VOD-SVOD-EST-Paytv Content Protection Schedule V1.1.6, C-B

0d59d0bbc8fbacf74380534a5f4e55c7.doc

SCHEDULE C [VOD-EST-PAYTV]

CONTENT PROTECTION REQUIREMENTS AND OBLIGATIONS

This Schedule C is attached to and a part of that certain [______Agreement, dated ______(the “Agreement”), between/among ______]. All defined terms used but not otherwise defined herein shall have the meanings given them in the Agreement.

General Content Security & Service Implementation

Content Protection System. All content delivered to, output from or stored on a device must be protected by a content protection system that includes digital rights management, conditional access systems and digital output protection (such system, the “Content Protection System”).

The Content Protection System shall: (i) be approved in writing by Licensor (including any upgrades or new versions, which Licensee shall submit to Licensor for approval upon such upgrades or new versions becoming available), (ii) be fully compliant with all the compliance and robustness rules associated therewith, and (iii) use only those rights settings, if applicable, that are approved in writing by Licensor. (iv) be considered to meet sections 1 (“Encryption”), 2 (“”Key Management”), 3 (“Integrity”), 5 (“Digital Rights Management”), 10 (“Protection against hacking”), 11 (“License Revocation”), 12 (“Secure Remote Update”), 16 (“PVR Requirements”), 17 (“Copying”) of this schedule if the Content Protection System is an implementation of one the content protection systems approved by the Digital Entertainment Content Ecosystem (DECE), and said implementation meets the compliance and robustness rules associated with the chosen DECE approved content protection system. The DECE approved content protection systems are: a. Marlin Broadband b. Microsoft Playready c. CMLA Open Mobile Alliance (OMA) DRM Version 2 or 2.1 d. Adobe Flash Access 2.0 (not Adobe’s Flash streaming product) e. Widevine Cypher ®

1. Encryption.

1.1. The Content Protection System shall use cryptographic algorithms for encryption, decryption, signatures, hashing, random number generation, and key generation and the utilize time-tested cryptographic protocols and algorithms, and offer effective security equivalent to or better than AES 128 (as specified in NIST FIPS-197) or ETSI DVB CSA3.

1.2. The content protection system shall only decrypt streamed content into memory temporarily for the purpose of decoding and rendering the content and shall never write decrypted content (including, without limitation, portions of the decrypted content) or streamed encrypted content into permanent storage..

1.3. Keys, passwords, and any other information that are critical to the cryptographic strength of the Content Protection System (“critical security parameters”, CSPs) may never be transmitted or permanently or semi- permanently stored in unencrypted form. Memory locations used to 0d59d0bbc8fbacf74380534a5f4e55c7.doc

temporarily hold CSPs must be securely deleted and overwritten as soon as possible after the CSP has been used.

1.4. If the device hosting the Content Protection System allows download of software then decryption of (i) content protected by the Content Protection System and (ii) CSPs (as defined in Section 2.1 below) related to the Content Protection System shall take place in an isolated processing environment and decrypted content must be encrypted during transmission to the graphics card for rendering

1.5. The Content Protection System shall encrypt the entirety of the A/V content, including, without limitation, all video sequences, audio tracks, sub pictures, menus, subtitles, and video angles. Each video frame must be completely encrypted.

2. Key Management.

2.1. The Content Protection System must protect all CSPs. CSPs shall include, without limitation, all keys, passwords, and other information which are required to maintain the security and integrity of the Content Protection System.

2.2. CSPs shall never be transmitted in the clear or transmitted to unauthenticated recipients (whether users or devices.

3. Integrity.

3.1. The Content Protection System shall maintain the integrity of all protected content. The Content Protection System shall detect any tampering with or modifications to the protected content from its originally encrypted form.

3.2. Each installation of the Content Protection System on an end user device shall be individualized and thus uniquely identifiable. [For example, if the Content Protection System is in the form of client software, and is copied or transferred from one device to another device, it will not work on such other device without being uniquely individualized.]

4. The Licensed Service shall prevent the unauthorized delivery and distribution of Licensor’s content (for example, user-generated / user-uploaded content) and shall use reasonable efforts to filter and prevent such occurrences.

Digital Rights Management

5. Any Digital Rights Management used to protect Licensed Content must support the following:

5.1. A valid license, containing the unique cryptographic key/keys, other necessary decryption information, and the set of approved usage rules, shall be required in order to decrypt and play each piece of content.

5.2. Each license shall bound to either a (i) specific individual end user device or (ii) domain of registered end user devices in accordance with the approved usage rules.

5.3. Licenses bound to individual end user devices shall be incapable of being transferred between such devices. 0d59d0bbc8fbacf74380534a5f4e55c7.doc

5.4. Licenses bound to a domain of registered end user devices shall ensure that such devices are only registered to a single domain at a time. An online registration service shall maintain an accurate count of the number of devices in the domain (which number shall not exceed the limit specified in the usage rules for such domain). Each domain must be associated with a unique domain ID value.

5.5. If a license is deleted, removed, or transferred from a registered end user device, it must not be possible to recover or restore such license except from an authorized source.

5.6. Secure Clock. For all content which has a time-based window (e.g. VOD, catch-up, SVOD) associated with it, the Content Protection System shall implement a secure clock. The secure clock must be protected against modification or tampering and detect any changes made thereto. If any changes or tampering are detected, the Content Protection System must revoke the licenses associated with all content employing time limited license or viewing periods.

Conditional Access Systems

6. Any Conditional Access System used to protect Licensed Content must support the following:

6.1. Content shall be protected by a robust approved scrambling or encryption algorithm in accordance section 1 above.

6.2. ECM’s shall be required for playback of content, and can only be decrypted by those Smart Cards or other entities that are authorized to receive the content or service. Control words must be updated and re-issued as ECM’s at a rate that reasonably prevents the use of unauthorized ECM distribution, for example, at a rate of no less than once every 7 seconds.

6.3. Control Word sharing shall be prohibited, The Control Word must be protected from unauthorized access.

Streaming

7. Generic Streaming Requirements

The requirements in this section 7 apply in all cases where streaming is supported.

7.1. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break.

7.2. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state.

7.3. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client.

7.4. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users.

8. Flash Streaming Requirements 0d59d0bbc8fbacf74380534a5f4e55c7.doc

The requirements in this section 8 only apply if the Adobe Flash product is used to provide the Content Protection System.

8.1. Adobe RTMPE is approved for streaming using the following Adobe product versions or later:

8.1.1. Client side: Flash Player 10.0.22

8.1.2. Server side: FMS 3.51 and FMS 3.03

8.2. Licensee will make reasonable commercial efforts to stay up to date with the “then current” versions of the above Adobe products.

8.3. Progressive downloading of licensed content is prohibited.

8.4. Flash Encoded Content (including FLV and F4V file formats) must be streamed using Adobe RTMP-E protocol.

8.5. Flash servers shall be configured such that RTMP-E is enabled, and RTMP is disabled. No content shall be available through both RTMP and RTMP-E.

8.6. Flash Media Servers shall be configured such that SWF Verification is enabled.

8.7. Licensee’s and/or its designated CDN shall implement “Token Authentication”, i.e. mechanism that creates a short-lived URL (approx 3-5 minutes) for content by distributing a “token” to the client only at such a time it is authorized to receive the VOD Stream.

8.8. Licensee must migrate from RTMP-E (stream encryption) to Adobe DRM i.e. Flash Media Rights Management Server successor “Flash Access 2.0” (file- based encryption) or other DRM approved by Licensor in writing within 6 months of the commercial launch of Flash Access 2.0 and be in full compliance with all content protection provisions herein or;.

8.9. Licensee must make reasonable commercial efforts to comply with Adobe compliance and robustness rules for Flash Server products at such a time when they become commercially available.

9. Microsoft Silverlight

The requirements in this section 9 only apply if the Microsoft Silverlight product is used to provide the Content Protection System.

9.1. Microsoft Silverlight is approved for streaming if using Silverlight 2 or later version.

9.2. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class.

9.3. Within 6 months of the commercial launch of Silverlight 4, Licensee shall migrate to Silverlight 4 and be in full compliance with all content protection provisions herein or;.

9.3.1. Within 6 months of the commercial launch of Silverlight 4, Licensee shall migrate to alternative, Licensor-approved DRM/streaming protection technology in full compliance with content protection requirements herein. 0d59d0bbc8fbacf74380534a5f4e55c7.doc

Protection Against Hacking

10. Any system used to protect Licensed Content must support the following:

10.1. Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing.

10.2. The Content Protection System shall employ industry accepted tamper- resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers).

10.3. The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.

10.4. The Content Protection System shall employ tamper-resistant software. Examples of tamper resistant software techniques include, without limitation:

10.4.1. Code and data obfuscation: The executable binary dynamically encrypts and decrypts itself in memory so that the algorithm is not unnecessarily exposed to disassembly or reverse engineering.

10.4.2. Integrity detection: Using one-way cryptographic hashes of the executable code segments and/or self-referential integrity dependencies, the trusted software fails to execute and deletes all CSPs if it is altered prior to or during runtime.

10.4.3. Anti-debugging: The decryption engine prevents the use of common debugging tools.

10.4.4. Red herring code: The security modules use extra software routines that mimic security modules but do not have access to CSPs.

10.5. The Content Protection System shall implement secure internal data channels to prevent rogue processes from intercepting data transmitted between system processes.

10.6. The Content Protection System shall prevent the use of media player filters or plug-ins that can be exploited to gain unauthorized access to content (e.g., access the decrypted but still encoded content by inserting a shim between the DRM and the player).

REVOCATION AND RENEWAL

11. License Revocation. The Content Protection System shall provide mechanisms that revoke, upon written notice from Licensor of its exercise of its right to require such revocation in the event any CSPs are compromised, (a) the instance of the Content Protection System with the compromised CSPs, and (b) any and all playback licenses issued to (i) specific individual end user device or (ii) domain of registered end user devices.

12. Secure remote update. The Content Protection System shall be renewable and securely updateable in event of a breach of security or improvement to the Content Protection System.

13. The Licensee shall have a policy which ensures that clients and servers of the Content Protection System are promptly and securely updated in the event of a 0d59d0bbc8fbacf74380534a5f4e55c7.doc

security breach (that can be rectified using a remote update) being found in the Content Protection System and/or its implementations in clients and servers.

ACCOUNT AUTHORIZATION

14. Content Delivery. Content, licenses, control words and ECM’s shall only be delivered from a network service to registered devices associated with an account with verified credentials. Account credentials must be transmitted securely to ensure privacy and protection against attacks.

15. Services requiring user authentication:

The credentials shall consist of at least a User ID and password of sufficient length to prevent brute force attacks.

Licensee shall take steps to prevent users from sharing account credentials. In order to prevent unwanted sharing of such credentials, account credentials may provide access to any of the following (by way of example):

purchasing capability (e.g. access to the user’s active credit card or other financially sensitive information)

administrator rights over the user’s account including control over user and device access to the account along with access to personal information.

RECORDING

16. PVR Requirements. Any device receiving playback licenses must not implement any personal video recorder capabilities that allow recording, copying, or playback of any protected content except as explicitly specified in the usage rules.

17. Copying. The Content Protection System shall prohibit recording of protected content onto recordable or removable media, except as specified in the agreed usage rules.

Outputs

18. Analogue Outputs.

If the licensed content can be delivered to a device which has analog outputs, the Content Protection System must ensure that the devices meet the analogue output requirements listed in this section.

18.1. The Content Protection System shall enable Macrovision content protection technology on all analog outputs from end user devices. Licensee shall pay all royalties and other fees payable in connection with the implementation and/or activation of such content protection technology allocable to content provided pursuant to the Agreement.

18.2. The Content Protection System shall enable CGMS-A content protection technology on all analog outputs from end user devices. Licensee shall pay 0d59d0bbc8fbacf74380534a5f4e55c7.doc

all royalties and other fees payable in connection with the implementation and/or activation of such content protection technology allocable to content provided pursuant to the Agreement.

19. Digital Outputs.

If the licensed content can be delivered to a device which has digital outputs, the Content Protection System must ensure that the devices meet the digital output requirements listed in this section.

19.1. The Content Protection System shall prohibit digital output of decrypted protected content. Notwithstanding the foregoing, a digital signal may be output if it is protected and encrypted by High Definition Copy Protection (“HDCP”) or Digital Transmission Copy Protection (“DTCP”). Defined terms used but not otherwise defined in this Digital Outputs Section shall have the meanings given them in the DTCP or HDCP license agreements, as applicable.

19.1.1. A device that outputs decrypted protected content provided pursuant to the Agreement using DTCP shall:

19.1.1.1. Deliver system renewability messages to the source function;

19.1.1.2. Map the copy control information associated with the program; the copy control information shall be set to “copy never” in the corresponding encryption mode indicator and copy control information field of the descriptor;

19.1.1.3. Map the analog protection system (“APS”) bits associated with the program to the APS field of the descriptor;

19.1.1.4. Set the image_constraint_token field of the descriptor as authorized by the corresponding license administrator;

19.1.1.5. Set the eligible non-conditional access delivery field of the descriptor as authorized by the corresponding license administrator;

19.1.1.6. Set the retention state field of the descriptor as authorized by the corresponding license administrator;

19.1.1.7. Deliver system renewability messages from time to time obtained from the corresponding license administrator in a protected manner; and

19.1.1.8. Perform such additional functions as may be required by Licensor to effectuate the appropriate content protection functions of these protected digital outputs.

19.1.2. A device that outputs decrypted protected content provided pursuant to the Agreement using HDCP shall:

19.1.2.1. If requested by Licensor, at such a time as mechanisms to support SRM’s are available, deliver a file associated with the protected content named “HDCP.SRM” and, if present, pass such file to the HDCP source function in the device as a System Renewability Message; and 0d59d0bbc8fbacf74380534a5f4e55c7.doc

19.1.2.2. Verify that the HDCP Source Function is fully engaged and able to deliver the protected content in a protected form, which means:

19.1.2.2.1. HDCP encryption is operational on such output,

19.1.2.2.2. Processing of the System Renewability Message associated with the protected content, if any, has occurred as defined in the HDCP Specification, at such a time as mechanisms to support SRM’s are available, and

19.1.2.2.3. There is no HDCP Display Device or Repeater on such output whose Key Selection Vector is in such System Renewability Message at such a time as mechanisms to support SRM’s are available.

20. Exception Clause for Standard Definition, Uncompressed Digital Outputs on Windows-based PCs and Macs running OS X or higher):

HDCP must be enabled on all uncompressed digital outputs (e.g. HDMI, Display Port), unless the customer’s system cannot support HDCP (e.g., the content would not be viewable on such customer’s system if HDCP were to be applied)

21. Upscaling: Device may scale Included Programs in order to fill the screen of the applicable display; provided that Licensee’s marketing of the Device shall not state or imply to consumers that the quality of the display of any such upscaled content is substantially similar to a higher resolution to the Included Program’s original source profile (i.e. SD content cannot be represented as HD content).

Embedded Information

22. Watermarking. The Content Protection System or playback device must not remove or interfere with any embedded watermarks in licensed content.

23. Embedded Information. Licensee’s delivery systems shall “pass through” any embedded copy control information without alteration, modification or degradation in any manner;

24. Notwithstanding the above, any alteration, modification or degradation of such copy control information and or watermarking during the ordinary course of Licensee’s distribution of licensed content shall not be a breach of this Embedded Information Section.

Geofiltering

25. The Content Protection System shall take affirmative, reasonable measures to restrict access to Licensor’s content to within the territory in which the content has been licensed.

26. Licensee shall periodically review the geofiltering tactics and perform upgrades to the Content Protection System to maintain “state of the art” geofiltering capabilities. 0d59d0bbc8fbacf74380534a5f4e55c7.doc

27. Without limiting the foregoing, Licensee shall utilize geofiltering technology in connection with each Customer Transaction that is designed to limit distribution of Included Programs to Customers in the Territory, and which consists of (i) IP address look-up to check for IP address within the Territory and (ii) either (A) with respect to any Customer who has a credit card on file with the Licensed Service, Licensee shall confirm that the country code of the bank or financial institution issuing such credit card corresponds with a geographic area that is located within the Territory, with Licensee only to permit a delivery if the country code of the bank or financial institution issuing such credit card corresponds with a geographic area that is located within the Territory or (B) with respect to any Customer who does not have a credit card on file with the Licensed Service, Licensee will require such Customer to enter his or her home address (as part of the Customer Transaction) and will only permit the Customer Transaction if the address that the Customer supplies is within the Territory.

Network Service Protection Requirements.

28. All licensed content must be received and stored at content processing and storage facilities in a protected and encrypted format using a “state of the art” protection system.

29. Document security policies and procedures shall be in place. Documentation of policy enforcement and compliance shall be continuously maintained.

30. Access to content in unprotected format must be limited to authorized personnel and auditable records of actual access shall be maintained.

31. Physical access to servers must be limited and controlled and must be monitored by a logging system.

32. Auditable records of access, copying, movement, transmission, backups, or modification of content must be securely stored for a period of at least three years.

33. Content servers must be protected from general internet traffic by “state of the art” protection systems including, without limitation, firewalls, virtual private networks, and intrusion detection systems. All systems must be regularly updated to incorporate the latest security patches and upgrades.

34. All facilities which process and store content must be available for Motion Picture Association of America and Licensor audits upon the request of Licensor.

35. At Licensor’s written request, security details of the network services, servers, policies, and facilities that are relevant to the security of the Licensed Service (together, the “Licensed Service Security Systems”) shall be provided to the Licensor, and Licensor reserves the right to subsequently make reasonable requests for improvements to the Licensed Service Security Systems. Any substantial changes to the Licensed Service Security Systems must be submitted to Licensor for approval, if Licensor has made a prior written request for such approval rights.

36. Content must be returned to Licensor or securely destroyed pursuant to the Agreement at the end of such content’s license period including, without limitation, all electronic and physical copies thereof.

High-Definition Restrictions & Requirements

In addition to the foregoing requirements, all HD content is subject to the following set of restrictions & requirements: 0d59d0bbc8fbacf74380534a5f4e55c7.doc

37. Personal Computers HD content is expressly prohibited from being delivered to and playable on General Purpose Computer Platforms (e.g. PCs) unless explicitly approved by Licensor. If approved by Licensor, the additional requirements for HD playback on PCs will include the following:

37.1. Secure Video Paths:

The video portion of unencrypted content shall not be present on any user-accessible bus in any analog or unencrypted, compressed form. In the event such unencrypted, uncompressed content is transmitted over a user-accessible bus in digital form, such content shall be either limited to standard definition (720 X 480 or 720 X 576), or made reasonably secure from unauthorized interception.

37.2. Digital Outputs:

For avoidance of doubt, HD content may only be output in accordance with Section 22 and Section 23 above.

37.3. Hardware Root of Trust

The Content Protection System (CPS) and/or the Approved Device on which the CPS executes shall use a hardware means ("Hardware Root of Trust") which prevents compromise via software attacks, of the Content Protection System. For example, the Hardware Root of Trust may provide some or all of the following functions:

 hardware defences against reverse engineering of software  hardware assisted software tamper resistance  hardware secure key storage (and or key use)  hardware assisted verification of software

37.4. Secure Content Decryption.

Decryption of (i) content protected by the Content Protection System and (ii) CSPs (as defined in Section 2.1 below) related to the Content Protection System shall take place in an isolated processing environment. Decrypted content must be encrypted during transmission to the graphics card for rendering

HD Day & Date Requirements

In addition to the foregoing requirements, all HD content is subject to the following set of content protection requirements:

38. Analogue Sunset.

After December 31, 2011, all Approved Devices shall limit (e.g. down-scale) analog outputs for decrypted protected Included Programs to standard definition at a resolution no greater than 720X480 or 720 X 576.

39. Additional Watermarking Requirements. 0d59d0bbc8fbacf74380534a5f4e55c7.doc

At such time as physical media players manufactured by licensees of the Advanced Access Content System are required to detect audio and/or video watermarks during content playback (the “Watermark Detection Date”), Licensee shall require, within two (2) years of the Watermark Detection Date, that any new devices capable of receiving and decrypting protected high definition content from the Licensed Service that can also receive content from a source other than the Licensed Service shall detect and respond to the embedded state and comply with the corresponding playback control rules.