Configuration Manual

Configuration Manual
Cryptoguard AB Östermalmsgatan 101

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Table of Contents
Configuration Manual ....................................................................................................................................................... 1
INTRODUCTION ................................................................................................................................................................. 2
ABOUT CRYPTOGUARD ...................................................................................................................................................... 2
MODULES .......................................................................................................................................................................... 2
SMS (SUBSCRIBER MANAGEMENT SYSTEM) ...................................................................................................................... 2
ECM GENERATOR .............................................................................................................................................................. 2
EMM INJECTOR .................................................................................................................................................................. 3
SAFETY MODULE ............................................................................................................................................................... 3
PSI/SI MODULE .................................................................................................................................................................. 3
OTA PLAYER MODULE ........................................................................................................................................................ 3
API MODULE ...................................................................................................................................................................... 3
EPG MODULE ..................................................................................................................................................................... 3
ADDITIONAL SUB-SERVERS ............................................................................................................................................... 3
INTERNET .......................................................................................................................................................................... 4
INSTALLATION ................................................................................................................................................................... 4
KICKSTART INSTALLATION ................................................................................................................................................. 5
SERVER SECURITY ............................................................................................................................................................. 5
LOGIN TO CRYPTOGUARD SMS .......................................................................................................................................... 5
SYSTEM CONFIGURATION .................................................................................................................................................. 5
SYSTEM SETUP .................................................................................................................................................................. 6
TIME SETTINGS .................................................................................................................................................................. 7
CARD NUMBER SETTINGS .................................................................................................................................................. 7
OTHER SETTINGS .............................................................................................................................................................. 7
BACKUP ............................................................................................................................................................................. 8
IP SETUP ............................................................................................................................................................................ 9
ROUTES SETUP .................................................................................................................................................................. 9
ACCESS CRITERIAS .......................................................................................................................................................... 11
PAIRING ........................................................................................................................................................................... 12
SERVICE KEYS ................................................................................................................................................................. 13
ACCESS CRITERIA MANAGEMENT .................................................................................................................................... 13
COMMANDS MENU .......................................................................................................................................................... 13
Payment terms ................................................................................................................................................................ 14
Pairing ............................................................................................................................................................................. 14
STREAM STATUS PAGE .................................................................................................................................................... 16
EMM INJECTOR SETTINGS ................................................................................................................................................ 17
CHANNEL PACKAGES ....................................................................................................................................................... 17
COMMON CHANNELS ....................................................................................................................................................... 18
DISMISSAL PERIODS ........................................................................................................................................................ 18
COMBINATION PACKAGE ................................................................................................................................................. 18
HOW TO CREATE A CHANNEL PACKAGE .......................................................................................................................... 18
THE GENERAL SETTINGS OF PACKAGE CREATION PAGE ................................................................................................. 18
OTHER CUSTOMER FEES AND GROUPS ........................................................................................................................... 20
SERVICES ........................................................................................................................................................................ 20
GENERAL SETTINGS OF SERVICE CREATION PAGE .......................................................................................................... 20
ECONOMICAL SETTINGS OF SERVICE CREATION PAGE .................................................................................................... 20
ARTICLES ......................................................................................................................................................................... 21
GENERAL SETTINGS OF ARTICLE CREATION PAGE .......................................................................................................... 21
ECONOMICAL SETTINGS OF ARTICLE CREATION PAGE .................................................................................................... 21
CUSTOMER GROUPS ........................................................................................................................................................ 21
GENERAL SETTINGS OF ARTICLE CREATION PAGE .......................................................................................................... 22
MANAGE PRICE CHANGES ............................................................................................................................................... 23

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
PPV PROGRAMS ............................................................................................................................................................... 23

PPV PROGRAM MANAGER ................................................................................................................................................ 24
MANAGE SYSTEM USERS ................................................................................................................................................. 25
MANAGE SYSTEM ROLES ................................................................................................................................................. 25
IP ACCESS LIST ................................................................................................................................................................ 26

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Configuration Manual
Version: 2.34
Updated: 2018-09-26
Version PDF
2.34 PDF 2.34
2.33 PDF 2.33
Download this latest document as PDF

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
INTRODUCTION
This manual shows you an overview of CryptoGuard system and also how to install and configure CryptoGuard CAS/SMS
server. This manual also shows you how to create TV channels and how to gather them into program packages. It also
explains procedures to create other types of products, such as services, articles and PPV events. All products are handled in
the customer management system to create a basis for billing.
ABOUT CRYPTOGUARD
CryptoGuard is a Conditional Access System (CAS) for digital television. As an operator for DVBC, DVB-T, DVB-S or IPTV you
can be sure that only your paying customers are able to view your TV-channels. CryptoGuard uses a high grade encryption
scheme to meet the demands of service providers today.
Security is a top priority for us. We make sure our components are certified and use our long experience in hardware
solutions to stay ahead of the competition. CryptoGuard uses the standard determined by ETSI (European
Telecommunications Standards Institute) nr ETSI TS 101 197 V1.3.
The CryptoGuard CAS is provided with an integrated owned developed Subscriber Management System (SMS), and API
details are available for any operator to develop or integrate an alternative SMS. The SMS uses an encrypted subscriber
database based on MySQL. The headend security application module is written in C, and uses an ISO7816 smartcard-based
security module to handle cryptographic functions.
Cryptoguard use a state-of-the-art smartcard processor, with hardware protection against SPA/DPA attack, shield protection
against physical attack and light exposure, and detection of voltage, clock frequency, temperature and glitch attacks (chip
countermeasures).
MODULES
CryptoGuard system consists of several modules, and some of them can be separated from main system and installed on
additional servers. This can be done out of redundancy or/and performance reasons. Consult with CryptoGuard about what
the best solutions is for your type of installation.
SMS (SUBSCRIBER MANAGEMENT SYSTEM)
Cryptoguard CAS and SMS are integrated with each other on the same server. Our SMS manages customers, cards and
subscriptions as well as all configurations of the CAS system.
ECM GENERATOR
ECM (Entitlement control message) generator is a standard module of a Conditional Access System. It encrypts the control
words sent from head-end scramblers, and sends the encrypted control word back to the head-end as an ECM, together with
other configurations such Fingerprinting and No Access Message, and from head-end further to the receivers. ECM encrypts
the services through the encrypted control word and control words are changed every configured Crypto Period, normally
every 10 seconds.
ECM generator settings are done in “Configuration→SimulCrypt ECM” settings of CryptoGuard SMS. ECM generator can be
separated from the main server and installed on a sub-server, which communicates with the main server. This can be done
to enhance performance, since ECM generation is the heaviest and most sensitive part of a CAS system. A second ECM

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
server may also be installed out of redundancy reasons, where the head-end scrambler detects if one ECM server goes
down, to automatically connect to second one.
EMM INJECTOR
EMM (Entitlement management message) injector is also a standard component of a Conditional Access System. The system
generates an EMM for every channel key, subscription, PPV event, paired card, message and EMM fingerprint created in the
system. EMM’s are used to decrypt the control words in the STB and in such way decrypt the channel, if authorized to do so.
EMM injector settings are configured in “Configuration→SimulCrypt EMM” settings and can also be installed on a separate
sub-server to ease the burden of the main server.
SAFETY MODULE
Every CryptoGuard server that has ECM or EMM module installed must have a safety module inserted. A safety module is a
USB dongle that is inserted into the server, and secures the system by preventing sensitive information, codes and keys to
leak to eventual hackers. An ECM generator or EMM injector cannot work without the module being inserted into the server,
so thereby always make sure that it is.
PSI/SI MODULE
PSI/SI describes to the recipients how the network is constituted and thereby you can configure channel lists, frequency
tables and program guide in a user friendly interface. It is possible to generate NIT/SDT/SDT-Other/CAT/TDT/TOT/PAT/BAT
and EIT tables via our PSI/SI module. All information is sent from the server as MPEG-2 TS packets.
OTA PLAYER MODULE
This module makes it possible to upgrade the software of your STB's and CA modules Over-The- Air.
API MODULE
Cryptoguard's API module makes it possible to integrate our CAS system with 3rd party systems, such as your own SMS,
CMS or billing system. Functions exist for managing customers, cards and subscriptions as well as controlling other features
of the system.
EPG MODULE
CryptoGuard central EPG server delivers EPG data to the clients by collecting it either from satellite sources, or other source
such as XML feeds. Minimal configuration is required on the client side (your CAS/SMS server).
ADDITIONAL SUB-SERVERS
When your network extends over a larger geographic area with different frequency tables or if you have several head-ends,
it can be necessary to separate components from the main server. An example is an additional PSI/SI server, ECM or EMM
server. Check out other types of additional modules that our system supports in our SMS in Help-

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Modules menu.
INTERNET
The server must have continuous access to internet in order to be able to renew its license and retrieve encryption codes
from central CryptoGuard servers. Always make sure that the server has an internet connection, otherwise it may stop
working after the license have expired. Internet is also required for us to be able to support you, and in order for our
surveillance module to send us messages in case of failures.
Remember that interruptions of your connection do not affect the broadcasting at all. But during the downtime there is a
possibility that you won’t be able to add new smart cards or change the paired IRD's.
MINIMAL SYSTEM REQUIREMENTS
CentOS CentOS7 - 64 bit - x86_64

A Server with at least Xeon 1240 V5 CPU
At least 8 GB RAM
At least 250 GB Hard drive space
At least 1 USB port free (in virtual environment access to the USB port is required)
The server must have continuous access to the Internet.
RECOMMENDED SYSTEM REQUIREMENTS
CentOS CentOS7 - 64 bit - x86_64

A Server with at least Xeon 2620v3 CPU
At least 16 GB RAM
500 SSD HDD
At least 3 USB port free (in virtual environment access to the USB port is required)
The server must have continuous access to the Internet.
INSTALLATION
A Kickstart-DVD for installation of the operating system and CryptoGuard libraries can be found at:
http://www.cryptoguard.se/files
or
https://drive.google.com/open?id=0BydFx2F1_7sVTG9aVXRYX01nc3c
Burn the image on a DVD disc and the installation will start automatically once the server is booted with disc inserted.
Observe that the Kickstart installation will not work when making bootable USB stick. Also be aware of that RAID
configuration cannot be done by installing with our Kickstart-DVD.
If RAID configuration is desired, or you have to install the operating system through a USB stick, then you will have to
download and install a clean copy of CentOS 7 minimal. Observe that the system will not work properly if CentOS 6 is
installed.
A minimum CentOS must be installed with no “X systems” and must include MySQL and web server packages.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
KICKSTART INSTALLATION
1. Always check if newer download is available on http://www.cryptoguard.se/files. Download the file and burn the
image on to a DVD. Note that it does not work with USB.
2. Insert the DVD disc into the server and make sure that server is configured to boot from DVD in BIOS settings.
3. The installation starts and runs approximately between 10 to 20 minutes depending on server hardware.
4. The default root password after installation is “d98hlm7”.
5. When installation is done the network needs to be configured and access to server be granted to CryptoGuard
support team:
ifconfig eth0 x.x.x.x netmask x.x.x.x (Command to configure IP address of eth0)
route add default gw x.x.x.x eth0 (Command to add default gateway on eth0)
Nameserver has to be configured in /etc/resolv.conf, if you do not have your own DNS server, Google’s 8.8.8.8
can be used.
6. Ping 8.8.8.8 and www.google.com to verify that the network is successfully configured.
7. Contact CryptoGuard support team to retrieve a license for the server and to finalize the installation.
SERVER SECURITY
It is very important to keep your server out of reach of unauthorized access. It should be of every operator’s interest to
protect the server from potential attacks from hackers. We strongly recommend the use of firewalls, VPN connections, SSL
certificates and other security approaches in order to make sure that the system is not accessible by unauthorized users.
CryptoGuard cannot be held responsible for security holes in your network, but we are more than willing to help you to make
the server as protected as possible.
Make sure CryptoGuard support team always have the possibility to access the server. Currently access has to be granted to
213.134.106.74 and 77.110.47.79.
Also make sure that outgoing traffic from the server is allowed to p1.cryptoguard.se, p2.cryptoguard.se, epg.cryptoguard.se
and license.cryptoguard.se.
Change root password of the server as soon as possible after installation, and notify us, as well as web administrator login
password.
LOGIN TO CRYPTOGUARD SMS
Use a Web browser, such as Explorer, Chrome or Firefox and enter the IP address of the newly installed server. Always make
sure to have the latest version of your preferred Web browser installed.
If installation was successful, you will see the login screen above. Default username is “admin” and the default password is
“admin”. You should change the admin user’s password as soon as possible to prevent unauthorized access to the system.
SYSTEM CONFIGURATION
The first configuration page after the installation should be the System Configuration page found here:
Below is a screen-shot of System configuration page:

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
SYSTEM SETUP
Site name The name of your site. It is used for showing it on the login-screen, the main title of the site, and in title of the
Web browser.
Next customer number When adding a new customer you can either set the customer number manually, or choose to be
incremented automatically. This setting configures what the “next customer number” will be, when the number is not set
manually. You can set a low value if you want to fill eventual gaps in the customer number series. This setting also exists in
the network configuration page, for possibility to create network-specific customer number series. If “next customer
number” for the network is not set, the system will increment the global customer number from this setting instead.
Currency Configures the currency of your country. The currency is shown on different pages and reports that shows the
price of a product.
Max. length of lists This setting sets the maximum value of how many table rows are listed on each page of our SMS that
displays a list of data. Setting a very high value will cause the pages to render slowly. It is recommended to leave the default
values of 100 rows.
Duplicate customer number check If this flag is checked, which it normally should be, the system will prevent you from
adding multiple customers with the same customer number. Uncheck this flag if requirements of customers with the same
customer number exists.
Skip Saturdays and Sundays If this flag is checked, reports such as Channel Statistics, Package Statistics and Card
Statistics will not generate and display data for weekends. This settings depends a lot of if you sell new subscription on
weekends or not.
Language for user web Configures which language will be displayed when your clients login on the end-customer module,
where they can order new subscriptions, PPV events and check their invoices. End-customer module, if activated on your
server, can be found here:
http://[server_address]/customer_login.php
Billing period The billing period that is pre-selected when adding new customers.
Invoice type The invoice type that is pre-selected when adding new customers.
Invoice renewal period The system renews subscription for a period of time, defined by the period setting in the channel
package settings combined with customer settings. This value sets on how many days before an expire date of a
subscription occurs, the system will renew the subscription for a new period, and generate an invoice row for the new period.
Subscriptions are renewed indefinitely, until an explicit end date is set. It is recommended to leave the default value of 30
days.
EMM renewal date The day of month when the card entitlements will be renewed. The technical renewal of the cards is
done one month at a time. Even if your subscription has an expire date for example 12 month ahead, the card is renewed
only until the end of current or next month, depending on the current date. When the day of month has reached this value,
the system will renew the cards for the following month. One of the reasons why this functionality exists is for example if you
decide to close a subscription immediately from a card, and some hacker is using eventual EMM blockers, the card will not
shut-down. So instead of hackers being able to watch channels for free until the subscription expire date, they will only be
able to watch until the end of month. It is recommended to leave the default value of 15th.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
TIME SETTINGS
Timezone Set the correct time zone settings in order for the system to display correct date and time information.
NTP server Type to which NTP server, the system clock will synchronize to. The server synchronizes the clock every hour.
You can leave the default value as is.
PHP time Displays the date and time configured in the Apache configuration.
Server time Display the date and time configured in the operating system.
Database time Displays the date and time configured in MySQL database configuration. Contact CryptoGuard support team
if date and time of the three values above differs from each other.
LICENSE PARAMETERS
License number This is the license number of your server. This number may be used when contacting CryptoGuard support
team, to identify the server.
License end day Displays the date until the license of the server is valid. License requires internet connection to be
renewed, and is normally renewed one day at a time for one month ahead. Different methods could be applied on different
servers. Once the license expires, you will no longer be able to use the system. A warning will be visible on the start page
when license is about to expire. Always make sure that server has access to internet, and your firewall is allowed to connect
to license.cryptoguard.se for license renewal.
Number of cards Displays the number of active, non-stored, cards that exists on your server.
Number of customers Displays the number of customers that are created in your system.
Number of customers without cards Displays the number of customers that do not contain any active cards.
CARD NUMBER SETTINGS
First card number The lowest card number that is allowed to be added to the system. If customer service tries to add a
number lower than this value, they will get an error message. This way you can prohibit customer service to add invalid card
numbers, by allowing only the range of cards that you have purchased.
Last card number The highest card number that is allowed to be added to the system. If customer service tries to add a
number higher than this value, they will get an error message. This way you can prohibit customer service to add invalid
card numbers, by allowing only the range of cards that you have purchased.
OTHER SETTINGS
API security enabled If API is activated on your server, you can configure if access tokens must be sent with each call for
authorization. Access tokens can be configured for every user of the system.
EMM Total Cleanup Press this button to regenerate EMM’s for all cards. Don’t misuse this functionality, since it creates a
heavy load on the system. It is mainly done by CryptoGuard support team, when the need to regenerate EMM’s of all cards

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
exists.
BACKUP
Note: Since CryptoGuard CAS/SMS Version 2.34, FTP Backup is now located under menu: Configuration → Backup.
The system can automatically backup the database daily to a specified remote server. It is recommended to configure the
values below in order to grant that you have a recent backup of the system in case of unexpected hardware failure. The
system only makes a backup of the database. The source files are available on CryptoGuard’s central servers.
Contact CryptoGuard support team if you have a hardware failure, and need to reinstall the server and restore the latest
backup. When valid settings are made under “Schedule backup → Remote backup” section, the system will automatically
start at given time to backup and transfer to remote host. Verify on your remote server that the files are transferred.
Schedule backup
Remote backup
Protocol The protocol which should be used to transfer the backup.
Host name The IP address of the remote server to backup the data to.
Port The port on the remote server.
User name The username of an remote account of the server.
Password The password of the remote user account.
Destination path The destination path for placing the backup files.
Backup now Perform a manual backup to the remote server using the saved credentials.
Note about FTP-protocol: If the server has already are using the FTP you can still use it for now, but generates a warning
message on the page. FTP support will be discontinued in the future and it is encouraged to use the more secure protocols
SFTP and SCP.
Local backup
Destination path The destination path for placing the backup files on the local server. Optional, otherwise leave blank.
Restore backup

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Upload an encrypted copy of a backup to restore the entire database(s) to the previous state. Contact CryptoGuard if you
are not sure, since restoring a too old copy might the database might get out of sync with the sourcecode. Note that only
encrypted copies with filename like: system.cryptoguard.20180926_010000.tar.gz.enc are supported through this GUI.
IP SETUP
We have made it possible to change IP addresses and route settings of the server though our SMS, without being forced to
do it via console. After the installation is done, IP configuration should be saved on the following page to make the settings
persistent and functional after a restart of the server.
Press this menu item to navigate to IP settings page:
Select the interface for which you want to edit the IP settings. The IP configuration of all interfaces are listed on the IP
settings page, and here is an example of how it may look like:
When clicking on the interface you want to edit you will get following page:
Type Configure if you want to use a static IP address or an address received by your DHCP server. If DHCP is selected, no
more values needs to be edited. Just click “Save” button to exit.
IP Address If static address is used, type it here.
Netmask If static address is used, type the correct netmask address here.
Broadcast If static address is used, type the correct broadcast address here.
After the settings are changed, it could take up to 5 seconds before they take effect. If you have changed the address of the
management interface, then you need to refresh the web page to continue working with the SMS.
Contact CryptoGuard support team if you are uncertain or do not have experience of making network configuration.
There is also a possibility to make vlan configuration through our SMS, by adding vlan to an interface.
ROUTES SETUP
In configuration menu you also have an option to change route settings of the server. All routes created by you, or by the
operating system are listed on this page.
Green light indicates that the route is up and working. A red light means that the route you tried to create is not accepted by
the operating system. You should then delete it and make another try.
When adding new routes it can take up to 5 seconds before they become active in the operating system. They are not
automatically stored to be created after the restart of server. For that, you have to check all routes that you want to make
persistent and press “Save selected to boot files” in the Commands button menu.
If you have a lot of routes glowing red, or for some other reason want to restart the network service of the server, you can

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
press menu item “Restart network service” in the Command button menu. Observe that restarting network service will also
restart ECM and EMM communication with the scrambler and can take up to 30 seconds to take effect.
Press “Add” in the Command menu to create a new route.
Type You can choose from a list of templates what kind of route you want to add. Choosing a template can simplify the
configuration for you, by predefining some values and eventually disables settings not needed to be made.
None = no template is used, type all the values manually.
Default Gateway = template to add the default gateway for the server. Type the correct gateway address and choose which
network interface it applies to. Only one default gateway can be added to the system.
NIT/SDT = template for the PSI/SI part of the system. The predefined values set when selecting this template are optional,
means you should probably change to something else. This route is added to the multicast interface of the server.
OTA = template for over-the-air upgrades of STB firmware’s. The predefined values are recommended to be used, but can
be changed to something else. This route is added to the multicast interface of the server.
Route name The name of this route, which is listed in the Routes setup page.
Network The route address to be added.
Netmask A valid netmask address.
Gateway Can only be changed if Default Gateway.
Contact CryptoGuard support team if you are uncertain or do not have experience of making network configuration.
NETWORK CONFIGURATION
Your customers can be divided into several logical or physical networks. All customers must belong to a network. A network
can be geographical like a region or a city, but it could also be anything else according to your requirements. When sub-
servers are used, normally a network for the sub-server is created. New installations have a predefined network added,
called “Default network”. Some operators place all their customers in one network, some are dividing them in several
networks. You can configure system users to only have access to one particular, or several networks. Those users cannot
see information of customers or products of other networks they don’t have access to.
Edit networks by clicking on the following menu:
Let’s check the properties that can be set for a network:
Network name The name of your network
EMM IP address The address from where the EMM’s are sent to the head-end. Normally 127.0.0.1 if a single CryptoGuard
server is installed, but can be an address to a sub-server if stand-alone EMM server is used.
Next customer number A network could use its own customer number series, that differs from other networks. Leave
empty if the setting from System setup will be used. Check System configuration settings for more information.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Invoice renewal period A network could use its own invoice renewal period. Leave empty if invoice renewal period from
System setup should be used. Check System configuration settings for more information.
Key index Configures which one of the 16 network keys that shall be used for decryption. Never change the default value
without consulting with CryptoGuard support team, otherwise your system may not be able to decrypt channels.
CryptoQAM Subscription EMM Specifies if system should send subscription EMM’s. Should be set to individual if not
otherwise advised by CryptoGuard. Do not change to group EMM without consulting with CryptoGuard first.
CryptoQAM PPV EMM Specifies if system should send PPV EMM’s. Can be inactivated if PPV is not used in your system.
CryptoQAM Pairing EMM Specifies if system should send pairing EMM’s. Should be inactivated if pairing is not used in your
system, so unnecessary EMM’s are not created and prolongs card activation times. If you later decide to turn on pairing on
access criteria’s, activate this setting first so all STB’s receive a pairing EMM. Then after a couple of hours pairing can be
turned on for selected access criteria’s.
Cryptoguard Messaging Specifies if system should send message EMM’s. Normally set to individual.
Cryptoguard Key EMM Specifies if system should send service key EMM’s. Normally set to individual. Do not change to group
EMM without consulting with CryptoGuard first.
You can issue commands for every network by clicking on the commands menu:
Send message Sends message to all cards that belong to this network.
EMM Fingerprint Use this command to send an EMM Fingerprint to all cards that belong to this network. Notice that the
EMM Fingerprint module has to be enabled on your server, otherwise this menu item will not appear in the Commands
menu. Not all STB’s supports this functionality.
Force tuning Use this command to force the STB’s to tune to a specific service on all cards that belong to this network.
Notice that the Force Tuning module has to be enabled on your server, otherwise this menu item will not appear in the
Commands menu. Not all STB’s supports this functionality.
Manage packages You can specify which channel packages are allowed to be added to the cards of this network.
Manage services You can specify which services are allowed to be added to the customers of this network.
Manage articles You can specify which articles are allowed to be added to the customers of this network.
Manage users You can specify which system users are allowed to view information, and manage the products and
customers of this network.
Merge networks It is possible to merge several networks into one network. All customers of the other networks will be
moved to current network.
Remove network Use this command to delete the network. Be careful, since all customers and cards that eventually
belong to the network will also be deleted. You will get a warning after pressing this menu item.
ACCESS CRITERIAS
Next step should be to create access criteria’s for your channels. Let’s begin to explain briefly how a smart card works.
The card must deal with both service keys and to manage customer subscriptions:

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Service keys are loaded into the card at regular intervals and used to decrypt one or more encrypted channels. Sixteen
different service keys can fit on the card simultaneously.
The subscription information is located on the card and tied to a specific TV service. The card is filled on a monthly basis
for the TV services that the customer is entitled to see, according to the explanation of technical renewal date in System
setup
For example, if TV service is refilled on 2015-01-01, it will be written as an end date of 2015-02-01 on the card. If the TV
service is not in the client’s subscription, it will be inserted with a much older date, such as 2000-01-01. See picture below:
Every TV channel should have its own ”position” in the smart card memory, and this location can be described as a box in a
large excel sheet. This ”excel sheet” have 16 rows and 32 columns, so in total there are space for 16 x 32 = 512 television
channels. See picture below:
The image shows the TV channel “TV4+” located in row 5 and column 3, or as the technical expression: AC Index = 5 and AC
bit = 3. This is now the smartcard reference to the television program TV4 +.
When you add new access criteria’s, a hexadecimal code will be generated, and you must use the generated code to
connect the access criteria to a control word group in the scrambler. The first AC you add will generate the code
0x03000001. This code is used in the head-end to scramble services.
While it is normal to have one access criteria for every TV channel, it is also possible for channels to share the same access
criteria, for example if they are always contained in same channel packages. In that case several services in head-end can
be connected to same access criteria.
Keep in mind that the code 0x03000001 is used to scramble the channel, while a combination of AC Index and AC Bit is used
to descramble it.
It is also possible that two or more access criteria’s share the same AC index and AC bit, and in those cases the card will
decrypt all services connected to those access criteria’s, as long as one of them is subscribed. This also means that the
system in practice supports more than 512 access criteria’s.
The smart card updates TV programs in various stages. First it updates the rows 0-3, then 4-7, 8-11 and 12-15, since the
system creates one subscription EMM for every 4 AC Index. To optimize card activation times, you should try to minimize the
amount of EMM being created. This means you should fill up all unused slots on row 0-3, before using AC index 4 and higher.
When row 0 -3 is filled up with 128 access criteria’s, you can continue working with next 128 channels on row 4 – 7, next 128
on 8-11, and so on depending on the amount of channels you are broadcasting.
The most common and most subscribed channels should always be placed in row 0-3 for faster activation.
PAIRING
To prevent that a smart card is shared by more users or STB’s, the card and the STB can be paired to each other. A card can
also be paired with a CA module. All TV channels can individually be programmed to use pairing, or to not use pairing, and
this is done per access criteria. You can configure to force the use of pairing on particular access criteria’s, meaning that
STB’s that do not support pairing will not decrypt the channel, or you can enabled pairing only on supported devices.
It is also able to force that only HD STB’s can work with the particular access criteria. The CA ID must be paired to the card
number, when adding a card to a customer. This should be done even if pairing is not activated on any access criteria’s, to
make it easier to introduce pairing later.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
For a STB you will find the number on the bottom of a paper label. The number uses eleven digits. The image shows an
example of CA ID ”00020008607”. On a CA module, the number is on the reverse side to the label.
SERVICE KEYS
The sixteen different service keys should preferably be allocated to different channels so as to obstruct that the system is
subjected to trial by a ”hacker”. Service keys should also be changed with some regularity in order to prevent a possible
attack.
The CryptoGuard system automatically manages all service keys from system version 2.30, meaning no configuration have
to be made from client side.
ACCESS CRITERIA MANAGEMENT
Click on the following menu to navigate to access criteria page:
Below is an example of how the access criteria list looks like on one of our development servers:
Access criteria name Displays the name of the criteria.
Attr Shows the combination of AC Index and AC Bit. Notice that they are configured from 0-0 to 0-5 as it should be, with no
gaps.
Keys Shows the current service key used, and the one going to be used after the next change of service key.
AC Criteria The generated hexadecimal access criteria. Access criteria’s are generated automatically, and cannot be
changed. Use the generated AC when configuring the scramblers.
Pairing Shows if the access criteria is configured for pairing or not.
IH Shows if the access criteria is inheritable, meaning it is allowed to be added to a twin card.
Payment terms Shows what type of criteria it is. More explanation follows.
Subscribers The amount of cards that subscribes to this criteria. Click on the amount if you want to see all the subscribers.
COMMANDS MENU
Add Click to add a new access criteria.
Edit selected Check all access criteria’s that you want to change data for and click this menu item. When the popup
appears, select all parameters to change and save.
Edit all You are able to change parameters for all access criteria’s by pressing this menu item. Remove selected Deletes all

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
selected access criteria’s.
Export to Excel Exports all data to Excel spread sheet.
ADDING NEW ACCESS CRITERIA
When pressing “Add” menu item the following popup will appear:
Payment terms
All access = All clients with a smart card have access to the channel. “All access” criteria’s cannot be billed and are not
added to any channel packages. This setting is for free channels.
Date access = A pay channel that can be billed and has to belong to a channel package to be decrypted. This is the default
setting.
PPV Event access = A channel that offers Pay-Per-View events. Channel is not added to any channel packages, since it can
only be decrypted by adding PPV events to a smart card.
Unencrypted = All clients have access to this channel, regardless of having a smart card inserted or not.
No access = The channel cannot be decrypted.
Access criteria name Name of the access criteria, such as BBC.
AC Index / AC Bit As already explained, recommended to be a unique combination for every access criteria. Used for
decryption of channels. Don’t make gaps in the series.
Pairing
No pairing = Pairing is not enabled on this access criteria.
Pairing on supported devices = Pairing is required to decrypt the services, if the STB/CAM supports pairing. Cards will not
work on other STB/CAM then they are paired to.
Pairing on all devices = Pairing is always required. STB/CAM that does not support pairing will not be able to decrypt
services. Cards will not work on other STB/CAM then they are paired to.
Pairing on all HD and content control = Pairing is always required. Normally only used for HD channels. STB must
support HDCC and CAM must support CI+.
Start time / Stop time You can configure between which start and stop time during the day the service will be encrypted.
Useful for time-shared access criteria’s, for example when channels shares the same service-ID (SID).
Inherited to second card Specifies if the access criteria is allowed to be added to a connected card. Connected cards, twin
cards, normally shares same subscriptions as main card of the customer.
Adult content A simple parental control feature. If Adult content is selected on the access criteria, and parental lock is
enabled on the card, the channel will not be decrypted. No PIN-codes can be used for this feature. Function removed in CG
CAS/SMS version 2.31.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Fallback Can only be configured for “PPV Event access” criteria’s. Specifies if the criteria will be a “No access” criteria or
connected to some other criteria, when no PPV events are broadcasting on the channel. The criteria can be connected to
other criteria for example if some channel package always decrypts the channel, without the need for the client to pay for an
event.
No access message This value can override the default messages shown when clients have no access to the channel. Such
as, “Call this number xxxxx to buy this channel”.
No access message encoding You should configure a correct character set for your custom defined message, if specified
above.
Team – League Only used by “League/Team access”. Special function, contact CryptoGuard if you are considering offering
clients possibility to subscribe to seasons of sport events.
ECM Fingerprinting parameters are not available on all installations. Contact CryptoGuard if you are interested in ECM
Fingerprinting functionality. With fingerprinting it is possible to display the card number or IRD number on the TV screen in
order to track recorded copyright protected material.
Show Select if card number or/and IRD number will be shown on the screen. Selecting a value will enable the fingerprinting
on the channel.
Position Choose if fingerprinting message will be shown at a fixed position on the screen or randomly.
Position X If fixed position, choose location on the X coordinate.
Position Y If fixed position, choose location on the Y coordinate.
Duration Duration in milliseconds of how long the message will appear on the screen. 0 – 65535.
Repeat Number of minutes between repetitions. 1 – 30. 0 = No repeat.
Font size Specifies the font size of displayed message.
Font color Choose font color to use.
Background color Choose background color to use.
STB control and CI+ parameters are not available on all installations. Contact CryptoGuard if you are interested in these
functionalities. Description of the parameters are beyond the scope of this manual.
ECM GENERATOR SETTINGS
To setup ECM connection between CryptoGuard CAS and head-end scrambler navigate to the following page:
Click the button “Add” to add an IP port that the ECMG should start listening to for incoming connections. The ECMG can
communicate with multiple devices simultaneously and they can all be connected to the same port. You can also choose to
add multiple ports, so every device can connect to its own unique port.
After the page is opened we recommend you to leave the default values as is and just to press “Add” button. Don’t change
the values without consulting with CryptoGuard support team, or if not having a deep knowledge about DVB-SimulCrypt
configuration.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Port A port to start listening to, for incoming connections. Default is 1101.
ECMG delay start Indicates how much pre-plannig to use for a particular Crypto Period (CP), meaning how long before CP
an ECM will be sent. 5000 ms ahead is recommended.
ECMG delay stop Specifies the amount of backlog that shall be used for a particular CP, meaning how long after CP an ECM
will be sent. You should use the same value as in ECMG delay start.
ECMG max comp Specifies an estimated calculation time for an ECM. 8000 ms is recommended.
ECMG rep period Specifies interval between regular posting of the same ECM. 200 ms is recommended interval.
ECMG min CP Defines a minimum frequency of CP. Defined in steps of 100 ms.
ECMG timeout Specifies the time after which an idle connection is closed a timeout will occur, Default is 30 seconds.
ECM packet mode If the ECM will be sent in “Sections” or “TS mode”. “Sections” should be used.
After the configuration is saved, the changes will be applied within 60 seconds. When adding new ECM connections, existing
connections will be restarted. If scrambler settings also are configured, connection should be established within a minute:
A green light indicates that the connection with scrambler is successfully made. A red light means that no connection is still
made, and you will have to check scrambler settings and check if CAS server and head-end scrambler are in the same IP
range, and can communicate with each other through PING.
Existing connections are listed in the second table of the page:
Port = Displays to which IP port a connection is made.
SuperCAS = Displays which SuperCAS is used. Cryptoguard uses SuperCAS 4AEA.
Connected = Shows when the connection was made.
Disconnected = Shows if there was any disconnections made. If connection disconnects, a new connection will be created
if possible, and will be added to a new row in this list.
Timeout = Shows eventual timeouts. Meaning that the ECMG timeout setting has passed and no further connection
attempts was made from scrambler on selected port.
Channel status = Shows latest sent channel status. Notice that not all scramblers send channel status and this value can
be empty on some servers.
Stream status = Shows latest sent stream status. Notice that not all scramblers send stream status and this value can be
empty on some servers.
ECM count = Shows the amount ECM sent, since the connection is made.
Stream status = Shows status of all streams connected, in current ECM connection.
STREAM STATUS PAGE

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Stream status page shows all connected streams. It displays all the access criteria sent from the scrambler, and to which
channel they are connected to. A green light indicates that the access criteria sent is found on the CAS server and
Connected to shows to which access criteria on your server it is connected to. A red light indicates an error in the stream,
and you should check scrambler settings for that stream, such as if correct access criteria is configured. If all streams are
red, try restarting Security and ECMG secure applications from Process control page in Configuration menu and wait couple
of minutes. If that does not help, contact CryptoGuard for assistance.
EMM INJECTOR SETTINGS
To setup EMM connection between CryptoGuard CAS and head-end scrambler navigate to the following page:
The EMM injector can also communicate with several devices simultaneously. Click “Add” button to create a new EMM
connection:
IP Address Type the correct address of the scrambler to connect to.
Port Type the IP port on which the communication will be made. The default value of 1500 is just fine for every connection.
IP port must be unique for each SuperCAS, if several SuperCAS is configured on your server.
SuperCAS Set the SuperCAS used for the connection. CryptoGuard’s SuperCAS is 4AEA, but some exceptions exist for
example if OVL cards are used.
Data Id Set the correct data-id/stream id for the EMMG connection. Same value as used in scrambler. It normally does not
need to be unique for every connection.
Stream test delay The stream test delay in seconds. It is recommended to leave the default value of 10 seconds.
Channel test delay The channel test delay in seconds. It is recommended to leave the default value of 10 seconds.
EMM Bandwidth Specifies the bandwidth in Kbps that can be used for EMM. Default is 100 and do not change this value
before consulting with CryptoGuard support team first.
EMM packet mode Specifies if “Sections” or “TS Mode” will be used in EMM communication.Configure Sections unless
otherwise advised.
EMM constant bitrate Specifies if the EMM bitrate will be constant or not. Set always to Off.
After the EMM configuration is created, it can take up to 1 minute before the EMM injector connects and starts sending EMM
to scrambler. It starts sending EMM first after subscriptions exists in the system, and keep in mind that bitrate is very low in
the beginning before considerable amount of cards and subscriptions are created in the system.
There is no status of the connection yet in our SMS, so you will have to check the status in your scrambler instead, if the
provisions are incrementing or not.
CHANNEL PACKAGES
Most TV channels are grouped to be handled jointly with a package of channels. The package can contain anything from zero
TV channels to all TV channels that are used in your network. It is common for all packages that the customer must have a
Cryptoguard smart card to view the channels that it contains.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
A channel package that does not contain any channels at all can be used to debit a monthly card fee. To manage an
individual channel by direct debit, you can create a package with content of only one TV channel.
The packages are sorted into groups, this in order to prevent the customer service (or the customer himself) to add the
same kind of channel package to the same card. Only one package of a group can be added to the same card. When one of
the packages is added to the card, the other packages of the same group will no longer be visible. There are several reasons
to why you should group packages:
COMMON CHANNELS
If there are common TV channels in two packages, such as ”Basic Package” and ”Premium Basic Package ”, these packages
should have the same package number to avoid customer service to add both packages to a card. See image below:
DISMISSAL PERIODS
A package of channels can have different pricing for different periods. A”Family Package” with joint TV channels but with
different periods should use the same package number.
COMBINATION PACKAGE
In this example different versions of packages are shown. The ”Canal Plus Package“ with two different periods, ”TV1000
Package” and the joint package ”Maxfilm Package” with two different periods. All these five packages should all have the
same group number:
HOW TO CREATE A CHANNEL PACKAGE
Example: Let’s add a basic package of public TV channels for a certain network. Click the ”Channel packages” menu under
”Products”. Select button “Add” to the right.
THE GENERAL SETTINGS OF PACKAGE CREATION PAGE
Package name Specifies the package name, the name that your customer service will see.
Network Select which networks this package is allowed for. Package will only be visible when managing customers of
selected networks.
Invoice period Number of months invoice period is valid for. Observe that if the invoice period in customer settings is set to
a higher value, that value will be applied. The highest value is always applied.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Dismissal period Number of month that must pass before the client can end the package, after the initial dismissal period
has passed.
Initial dismissal period Number of months the customer has agreed to pay for the package. Initial dismissal period and
dismissal period are added to original start date to calculate and display the “First dismiss” field in cards management page,
but the field is only for informational purpose, customer service can end packages whenever.
Price Specifies the price of the package per month in configured currency. (Currency is set in ”System Configuration”
settings). Price 0 will be shown as “Free” in the lists. After the package is created, the price can no longer be changed on the
channel package page. Price changes are configured on “Manage price changes” page.
Rounded invoice rows If checked, system will round invoice row amounts to whole numbers.
Package group Group number of the channel package. Customer service cannot add more than one package of the same
group number to a customer. If group number 0 is specified, customer service can add multiple packages to the same
customer.
Permit subscriptions Normally selected. Means that this package can be managed by customer service. If the package is
temporarily blocked, you can uncheck this box.
Permit subscriptions via API Normally selected. Means that the package can be managed via API.
Add package if a new card is created If selected, then the package is automatically added when a new card is added to a
customer.
Delayed start Delaying the start of this package in X months and Y days after creation. Means that the billing of the
product and decryption of channels will occur after the delay has passed.
Automatic stop Stops this package X month and Y days after it has been created. Used often for “Free entitlement” and
promotion packages.
Definition package Configures if the package is a customer definition package or not. When customer definition package,
channels to subscribe to are chosen after the card is added. This parameter is for creation of “Favorite channels”, where the
end-user choses which channels to subscribe to. Number of channels that the package allows is set in the setting below.
Definition package, number of channels Configures how many channels are allowed to be subscribed to if it is a
customer definition package.
Dependencies Here you can select if the channel package has any dependencies, meaning that other channel packages
must be added to the card in order to add this one.
Automatic packages You can configure if other packages will be added together automatically,when current package is
added to the card.
Cubiware package offer If Cubiware’s middleware solution is enabled on your server, choose which middleware
entitlement to connect this package to.
Visible in contract If contract module is enabled on your server, set if this package is allowed to be printed on the contract
After channel package is created it is time to select which channels the package will decrypt. If it is a customer definition
package, then channels that are allowed to choose from are configured:

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
OTHER CUSTOMER FEES AND GROUPS
As a TV operator, there are other contributions you want to bill a customer – even the customers who do not have a digital
TV offering. These other charges are divided as ”Services”, ”Customer Groups” and ”Articles”. Services are used if other fees
are to be added. They are usually unrelated to digital television programming and could be used for Internet billing and
other charges. These fees are periodic, as they are recurrently billed in configured intervals. All periodic fees are added as
services and do not require that the client has a smart card.
Customer Groups are selected group of costumers at your choice without the need of a customer´s smart card. The billing (if
any) must be handled manually. For instance you can save all customers that end their subscription in the same group.
Articles are non-recurring charges, such as charging for a set-top box, installation fee, etc.
SERVICES
A service is a periodic charge without requiring that the customer uses a Cryptoguard smart card. Press the “Services” under
“Products” and then press “Add”.
You will see the following popup-menu:
GENERAL SETTINGS OF SERVICE CREATION PAGE
Service name The name of the service. Customer service will see this name when adding products to a customer.
Network Choose to which networks this service is allowed to be added.
Price Specifies the price of the service per month in configured currency. (Currency is set in ”System Configuration”
settings). Price 0 will be shown as “Free” in the lists. After the service is created, the price can no longer be changed on the
services page. Price changes are configured on “Manage price changes” page.
Rounded invoice rows If checked, system will round invoice row amounts to whole numbers.
Visible in contract If contract module is enabled on your server, set if this service is allowed to be printed on the contract
Permit subscriptions via API Normally selected. Means that the service can be managed via API.
ECONOMICAL SETTINGS OF SERVICE CREATION PAGE
Service invoice name The name that will be printed on invoice rows, exported to external billing systems and shown when
retrieving data from API functions.
Account number Used to connect the service with an account on external billing system.
Article number Used to connect the service with an article on external billing system.
Entity The entity to be printed on invoice rows and exported to external billing systems.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
Exclude from invoice Set this flag if no invoices should be created for this service.
Full month debit If invoice rows will be synchronized monthly. Adding a one-month service 2015-01-11 with this flag set,
will generate the first invoice row until 2015-01-31. If flag is not set, the first invoice row will be generated until 2015-02-10.
Allow manual prices If this setting is set, customer service can enter a manual price when adding the service to a
customer. Otherwise the price is constant and cannot be changed.
ARTICLES
An article is billed as a one-time charge without requiring the customer to have a smart card. Press “Articles” under
”Products”, and press “Add article”. You will see the following menu:
GENERAL SETTINGS OF ARTICLE CREATION PAGE
Article name The name of the article. Customer service will see this name when adding article to a customer.
Network Choose to which networks this article is allowed to be added.
Price Specifies the price of the article in configured currency. (Currency is set in ”System Configuration” settings). Price 0
will be shown as “Free” in the lists. After the article is created, the price can no longer be changed on the article page. Price
changes are configured on “Manage price changes” page.
ECONOMICAL SETTINGS OF ARTICLE CREATION PAGE
Article invoice name The name that will be printed on invoice rows, exported to external billing systems and shown after
retrieving data from API functions.
Account number Used to connect the article with an account on external billing system.
Article number Used to connect the article with an article on external billing system.
Exclude from invoice Set this flag if no invoices should be created for this article.
CUSTOMER GROUPS
You can sort your customers into different groups that you create yourself. The groups can be used to charge different fees
where, unlike TV subscriptions they do not require that the customer has a smart card. The groups can also be used to sort
different types of customers, such as those who have terminated their subscription, separate them by region, or group them
by any other criteria.
You can also execute commands to every customer group.
Press the ”Customer group” under Packages”, and then “Add”:

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
GENERAL SETTINGS OF ARTICLE CREATION PAGE
Name Name of the customer group.
Period Invoice period that will be displayed on created invoice rows. Keep in mind that customer groups are not periodically
invoiced, so this value may be changed when you plan to debit your groups.
ECONOMICAL SETTINGS OF ARTICLE CREATION PAGE:
Price Specifies the price when debiting a customer group, in configured currency. (Currency is set in ”System Configuration”
settings). Price 0 will be shown as “Free” in the lists. Unlike other products, price changes are done directly when editing a
customer group, instead of on Manage price changes page.
Account number Used to connect the customer group debit with an account on external billing system.
Article number Used to connect the customer group debit with an article on external billing system.
When clicking on the Commands button on customer group page the following commands are found:
Debit customer group Use this command when you want to debit all customers of the current group. Type the invoice text
when the popup form appears and click the Debit button. Invoice rows will be created for all customers of the group.
Invalidate cards Use this command when you want to temporary invalidate all cards that belongs to the customers of the
group. Invalidated cards do not have access to any channels, except for channels configured as All access. This command is
most often used for customers that have not paid their invoices.
Revalidate cards Use this command when you want to revalidate all cards, that have previously been invalidated.
Parental lock on Use this command to enable the parental lock on all cards that belong to the customers of the group.
Parental lock off Use this command to disable the parental lock on all cards that belong to the customers of the group.
Store cards Use this command to remove all cards from all customers of the group. Stored cards lose all their subscriptions
and are removed from the customers into a stored state. Stored cards can be found in the Cards→Stored cards menu. Be
careful before executing this command, you have to be really sure that you want to remove all the cards.
EMM Fingerprint Use this command to send an EMM Fingerprint to all cards of the customers in the group. Notice that the
EMM Fingerprint module has to be enabled on your server, otherwise this menu item will not appear in the Commands
menu. Not all STB’s supports this functionality.
Force tuning Use this command to forcing the STB’s to tune to a specific service on all cards of the customers in the group.
Notice that the Force Tuning module has to be enabled on your server, otherwise this menu item will not appear in the
Commands menu. Not all STB’s supports this functionality. Send message Use this command if you want to send a short or
a long message to all cards of the customers of this group. The message will appear on the TV screen. Regenerate EMM Use
this command if you want send new signal to all the cards that belong to the customers of this group.
Remove customer group Use this command if you no longer have the need for this customer group and you want to

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
delete it. Only the customer group will be deleted, not the cards or the customers that belong to the group.
MANAGE PRICE CHANGES
This module is used to change the price of channel packages, services and articles.
The page can be found in the menu below:
Click “Add” button to create a new price change:
Following popup will display:
Product Select which product type to change price for, a channel package, a service or an article.
Channel package/Service/Article Select which product to change price for.
Change Price change can either occur immediately, or at a specific date.
Date If you choose to change price on a specific date, type the date here.
Old price Shows the current price of the product.
New price Type the new price. New price will be changed on the date configured above.
Change applies This settings is only available for channel packages. Choose if the new price is only valid for new
customers created after the change of price, or if it is also applied on existing customers.
Keep old price on products with initial dismissal period This settings is only available for channel packages. If set,
price change will only occur on subscriptions where the initial dismissal period has passed.
Update price on current invoice rows Select if you also want to change price on invoice rows already created, but not
yet debited.
PPV PROGRAMS
A ”Pay-Per-View“ program is created from a TV channel for a certain start- and stop time and at a certain date. Press the
“PPV program” to create a marketable product of a particular television broadcast, such as a sports broadcast or a feature
movie.
Click “Add” to add new PPV event:
Program name Type the name of the event.
Start time Type the start time, not necessarily when the event begins, but when the decryption of the channel will occur for

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
those who have ordered the event.
Stop time Type the stop time, not necessarily when the event ends, but when the decryption of the channel will end for
those who have ordered the event.
Parental level Not yet used.
Channel Choose on which channel the event is broadcasted. You can only select from access criteria’s configured as “PPV
Event Access”.
Account number Used to connect the PPV event with an account on external billing system.
Article number Used to connect the PPV event with an article on external billing system.
Price The price of the event for the end customers.
After you create the event, customer service will be able to add it to a card when a customer orders the event.
PPV PROGRAM MANAGER
This is used to control ”Pay-Per-View” events, a recurring television program broadcast at the same time each day, week or
month. You set up rules for how to do this. Press the ”PPV program manager” menu:
Click “Add” to add a new PPV rule:
Program name Type the name of the event.
Start time Type the start time, not necessarily when the event begins, but when the decryption of the channel will occur for
those who have ordered the event. Duration Type duration of the event in minutes, not necessarily when the event ends,
but when the decryption of the channel will end for those who have ordered the event.
Parental level Not yet used.
Channel Choose on which channel the event is broadcasted. You can only select from access criteria’s configured as “PPV
Event Access”.
Account number Used to connect the PPV event with an account on external billing system.
Article number Used to connect the PPV event with an article on external billing system.
Price The price of the event for the end customers.
Choose the recurrence options daily, weekly or monthly and if the occurrence will go on indefinitely or with a certain end
date. After creating the rule the system will start making PPV events out of it, and those events will be shown in PPV
Programs page, and can be added by the customer service to a card after the customer have ordered the event.

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
MANAGE SYSTEM USERS
System supports unlimited amount of users being created, and you can grant different access rights by adding them to
different system roles. Administrator user, with access to the whole system, is predefined and cannot be deleted. You should
as soon as possible after an installation change the Administrator password. You can also change the username admin to
something else if you prefer.
Navigate to following page:
And then click “Add” button to create a new user:
User name The real name of a user, not the user id used to login to the system.
Network Choose which networks this user is allowed to manage.
User id The username used to login to the system.
Password A password for the user. Don’t use short and easy passwords.
Language The language of the web interface for the user.
Theme Choose a color theme for the web interface.
Maximum popup width as a percentage of screen You can tweak this setting to configure the maximum allowed width of
popup window.
After you click “Add button” and the user is created, the following page will appear where you can select which role or roles
the user will be member of. The page lists both the predefined. system roles and your custom defined roles:
Choose the roles and click “Save” button. Now your new system user is successfully created.
MANAGE SYSTEM ROLES
To navigate to manage roles page:
System supports unlimited amount of access roles being created. The system is installed with five predefined roles that
cannot be changed or deleted. Those are:
Administrator = Have full access to the system.
Customer service = Have access to those pages that customer service should have access to.
Financial administrator = Have access to all parts of the system except for the configuration parts.
No access = Have no access at all. If you temporarily want to remove access from a user.
Exactly what part of the system the predefined roles have access to, can be checked by pressing on a selected role and

Phone: +46 971-107 35 591 60 MOTALA
Fax: +46 141-20 88 14 SWEDEN
inspecting all pages that are checked.
To create a custom defined role, press “Add” on the manage roles page:
Type the name of the role and optionally a short description. Then select every page and command the role will have access
to. Click on the headers, to see sub-pages. Users that are members of your role will only have access to those pages that
you have defined.
IP ACCESS LIST
If desired, you can grant access to our SMS only to some computers of your local network, or some computers of public
network. An error message will appear if someone without access tries to login to the SMS. This security feature is not
intended to replace firewalls or VPN connections, which we strongly recommend to every of our clients.
Navigate to IP Access List page:
Click “Add” to add new IP rule:
You can add a single IP address, or a range of IP addresses allowed access to the system. Multiple rules can be created. If no
rules are created in the IP Access List, then everyone have access to the system. As soon as you create one rule, then you
deny access to all other IP addresses. This means that you always have to add your own IP-address first, otherwise you will
lock yourself out of the system. Contact CryptoGuard support is such mistake should happen.
From:
http://wiki.cryptoguard.com/ - CryptoGuard Wiki
Permanent link:
http://wiki.cryptoguard.com/cs
Last update: 2018/12/04 08:23

Configuration Manual

Uploaded by

Copyright:

Available Formats

Configuration Manual

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Configuration Manual

Uploaded by

Copyright:

Available Formats

Conﬁguration Manual

Cryptoguard AB Östermalmsgatan 101

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

PPV PROGRAMS ............................................................................................................................................................... 23

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

Download this latest document as PDF

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

SMS (SUBSCRIBER MANAGEMENT SYSTEM)

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

OTA PLAYER MODULE

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

MINIMAL SYSTEM REQUIREMENTS

CentOS CentOS7 - 64 bit - x86_64

RECOMMENDED SYSTEM REQUIREMENTS

CentOS CentOS7 - 64 bit - x86_64

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

LOGIN TO CRYPTOGUARD SMS

Below is a screen-shot of System conﬁguration page:

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

CARD NUMBER SETTINGS

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

Protocol The protocol which should be used to transfer the backup.

Port The port on the remote server.

User name The username of an remote account of the server.

Password The password of the remote user account.

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

Press this menu item to navigate to IP settings page:

IP Address If static address is used, type it here.

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

Press “Add” in the Command menu to create a new route.

None = no template is used, type all the values manually.

Network The route address to be added.

Netmask A valid netmask address.

Gateway Can only be changed if Default Gateway.

Edit networks by clicking on the following menu:

Let’s check the properties that can be set for a network:

Network name The name of your network

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

ACCESS CRITERIA MANAGEMENT

Click on the following menu to navigate to access criteria page:

Access criteria name Displays the name of the criteria.

Pairing Shows if the access criteria is conﬁgured for pairing or not.

Add Click to add a new access criteria.

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

selected access criteria’s.

Export to Excel Exports all data to Excel spread sheet.

ADDING NEW ACCESS CRITERIA

No access = The channel cannot be decrypted.

Access criteria name Name of the access criteria, such as BBC.

No pairing = Pairing is not enabled on this access criteria.

http://wiki.cryptoguard.com/ Printed on 2020/06/01 16:21

Position X If ﬁxed position, choose location on the X coordinate.

Position Y If ﬁxed position, choose location on the Y coordinate.

Repeat Number of minutes between repetitions. 1 – 30. 0 = No repeat.

Font size Speciﬁes the font size of displayed message.