Video Service Protection: Simplified, Scalable and Robust Cross-Platform Security BRKSPV-2400 Cisco Live Berlin Edmond Shapiro Video Solutions Architect Service Provider Video - Cisco Agenda Cross-Platform Video Content & Service Protection 1. Background 2. Simplifying Operations 3. Scaling Operations 4. Strengthening Protections 5. Conclusion Agenda Cross-Platform Video Content & Service Protection 1. Background 2. Simplifying Operations 3. Scaling Operations 4. Strengthening Protections 5. Conclusion Background – Rapidly Evolving SP Network Enable New Business Models Protect • Secure content and revenue across all screens, networks and business models • Provide comprehensive and adaptive security to dynamic threat landscape Launch New Experiences Monetize • Rapidly deliver compelling new experiences that increase revenue • Compete with OTT threat and increase relevance versus cord cutting Fast and Flexible Automate • Move from months to days and minutes for supporting new services and workflows • Simplify infrastructure and service management Reduce Total Cost of Ownership Optimize • Improve infrastructure utilization • Lower operational costs and increase efficiency 8 Background – Rapidly Evolving SP Network Fragmented, Fragile Video Cloud DVR VOD Broadband Services Routing Services Slow, Outdated Manual, Complex Static, Siloed Compute Storage Network 9 Background - Cisco Open Network Architecture Service Providers and Content Providers Unified Comprehensive Video Cloud DVR VOD Broadband Services Routing Services Cloud Native Software Based Capture xCode Encrypt Ad Insert Splice Route Package Playout Automate Virtual Network Functions Orchestration Virtual Network Functions Orchestrated Programmable Compute Storage Network Elastic & Scalable 10 From Managed Network Distribution of Television… Creation Distribution Consumption Take 7 Content Service Video Creators Provider Consumer 11 …To an Open Content Ecosystem 3rd Party Sources Service Provider / Headend www… Video Consumer Take 7 Regional www… Headend Content Creators www… Creation Distribution Consumption Corporate Employees Video content Content Delivery Set top Satellite Telecommunications Cable www… IP Key: data centers & endpoints data centers Network (CDN) box (STB) 13 SP Operations Today is Complex and Costly STB(s) IP Networks Connected Linear VOD NG IP TV Device(s) Control Control Control Plane Plane Plane Customer Mobile Back Device(s) Office Conditional Conditional DRM DRM Access Access System A System B System A System B Linear VOD NG IP TV Data Data Data Plane Plane Plane 14 Ever Growing Number of Platforms and Devices … Roku Apple TV Fairplay Fairplay iPad iPhone PlayReady Fairplay Amazon Fire TV Chromecast Android Android Widevine Widevine Tablet phone PlayReady Widevine Xbox One PlayStation 4 Windows Windows PlayReady PlayReady Tablet phone PlayReady PlayReady PlayReady TiVo Samsung Smart TV (IE) PC ?? Widevine PlayReady PlayReady (Chrome) ?? ?? ?? ?? 15 With Complex Native Security Architectures DTCP/ VidiPath Not supported Not supported Not supported Multicast Not supported Not supported Not supported Home Network Not supported Not supported Require PR 3.0 capable device DVR Not supported Not supported Require PR 3.0 capable device Not supported Write your own app with WV Write your own app with PR Sync & Go hardening. No rights revocation hardening. No rights revocation Not supported. Root & Leaf Not supported. Root & Leaf Use Root & Leaf licenses Linear EBR concept is not portable concept is not portable Linear Key Rotation or Entitlement Key Rotation or Entitlement Key Rotation or Entitlement revocation revocation revocation VOD Device Identification Device Identification Device Registration Device Registration Device Registration Entitlement control Entitlement control Entitlement control App & Platform Integrity App & Platform Integrity App & Platform Integrity Concurrency Concurrency Concurrency CDN access tokens CDN access tokens CDN access tokens Expiration enforcement PlayReady Widevine FairPlay 16 With Support for Multi-Platform Video Services rd Service Provider Backend 3 Party OTT Services Netflix, YouTube Gateway / DVR 3rd party DRM devices: CA DRM * PlayReady – xBox 360, STV * FPS – Old AppleTV * Widevine – Chromecast Multi-DRM Gateway • Fusion • Evolution • PC, Mac • MHA Computers • iOS, New AppleTV Mobiles • RDK IPC • Android (AndroidTV, FireTV) • 3rd party • Windows Mobiles, METRO... • DTV DRM DLNA TV • Xbox ONE • Sagem • PS3/4 • Zodiac • Roku • HDMI dongles 17 Agenda Cross-Platform Video Content & Service Protection 1. Background 2. Simplifying Operations • Multi-DRM Framework, Common Control Plane Policy Enforcement 3. Scaling Operations 4. Strengthening Protections 5. Conclusion Simplifying Content & Service Protection Capture/Store Distribute Consume Data Center 3 Set Top Box 6 DRM/OTT SPP/IP 1 CA/Broadcast 4 DRM/Home IT Security network 2 Multi DRM DRM/OTT Devices 5 Multi-DRM/OTT Data Center Security VideoGuard Everywhere – Content & Service Protection 19 Simplify Security Operations – Hybrid Environments Authorization / Activation tokens Content Security Customer Device (s) Conditional Access Application SM Back SM Front End End Customer Entitlements Control Back CA Back CA Front Plane Content Security Client Office End End CA CA License Security SDK Player Broadcast Delivery Agent Device CA Activation Device Schedule Activation Secure Micro Multi-DRM Device License Control Control OS / Middleware AC/Events ECM / Keys provisioning Secure Micro Data Plane Support for MUX ABR-E One-Way Environment 20 Simplify Security Operations – Two-Way Environments Authorization / Activation tokens Content Security Customer Device (s) Conditional Access Application Customer Entitlements Control Back CA Back CA Front Plane Content Security Client Office End End CA CA License Security SDK Player Broadcast Delivery Agent Device CA Activation Device Schedule Activation Multi-DRM Device License Control Control OS / Middleware AC/Events ECM / Keys provisioning CA Support for Data Plane Two-Way MUX ABR-E Broadcast Environment 21 Simplify Security Operations – IP Only Environments Authorization / Activation tokens Content Security Customer Device (s) Application Customer Entitlements Control Back Plane Content Security Client Office License Security SDK Player Agent Device CA Activation Device Schedule Activation Multi-DRM Device License Control Control OS / Middleware AC/Events ECM / Keys provisioning Multi-DRM Data Plane Support for MUX ABR-E IP Only Environments 22 Simplify Integration of Native DRMs Multi-DRM Product Unified Multi-DRM Framework Integration Integration VGE DRM … PlayReady Widevine PlayReady Fairplay Widevine VGE Multi-DRM Framework PlayReady Widevine Headend Services Headend Services Headend Services 23 A Video Service Protection Platform is more than DRM Content Protection Application Integrity Sync & Go Home Network Event-Based Location and Proximity DTCP-IP support VGE Multi-DRM Concurrency Framework Device Management Registration Device Integrity License Traditional Keys DRM 24 User Context Control Policies Preference Concurrency Proximity • Control Plane sets and Security System enforces User policies • Every Service Provider application results in new Place Device Activity Time Content Enforcement requirements Account Network Status Content 25 Linear Schedule Event Control Policies Subscription Only Free Preview Banner Only PPV Purchase Only Subscription & PPV Recording Recording No Skip No Out of Home Recording 26 Common Policy Enforcement (VGE Features) • Linear Subscription • Tiered Bundles • À La Carte • Pay Per View Store/Forward, HEP • Free Preview Linear Channels and Live Events • EPG Coloring Variety of Concurrency Limits • Overt and Covert fingerprinting Video On Demand • Pre-Encrypted VODPolicy, Location and CDN Access Control • Transaction VOD Device/App Authentication Download, Sync & Go • Subscription VOD and Proximity Control • Session VOD • Request Queuing • Free VOD Home Network Sharing • Local Catalog DTCP-IP Import/Export • Background Download • Progressive Download Event-Based Entitlements CA Termination and Transcoding Support • Secure Completion Report • Electronic Sell Through • Different rules per operation Device Registration and Management • Rental window for viewing, for • Template basedEmergency license Alerts on Live Channels download creation in Gateways Rights Revocation Rich Set of Business Rules • Device type(for subscription and and downloaded assets) Network type restrictions • Blackouts, locations and proximity • Rentals, download counters • Copy protection/Output controls 27 Agenda Cross-Platform Video Content & Service Protection 1. Background 2. Simplifying Operations 3. Scaling Operations • Optimization of MPEG Broadcast, Adaptive Bit Rate Encryption & Key Handling 4. Strengthening Protections 5. Conclusion MPEG Broadcast Conditional Access Systems Linear TV Video Audio ECM-1 ECM-2 Switched Digital TV Video CAS CAS Scrambler Audio Multiplex (1) (2) ECM-1 MPEG ECM-2 On-Demand TV Video Audio ECM-2 DOCSIS • CAS elements are typically Data resident (e.g. Secure Micro) • DCAS are downloaded and thus not resident 29 MPEG Broadcast Key Rotation for Content Encryption MPEG Broadcast Key Rotation Signaling seconds PMT Delay Video A A A Audio ECM-1 B B ECM ECM-2 Cipher A A A B B B B B Playout • Delay Start is signaled by SimulCrypt Protocol • PMT signals MPEG Components that are scrambled as well as scrambling cipher 30 Network and Key Management (Distributed Headend) Headend Headend Headend