General Content Security & Service Implementation

Transcription

1 SCHEDULE C [VOD-EST-PAYTV] CONTENT PROTECTION REQUIREMENTS AND OBLIGATIONS This Schedule C is attached to and a part of that certain [ Agreement, dated (the Agreement ), between/among ]. All defined terms used but not otherwise defined herein shall have the meanings given them in the Agreement. General Content Security & Service Implementation Content Protection System. All content delivered to, output from or stored on a device must be protected by a content protection system that includes digital rights management, conditional access systems and digital output protection (such system, the Content Protection System ). The Content Protection System shall: (i) be approved in writing by Licensor (including any upgrades or new versions, which Licensee shall submit to Licensor for approval upon such upgrades or new versions becoming available), (ii) be fully compliant with all the compliance and robustness rules associated therewith, and (iii) use only those rights settings, if applicable, that are approved in writing by Licensor. (iv) be considered to meet sections 1 ( Encryption ), 2 ( Key Management ), 3 ( Integrity ), 5 ( Digital Rights Management ), 10 ( Protection against hacking ), 11 ( License Revocation ), 12 ( Secure Remote Update ), 16 ( PVR Requirements ), 17 ( Copying ) of this schedule if the Content Protection System is an implementation of one the content protection systems approved by the Digital Entertainment Content Ecosystem (DECE), and said implementation meets the compliance and robustness rules associated with the chosen DECE approved content protection system. The DECE approved content protection systems are: a. Marlin Broadband b. Microsoft Playready c. CMLA Open Mobile Alliance (OMA) DRM Version 2 or 2.1 d. Adobe Flash Access 2.0 (not Adobe s Flash streaming product) e. Widevine Cypher 1. Encryption The Content Protection System shall use cryptographic algorithms for encryption, decryption, signatures, hashing, random number generation, and key generation and the utilize time-tested cryptographic protocols and algorithms, and offer effective security equivalent to or better than AES 128 (as specified in NIST FIPS-197) or ETSI DVB CSA The content protection system shall only decrypt streamed content into memory temporarily for the purpose of decoding and rendering the content and shall never write decrypted content (including, without limitation, portions of the decrypted content) or streamed encrypted content into permanent storage Keys, passwords, and any other information that are critical to the cryptographic strength of the Content Protection System ( critical security parameters, CSPs) may never be transmitted or permanently or semipermanently stored in unencrypted form. Memory locations used to

2 temporarily hold CSPs must be securely deleted and overwritten as soon as possible after the CSP has been used If the device hosting the Content Protection System allows download of software then decryption of (i) content protected by the Content Protection System and (ii) CSPs (as defined in Section 2.1 below) related to the Content Protection System shall take place in an isolated processing environment and decrypted content must be encrypted during transmission to the graphics card for rendering 1.5. The Content Protection System shall encrypt the entirety of the A/V content, including, without limitation, all video sequences, audio tracks, sub pictures, menus, subtitles, and video angles. Each video frame must be completely encrypted. 2. Key Management The Content Protection System must protect all CSPs. CSPs shall include, without limitation, all keys, passwords, and other information which are required to maintain the security and integrity of the Content Protection System CSPs shall never be transmitted in the clear or transmitted to unauthenticated recipients (whether users or devices. 3. Integrity The Content Protection System shall maintain the integrity of all protected content. The Content Protection System shall detect any tampering with or modifications to the protected content from its originally encrypted form Each installation of the Content Protection System on an end user device shall be individualized and thus uniquely identifiable. [For example, if the Content Protection System is in the form of client software, and is copied or transferred from one device to another device, it will not work on such other device without being uniquely individualized.] 4. The Licensed Service shall prevent the unauthorized delivery and distribution of Licensor s content (for example, user-generated / user-uploaded content) and shall use reasonable efforts to filter and prevent such occurrences. Digital Rights Management 5. Any Digital Rights Management used to protect Licensed Content must support the following: 5.1. A valid license, containing the unique cryptographic key/keys, other necessary decryption information, and the set of approved usage rules, shall be required in order to decrypt and play each piece of content Each license shall bound to either a (i) specific individual end user device or (ii) domain of registered end user devices in accordance with the approved usage rules Licenses bound to individual end user devices shall be incapable of being transferred between such devices Licenses bound to a domain of registered end user devices shall ensure that such devices are only registered to a single domain at a time. An online registration service shall maintain an accurate count of the number of devices

3 in the domain (which number shall not exceed the limit specified in the usage rules for such domain). Each domain must be associated with a unique domain ID value If a license is deleted, removed, or transferred from a registered end user device, it must not be possible to recover or restore such license except from an authorized source Secure Clock. For all content which has a time-based window (e.g. VOD, catch-up, SVOD) associated with it, the Content Protection System shall implement a secure clock. The secure clock must be protected against modification or tampering and detect any changes made thereto. If any changes or tampering are detected, the Content Protection System must revoke the licenses associated with all content employing time limited license or viewing periods. Conditional Access Systems 6. Any Conditional Access System used to protect Licensed Content must support the following: 6.1. Content shall be protected by a robust approved scrambling or encryption algorithm in accordance section 1 above ECM s shall be required for playback of content, and can only be decrypted by those Smart Cards or other entities that are authorized to receive the content or service. Control words must be updated and re-issued as ECM s at a rate that reasonably prevents the use of unauthorized ECM distribution, for example, at a rate of no less than once every 7 seconds Control Word sharing shall be prohibited, The Control Word must be protected from unauthorized access. Streaming 7. Generic Streaming Requirements The requirements in this section 7 apply in all cases where Internet streaming is supported Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. 8. Flash Streaming Requirements The requirements in this section 8 only apply if the Adobe Flash product is used to provide the Content Protection System.

4 8.1. Adobe RTMPE is approved for streaming using the following Adobe product versions or later: Client side: Flash Player Server side: FMS 3.51 and FMS Licensee will make reasonable commercial efforts to stay up to date with the then current versions of the above Adobe products Progressive downloading of licensed content is prohibited Flash Encoded Content (including FLV and F4V file formats) must be streamed using Adobe RTMP-E protocol Flash servers shall be configured such that RTMP-E is enabled, and RTMP is disabled. No content shall be available through both RTMP and RTMP-E Flash Media Servers shall be configured such that SWF Verification is enabled Licensee s and/or its designated CDN shall implement Token Authentication, i.e. mechanism that creates a short-lived URL (approx 3-5 minutes) for content by distributing a token to the client only at such a time it is authorized to receive the VOD Stream Licensee must migrate from RTMP-E (stream encryption) to Adobe DRM i.e. Flash Media Rights Management Server successor Flash Access 2.0 (filebased encryption) or other DRM approved by Licensor in writing within 6 months of the commercial launch of Flash Access 2.0 on the relevant platforms (or within 4 months of the commencement of this Agreement if Flash Access 2.0 is already commercially available on the relevant platforms) and be in full compliance with all content protection provisions herein; Licensee must make reasonable commercial efforts to comply with Adobe compliance and robustness rules for Flash Server products at such a time when they become commercially available. 9. Microsoft Silverlight The requirements in this section 9 only apply if the Microsoft Silverlight product is used to provide the Content Protection System Microsoft Silverlight is approved for streaming if using Silverlight 2 or later version When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class Within 46 months of the commercial launch of Silverlight 4commencement of this Agreement, Licensee shall migrate to Silverlight 4 and be in full compliance with all content protection provisions herein or; Within 64 months of the commercial launch of Silverlight 4commencement of this Agreement, Licensee shall migrate to alternative, Licensor-approved DRM/streaming protection technology in full compliance with content protection requirements herein.

5 Protection Against Hacking 10. Any system used to protect Licensed Content must support the following: Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing The Content Protection System shall employ industry accepted tamperresistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers) The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to break once, break everywhere attacks Tamper Resistant Software. The Content Protection System shall employ tamper-resistant software. Examples of tamper resistant software techniques include, without limitation: Code and data obfuscation: The executable binary dynamically encrypts and decrypts itself in memory so that the algorithm is not unnecessarily exposed to disassembly or reverse engineering Integrity detection: Using one-way cryptographic hashes of the executable code segments and/or self-referential integrity dependencies, the trusted software fails to execute and deletes all CSPs if it is altered prior to or during runtime Anti-debugging: The decryption engine prevents the use of common debugging tools Red herring code: The security modules use extra software routines that mimic security modules but do not have access to CSPs The Content Protection System shall implement secure internal data channels to prevent rogue processes from intercepting data transmitted between system processes The Content Protection System shall prevent the use of media player filters or plug-ins that can be exploited to gain unauthorized access to content (e.g., access the decrypted but still encoded content by inserting a shim between the DRM and the player). REVOCATION AND RENEWAL 11. License Revocation. The Content Protection System shall provide mechanisms that revoke, upon written notice from Licensor of its exercise of its right to require such revocation in the event any CSPs are compromised, (a) the instance of the Content Protection System with the compromised CSPs, and (b) any and all playback licenses issued to (i) specific individual end user device or (ii) domain of registered end user devices. 12. Secure remote update. The Content Protection System shall be renewable and securely updateable in event of a breach of security or improvement to the Content Protection System. 13. The Licensee shall have a policy which ensures that clients and servers of the Content Protection System are promptly and securely updated in the event of a

6 security breach (that can be rectified using a remote update) being found in the Content Protection System and/or its implementations in clients and servers. Licensee shall have a policy which ensures that patches received from content protection technology providers (e.g. DRM providers) are promptly applied to clients and servers. ACCOUNT AUTHORIZATION 14. Content Delivery. Content, licenses, control words and ECM s shall only be delivered from a network service to registered devices associated with an account with verified credentials. Account credentials must be transmitted securely to ensure privacy and protection against attacks. 15. Services requiring user authentication: The credentials shall consist of at least a User ID and password of sufficient length to prevent brute force attacks. Licensee shall take steps to prevent users from sharing account credentials. In order to prevent unwanted sharing of such credentials, account credentials may provide access to any of the following (by way of example): purchasing capability (e.g. access to the user s active credit card or other financially sensitive information) administrator rights over the user s account including control over user and device access to the account along with access to personal information. RECORDING 16. PVR Requirements. Any device receiving playback licenses must not implement any personal video recorder capabilities that allow recording, copying, or playback of any protected content except as explicitly allowed elsewhere in this agreement. 17. Copying. The Content Protection System shall prohibit recording of protected content onto recordable or removable media, except as such recording is explicitly allowed elsewhere in this agreement. Outputs 18. Analogue Outputs. If the licensed content can be delivered to a device which has analog outputs, the Content Protection System must ensure that the devices meet the analogue output requirements listed in this section The Content Protection System shall enable Macrovision content protection technology on all analog outputs from end user devices. Licensee shall pay all royalties and other fees payable in connection with the implementation

7 and/or activation of such content protection technology allocable to content provided pursuant to the Agreement The Content Protection System shall enable CGMS-A content protection technology on all analog outputs from end user devices. Licensee shall pay all royalties and other fees payable in connection with the implementation and/or activation of such content protection technology allocable to content provided pursuant to the Agreement. 19. Digital Outputs. If the licensed content can be delivered to a device which has digital outputs, the Content Protection System must ensure that the devices meet the digital output requirements listed in this section The Content Protection System shall prohibit digital output of decrypted protected content. Notwithstanding the foregoing, a digital signal may be output if it is protected and encrypted by High-Bandwidth Definition Digital Copy Protection ( HDCP ) or Digital Transmission Copy Protection ( DTCP ). Defined terms used but not otherwise defined in this Digital Outputs Section shall have the meanings given them in the DTCP or HDCP license agreements, as applicable A device that outputs decrypted protected content provided pursuant to the Agreement using DTCP shall: Deliver system renewability messages to the source function; Map the copy control information associated with the program; the copy control information shall be set to copy never in the corresponding encryption mode indicator and copy control information field of the descriptor; Map the analog protection system ( APS ) bits associated with the program to the APS field of the descriptor; Set the image_constraint_token field of the descriptor as authorized by the corresponding license administrator; Set the eligible non-conditional access delivery field of the descriptor as authorized by the corresponding license administrator; Set the retention state field of the descriptor as authorized by the corresponding license administrator; Deliver system renewability messages from time to time obtained from the corresponding license administrator in a protected manner; and Perform such additional functions as may be required by Licensor to effectuate the appropriate content protection functions of these protected digital outputs A device that outputs decrypted protected content provided pursuant to the Agreement using HDCP shall:

8 If requested by Licensor, at such a time as mechanisms to support SRM s are available, deliver a file associated with the protected content named HDCP.SRM and, if present, pass such file to the HDCP source function in the device as a System Renewability Message; and Verify that the HDCP Source Function is fully engaged and able to deliver the protected content in a protected form, which means: HDCP encryption is operational on such output, Processing of the System Renewability Message associated with the protected content, if any, has occurred as defined in the HDCP Specification, at such a time as mechanisms to support SRM s are available, and There is no HDCP Display Device or Repeater on such output whose Key Selection Vector is in such System Renewability Message at such a time as mechanisms to support SRM s are available. 20. Exception Clause for Standard Definition, Uncompressed Digital Outputs on Windows-based PCs and Macs running OS X or higher): HDCP must be enabled on all uncompressed digital outputs (e.g. HDMI, Display Port), unless the customer s system cannot support HDCP (e.g., the content would not be viewable on such customer s system if HDCP were to be applied) 21. Upscaling: Device may scale Included Programs in order to fill the screen of the applicable display; provided that Licensee s marketing of the Device shall not state or imply to consumers that the quality of the display of any such upscaled content is substantially similar to a higher resolution to the Included Program s original source profile (i.e. SD content cannot be represented as HD content). Embedded Information 22. Watermarking. The Content Protection System or playback device must not remove or interfere with any embedded watermarks in licensed content. 23. Embedded Information. Licensee s delivery systems shall pass through any embedded copy control information without alteration, modification or degradation in any manner; 24. Notwithstanding the above, any alteration, modification or degradation of such copy control information and or watermarking during the ordinary course of Licensee s distribution of licensed content shall not be a breach of this Embedded Information Section.

9 Geofiltering 25. The Content Protection System shall take affirmative, reasonable measures to restrict access to Licensor s content to within the territory in which the content has been licensed. 26. Licensee shall periodically review the geofiltering tactics and perform upgrades to the Content Protection System to maintain state of the art geofiltering capabilities. 27. Without limiting the foregoing, Licensee shall utilize geofiltering technology in connection with each Customer Transaction that is designed to limit distribution of Included Programs to Customers in the Territory, and which consists of (i) IP address look-up to check for IP address within the Territory and (ii) either (A) with respect to any Customer who has a credit card on file with the Licensed Service, Licensee shall confirm that the country code of the bank or financial institution issuing such credit card corresponds with a geographic area that is located within the Territory, with Licensee only to permit a delivery if the country code of the bank or financial institution issuing such credit card corresponds with a geographic area that is located within the Territory or (B) with respect to any Customer who does not have a credit card on file with the Licensed Service, Licensee will require such Customer to enter his or her home address (as part of the Customer Transaction) and will only permit the Customer Transaction if the address that the Customer supplies is within the Territory. Network Service Protection Requirements. 28. All licensed content must be received and stored at content processing and storage facilities in a protected and encrypted format using a state of the art protection system. 29. Document security policies and procedures shall be in place. Documentation of policy enforcement and compliance shall be continuously maintained. 30. Access to content in unprotected format must be limited to authorized personnel and auditable records of actual access shall be maintained. 31. Physical access to servers must be limited and controlled and must be monitored by a logging system. 32. Auditable records of access, copying, movement, transmission, backups, or modification of content must be securely stored for a period of at least three years. 33. Content servers must be protected from general internet traffic by state of the art protection systems including, without limitation, firewalls, virtual private networks, and intrusion detection systems. All systems must be regularly updated to incorporate the latest security patches and upgrades. 34. All facilities which process and store content must be available for Motion Picture Association of America and Licensor audits upon the request of Licensor. 35. At Licensor s written request, security details of the network services, servers, policies, and facilities that are relevant to the security of the Licensed Service (together, the Licensed Service Security Systems ) shall be provided to the Licensor, and Licensor reserves the right to subsequently make reasonable requests for improvements to the Licensed Service Security Systems. Any substantial changes to the Licensed Service Security Systems must be submitted to Licensor for approval, if Licensor has made a prior written request for such approval rights.

10 36. Content must be returned to Licensor or securely destroyed pursuant to the Agreement at the end of such content s license period including, without limitation, all electronic and physical copies thereof. High-Definition Restrictions & Requirements In addition to the foregoing requirements, all HD content is subject to the following set of restrictions & requirements: 37. Personal Computers HD content is expressly prohibited from being delivered to and playable on General Purpose Computer Platforms (e.g. PCs) unless explicitly approved by Licensor. If approved by Licensor, the additional requirements for HD playback on PCs will include the following: Secure Video Paths: Digital Outputs: The video portion of unencrypted content shall not be present on any user-accessible bus in any analog or unencrypted, compressed form. In the event such unencrypted, uncompressed content is transmitted over a user-accessible bus in digital form, such content shall be either limited to standard definition (720 X 480 or 720 X 576), or made reasonably secure from unauthorized interception. For avoidance of doubt, HD content may only be output in accordance with Section 22 and Section 23section Digital Outputs above. Further, by downloading a script of other investigation method, Licensee shall determine unequivocally before offering HD content to the user that the user s PC supports digital output control in compliance with section Digital Outputs of this schedule. HD content shall NOT be offered to the user or delivered to the user if this test determines the user s PC does not support digital output control in compliance with section Digital Outputs of this schedule Hardware Root of Trust Or State of the Art Software Tamper Resistant The Content Protection System (CPS) and/or the Approved Device on which the CPS executes shall use a hardware means ("Hardware Root of Trust") which prevents compromise via software attacks, of the Content Protection System. For example, the Hardware Root of Trust may provide some or all of the following functions: hardware defences against reverse engineering of software hardware assisted software tamper resistance hardware secure key storage (and or key use) hardware assisted verification of software Alternatively, the Content Protection System (CPS) and/or the Approved Device on which the CPS executes shall use software obfuscation or other method of software tamper resistance (as described in clause 10.4, Software Tamper Resistance ) from a recognized, state of the art provider that is approved by Licensor Secure Content Decryption.

11 Decryption of (i) content protected by the Content Protection System and (ii) CSPs (as defined in Section 2.1 below) related to the Content Protection System shall take place in an isolated processing environment. Decrypted content must be encrypted during transmission to the graphics card for rendering HD Day & Date Requirements In addition to the foregoing requirements, all HD content is subject to the following set of content protection requirements: 38. Analogue Sunset. After December 31, 2011, all Approved Devices shall limit (e.g. down-scale) analog outputs for decrypted protected Included Programs to standard definition at a resolution no greater than 720X480 or 720 X Additional Watermarking Requirements. At such time as physical media players manufactured by licensees of the Advanced Access Content System are required to detect audio and/or video watermarks during content playback (the Watermark Detection Date ), Licensee shall require, within two (2) years of the Watermark Detection Date, that any new devices capable of receiving and decrypting protected high definition content from the Licensed Service that can also receive content from a source other than the Licensed Service shall detect and respond to the embedded state and comply with the corresponding playback control rules.