DECE Platform Security Analysis & Recommendations
Total Page:16
File Type:pdf, Size:1020Kb
NDS VideoGuard Connect™ DECE Platform Security Analysis & Recommendations White Paper 19 March 2012 Confidential VGDRM-WHT-514 1.0 NDS and Approved Recipients Total pages: 19 Doc. Title: NDS VideoGuard Connect™ DECE Platform Security Analysis & Recommendations White Paper Doc. No.: VGDRM-WHT-514 Classification: Confidential Revision: 1.0 Restriction: NDS and Approved Recipients Date: 19 March 2012 Customer: Owner: Leonid Sandler Reviewers/ Nick Thexton Approvers: Peter Lynskey Yossi Tsuria Author: Leonid Sandler NDS Limited 2012. All rights reserved. PROPRIETARY AND CONFIDENTIAL. This document may include reference to technologies that use patents (pending or granted) which are owned by NDS Limited or third parties. The use of such patents shall be subject to express written license terms. You shall not copy, disclose, reproduce, store in a retrieval system or transmit in any form or by any means whether in whole or in part this document. NDS Limited accepts no liability and offers no warranty in relation to the use of this document or any technology referenced herein as well as associated intellectual property rights except as it has otherwise agreed in writing. All trademarks and brands are the property of their respective owners, and their use is subject to license terms. Contents Contents 1 Preface ..............................................................................................................4 1.1 Purpose of This Document .............................................................................. 4 1.2 Terminology ..................................................................................................... 4 2 Security Perspective of the OTT Systems....................................................6 2.1 Content Distribution in the Open Internet ..................................................... 6 2.2 Role of the CDNs.............................................................................................. 7 2.3 What are Hackers looking for?........................................................................ 8 2.4 Anti-sharing Regulations................................................................................. 9 2.5 Lessons from the Conditional Access World................................................ 10 2.5.1 Motivation (and potentially expected investment)...................... 10 2.5.2 How Extraction/Stealing of the Keys Works................................ 10 2.5.3 How Distribution of These Keys Works....................................... 11 2.5.4 Conclusions .................................................................................... 11 3 Security Aspects of DECE System ..............................................................13 3.1 DECE Infrastructure Observations ............................................................... 13 3.2 Potential Attacks in DECE Environment...................................................... 13 3.2.1 Attack Scenarios............................................................................. 14 3.3 DECE Software vs. Hardware Security......................................................... 14 4 Introduction of Service Protection..............................................................16 4.1 What is Service Protection?............................................................................ 16 4.2 Service Protection in DECE ........................................................................... 17 5 Service Protection in NDS Implementation..............................................18 5.1 Videoguard Connect Service Protection Features........................................ 18 6 Conclusions ...................................................................................................19 List of Tables Table 1 Terminology ..................................................................................................... 4 VGDRM-WHT-514 1.0 NDS VideoGuard Connect™ Confidential DECE Platform Security Analysis & Recommendations: White Paper Page 3 Preface 1 Preface 1.1 Purpose of This Document This document presents a security analysis and the potential threats on Over the Top (OTT) content distribution systems in general and the Digital Entertainment Content Ecosystem (DECE) environment in particular. It also describes NDS’s proposal to DECE to provide an elevated robustness level solution suitable for HD content distribution on all the current and future client platforms on which DECE operates. The document includes: 1. Generic OTT platform security perspectives outlining the protection system priorities in this arena. 2. DECE specific issues driven by both the technology and the business model of the ecosystem. 3. An extended conceptual proposal for the new security paradigm called the service protection. 4. It also contains a feature set that NDS would provide to fulfill this paradigm. 1.2 Terminology Table 1 lists acronyms and abbreviations used in the document. (Many of the definitions are taken from Wikipedia, http://www.wikipedia.com/.) Table 1 Terminology Term Definition CDN Content Distribution Network CFF Common File Format DECE Digital Entertainment Content Ecosystem DRM Digital Rights Management DVB Digital Video Broadcasting. A suite of internationally accepted open standards for digital television developed by the DVB Project, an international industry consortium. E2E End-to-end HD High Definition. HD+ High Definition profile of DECE VGDRM-WHT-514 1.0 NDS VideoGuard Connect™ Page 4 Confidential DECE Platform Security Analysis & Recommendations: White Paper Preface Term Definition HLS HTTP Live Streaming HN Home Network HTTP Hypertext Transfer Protocol. An application-level protocol for distributed, collaborative, hypermedia information systems. ISP Internet Service Provider MPEG2 TS MPEG Transport Stream NAS Network Attached Storage NAT Network Address Translation OTT Over the Top – content distribution via open Internet utilizing existing general-purpose Internet infrastructure and cloud services. P2P Peer-to-peer distribution model PIFF Protected Interoperable File Format PIPA Protect IP Act QoS Quality of Service SOPA Stop Online Piracy Act UPnP Universal Plug and Play UV Ultra Violet – commercial name for DECE VLC VLC media player, a free software cross-platform multimedia player and framework VOD Video on Demand VPN Virtual Private Network VGDRM-WHT-514 1.0 NDS VideoGuard Connect™ Page 5 Confidential DECE Platform Security Analysis & Recommendations: White Paper Security Perspective of the OTT Systems 2 Security Perspective of the OTT Systems This section provides a generic security-related analysis of the content distribution systems operating in the open Internet. This analysis describes potential problems and attacks that may appear in this environment and presents an analogy to the existing attacks in the Conditional Access (CA) world. 2.1 Content Distribution in the Open Internet DECE operates in the open Internet environment where each client device has the potential of accessing any content asset at any point in time. DECE uses HTTP- based distribution methods involving CDN technologies, but its content is also suitable for peer-to-peer redistribution, ISP caching, private super-distribution, file sharing, etc. It can be considered as a global file system. For as long as content remains encrypted, all these additional distribution methods can’t be considered illegal, , as they just help legitimate clients to gain better access to the data that they are entitled to. However, the security analysis of this situation takes a completely opposite perspective. Practically speaking, this means that encrypted content is available to anybody at any time, which is worse security-wise than traditional broadcast systems, whereby content appears only once at certain times and is protected by hundreds of different keys (key periods). In addition, most of these traditional broadcast systems require special equipment in order to gain access to the signals, unlike the IP networks, where everything attackers and/or consumers need is already available to them. Even though some protection means (aka URL tokenization) is put in place against unauthorized CDN access, they would be absolutely ineffective against P2P, ISP caching and other forms of file sharing. The following section describes the pros and cons of CDN usage in DECE in general, but it is mainly intended to shows that CDNs are not to be used for any role in the protection chain given the amount of effort that would be required to circumvent this kind of protection. Since protection is not only about implementing steps to prevent abuse, but also about taking responsibility that the steps being taken are appropriate, CDNs cannot be held responsible for attacks that bypass them or misuse them. The only technology in place which actually prevents unauthorized access to content in this environment is the security (DRM) technology. VGDRM-WHT-514 1.0 NDS VideoGuard Connect™ Page 6 Confidential DECE Platform Security Analysis & Recommendations: White Paper Security Perspective of the OTT Systems 2.2 Role of the CDNs This section explains the traditional form of usage of the CDN technologies in the OTT ecosystem and their role in the protection chain and shows the weaknesses of this protection scheme at present and going forward. Based in these weaknesses, it is suggested to stop relying on CDNs as part of a content protection mechanism. Later in this document, a separate mechanism will also be suggested to prevent denial of service and