Doomsday clock ticks for millions of 'PowerKEY' set-tops

North American cable operators have less than a year to figure out a remedy for millions of older set-tops outfitted with "PowerKEY" security that are poised to go on the blink because their internal clocks will roll over next November.

To help manage what could be a costly issue for the cable industry, suppliers such as Vantiva, Synamedia and Adara Technologies have developed fixes designed to salvage at least a subset of those devices. Meanwhile, cable operators such as Comcast and Charter Communications have also developed plans to rescue some legacy set-tops or swap them out with new video devices.

As first reported by Light Reading last year, some 20 million set-tops and digital transport adapters (DTAs) that use PowerKEY security technology originally developed by Scientific Atlanta will effectively time out and become inoperable when their internal clocks roll over on November 24, 2024, due in part to memory limitations in the secure microprocessors that keep time. The epoch/start time for PowerKEY's clock goes back to January 1, 1993 – around the time cable operators stated to develop QAM-based digital video services that could spar against emerging satellite TV competition from Dish/EchoStar and DirecTV.

A PowerKEY multi-stream CableCARD security module used in set-tops and some older cable-ready TV models and TiVo boxes outfitted with CableCARD slots. (Source: Petiatil/Wikimedia Commons)

Though the clock turnover date for PowerKEY devices is still about a year away, suppliers have encouraged operators to have a fix in place as early as next August.

Related:Time warp could cause millions of old 'PowerKEY' set-tops to go on the blink

Operators, suppliers in fix mode

Among the nation's largest operators, Charter and Comcast say they are well prepared to deal with the issue.

"We have made significant progress replacing equipment for the very small population of set-top boxes not eligible for a remote code upgrade and are on track to mitigate any potential impact for customers well in advance of the November 2024 deadline," a Charter official said in an emailed statement.

Comcast has begun to deploy software and firmware updates that will enable the operator to keep "some" of those older PowerKEY boxes operational, a Comcast spokesperson said. "Any remaining impacted devices will be swapped out in early 2024," the official added.

Suppliers with exposure to the PowerKEY clock issue say they have remedies available that can cover at least a portion of the legacy base.  

Vantiva, which acquired Cisco's set-top business in 2015 (before Vantiva was spun out of Technicolor), has built image updates for the bulk of PowerKEY devices in the field, said Jim Potts, Vantiva's SVP of North American sales.

That solution has been in customer labs for at least six months, and one customer has already begun to deploy it, he said.

Related:Comcast Pursuing $35 Digital Dongle

Potts said the new image addresses the rollover date for the "vast majority" of set-tops with PowerKEY-based CableCARD security modules, including the Gen 2 and Gen 3 versions. There are a small number of Gen 1 versions in the field that aren't addressed by the new software images, he said.

Vantiva has also developed updated code for older DTAs – simple, one-way channel zappers originally used by operators to fuel their analog-to-digital video transitions – that use some base elements of PowerKEY.

A Cisco-made digital transport adapter (Source: ML4.com)

Vantiva currently is unable to salvage older interactive digital cable set-tops that use embedded PowerKEY security. Those boxes are a bit more complex because the underlying code, which goes back many years, would have to be modified. "We're not able to address those at this time," Potts said.

Vantiva is working with Synamedia on some of these fixes because both companies hold critical pieces of the PowerKEY puzzle. Vantiva owns the elements of PowerKEY contained in the set-top, including decryption. Synamedia, meanwhile, has responsibility for the encryption and control plane pieces – components that stem from Synamedia's 2018 acquisition of Cisco's video software unit.

Synamedia confirmed it's working with customers to upgrade the control plane to keep PowerKEY devices running and on schedule. "Through our collaboration with Vantiva, rollouts at several sites are complete and others are proceeding as planned," Meir Lehrer, Synamedia's senior director, product management, video network, said in an emailed statement.

Vantiva is selling licenses of the new images, based on the number of devices addressed and the number of different images required by cable operators.

Fishing out old passwords

It's taken "thousands of man-hours" to create these fixes, Potts said. "There's still a lot to do, but we're happy we've been able to come up with a solution that we feel will address the needs out there," he added.

Vantiva has maintained some PowerKEY expertise in-house, even though the base code hasn't been touched in years. The company also has refreshed a PowerKEY lab and even brought some people out of retirement to lend a hand.

But Vantiva has had to go to special lengths to retrieve some parts of PowerKEY's past.

Resolving the DTA issue represented a particularly tough task. It turns out that DTA code resided in a database protected by a password that Vantiva had trouble locating internally. The company eventually retrieved that password (Light Reading confirmed it was not "Joshua") from a retiree living in the mountains of north Georgia who thankfully remembered it, Potts said.

"It was a bit hairy, but the good news is that we've been able to piece it all together and have a solution," he said.

An alternative approach

Adara Technologies, a Canadian company that relies on PowerKEY set-tops to deliver and support video services for dozens of cable operators, is also making progress with a solution of its own.

Adara claims it can help operators recover the full generation of PowerKEY devices based on an approach that spoofs the controller time clock in a way that won't cause the underlying condition access system to time out. The company also claims its approach is designed to resolve the problem independent of what generation of PowerKEY is present.

"Our solution enables the operator to not have to deal with that mishmash and patchwork" of multiple generations of PowerKEY, Adara CEO Joseph Nucara said.

Nucara noted that Adara has also figured out how to iron out some critical complications. For instance, the updated back office needs to tell the other apps and services in the set-top, such as the emergency alert system and content authorization mechanisms, to realign with the current date.

"If [the set-top] thinks it's 2015, you won't get [video service] authorization," he pointed out.

Nucara said Adara has been engaged with operators for months about how to fix the PowerKEY time warp issue. Adara hasn't announced any takers by name, but Nucara said a tier 1 service provider along with dozens of multiple smaller cable operators, including a few that already use Adara's hosted video platform, have made commitments.

Update: ImOn Communications, a company that serves about 13,000 subscribers in Cedar Rapids, Iowa, is among the first operators to work with Adara to salvage the operations of thousands of set-top boxes and DTAs from Scientific-Atlanta, Cisco and Technicolor. That work is being built into a broader three-year support agreement between ImOn and Adara.

Impact on IP video transitions

Salvaging these legacy devices with new software and clock spoofing are just two ways to resolve the issue. Some operators might skip that step by removing them in the field and replacing them with new devices.

The PowerKEY clock issue might also give operators reason to accelerate their migration to IP-based video services and eventually shut down the older QAM-based video platforms and redeploy that spectrum towards DOCSIS-based services.

Potts noted that a majority of the service providers Vantiva works with have already launched some type of IP video platform. "In some cases, it [the PowerKEY issue] may have sped up their plans," he said.

Notably, some operators have exited the pay-TV business completely, placing most of their focus on broadband and ceding video to various third-party streaming options. Cable One, already indifferent to ongoing pay-TV subscriber losses, has already acknowledged it is in the "final stages of decline in our video product."

Nucara warned that a forced IP video migration approach could be disruptive and cause some video customers – perhaps 5% of them – to churn.

That could serve as the "proverbial straw that breaks the camel's back" and cause customers to go elsewhere for video… and even broadband, he said. For some operators, that could equate to tens of millions of dollars of lost revenues and profits, he added.