 to 4,294,967,295

4.13.5 Command 1004: Acknowledge command with data
This command is a positive acknowledgement returned in answer to some SMS commands such
as SMS 127 (the description of the SMS command mention this point explicitly when SMS 1004
is used as a response instead of the usual SMS commands 1000 or 2000). In addition to
signaling that the command was processed succsessfully, it also returns additional information
to the SMS.
The returned information varies depending on the input command. The exact list of information
that can be returned is indicated in the section describing the command.
Command 1004: acknowledge command with data

transaction_number 9 num Transaction number acknowledged.
Range: 000000000 to 999999999
data_length 5 num Size of the data field (number of ASCII
characters following this field)
data data-length hex The data block in hexadecimal
Data is encoded with a set of TLV (Tag-Length-Value) triplets. A triplet is:
 Tag - on 1 byte (2 characters in hexadecimal representation). Indicates the kind of

information contained in the triplet. Refer to the table below
 Length - on 2 bytes (4 characters in hexadecimal representation). Indicates the size of

the "Value" field that follows, in bytes
 Value - the value itself. The value format is described in tha table below depending on
its tag. Its length was provided in the Length part of the triplet.
Here is the list of all tags supported by SMS command 1004.

Tag Description and properties
0x00 Device suspended flag. Indicates that the device is suspended. The length is always on 1
byte and its value is 0x01.
0x01 Product properties. This tag indicates that it contains several additional tags (using the
same Type-Length-Value scheme) all related to the description of a single product. The
length varies depending on the number of those tags.
0x02 Product ID. This tag contains an IMS product ID. Its length is always 4 bytes.
0x03 Product suspended flag. This tag indicates that a product is suspended. Its length is
always 1 byte and its value is 0x01.
0x04 A-la-carte product services. This tags contains a list of services belonging to an a-la-carte
product and is represented as a bitmap with 2 bits per channel starting at channel 1.
00 = The service is not available

01 = The service will be available at schedule date and will end at expiration date
10 = The service is available immediately but will end at schedule date
11 = The service is available immediately until the expiration date
The missing bits are implicitly set to 0.
For each pair of bits, the first indicates that the service is currently
0x05 Start date. This tag contains a date stored on 4 bytes as UNIX time. The date represents the
start date of the described element.
0x06 End date. This tag contains a date stored on 4 bytes as UNIX time. The date represents the
end or expiration date of the described element.
Important
 Tags which are not supported by the SMS shall be ignored. This allows upgrading the
CAS with new information without necessarily having to modify the SMS whenever
new tags are deployed.
Example: result of SMS 127
The following command 1004 is returned in answer to an SMS 127 "Get all products":
000052758050001000214121211220121004735963126000680000010101000B02000400004E
200300010101000D020004000061A804000340C002
This is decomposed as follows:
Root header of SMS command + SMS 1004 containing 68 characters Tag

000052758 05 0001 0002 14121 21120121004 735963126 00068 Length Value
00 0001 01(device suspended)
01 000B02 0004 00004E20 03 0001 01(product 20000, suspended)
01 000D02 0004 000061A8 04 0003 40C002 05 0004 54001111 06 0004 59999ABC

(a-la-carte product 25000)
Bitmap 01 00 00 00 11 00 00 00 00 00 00 10
Service Nr 1 2 3 4 5 6 7 8 9 10 11 12
So this command means that the subscriber has:
 A suspended smartcard
 With product 20000 which is also suspended
 And with a-la-carte product 25000 containing
o current services 5 and 12
o services 1 and 5 will be available next update (service 1 replaces service 12)
o the next update (begin date) will occur on 29.8.2014 at 05:35:13
o the product will expires (end date) on 20.8.2017 at 14:20:44

4.13.6 Command 2000: EMM via Portal Acknowledge command
The CAS uses this command to acknowledge a command issued by the SMS when the
broadcasting mode specified in the Address Header of the EMM command or control command is
of type E (EMM via Portal). Field “transaction number” identifies the corresponding command
that has been processed successfully.
Command 2000: EMM via Portal Acknowledge command

Range: 000000000 to 999999999
nb_of_emm 3 num Number of EMM.
Range: 000 to 999
for(i=0; i<nb_of_emm; i++){
emm_data_length 3 num Length of emm_data, in bytes.
Range: 000 to 999
emm_data 2x r_text This field contains a string of characters
emm_data_length (see note representing hexadecimal data encoded in
below) the ASCII format (two characters for one
byte).
}
Important
 As indicated in the table above, the format of the emm_data field is r_text. However,
it does not contain a regular string: it is not a text field, such as “this is a sentence
with characters and 1 2 3 4 numerical values”. The emm_data field contains a
will only accept alpha characters A, B, C, D, E, F representing the numbers 10 to 15 in
a hexadecimal form.
 As an example – the CAS will accept the following data:
A0BCD12A29327B9F. Therefore, the value of emm_data_length is 8.
4.13.7 Command 2001: EMM via Portal Negative-Acknowledge command
The command specified could not be completed because it is either REJECTED or POSTPONED. A
rejected command is a consequence of a mistake in the command format or in the command
processing. A postponed command is a consequence of a CAS system that is busy.
Command 2001: EMM via Portal Negative-Acknowledge command

Range: 000000000 to 999999999
nack_status 1 r_num 1 = REJECTED means that the command has
been rejected because an error has been
detected.
2 = POSTPONED means that the command could
not be completed because the system is
busy.
error_code 4 r_num Main error code.
error_code_ext 4 r_num Error code extension.
The CAS will return the following error codes:

 SYSTEM_ERROR with code extension EXTERNAL_SYSTEM_ERROR (nack postponed returned in
SMS command 2001 when the CAS is not ready to handle the request or in case of time-out
with the EME, etc.)
 SYSTEM_ERROR with code extension CIPHERING_ERROR (nack rejected returned in
SMS command 2001 in case of ciphering error)
5. Error codes
If an error occurs when executing an SMS command, it is reported by the use of an error code
and an error code extension. The error code indicates an error category and the error code
extension gives more details regarding the error source (e.g., an incorrectly specified field or
value exceeded).
An error code is always followed by an error code extension (possibly extension 0000:
NO_EXTENDED_ERROR_CODE). The error codes and extensions available are indicated in the
following tables.
5.1 Table of Error codes
Error Code Name Code Description

FATAL_ERROR 0000 The Oracle database interface returns an exception
as database error or protocol error due to a non-
understood field in the SMS command. All SMS EMM
commands might generate such FATAL_ERROR.
BAD_ROOT_HEADER_SYNTAX 0001 The syntax of the command root header is not
correct. See error code extension
BAD_HEADER_SYNTAX 0002 The syntax of the command header is not correct.
See error code extension
BAD_COMMAND_SYNTAX 0003 The syntax of the command is not correct. See error
code extension.
DATABASE_ERROR 0004 An error occurred during an CAS database query
processing.
MESSAGE_NOT_FOUND 0005 The message referenced in the command does not
exist.
PRODUCT_NOT_FOUND 0006 The product_id used in the command does
not exist in the CAS database.
CANCELED_CARD 0007 The smart card referenced in the command has
been canceled.
UA_NOT_FOUND 0008 The smart card UA referenced in the command does
not exist
PPV_IN_THE_PAST 0009 The command attempts to access a PPV whose
validity has expired.
STU_ALREADY_EXISTS 0010 The command attempts to create a smart card in
the CC database, but the smart card is bound to an
already existing STB.
SERVICE_NOT_FOUND 0011 The service referenced in the command does not
exist in the CAS database.
PRODUCT_ALREADY_EXISTS 0013 The command attempts to create an already existing
product.
UA_ALREADY_EXISTS 0014 The command attempts to create in the CC database
a smart card that already exists.
BAD_EPG_FORMAT 0015 The format of the EPG data feed is not correct.
DB_INCONSISTENT_TOO_MANY_ROWS 0021 Inconsistency in the CAS database
DB_INCONSISTENT_INVALID_PRODUCT 0022 Inconsistency in the CAS database
PRODUCT_INCONSISTENT 0024 There is an inconsistency between the product
definition received and the internal SMS Gateway
product database.
TOO_MANY_ITEMS 0025 Too many items are given in the list.
VALUE_OUT_OF_RANGE 0026 The value in the incoming command is out of the
authorized range.
BAD_USAGE 0027 The usage of this parameter is not correct. See error
code extension.
INVALID_PPID 0028 The MOP PPID used in this command is invalid.
SYSTEM_ERROR 0029 An error not related to the business or to the field
value occurs within the system. See error code
extension.
BAD_PRODUCT_TYPE 0030 The type of the product is wrong (not supported for
this command or for this addressing type).
BAD_PRODUCT_STATUS 0031 The status of the product does not allow the
execution of this command.
ACCOUNT_NOT_FOUND 0032 The account that corresponds to this UA and to this
MOP does not exist in the database.
ZIP_NOT_FOUND 0034 The Zip code does not exist in the database.
RIGHT_NOT_FOUND 0035 The Right does not exist in the database
NO_LICENSE 0036 No license for this type of SMS command
NOT_AUTHORIZED 0037 This command is not authorized. The underlying
cause can be a misuse of one of the following
parameters:
 MOP
 SMS source ID
 bad product PA type vs MOP PA type
 bad product PA type vs addressing type
NO_RTM_PRESENT 0040 A cmd 1002 is issued by SMS on EMM/control
channel, but no RTM is configured in the CAS
system.
SMS_NOT_AUTHORIZED 0041 Invalid source_ID used by SMS.
NO_SERVER_AVAILABLE 0043 There is no TM application available to handle the
command
TM_SERVER_ERROR 0044 Occurs when system returns a CORBA exception
SOURCE_ID_ALREADY_USED 0045 The SMS Source ID is already used by another
connection. Check why two different SMS are
connected with the same source_ID
UA_OUT_OF_RANGE 0046 smart card Unique Address is out of range for the
operator
EXPIRED_CARD 0047 The smart card life time has expired
COMMAND_THRESHOLD_OVERFLOW 0048 This error is generated back to the SMS if there are
too many commands for a certain smart card
coming in a short time frame.
INVALID_VOUCHER 0049 The voucher checked is invalid
NO_CIPHER_PRESENT 0050 There is no cipher available
CARD_NOT_PAIRED 0051 Card is not paired with STB.
SEGMENT_NOT_FOUND 0052 The segment requested in not defined in CAS.
PRODUCT_CAT_NOT_FOUND 0053 The product category requested in not defined in
CAS.
NETWORK_NOT_FOUND 0054 The network ID requested in not defined in CAS.
STB_CONTEXT_NOT_FOUND 0055 The STB context requested in not defined in CAS.
CONDITIONAL_ID_NOT_FOUND 0056 The conditional add ID requested is not defined in
CAS.
ONLINE_PURCHASE_REFUSED 0057 Online purchase has been refused.
UA_LOCKED_WHILE_EXCHANGED 0058 A smart card exchange is in progress for the
specified UA. No other SMS command can be
accepted as long as the exchange is not finished.
NO_FREE_PAIRING_SLOT 0059 All the available pairing slots are already used.
EXCHANGED_CARD 0060 The smart card has been exchanged with a new one,
therefore it cannot be used anymore.
SC_SET_ID_NOT_FOUND 0061 There is no smart card set ID defined in CAS for the
requested UA.
PPV_PURCHASE_NOT_ALLOWED 0062 The SMS sends a command to add a PPV for a
subscriber that is not authorized for PPV.
ALREADY_LINKED_CARD 0063 UA already linked to another UA.
NO_LINKED_CARD 0064 UA has not substitute UA linked to it.
EXCHANGED_CARD_REVERSED 0065 A reverse exchange command 503 has been issued
for this UA. No SMS command is accepted anymore
for this UA.
BAD_CARD_TYPE 0066 The substitute UA is of the wrong smartcard type
and cannot be used as a new smartcard for the
swap.
BAD_PRODUCT_FAMILY 0067 There is an inconsistency between the IMS family
index specified in the SMS command and the one
assigned to the product.
BAD_REPLACED_CARD_TYPE 0068 The replaced UA is of the wrong smartcard type and
cannot be used for the swap.
DISCONNECTED_CARD 0069 The smartcard is disconnected.
SUSPENDED_CARD 0070 The smartcard is suspended.
SUSPENDED_MOP 0071 The MOP is suspended.
FOREIGN_SC 0072 The SC is a foreign SC.
CARD_REFURBISHMENT_FAILED 0074 An operation was attempted on a card which wasn't
refurbished successfully, and this operation is not
allowed on such cards.
VUA_NOT_LINKED_TO_NUID 0076 Virtual UA was not assigned to NUID.
Reasons:
 The SMS command ‘126-Assign Virtual UA
to NUID’ was not sent
 Or the given virtual UA is not the virtual UA
returned in the acknowledgment of the
SMS 126.
NUID_OUT_OF_RANGE 0077 NUID is out of range for the operator.
NO_VUA_AVAILABLE 0078 All vUA defined in the system were already assigned
to NUID. A new range of vUA shall be deployed.
COMMAND_NOT_SUPPORTED 0079 The sent SMS command is not supported.
DATE_MISMATCH 0081 A check to ensure date consistency failed. The error
extension sometimes provides more information to
identify which date was being checked.
NUID_BLACKLISTED 0084 An NUID was blacklisted and therefor the pairing is
not done
Table 5-1: Error codes
5.2 Table of Error code extensions
Error code extension Name Code Description

NO_EXTENDED_ERROR_CODE 0000 No error code extension is available for the
error code specified.
BAD_DATE_FORMAT 0004 The command contains a date whose
format is incorrect.
BAD_DATE_SEQUENCE 0005 The command contains a begin date and
an end date that are out of sequence.
BAD_FREQUENCY_FORMAT 0006 The call_freq field of the command
contains a value whose format is incorrect.
BAD_STU_NUMBER_FORMAT 0007 The format of the STB number specified in
the command is incorrect.
BAD_IMS_PRODUCT_ID_FORMAT 0008 The format of the CAS_product_id of
BAD_MESSAGE_NUMBER_FORMAT 0010 The value of the message_number field
of the command is incorrect.
BAD_PRICE_FORMAT 0013 The value of the price field of the
command is incorrect.
BAD_UA_FORMAT 0015 The value of the UA field of the command is
incorrect.
BAD_ZIP_CODE_FORMAT 0016 The value of the zip code field of the
DIFFERENT_PRODUCTS 0017 The command attempts to define a product
with a product_id already attributed to a
different product.
BAD_BROADCAST_MODE 0019 The broadcast mode is incorrect.
BAD_ADDRESS_TYPE 0020 The format of the value of the
address_type field of the command
is incorrect.
BAD_MOP_PPID 0021 The MOP_PPID indicated in the command
is not valid.
BAD_DEST_ID 0022 The dest_id indicated in the command
is not valid.
BAD_SOURCE_ID 0023 The source_id indicated in the
command is not valid.
BAD_COMMAND_TYPE 0024 This type of SMS command does not exist.
BAD_COMMAND_ID 0025 The command ID given in the SMS
command does not exist.
BAD_NUMBER_FORMAT 0027 A non-numerical character was found in
the content of a Num field.
BAD_ERROR_CODE 0032 The error code specified in the command
does not exist (section 8).
BAD_ERROR_CODE_EXT 0033 The error code extension specified in the
command does not exist (section 8).
BAD_SERVICE_UID_FORMAT 0040 The format of the value of a service_UID
field of the command is incorrect.
BAD_SERVICE_NUMBER_FORMAT 0041 The format of the value of the
service_number field of the command
is incorrect.
BAD_NUMBER_OF_IPPV_FORMAT 0044 The format of the number_of_IPPV field
in the command is incorrect.
BAD_IP_ADDRESS_FORMAT 0045 The format of the IP address in the
EXTERNAL_SYSTEM_NOT_RESPONDING 0048 The other components of the CAS system
do not respond to the gateway process.
EXTERNEL_SYSTEM_ERROR 0049 The other components of the CAS system
have not successfully processed the
command.
BAD_SERVICE_ID_FORMAT 0052 The format of the service ID is incorrect.
BAD_TRANSPORT_ID_FORMAT 0053 The format of the transport ID is incorrect.
BAD_NETWORK_ID_FORMAT 0054 The format of the network ID is incorrect.
BAD_LID_FORMAT 0055 The format of the lid is incorrect.
BAD_PRIORITY_FORMAT 0056 The format of the priority is incorrect.
BAD_MODE_FORMAT 0057 The format of the mode is incorrect.
LENGTH_TOO_LONG 0058 The length is out of range.
BAD_FLAG_VALUE 0059 The flag value is not recognized.
BAD_CC_PORT_FORMAT 0060 The format of the CC port is incorrect.
BAD_TRANSACTION_NUMBER_FORMAT 0061 The format of the transaction number is
incorrect.
BAD_PURGE_MODE_FORMAT 0062 The format of the purge mode is incorrect.
BAD_CALLBACK_FORMAT 0063 The format of the callback type is incorrect
BAD_TIME_FORMAT 0064 The time format is incorrect
DATE_NOT_IN_THE_PAST 0065 This date must be set in the past
ACCESS_ERROR 0066 Error when trying to access database
TRANSACTION_ERROR 0067 An error occurs during a database
transaction (i.e. limitation reached,
overflow…)
DATA_ERROR 0068 An error related to the data contained in
database occurs (i.e. expected record is
missing).
TRANS_NR_ALREADY_IN_USE 0069 This transaction number is already in use
within the system.
COMMUNICATION_ERROR 0070 Communication error between components
within the system.
INTERNAL_ERROR 0071 System internal error.
SOURCE_NOT_AUTHORIZED 0072 Use of this source identifier is not allowed.
SOURCE_ALREADY_IN_USE 0073 This source identifier is already used by
another source.
DEST_NOT_AUTHORIZED 0074 Use of this destination identifier is not
allowed.
MOP_NOT_AUTHORIZED 0075 Use of this MOP PPID is not allowed.
DATE_IN_THE_FUTURE 0076 This date must be set in the present or in
the past.
CANCELLED_PRODUCT 0077 The product has been cancelled.
SUSPENDED_PRODUCT 0078 The product has been suspended.
INVALID_PURCHASE_DATE 0079 The purchase date is invalid.
DRAFT_PRODUCT 0080 The product is a draft.
PPV_PRODUCT 0081 The product is a PPV.
DATE_IN_THE_PAST 0082 This date must be set in the present or in
the future.
ADDRESS_TYPE_NOT_AUTHORIZED 0083 This type of address is not allowed for this
command.
ISD_MOP_NOT_FOUND 0084 The MOP record does not exist for this UA.
BAD_DATA_FORMAT 0085 The format of the data is invalid.
REGULAR_PRODUCT 0086 This product is a regular (subscription)
product.
INVALID_CATEGORY 0087 The category requested is not defined in
the CAS.
CORBA_EXCEPTION 0088 Low level system error
RENTAL_PRODUCT 0089 Operation not allowed with a rental product
FREE_RENTAL_PRODUCT 0090 Operation not allowed with a Free Rental
product
VOD_RENTAL_PPV 0091 Operation not allowed with a VOD Rental
product
PPT_PRODUCT 0092 Operation not allowed with a Pay Per Time
product
BAD_SECRET_CODE 0093 The secret code is incorrect
BAD_VERIFICATION_CODE 0094 The verification code is incorrect
BAD_THIRD_PARTY 0095 The third party is unknown
BAD_PARAM_IN_CASDB 0096 SAS is wrongly configured and cannot
properly handle the SMS command for the
specified UA.
BAD_CATEGORY_FORMAT 0097 The format of the category is incorrect
BAD_SUBCATEGORY_FORMAT 0098 The format of the subcategory is incorrect
BAD_FREE_PRODUCT_MODE 0099 The free product mode contains an
unauthorized value
BAD_PRODUCT_CAT_FORMAT 0100 The format of the product category is
incorrect
BAD_NB_FREE_PROD_FORMAT 0101 The format of the number of free product
is incorrect
BAD_NETWORK_FORMAT 0102 The format of the network ID is incorrect
BAD_STB_CONTEXT_FORMAT 0103 The format of the STB context is incorrect
BAD_PURCHASE_MODE 0104 The purchase mode contains an
unauthorized value
BAD_CONDITIONAL_ID_FORMAT 0105 The format of the conditional ID is
incorrect
BAD_ONLINE_PURCHASE_MODE 0106 The online purchase mode contains an
unauthorized value
BAD_SYNCHRO_TYPE 0108 The format of the synchro_type field
is incorrect.
CIPHERING_ERROR 0109 The CAS is not able to cipher the request.
PRODUCT_NOT_AUTHORIZED 0110 This product is not allowed for this SMS
source.
BAD_CHIPSET_ID_FORMAT 0113 The format of the chipset ID specified in
ASP_PROFILE_ID_NOT_AUTHORIZED 0115 The ASP profile ID is not authorized
according to CAS configuration
ALREADY_PAIRED_WITH_STB 0116 The smart card is already paired with the
given STB on another slot.
EXPIRATION_DATE 0117 Indicates that the problem lisetd in the
error code relates to the expiration date
SCHEDULE_DATE 0118 Indicates that the problem listed in the
error code relates to the schedule date
Table 5-2: Error code extensions
6. UA and CA-S/N checksum
This chapter describes the procedure to manage UAs (unique addresses) and CA-S/Ns
(conditional access serial numbers) at the customer site.
6.1 Definitions
The mandatory information to allow a CAS to fully recognize an individual customer is:
UA Unique address of the smart card. This is a 12-digits long number that
uniquely identifies the smart card. The first 10 digits represent the address
itself; the last 2 digits are a checksum allowing the SMS to verify the
number given by the customer. The preferred (but not mandatory) format
is:
nn nnnn nnnn cc This number is printed and bar-coded on the smart card and is normally
accessible through a set-top box menu on the TV screen.
CA-S/N Conditional access serial number. This is a 12-digits long number that
uniquely identifies the set-top box for the conditional access system. The
first 10 digits represent the serial number; the last 2 digits are a checksum
allowing the SMS to verify the number given by the customer. The
preferred (but not mandatory) format is:
nn nnnn nnnn cc This number may be printed (and possibly bar-coded) on a sticker on the
set-top box and is normally accessible through a set-top box menu on the
TV screen.
This number may differ (and usually differs) from the manufacturing S/N,
which identifies the set-top box for the manufacturer himself. We had to
use a common format throughout the system and different numbers for all
set-top boxes whatever the format chosen by the manufacturer.
6.2 Pairing operation

The pairing only applies to STBs with a Nagravision CAK. Therefore, it does not apply to STBs
with a MediaGuard CAK (this could change in the future).
The pairing operation links a smart card with a set-top box. The pairing operation is mandatory.
Without the pairing operation, the end user’s STB does not work and IRD commands cannot be
forwarded by the smart card to the STB.
There are two types of pairing:

 Secure channel (no pairing command needs to be sent, global operator pairing).
 Strong pairing:
 With soft hardware pairing,
 With chipset hardware pairing.
For strong pairing:

 The end user will communicate his UA and his CA-S/N (and optionally his chipset ID, in cases
where there is chipset hardware pairing and where the CAS cannot retrieve the accurate
value) to the SMS during the installation process. Those numbers may be filled in the
contract or in any place the customer finds suitable for this purpose.
The pairing key(s), which is used to effectively prevent the use of a smart card in another set-
top box, is provided in the Nagravision system.
6.3 Data files

Nagravision usually provides the customer with files containing the list of the smart cards
produced. Those files contain a list of UA. They are given by production box (250 smart cards)
and/or by production batch (indeterminate number of boxes in one file).
On the other hand, the set-top box manufacturer has the responsibility to provide files
containing the list of set-top boxes effectively produced. Those files must contain a list or range
of CAS/N. If needed by the customer, those files may provide a link between the CAS/N and the
manufacturing S/N for each box, but this is not requested by the Nagravision system.
Nagravision may possibly provide the range of CAS/N allocated for each manufacturer but has
no view on what is effectively produced.
6.4 CA-S/N – Pairing keys

The CA-S/N is chosen by Nagravision and provided to the set-top box manufacturer, each of
them associated with a pairing key. This pairing key is a system security element and must not
be known by the end user, by the customer, or by any unauthorized people at the
manufacturing site. Thus this pairing key must not appear on any support (label, screen, paper,
accessible memory, file…). A violation of this rule is a severe security breach and may induce
Nagravision into litigation actions.
6.5 Checksum algorithm

The following C routine describes the formula used for the computation of the checksum:
unsigned char calcCheckSum (unsigned long SN)

{
return ((6*(SN/100000000L)+19*(SN/10000000L%10)+
8*(SN/10000L%1000)+(SN/100L%100))%23+
(SN%100))%100;
}
7. ASCII Table
Decimal Hex Binary Value

00 00 00000000 NUL (Null char.)
32 20 00100000 SP (space)
33 21 00100001 ! (exclamation mark)
34 22 00100010 “ (double quote)
35 23 00100011 # (number sign)
36 24 00100100 $ (dollar sign)
37 25 00100101 % (percent)
38 26 00100110 & (ampersand)
39 27 00100111 ‘ (single quote)
40 28 00101000 ( (left/opening parenthesis)
41 29 00101001 ) (right/closing parenthesis)
42 2A 00101010 * (asterisk)
43 2B 00101011 + (plus)
44 2C 00101100 , (comma)
45 2D 00101101 - (minus or dash)
46 2E 00101110 . (dot)
47 2F 00101111 / (forward slash)
48 30 00110000 0
49 31 00110001 1
50 32 00110010 2
51 33 00110011 3
52 34 00110100 4
53 35 00110101 5
54 36 00110110 6
55 37 00110111 7
56 38 00111000 8
57 39 00111001 9
58 3A 00111010 : (colon)
59 3B 00111011 ; (semi-colon)
60 3C 00111100 < (less than)
61 3D 00111101 = (equal sign)
62 3E 00111110 > (greater than)
63 3F 00111111 ? (question mark)
64 40 01000000 @ (AT symbol)
65 41 01000001 A
66 42 01000010 B
67 43 01000011 C
68 44 01000100 D
69 45 01000101 E
70 46 01000110 F
71 47 01000111 G
72 48 01001000 H
73 49 01001001 I
74 4A 01001010 J
75 4B 01001011 K
76 4C 01001100 L
77 4D 01001101 M
78 4E 01001110 N
79 4F 01001111 O
80 50 01010000 P
81 51 01010001 Q
82 52 01010010 R
83 53 01010011 S
84 54 01010100 T
85 55 01010101 U
86 56 01010110 V
87 57 01010111 W
88 58 01011000 X
89 59 01011001 Y
90 5A 01011010 Z
91 5B 01011011 [ (left/opening bracket)
92 5C 01011100 \ (back slash)
93 5D 01011101 ] (right/closing bracket)
94 5E 01011110 ^ (caret/cirumflex)
95 5F 01011111 _ (underscore)
96 60 01100000 `
97 61 01100001 a
98 62 01100010 b
99 63 01100011 c
100 64 01100100 d
101 65 01100101 e
102 66 01100110 f
103 67 01100111 g
104 68 01101000 h
105 69 01101001 i
106 6A 01101010 j
107 6B 01101011 k
108 6C 01101100 l
109 6D 01101101 m
110 6E 01101110 n
111 6F 01101111 o
112 70 01110000 p
113 71 01110001 q
114 72 01110010 r
115 73 01110011 s
116 74 01110100 t
117 75 01110101 u
118 76 01110110 v
119 77 01110111 w
120 78 01111000 x
121 79 01111001 y
122 7A 01111010 z
Table 7-1: ASCII Table
8. Examples
8.1 Device_IO connection establishment

The following example is a network capture of one whole Device_IO connection process.
Packet #1 Flags:
0x00
Status:0x01 Packet Length:64
Timestamp: Ethernet Header18:04:12.473073 10/09/2001

Destination: Source: Protocol Type:
08:00:2B:C5:7E:2A
00:C0:F0:3D:7F:9D
0x0800 IP
IP Header - Internet Protocol Datagram Version:4
Header Length:5 (20 bytes) Type of Service:%00000000
Precedence: Routine,Normal Delay,Normal Throughput,Normal Reliability Total Length:44
Identifier:63087
Fragmentation Flags: %010 Do Not FragmentLast Fragment Fragment Offset:0 (0 bytes)
Time To Live:128
Protocol:6 TCP - Transmission Control Protocol
Header Checksum:0x82E9 Source IP Address:192.168.0.31
Dest. IP Address:192.168.0.3
No IP Options
TCP - Transport Control Protocol
Source Port: Destination Port: Sequence Number: Ack

1090Number:
ff-fmsOffset:
Reserved: Code: Window: Checksum: 20000 sms_gateway
Urgent Pointer: TCP Options: 55594
Option Type: Length: MSS: 0
6 (24 bytes)
%000000
%000010 Synch
8192
0xCB26
0
2 Maximum Segment Size 4

1460
TCP Data Area:No more data.

Extra bytes (Padding):
..00 00
FCS - Frame Check Sequence
FCS (Calculated):0x5FAFB276
Listing 8-1: Device_IO connection

CONFIDENTIAL

Version 1.0.0 Draft
Packet #2 Flags: Status:

0x00
0x01
Packet Length:64
Timestamp:18:04:12.473409 10/09/2001
Ethernet Header
Destination:00:C0:F0:3D:7F:9D
Source:08:00:2B:C5:7E:2A
Protocol Type:0x0800 IP
Identifier:56682
Time To Live:60
Header Checksum:0xDFEE Source IP Address:192.168.0.3
No IP Options
Source Port: Destination Port: Sequence Number: Ack

20000
Number:
sms_gateway
Offset:
Reserved: Code: Window: Checksum: 1090 ff-fms
Urgent Pointer: TCP Options: 1524200406
Option Type: Length: MSS: 55595
6 (24 bytes)
%000000
%010010 Ack Synch
33580
0x9939
0
2 Maximum Segment Size 4

1460
TCP Data Area:No more data.

..00 00
FCS (Calculated):0x36B97026

0x00
0x01
Packet Length:64
Timestamp:18:04:12.473450 10/09/2001
Ethernet Header
Destination:08:00:2B:C5:7E:2A
Source:00:C0:F0:3D:7F:9D
IP Header - Internet Protocol Datagram
Version: Header Length: 4
Type of Service: Precedence: Routine, Total Length: Identifier: Fragmentation
5 (20
Flags:
bytes)
Fragment Offset: Time To Live: Protocol:
Header Checksum: Source IP Address: Dest. IP Address: %00000000
Normal Delay,Normal Throughput, 40 Normal Reliability
63343
%010 Do Not FragmentLast Fragment
0 (0 bytes) 128
6 TCP - Transmission Control Protocol 0x81ED

192.168.0.31
192.168.0.3
No IP Options
Source Port: Destination Port: Sequence Number:1090
Ack Number:
ff-fms Offset:
Reserved: 20000 sms_gateway
Code: 55595
Window: Checksum: Urgent Pointer: No TCP Options
1524200407
TCP Data Area:
Extra bytes (Padding): 5 (20 bytes)
%000000
%010000 Ack
8760
0x11EB
0
No more data.
......00 00 00 00 00 00
FCS (Calculated):0x62217FDC
Listing 8-1 Device_IO connection (cont.)
CONFIDENTIAL
0x00
0x01
Packet Length:69
Timestamp:18:04:12.485934 10/09/2001
Ethernet Header
Identifier:63599
Time To Live:128
Header Checksum:0x80E2 Source IP Address:192.168.0.31
No IP Options
Source Port: Destination Port: Sequence Number: 1090

Ack Number:
ff-fms Offset:
Reserved: Code: Window: Checksum: 20000 sms_gateway
Urgent Pointer: No TCP Options 55595
1524200407
5 (20 bytes)
%000000
%011000 AckPush
8760
0xC9C3
0
SMSgateway spec. 2.6.2 - decoder v.0.8 DeviceIO: message_1

len:9
op_mode:1 Fast data transfer (do not allow tracing)
ob_name_len:7
ob_name:SMS_GWY FCS - Frame Check Sequence
FCS (Calculated):0xC6762DDA

0x00
0x01
Packet Length:64
Timestamp:18:04:12.486303 10/09/2001
Ethernet Header
Destination:00:C0:F0:3D:7F:9D
Source:08:00:2B:C5:7E:2A
Identifier:56683
Time To Live:60
Header Checksum:0xDFEE Source IP Address:192.168.0.3
No IP Options

Ack Number:
sms_gateway
Offset:
55606
5 (20 bytes)
%000000
%011000 AckPush
33580
0xAADF
0

len:1
value:6
...00 00 00
FCS (Calculated):0xBDB648A1
0x00
0x01
Packet Length:64
Timestamp:18:04:12.640961 10/09/2001
Ethernet Header
Identifier:63855
Time To Live:128
Header Checksum:0x7FED Source IP Address:192.168.0.31
No IP Options

Ack Number:
ff-fms Offset:
Code: 55606
1524200410
TCP Data Area:
%000000
%010000 Ack
8757
0x11E0
0
No more data.
......00 00 00 00 00 00
FCS (Calculated):0xB161CF21
Packet #7 Flags:
0x00
Status:0x01 Packet Length:64
Timestamp: Ethernet Header18:04:12.641152 10/09/2001

Destination: Source: Protocol Type:
00:C0:F0:3D:7F:9D
08:00:2B:C5:7E:2A
0x0800 IP
Identifier:56686
Time To Live:60
Header Checksum:0xDFEB Source IP Address:192.168.0.3
No IP Options

Ack Number:
sms_gateway
Offset:
55606
5 (20 bytes)
%000000
%011000 AckPush
33580
0xB0DC
0

len:1
value:0
...00 00 00
FCS (Calculated):0x77CEA603
CONFIDENTIAL

Version 1.0.0 Draft

0x00
0x01
Packet Length:64
Timestamp:18:04:12.841621 10/09/2001
Ethernet Header
Identifier:65135
Time To Live:128
Header Checksum:0x7AED Source IP Address:192.168.0.31
No IP Options

Ack Number:
ff-fms Offset:
Code: 55606
1524200413
TCP Data Area:
%000000
%010000 Ack
8754
0x11E0
0
No more data.
......00 00 00 00 00 00
FCS (Calculated):0x22659BEF
Listing 8-1 Device_IO connection (cont.)
8.2 Example of command 52

Raw data:
Listing 8-2: Example of command 52
CONFIDENTIAL
Whole network packet, interpreted:
Figure 8-1: Entire network packet
—— END OF DOCUMENT ——
Glossary
Term Definition Description

ANI Automatic Number Also known as caller id
Identification
CAS Conditional Access System A generic term for a system used in pay
television.
CC Call Collector This is the sub-system of the CAS managing the
callback coming from the STB
DVB Digital Video Broadcasting DVB is a family of international standards for all
program delivery media: satellite, cable,
terrestrial, microwave, MDS, CATV, and SMATV.
EBNF Extended Backus-Naur Form A formal mathematical way to describe a
language
EMM Entitlement Management Carries data from the system to one or many
Message smart cards.
ICC Integrated Circuit Card Smart card
IPPV Impulse Pay Per View A PPV event product, which can be impulsively
purchased through the STB and results in the
acquisition of the related entitlement needed in
the SMART CARD.
ITM Interactive Transaction Manager This is the new name of the Call Collector
MOP Management Operator The operator who manages end users and
entitlements.
NVOD Near Video On Demand.
PA Positive Addressing
PPV Pay Per View
Product Product A single or group of services or events that may
be purchased as a single entity.
SAS Subscriber Authorization This is the sub-system of the CAS that converts
System the SMS command to EMM
SMS Subscriber Management System
SMSgw SMS Gateway SMSgw is an application and an interface
described in this document.
SOP Smart card Operator The operator who manages the system itself
(such as the creation of new MOPs, etc.).
STB Set-Top Box The decoder installed at the end user’s home
STU See STB
UA Unique Address This is the id or number of the smart card
UTC Coordinated Universal Time Formerly known as GMT (Greenwich mean
time).
Data formats
Format Description Samples Data
hex Raw hexadecimal 19 or 13(hex) in 2 bytes 0x00:0x13
value 88564006 or 0x05:0x47:0x61:0x26
05476126(hex) in 4 bytes
HHMMSS time hour-min-sec 102500 (10h25 and 00 0x31:0x30:0x32:0x35:0x30:0x30
represented in sec)
ASCII
ip_num human As an example the IP 0x30:0x30:0x31:0x2E:0x31:0x31
representation of an address 1.112.25.2 must :0x32:0x2E
IP address. The be formatted as: 0x30:0x32:0x35:0x2E:0x30:0x30
length is fixed to 15 001.112.025.002 :0x32
bytes (4 x 3-digit
num value
separated with dot
characters).
num numerical value 206 0x32:0x30:0x36
represented in
ASCII.
num_x hexadecimal 6A10F9 0x36:0x3A:0x31:0x30:0x3F:0x39
numerical value
represented in
ASCII.
r_num numerical value see num samples
represented in
ASCII. The range is
restricted.
r_num_x hexadecimal value see num_x samples
represented in
ASCII. The range is
restricted.
r_p_num numerical value see p_num samples
represented in
ASCII and padded
with space
characters. The
range is restricted.
p_num numerical value 206 (the value is a string 0x32:0x30:0x36:0x20:0x20
represented in of 5 digit, 3 significant digit
ASCII and padded and padded with 2 space
with space characters)
characters.
r_text any text N as No 0x4E
represented in Y as Yes 0x59
ASCII characters.
The range is
restricted.
text any text SMS_GWY 0x53:0x4D:0x53:0x5F:0x47:0x5
represented in 7:0x59
ASCII characters.
YYYYMMDD date year-month- 20030518 (18 May 2003) 0x32:0x30:0x30:0x33:0x30:0x35
day represented in :0x31:0x38
ASCII.

SasGwyDLK2 1Spe010000Approved

Uploaded by

Copyright:

Available Formats

SasGwyDLK2 1Spe010000Approved

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

SasGwyDLK2 1Spe010000Approved

Uploaded by

Copyright:

Available Formats

Nagravision SMS Gateway

Interface Definition: HE DLK 2.1STD CAS (EIS 2.7)

Filename SasGwyDLK2 1Spe010000A.docx

Interface Definition: HE DLK 2.1STD CAS (EIS 2.7)

Copyright © 2014 Nagravision. All rights reserved.

The information contained in this document is subject to change without notice.

Security Policy of Nagravision Kudelski Group

6. UA and CA-S/N checksum...................................................................108

How to use this document

Chapter 2: System overview and communication protocols

Chapter 3: SMS-SMSgw connection

Chapter 4: SMS commands

Chapter 5: Error codes

Chapter 6: UA and CA-S/N checksum

Chapter 7: ASCII Table

Chapter 8: Error! Reference source not found.

2.1 Purpose of the SMSgw

SMS SMS Set-Top-Box

Figure 2-1: CAS overview

2.2 Communication protocols

Figure 2-2: SMSgw protocol – communication layers

2.2.2 TCP/IP protocol

Reading an incomplete message:

Reading one complete message:

Reading more than one message:

2.2.3 Device_IO protocol

The content of the payload section is described in the following chapters.

2.2.4 SMSgw protocol

The SMSgw protocol defines the application-oriented message. It is a high-level protocol in

2.3 Device_IO communication

Communication is established through entry points called services. An application establishes

For Device_IO communication between applications running on different machines,

2.3.2 Establishing a connection with a Device_IO server

SMS computer CAS computer

SMS DeviceIO server

Figure 2-3: Device_IO connection establishment and data exchange phases

An example of a Device_IO connection can be found in section 8 Examples (page 113).

2.3.4 Closing a connection with a Device_IO server

The connection is closed when communication is closed at TCP level.

2.3.5 Rules of use

2.3.6 Messages format

2.3.7 Message_1 (connect to the CAS)

2.3.8 Message_2 (answer 1 from the CAS)

2.3.9 Message_3 (answer from the CAS)

2.3.10 Message_5 (Cmd message from the SMS or the CAS)

This message must contain only one SMSgw command.

The data section of message_5 follows the structure shown below:

SMS Nagra SMSgw

Figure 3-1: Connections between the SMS and the SMSgw

EMM & Control channel Nagra SMSgw

Figure 3-2: Multi SMS connections

3.2 EMM/Control command flow

3.3.1 Source identifier

3.3.2 Transaction number

3.3.3 Keeping the SMS connection alive

3.3.4 Establishing the SMS connection

4.1.1 Commands and responses

4.1.2 Asynchronous by nature

4.3 Time and date

4.5 Special notes