The image to the left is a multi-stream Scientific Atlanta CableCard. Click on the image for a detailed view. The bottom layer is fairly bare and largely un-interesting component wise.

If you look carefully at the images you’ll see that the PCB wasn’t perfectly flat on the scanning surface. A mild annoyance I’ve noticed when doing other scanning projects. My quest for fast and easy board scanning solutions continues.

I picked up this board to compare it with a previous card I’d examined a few weeks ago. This card was sourced from eBay, two card for $10 incl. shipping.

Its handy to have multiple devices for testing and inspection - especially when they’re so cheap.

Design Expectations

Prior to opening this card, I expected to see the same old story of secure design. That is, BGA components, buried traces, little or no test points. IE. Little or no opportunity for tampering with the design. I was wrong, this hardware is visually much more interesting.

Components

• MT 48LC4M16A2 64Mb SDRAM - Datasheets available
• ST M29W160EB 16Mbit parallel flash - Datasheets available
• SLE88CFX2921P Infineon security processor - Quote: “Chip Card & Security ICs SLE88CFX2921P for Highest-End Security Applications 292 Kbyte Flexible EEPROM 16 Kbyte RAM 32-Bit ROM-less Microcontroller tailored for highest-end security applications with powerful Memory Management & Protection Unit and 1408-bit Crypto Engine (Crypto@1408) designed in 0.13m CMOS Technology By Infineon Technologies Corporation”
• ST 4014163 - Assumed to be a general media processor and the main SOC. I can’t find any significant detail on this, although my assumptions is that’s its a generic ARM with support for DES and other A/V capabilities.

Initial thoughts…

• Why didn’t SA choose BGA packages and follow the CableLabs secure design considerations?
• Why are the traces on the top and bottom layers easily accessible with reasonable debugging tools?
• No onboard battery when compared to Motorola CableCards. Why not? What makes this design not require permanent power vs the Motorola competing product? Curious.

Note the interesting set of pads top right of the board, suggesting that other revisions of the hardware may contain an ISO-7810 sim card interface, similar to those used in Europe for external security chips on CAM / DVB access cards.

I haven’t tried to power the card up, or to look at any pin activity, or so see whether a HDHomeRun Prime can reliably communicate with the card. That’s a task for another day.