The US cable TV industry is once again in turmoil following the regulator FCC’s decision late February to allow public comments on a proposal from its chairman Tom Wheeler that would require pay TV operators to use set tops that conform to open standards. The move has wider ramifications in that it could herald the end of the set top as we know it.
But more significantly it plays into the debate over how best to migrate to all-IP cloud based services, while ensuring that content rights are upheld and emerging security threats countered. Security is at the heart of the debate just as it was when the longest running saga in pay TV began exactly two decades ago in 1996 when the FCC was charged with creating a “more open and competitive market” for set tops. Cable Card was introduced for this end by roping off the security component in a modular device that any manufacturer could incorporate in principle to produce a box compatible with a given cable operator’s service.
The move achieved limited success in the sense that Tivo and a few others were able to come in and develop compatible boxes, but only where these were approved by operators. The new generation of connected set tops from the likes of Apple, Roku and Google have been limited by their inability to access the programming of pay TV operators.
As a result, 99% of US pay TV subscribers still rent set tops from pay TV providers, linked to expensive packages that effectively exert a lock-in. Cable Card largely failed because of both technical and logistical problems that were never resolved properly in the earlier days. Technical problems included the inability of a Cable Card to send signals upstream for VoD and other interactive services, while among logistical problems was poor inventory management with differences between implementations.
More recently the long established model around Cable Card has been eroding through cord cutting to OTT players like Netflix, combined with Free-To-Air services.
At the same time there has been renewed pressure on the FCC to fix at last this long flawed model, starting with an admission in 2009 that Cable Card had failed to deliver on its promise. This led to the more tangible move in December 2014 when Congress ordered the FCC to establish a working group to find a “software-based downloadable security system” that would embody the functionality of Cable Cards without any physical device. At the same time Congress abolished the long standing obligation on operators to include Cable Cards in their own set tops.
The new standard was supposed to be technology and platform neutral, but developing this has itself proved controversial, not least because it overturns the long established business model of cable operators around set top subscriptions and associated packages. The FCC then formed its Downloadable Security Technical Advisory Committee (DSTAC), which issued its final report in August 2015 containing two proposals for a software-based downloadable security system, one written by the non-profit Washington based Internet standards group Public Knowledge and the other by cable operators spearheaded it appears by Comcast, since it was authored by Mark Vickers, its VP of Software Architecture.
It may have been a mistake to allow the cable operators to be so closely involved themselves but it could be argued their proposal is more open than the one from Public Knowledge, which would mandate use of the DTCP-IP protocol for end-to-end security administered from the cloud. The second MSO proposal would involve the operators building their own apps for the third party devices and then rely on security APIs in HTML5. That second proposal could be deemed more open since DTCP-IP is still controlled by just five vendors that originally developed it, Intel, Hitachi, Panasonic, Sony and Toshiba, while the MSOs’ alternative would allow operators to select their own security.
However, DTCP-IP has been adopted by DLNA as its security protocol for transmitting content between devices over WiFi, so is regarded as being part of an open standard set that would still allow choice of DRM for enforcing differential rights across target devices. The FCC, after all, has endorsed DLNA’s Premium Video (PV) profile incorporating DTCP-IP for its open set top standard, deeming it to be the one possible contender that looked like it met its requirements including openness, because membership is open to any “for-profit corporation, nonprofit corporation, or other enterprise.”
But that is for communication within the home. Now the first of the FCC proposals is for DTCP-IP to be extended outside the home to secure links from the cloud to the set top or other authenticated device in the home. But the focus is still on a box of some sort, whether running HTML5 or connected via DTCP-IP.
The cable operators contend that their downloadable ‘apps’ approach enables consumers to watch their own programming as well as third party OTT content on a wide array of devices, including iOS and Android tablets and smartphones, game stations, PCs and Macs, Smart TVs, Kindle Fire, and Roku. They go on to argue that because consumers can now access pay TV content on such diverse devices, there is no need for a technology mandate like the one based on DTCP-IP pushed by consumer advocacy groups.
They also express concern over the upheaval to their infrastructures that the DTCP-IP proposal would entail. This argument can be largely discounted because all MSOs are engaged in a large scale migration to IP around DOCSIS 3.0 in any case and it would not involve a major extension to incorporate the FCC’s DTCP-IP proposal.
Ironically US MSOs are very enthusiastic about DLNA and DTCP-IP for home networking, because here the idea of a secure path that is trusted by rights holders is very appealing. DLNA released its CVP-2 guidelines in March 2014 and followed up in September that year with VidiPath as its secure, in-home IP networking path based on DTCP-IP. The attraction was that VidiPath simplifies the process of ensuring that all devices in the home can get access to all content the subscriber is entitled to receive. Prior to that many homes found that only some of the content they had paid for was available on connected devices rather than just the TV. Sometimes deals between operators and the TV networks meant that not every channel in a subscription was available online.
But with VidiPath a single cable set top or gateway can “out of the box” stream all of a provider’s programming, including HD content and channel guide data, directly to a DLNA device over home WiFi. This leads on to the debate over external connectivity, since this again is shaped by rights holders. Requirements are getting tighter as ever higher quality content becomes available and this will apply within the home, although equally to all devices if DLNA is implemented. Some subtleties arise here, some of them applying end-to-end and others just to delivery from cloud to home.
As a starting point most content providers now allow SD (Standard Definition) content to be delivered to tablets and mobile phones without restrictions. But for HD content they usually require a trusted video path and CPUs incorporating some additional security. This could be a Trusted Execution Environment (TEE) such as ARM TrustZone, which isolates secure code executing in a region of the chip partitioned from application code. ARM-based chips, along with mobile chips from Broadcom, MediaTek and Intel, now have versions incorporating such a trusted environment for isolating secure software execution.
When it comes to Ultra HD the ante is upped further with some of the movie studios, although not yet all, insisting on the protections enshrined in the MovieLabs Specification for 4K content. This is based on three pillars of security, hardware, software and forensic watermarking. The first two are just enhancements of what was already required for HD, with watermarking being the addition. The hardware pillar provides security inside the SoC for credentials such as keys, while the second pillar, sometimes described as hardened software, ensures that only privileged logic components can be executed by the system, as protection against infiltration. In other words, the second pillar ensures that the most sensitive subsets of the security software logic that are critical for key handling and entitlement management are isolated and cannot be corrupted or manipulated, very much as laid down in the TEE.
Then the third pillar is the watermarking to enable tracking of streams during distribution and identification of sources, devices and users. As Verimatrix pointed out in its white paper The Future of Revenue Security for Ultra HD Video, this mandate enhances security not just through the addition of watermarking, but also by exploiting the interdependency between these three pillars. This amounts to protection of the secret information each requires to enable secure end-to-end chain of custody. As Verimatrix noted, the first pillar includes hardware functions and subsystems on SoCs that can be programmed or configured and then provided with secret key material at time of manufacture. This secret material is known only to the device itself and to the security authority that provided it, with the keys inaccessible to any other CPU functions. This combination of hardware and secret keys in the first pillar provides a mechanism to underpin device authentication, revocation and trusted renewability of the software logic – the second pillar – that leverages this hardware. This provides a hardware root of trust underpinning software-based, or cardless, security systems.
The second software pillar then must make sure this root of trust is not undone by attempts to obtain secret information during execution and uses hardening techniques such as code obfuscation, which essentially make software difficult to reverse engineer and therefore hack.
The third pillar, watermarking, depends on both the other pillars for the trusted insertion of unique identifiers into payloads. Then potential hackers cannot readily determine what the identifiers are in an attempt to undo the watermarking. Yet if pillars one and two are effectively bypassed through content redistribution by somebody who is or pretends to be a legitimate subscriber, watermarking is still there and able to pinpoint the source quickly, at least in theory.
This raises the other main point of the MovieLabs specification highlighted by Verimatrix, which is that because it was developed to tackle threats in the connected era, there is a greater emphasis than before on stopping redistribution over IP networks and shutting down infringing sources of pirated content as quickly as possible. The aim is to avoid the ‘hack once, hack all’ scenario through the ability to revoke content sources in as near real time as possible.
As yet few pay TV services have incorporated this 4K mandate. For one thing, unlike set tops, mobile devices do not have keys factory installed but added afterwards, while watermarking is not yet widely deployed. That will change given the growing realization that watermarking is needed not just to protect premium movie content, but also to protect live sports.
There is also a realization that watermarking may be necessary but is not sufficient on its own to counter live stream piracy. There also has to be continuous surveillance spanning the whole Internet to detect illicit live streams very quickly so that action can be taken in near real time, given how quickly the value of live sports decays with time. This was behind Verimatrix’ recently announced partnership with UK based Friend MTS, bringing together the former’s VideoMark watermarking system with the latter’s network forensics, which is aimed at all premium content but particularly live.