PowerKEY VOD allows the operator to provide secure, encrypted video streams to a particular subscriber over the RF plant. PowerKEY video-on-demand is used in a Cisco cable environment to provide edge-encrypted video-on-demand movies and other content to subscribers. A subscriber can select the content through an on-screen selection and the set-top box (STB) notifies the head-end of the request.

The head-end equipment receives the request from the STB and triggers the Session Resource Manager (SRM) to create an encrypted video session on the Cisco cBR-8. At the same time, the video streamer is triggered to begin streaming the content in a UDP stream to the Cisco cBR-8. The Cisco cBR-8 receives an unscrambled video content, encrypts it using PowerKEY, combines the scrambled stream with other content intended for the RF carrier into a Multi-Program Transport Stream (MPTS), encapsulates it using R-DEPI protocol, and sends it out on Ethernet port to the Converged Interconnect Network (CIN) between the cBR-8 RPHY core and the RPHY Device (RPD).

The Cisco IOS-XE supports PowerKey encryption CA systems, but allows only one encryption type to be installed on the line card. There are two levels in the CA system. The lower level scrambler, which encrypts the actual data streams and the upper level conditional access system, which handles how the control words are transferred from the encrypting device to the decrypting device.

configure terminal cable video encryption
linecard slot/bay ca-system [powerkey] scrambler scrambler-type
exit

PowerKey currently supports DES type of encryption.

For the sessions to be encrypted on the Cisco cBR-8, the Virtual Carrier Groups (VCGs) must be specified as encrypt and the line card must be configured as encrypted. In this way, the operator can choose the carriers on the line card that support encryption and other carriers that support only clear or pre-encrypted sessions. Each encrypted carrier consumes an encrypted carrier license.

For the VCG to be used in a Logical Edge Device (LED) that is configured with the GQI protocol, each RF carrier must be assigned with an output port number. The LED must be configured with the Generic QAM Interface (GQI) protocol in order to support session-based operation.

Note	For PowerKEY VOD, you have to specify the session-based operation.

configure terminal cable video
virtual-carrier-group vcg-name
encrypt
rf-channel channel range tsid tsid range output-port-number port num range 
exit

For the sessions to be encrypted on the Cisco cBR-8, the Virtual Carrier Groups (VCGs) must be specified as encrypt and the line card must be configured as encrypted. In this way, the operator can choose the carriers on the line card that support encryption and other carriers that support only clear or pre-encrypted sessions. Each encrypted carrier consumes an encrypted carrier license.

For the VCG to be used in a Logical Edge Device (LED) that is configured with the GQI protocol, each RF carrier must be assigned with an output port number. The LED must be configured with the Generic QAM Interface (GQI) protocol in order to support session-based operation.

Note	For PowerKEY VOD, you have to specify the session-based operation.

To configure the VCG, complete the following procedure:

configure terminal
cable video
virtual-carrier-group vcg-name
rf-channel channel range tsid tsid range output-port-number port num range
virtual-edge-input ip-address [vrf] vrf name input-port-number number
encrypt 
exit

The Service Distribution Group (SDG) is a collection of one or more RF ports and defines the physical slot/bay/port to be used in a video service. After you configure an SDG, you can bind a VCG to an SDG. The binding connects the carriers defined in the VCG to the physical port listed in the SDG. After binding, a path from the Virtual Edge Input (VEI) is mapped to the RF channels.

configure terminal cable video
  mgmt-intf VirtualPortGroup 0

service-distribution-group sdg1 id 1
    rpd downstream-cable 7/0/0
virtual-carrier-group vcg1 id 1
    service-type narrowcast
    encrypt
    rf-channel 0-10 tsid 1-11 output-port-number 1-11
   
bind-vcg
    vcg vcg1 sdg sdg1

The PowerKEY VOD feature on the Cisco cBR-8 is directed by an external Session Resource Manager (SRM) that creates video sessions in response to a subscriber selecting VOD content to watch on the set top box. You must configure a Logical Edge Device (LED) supporting the GQI protocol on the Cisco cBR-8 to support the PowerKEY VOD.

The LED is configured with the GQI protocol as the LED communicates with an external SRM using the GQI protocol. The GQI protocol supports the creation and deletion of sessions on the carriers owned by this LED.

Note

Use the following command to get the chassis MAC address: Router#show diag all eeprom detail | include MAC Chassis MAC Address : 54a2.740e.2000 MAC Address block size : 1024 Using the Chassis MAC as a basis, increment the least significant number to give a unique identifier (mac-address) for each LED. This number needs to be unique with respect to the GQI server and does not really relate to a true MAC address. Thus, the number is irrelevant, but needs to be unique.

cable video
logical-edge-device led1 id 1
    protocol gqi
      mgmt-ip management ip address
      mac-address mac address from this chassis range
      server ip address of srm
      keepalive retry 3 interval 10
      reset interval 8
      virtual-edge-input-ip ip addr for content input-port-number num
      vcg virtual edge qam name (may be multiple vcgs in an LED)
      active

The PowerKEY encrypted VOD LED is active and communicates with the external SRM device after configuring the encryption type on the line card, VCGs, binding of SDGs, and LED with GQI protocol are completed.

show cable video logical-edge-device name pkvodled
Logical Edge Device: pkvodled 
Id: 1
Protocol: gqi
Service State: Active 
Discovery State: Disable 
Management IP: 1.23.2.10
MAC Address: 54a2.740d.dc99 
Number of Servers: 1
Server 1: 1.200.3.75
Reset Interval: 8
Keepalive Interval: 10
Retry Count:3 
Number of Virtual Carrier Groups: 1 
Number of Share Virtual Edge Input: 1 
Number of Physical Qams: 20
Number of Sessions: 0 
No Reserve PID Range
Virtual Edge Input:
Input Port  VEI        Slot/Bay  Bundle  Gateway 
ID	   IP	     	ID     IP
----------------------------------------------------------------- 
1          174.10.2.1   7/0	-	-

Verify the following:

• The service state of the LED should be active and the other fields must be same as the configured values.

• The connection to the remote SRM should be displayed to ensure that there is a valid network connection to the SRM.

• Execute the show cable video gqi connections command. The following is the sample output when the connection is not established to the SRM:

  LED Management  Server    Connection     Version Event   Reset       Encryption
  ID  IP   	IP	 Status	          Pending Indication  Discovery
  ---------------------------------------------------------------------------------
  1   1.23.2.10  1.200.3.75 Not Connected  0	0        Not Sent     Not Sent
  

  The following is the sample output when the connection is established to the SRM:

  LED Management Server      Connection     Version Event    Reset      Encryption
  ID  IP	  IP	   Status	          Pending  Indication Discovery
  ---------------------------------------------------------------------------------
  1   1.23.2.10  1.200.3.75  Not Connected  2	0	  ACKED	ACKED
  
  

  After the connection is established, the SRM may create encrypted sessions on the carriers of the LED.

• To view the encrypted sessions, use the show cable video session logical-edge-device id led name summary command as shown in the example below:

  show cable video session logical-edge-device id 1summary
  Video Session Summary:
  
  Active        : 1   Init    : 0   Idle      : 0
  Off    	: 0   Blocked : 0   PSI-Ready : 1
  UDP    	: 1   ASM     : 0   SSM	: 0
  Remap  	: 1   Data    : 0   Passthru  : 0
  Total Sessions: 1
  

• The individual session information can be displayed for the entire LED, for a particular port or line card. The details of a single session may be displayed by specifying a session-id or session-name. To display all the sessions on the LED, use the show cable video session logical-edge-device name led name command as shown in the example below:

  show cable video session logical-edge-device name pkvodled
  Total Sessions = 1
  
  Session Output Streaming Session Destination UDP   Output  Input     Output Input
  Id	Port  Type      Type                Port  Program State     State  Bitrate
  ---------------------------------------------------------------------------------
  1048576 1      Remap     UDP     174.101.1.1 4915  1	ACTIVE-PSI ON    732788
  
  Output  Encrypt  Encrypt   Session 
  Bitrate Type     Status    Name
  -----------------------------------
  1715446 PowerKey Encrypted 0x0000000000001
  

If the session is encrypted and transmitted properly, the session is displayed as shown in the above example. The input state is "ACTIVE-PSI". The output state is "ON". For PowerKEY encrypted sessions, the Encrypt Type will be "PowerKey" and the Encrypt Status will be "Encrypted".

If the session is created as a clear session, then the Encrypt Type will be "CLEAR" and the Encrypt Status will be "-".

The following example shows how to configure the service distribution groups and binding:

configure terminal cable video
  mgmt-intf VirtualPortGroup 0

service-distribution-group sdg1 id 1
    rpd downstream-cable 7/0/0
virtual-carrier-group vcg1 id 1
    service-type narrowcast
    encrypt
    rf-channel 0-10 tsid 1-11 output-port-number 1-11
   
bind-vcg
    vcg vcg1 sdg sdg1
logical-edge-device led1 id 1
    protocol gqi
      mgmt-ip 1.22.2.10
      mac-address c414.3c17.e001
      server 1.200.1.189
      keepalive retry 3 interval 10
      reset interval 8
      virtual-edge-input-ip 174.102.1.1 input-port-number 1
      vcg vcg2
      active