Cisco Remote PHY PowerKEY VOD

PowerKEY Video-on-Demand refers to video content that is chosen by the subscriber and streamed specifically to the subscriber. The content is encrypted using PowerKEY conditional access through a video session that is created on the line card in R-PHY mode on Cisco cBR-8, specifically for each request.

Finding Feature Information

Your software release may not support all the features that are documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. The Feature Information Table at the end of this document provides information about the documented features and lists the releases in which each feature is supported.

Use Cisco Feature Navigator to find information about the platform support and Cisco software image support. To access Cisco Feature Navigator, go to the link http://tools.cisco.com/ITDIT/CFN/. An account at the http://www.cisco.com/ site is not required.

Hardware Compatibility Matrix for Cisco Remote PHY Device


Note

Unless otherwise specified, the hardware components introduced in a given Cisco Remote PHY Device Software Release are supported in all subsequent releases.


Table 1. Hardware Compatibility Matrix for the Cisco Remote PHY Device

Cisco HFC Platform

Remote PHY Device

Cisco GS7000 Super High Output Node

Cisco 1x2 / Compact Shelf RPD Software 2.1 and Later Releases

Cisco Remote PHY Device 1x2

  • PID—RPD-1X2=

Cisco 1x2 / Compact Shelf RPD Software 2.1a and Later Releases

Cisco Remote PHY Device 1x2

  • PID—RPD-1X2-PKEY=

Cisco GS7000 Super High Output Intelligent Node (iNode)

Cisco 1x2 / Compact Shelf RPD Software 4.1 and Later Releases

Cisco Intelligent Remote PHY Device 1x2

  • PID—iRPD-1X2=

  • PID—iRPD-1X2-PKEY=


Note

The -PKEY suffix in the PID indicates units that enable the SCTE-55-2 Out-of-Band protocol support.


Information About PowerKEY VOD

The line cards in R-PHY mode on Cisco cBR-8 supports session-based PowerKey VOD. In both RPHY and integrated modes, the Cisco cBR-8 router establishes a GQI Remote Procedure Call (RPC) connection to the Edge Resource Manager (SRM), which may be an Explorer Controller (EC), USRM, or any other session manager. The Cisco cBR-8 supports 40G-R line cards, which can be configured for RPHY.

Configure the PowerKey VOD carriers in a GQI protocol LED. The Virtual Carrier Groups (VCG) in the LED, must be bound to a Service Distribution Group (SDG) with downstream-cable ports (instead of the integrated-cable ports).

Overview of PowerKEY VoD

PowerKEY VOD allows the operator to provide secure, encrypted video streams to a particular subscriber over the RF plant. PowerKEY video-on-demand is used in a Cisco cable environment to provide edge-encrypted video-on-demand movies and other content to subscribers. A subscriber can select the content through an on-screen selection and the set-top box (STB) notifies the head-end of the request.

The head-end equipment receives the request from the STB and triggers the Session Resource Manager (SRM) to create an encrypted video session on the Cisco cBR-8. At the same time, the video streamer is triggered to begin streaming the content in a UDP stream to the Cisco cBR-8. The Cisco cBR-8 receives an unscrambled video content, encrypts it using PowerKEY, combines the scrambled stream with other content intended for the RF carrier into a Multi-Program Transport Stream (MPTS), encapsulates it using R-DEPI protocol, and sends it out on Ethernet port to the Converged Interconnect Network (CIN) between the cBR-8 RPHY core and the RPHY Device (RPD).

How to Configure RPHY PowerKey VOD


Note

To know more about the commands referenced in this section, see the Cisco IOS Master Command List.


Configuring the Encryption Type on the Line Card

The Cisco IOS-XE supports PowerKey encryption CA systems, but allows only one encryption type to be installed on the line card. There are two levels in the CA system. The lower level scrambler, which encrypts the actual data streams and the upper level conditional access system, which handles how the control words are transferred from the encrypting device to the decrypting device.

To specify the type of encryption used to scramble the data streams, complete the following procedure:
configure terminal cable video encryption
linecard slot/bay ca-system [powerkey] scrambler scrambler-type
exit

PowerKey currently supports DES type of encryption.

Verifying the Encryption Configuration

To verify the encryption type of a line card, use the show cable video encryption linecard command as shown in the following example:
show cable video encryption linecard 7/0
Line card: 7/0
CA System	Scrambler
================================
powerkey	des

Configuring the Encrypted Virtual Carrier Groups

For the sessions to be encrypted on the Cisco cBR-8, the Virtual Carrier Groups (VCGs) must be specified as encrypt and the line card must be configured as encrypted. In this way, the operator can choose the carriers on the line card that support encryption and other carriers that support only clear or pre-encrypted sessions. Each encrypted carrier consumes an encrypted carrier license.

For the VCG to be used in a Logical Edge Device (LED) that is configured with the GQI protocol, each RF carrier must be assigned with an output port number. The LED must be configured with the Generic QAM Interface (GQI) protocol in order to support session-based operation.


Note

For PowerKEY VOD, you have to specify the session-based operation.


To configure the VCG, complete the following procedure:
configure terminal cable video
virtual-carrier-group vcg-name
encrypt
rf-channel channel range tsid tsid range output-port-number port num range 
exit

Configuring the Encrypted Virtual Carrier Groups

For the sessions to be encrypted on the Cisco cBR-8, the Virtual Carrier Groups (VCGs) must be specified as encrypt and the line card must be configured as encrypted. In this way, the operator can choose the carriers on the line card that support encryption and other carriers that support only clear or pre-encrypted sessions. Each encrypted carrier consumes an encrypted carrier license.

For the VCG to be used in a Logical Edge Device (LED) that is configured with the GQI protocol, each RF carrier must be assigned with an output port number. The LED must be configured with the Generic QAM Interface (GQI) protocol in order to support session-based operation.


Note

For PowerKEY VOD, you have to specify the session-based operation.


To configure the VCG, complete the following procedure:

configure terminal 
cable video 
virtual-carrier-group vcg-name 
rf-channel channel range tsid tsid range output-port-number port num range 
virtual-edge-input ip-address [vrf] vrf name input-port-number number 
encrypt  
exit 

Verifying the Encrypted Virtual Carrier Groups Configuration

To verify the encrypted VCGs configuration, use the show cable video virtual-carrier-group name command as shown in the example below:

show cable video virtual-carrier-group name vod-grp 


Configuring the Service Distribution Groups and Binding

The Service Distribution Group (SDG) is a collection of one or more RF ports and defines the physical slot/bay/port to be used in a video service. After you configure an SDG, you can bind a VCG to an SDG. The binding connects the carriers defined in the VCG to the physical port listed in the SDG. After binding, a path from the Virtual Edge Input (VEI) is mapped to the RF channels.

The following example shows how to configure the SDGs and binding:
configure terminal cable video
  mgmt-intf VirtualPortGroup 0

service-distribution-group sdg1 id 1
    rpd downstream-cable 7/0/0
virtual-carrier-group vcg1 id 1
    service-type narrowcast
    encrypt
    rf-channel 0-10 tsid 1-11 output-port-number 1-11
   
bind-vcg
    vcg vcg1 sdg sdg1

Configuring the Logical Edge Device and GQI Protocol

The PowerKEY VOD feature on the Cisco cBR-8 is directed by an external Session Resource Manager (SRM) that creates video sessions in response to a subscriber selecting VOD content to watch on the set top box. You must configure a Logical Edge Device (LED) supporting the GQI protocol on the Cisco cBR-8 to support the PowerKEY VOD.

The LED is configured with the GQI protocol as the LED communicates with an external SRM using the GQI protocol. The GQI protocol supports the creation and deletion of sessions on the carriers owned by this LED.


Note

Use the following command to get the chassis MAC address:
Router#show diag all eeprom detail | include MAC
Chassis MAC Address : 54a2.740e.2000
MAC Address block size : 1024

Using the Chassis MAC as a basis, increment the least significant number to give a unique identifier (mac-address) for each LED. This number needs to be unique with respect to the GQI server and does not really relate to a true MAC address. Thus, the number is irrelevant, but needs to be unique.


To configure the Logical Edge Device and GQI Protocol, complete the following procedure:
cable video
logical-edge-device led1 id 1
    protocol gqi
      mgmt-ip management ip address
      mac-address mac address from this chassis range
      server ip address of srm
      keepalive retry 3 interval 10
      reset interval 8
      virtual-edge-input-ip ip addr for content input-port-number num
      vcg virtual edge qam name (may be multiple vcgs in an LED)
      active

Verifying the PowerKEY VoD Configuration

The PowerKEY encrypted VOD LED is active and communicates with the external SRM device after configuring the encryption type on the line card, VCGs, binding of SDGs, and LED with GQI protocol are completed.

To verify the Logical Edge Device configuration, use the show cable video logical-edge-device name led name command or the show cable video logical-edge-device id led number command as shown in the example below:
show cable video logical-edge-device name pkvodled
Logical Edge Device: pkvodled 
Id: 1
Protocol: gqi
Service State: Active 
Discovery State: Disable 
Management IP: 1.23.2.10
MAC Address: 54a2.740d.dc99 
Number of Servers: 1
Server 1: 1.200.3.75
Reset Interval: 8
Keepalive Interval: 10
Retry Count:3 
Number of Virtual Carrier Groups: 1 
Number of Share Virtual Edge Input: 1 
Number of Physical Qams: 20
Number of Sessions: 0 
No Reserve PID Range
Virtual Edge Input:
Input Port  VEI        Slot/Bay  Bundle  Gateway 
ID	   IP	     	ID     IP
----------------------------------------------------------------- 
1          174.10.2.1   7/0	-	-

Verify the following:

  • The service state of the LED should be active and the other fields must be same as the configured values.

  • The connection to the remote SRM should be displayed to ensure that there is a valid network connection to the SRM.

  • Execute the show cable video gqi connections command. The following is the sample output when the connection is not established to the SRM:
    
    LED Management  Server    Connection     Version Event   Reset       Encryption
    ID  IP   	IP	 Status	          Pending Indication  Discovery
    ---------------------------------------------------------------------------------
    1   1.23.2.10  1.200.3.75 Not Connected  0	0        Not Sent     Not Sent
    
    The following is the sample output when the connection is established to the SRM:
    
    LED Management Server      Connection     Version Event    Reset      Encryption
    ID  IP	  IP	   Status	          Pending  Indication Discovery
    ---------------------------------------------------------------------------------
    1   1.23.2.10  1.200.3.75  Not Connected  2	0	  ACKED	ACKED
    
    

    After the connection is established, the SRM may create encrypted sessions on the carriers of the LED.

  • To view the encrypted sessions, use the show cable video session logical-edge-device id led name summary command as shown in the example below:
    show cable video session logical-edge-device id 1summary
    Video Session Summary:
    
    Active        : 1   Init    : 0   Idle      : 0
    Off    	: 0   Blocked : 0   PSI-Ready : 1
    UDP    	: 1   ASM     : 0   SSM	: 0
    Remap  	: 1   Data    : 0   Passthru  : 0
    Total Sessions: 1
    
  • The individual session information can be displayed for the entire LED, for a particular port or line card. The details of a single session may be displayed by specifying a session-id or session-name. To display all the sessions on the LED, use the show cable video session logical-edge-device name led name command as shown in the example below:
    show cable video session logical-edge-device name pkvodled
    Total Sessions = 1
    
    Session Output Streaming Session Destination UDP   Output  Input     Output Input
    Id	Port  Type      Type                Port  Program State     State  Bitrate
    ---------------------------------------------------------------------------------
    1048576 1      Remap     UDP     174.101.1.1 4915  1	ACTIVE-PSI ON    732788
    
    Output  Encrypt  Encrypt   Session 
    Bitrate Type     Status    Name
    -----------------------------------
    1715446 PowerKey Encrypted 0x0000000000001
    

If the session is encrypted and transmitted properly, the session is displayed as shown in the above example. The input state is "ACTIVE-PSI". The output state is "ON". For PowerKEY encrypted sessions, the Encrypt Type will be "PowerKey" and the Encrypt Status will be "Encrypted".

If the session is created as a clear session, then the Encrypt Type will be "CLEAR" and the Encrypt Status will be "-".

Configuration Examples

This section provides configuration examples for the PowerKEY VOD feature:

Example: Configuring Encryption Type on the Line Card

The following example shows how to create a management IP interface:
configure terminal cable video encryption
linecard 6/0 ca-system powerkey scrambler des 
exit

Example: Configuring Encrypted Virtual Carrier Groups

The following example shows how to configure the QAM channels from 64 to 158. These channels are encryption capable once the VCG is successfully bound to a Service Distribution Group. The sessions created on these QAM carriers are encrypted using the scrambler installed on the line card.
configure terminal cable video
virtual-carrier-group RPC_VCG 
encrypt
rf-channel 20-47 tsid 20-47 output-port-number 20-47 
virtual-edge-input-ip 174.102.1.1 input-port-number 1
exit

Example: Configuring Service Distribution Groups and Binding

The following example shows how to configure the service distribution groups and binding:

configure terminal cable video
  mgmt-intf VirtualPortGroup 0

service-distribution-group sdg1 id 1
    rpd downstream-cable 7/0/0
virtual-carrier-group vcg1 id 1
    service-type narrowcast
    encrypt
    rf-channel 0-10 tsid 1-11 output-port-number 1-11
   
bind-vcg
    vcg vcg1 sdg sdg1
logical-edge-device led1 id 1
    protocol gqi
      mgmt-ip 1.22.2.10
      mac-address c414.3c17.e001
      server 1.200.1.189
      keepalive retry 3 interval 10
      reset interval 8
      virtual-edge-input-ip 174.102.1.1 input-port-number 1
      vcg vcg2
      active

Feature Information for Rmote PHY PowerKEY VoD

Use Cisco Feature Navigator to find information about the platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to the www.cisco.com/go/cfn link. An account on the Cisco.com page is not required.


Note

The following table lists the software release in which a given feature is introduced. Unless noted otherwise, subsequent releases of that software release train also support that feature.


Table 2. Feature Information for RPHY PowerKEY VoD

Feature Name

Releases

Feature Information

Remote PHY PowerKEY VoD

Cisco 1x2 / Compact Shelf RPD Software 3.1

This feature was integrated into Cisco Remonte PHY Device.