OTT Video Irdeto and CRI to keep the keys to cable and mobile Kingdoms

Transcription

1 OTT Video Irdeto and CRI to keep the keys to cable and mobile Kingdoms Cable companies in the US and elsewhere could soon take complete control of the encryption on their devices, overturning a 20 year old DRM lock-in that has artificially inflated cable costs, having delivered past windfall margins to businesses like Motorola Home and Cisco s set top division. The results could either go straight to the bottom line of companies like Comcast or Time Warner Cable (TWC) or be used to cut prices as these companies come under ARPU pressure from OTT video services. We felt this was one of the major stories of IBC, as it became obvious that a number of MSOs and even underlying chip providers are working towards taking complete control of the encryption environment on their devices. If MSOs like Comcast back this kind of move, and we think it is on the verge of it, it will mean an end to the Conditional Access locks-ins of the past. And to us that means bad news for incumbent set top box manufacturers and their conditional access partners, as the entire set top market could become commoditized and price-cut driven. Shifts to standard code bases like RDK now seem to be just the tip of the iceberg as far as cablecos go and they are on a mission to drive the prices of their essential technologies to the floor. The same trend could be seen among the traditional conditional access firms, with at least three we spoke to at the show upgrading their services either to deal with multiple DRMs from a single system, due to OTT and multiscreen proliferation, or to upgrade to the delivery requirements to 4K, or both (see next week s is-sue). The problem, as best described to us by Irdeto VP products Peter Oggel, is that Most operators have been locked into a DRM or Conditional Access, and often locked into the same operating sys-tem and middleware as a result of it. There has been a trend among large MSOs to try to manage their keys themselves, including a device root key and its growing key ladder. So either operators cannot make changes to their environment, or they are wasting resource managing keys. We know of one operator that has 80 people managing encryption keys full time, Oggel said. Back in May, Irdeto won the deal to agnostically control DRM systems for Liberty Global, in a deal similar, but not quite so as extensive as its Keys and Credentials service, in a deal where at Faultline we didn t fully appreciate what was involved. Encryption and security begin when an SoC is first pressed, and it has its very initial piece of software laid on it, and just before that the root key is dropped into the hardware. You need this key, part of

2 the Public Key Infrastructure accepted approach to encryption, to decrypt subsequent keys and to control what soft-ware can be installed on the hardware. In the past, for instance within General Instrument up until it was acquired by Motorola in 2000, set top makers kept their keys secret from the operators who bought them. This was known as operator lock in. They virtually gave away the conditional access system and in return no set tops could be attached to cable net-works that did not use that encryption system. This led to fat set top pricing and virtual stagnation in the US cable industry, and is perhaps responsible for its attitude going forwards, where it wants complete control of everything it buys so that it can never be tied in, in the same way, ever again. The most common state even today is where the CA supplier who is generating the root key still keeps those keys to themselves making it impossible for a technology change over after production. Some operators have demanded contractually to be the owner of these keys and while this solves the legal ownership question, it doesn t automatically lead to the possibility of actually doing a technology change over after deployment. Now operators recognize they need to have full management of the keys and the associated lifecycle processes during the lifetime of the end user device. Over the past 14 years cable has made huge inroads to achieving that control, either taking over control of its own keys, adopting CableCARD in the US or getting external suppliers such as Pace their own certification to access the conditional access systems of Motorola, so that its devices can work on the Comcast network. But cable is faced with further problems. As it moves to an all IP architecture it wants to avoid another lock in and yet needs to store something like 20 to 50 new keys to support multiple OTT deliveries and payment gateways and to control the rights of apps vendors to install code on the box. In order to offer a management service to do this, companies like Irdeto have to create a secure highway for key delivery at the location where the SoCs are made, and then must first install a key that can subsequently grant keys to DRM and Conditional access companies, rather than the other way around. The next step is to build a secure operating system before the true OS is laid on the device followed by any middleware that needs to go on it. Now none of this is rocket science and most operators today know that they would really rather have someone take this head-ache away from them, and yet they don t want it to be the OS provider, the middleware provider or the DRM or CAS provider, be-cause they need them to be truly agnostic, prepared to give up the keys to someone else on the say so of the operator. In the past this has continued to imply reliance on the CA vendor which constrains their strategy. Now Irdeto has come out and said Two of the largest MSOs in the US have now decided to go with

3 us to manage their key stacks. We take this to mean Com-cast and Time Warner Cable, although it could just as easily be Charter and Cablevision or Cox. The implications are enormous, in that those MSOs who choose to go down that route can change their Apps, their UI designs and their conditional access and DRM suppliers in a heartbeat, on a device where they have full key management and it is not tied to any software service. We remember one example of where this turned out to be really helpful, and that s when British Telecom decided to dump in February 2012 what was then Microsoft Mediaroom. By retaining and managing the root key for all the set tops, BT replaced the Microsoft CE operating system with a Linux variant, and put in a middleware stack from Oregan Networks and built an interface to a new VoD system and added a new UI, virtually overnight, in the process cutting down licensing costs, and prepared the path to-wards HTML 5.0. Later a new physical device was added by Pace. The Windows media DRM was upgraded to PlayReady. There will be deep suspicion where one CA player in Irdeto, takes responsibility for all encryption keys, instead of the CA incumbent, but Oggel explained, We have to take the role of a police officer, who can say what is allowed to run on the box and what is not. We have had to agree to a key handover process that is well defined, so that if we lose the contract to look after the keys, everything that we have to handover and the process of handover is pre-established. The only way is to be completely agnostic about DRM keys. This is meant to alleviate the often deep suspicions that exist be-tween different CA vendors, but it also leaves the marketplace free to continue to compete for all business on a set top way after the first systems are installed. We expect ALL prices in this market to go down, said Oggel. We have already commented how consumer Electronics players like Humax and Samsung have already begin to court the US MSOs with far cheaper OEM boxes, and that this threatens incumbent suppliers where there are new deployments, but this key management development now also threatens existing deployments and an MSO that has this in place, especially the confidence it brings of not having to manage the process with in-house staff, can replace the CA or any device software at a whim, as long as it s within existing contractual terms. Meanwhile, although that news is a significant shift all on its own, in the smartphone industry Qualcomm has already emulated this in a recent contract that was signed finally in June, with Cryptography Research Inc (CRI). CEO Paul Kocher was also at IBC and explained more about this deal with the world s largest mobile chip vendor. This came about because Qualcomm wanted a way to manage the different skews of its chips. What we mean is that it is too expensive to make a different mask for each slightly different

4 type of chipset. So what most chip companies like Qualcomm do is make all of these chips as a kind of superset, in one pass and they then need a mechanism to de-authorize different parts of the chip to create all the variants. It s really important that this is highly secure and they are often building their chips in environments which are not always the most secure. So we put a root key into the devices at manufacture, and use this key to authorize which parts of the chips are turned on at any point in time, said Kocher. Qualcomm is now using the CRI system to plant initial keys into its App Processor chips at manufacture. It does this by putting a tamper proof black box at the site which communicates directly with each chip as it is tested, and places initial keys onboard. But it has also signed up for lifecycle control of these and other keys with CRI, and what that can lead to is the same kind of lock-in avoidance that the US Cablecos are after in the Irdeto example above. So when subsequent keys are placed onto the chip either by OEMs or by software players that OEMs are working with, more keys that rely on the root key to the device can be created, and encrypted and issued accordingly. So the root key can now turn the most low end device into a top end device and the CRI systems can connect to billing and ac-counting systems which charge more for this chip transformation, which can be controlled remotely and triggered with a re-mote encrypted communication. But similarly CA and DRM keys and payment keys can also be issued to create new services on those chips, but in this case they will all be under Qualcomm s control. It can even comply with customer agreements that call for the chip to have a secure key handed over to the device owner, such as an MNO, but it has a reason NOT to give up the root key, because then the device can be compromised and parts of the chip can be brought into play that make the device top end, by remote management of the skewed designs. What Qualcomm can do is give up the next key on the ladder to the device owner and give them control to everything except the chip upgrade keys. Kocher echoed the Irdeto comment, that The number of keys being placed into smartphones is going up like crazy, so this will be the start of making it easier to build fresh new secure systems that used a phone, which are secure enough for a payment gate-way. That immediately raises a question over the use of ARM Trust Zone and any software reliant on it, such as its Trustonic partner-ship with Gemalto and Geisecke and Devrient, being the basis of these security systems. The problem with relying on something in a core design for your security is that it is not a chip, reminded Kocher, and it is the implementation of a full piece of silicon that makes most of the security holes, not the theoretical creation of a core. Perhaps that s why payment systems have not approved the use of ARM Trust Zone yet.

5 So the indecent rush to use Trust Zone, and the Trustonic implementation in particular, as a hardware root of trust in a smart-phone for entertainment media, may be checked by this Qualcomm announcement, as Qualcomm is now in a position to give you hardware access to the actual silicon via this new Rambus. (CRI s parent company) CryptoManager Solution. That immediately puts the onus on all the other rival chip makers such as MediaTek, to provide the same level of cryptographic services to its clients. And could lead to a mass change in strategy by MNOs globally to how they manage on device decryption keys. And if that takes off, then the ambitions of lots of software only protection businesses, such as Inside Secure, many suddenly hit a wall, as would anyone else who has focused solely on operating inside the software of Trustonic. Faced with a far tougher security environment, both payment services and media companies may insist on the Qualcomm CRI key management and secure environment being used.