Macrovision has splashed out over $45 million to buy one of the key content protection technologies for High Definition video, from 15 man research company Cryptography Research Inc (CRI).
Over the past ten years the web has been full of stories around how a 14 year old boy from Norway, nicknamed DVD Jon, broke the Content Scrambling System (CSS) encryption process on DVDs and published the ‘how to’ code (DeCSS) all over the internet. So virtually every security expert in the world set out to design a system where this couldn’t happen again, for the vitally important HD disks which are now being embraced by the US studios in two competing formats, Blu-Ray and HD DVD.
In the end the Self Protecting Digital Content idea which came out of CRI was embraced under the name BD+ on top of a new CSS called AACS (Advanced Access Content System), the primary first line encryption defense on both formats of High Definition DVDs. A third protection called ROM mark was also added to the Blu-ray system giving it a triple protection, with the HD DVD Forum claimed that BD+ is in fact based on a new device operating system, which is in itself attackable.
Macrovision is one of the companies that came to the rescue of the current generation of CD players and CD media, using its own CDS 300, a system of software that can be added to CDs which allows copies to be made of the content, but these are copies which themselves cannot be copied. In other words, Macrovision invented a similar technology, along with its analog protection system, to the one that Cryptographic Research has designed for DVD players.
Macrovision tried to do much the same thing in first generation DVDs with its RipGuard product line, adding extra protection over and above CSS, protecting against most DeCSS ripping procedures. It only seems naturally that Macrovision will be in one of the best positions to exploit the CRI inventions in the next generation DVDs.
But the actual underlying technology to SPDC is quite a bit more complex and comprehensive than perhaps the HD DVD people have given credit, and it was one of the reasons given for the attraction of many of the content companies, particular Fox, to the Blu-ray Disk (BD) format.
Back in December 2004 we talked this system through with Carter Laren, Chief Architect, Content Protection at CRI who told us that the system was based on a virtual machine that can be implemented in both hardware or in software only, initially based on a stripped down DLX processor with the floating point removed and a few APIs added to improve security. The original DLX is a 32-bit pipelined embedded RISC CPU architecture that came out of academia and was originally designed for teaching, not too unlike the ARM RISC core.
It can be built in hardware or expressed in a hardware language like the Verilog Hardware Description Language and CR has a reference implementation in the C programming language, Laren told us. So perhaps we should think of its as Java for the DVD player.
SPDC then sits above this and does a number of trick. It writes a few bits of player specific data into each version of the content it plays out, rather like a dynamic, player specific watermark, and it can revoke and remove license data and allow multiple DRMs to operate above it.
The idea is that if the content is found on a P2P site, the player can be identified, and a subsequent release can be issued from the studio to act as a trigger to revoke decryption licenses. These instructions can be carried on any subsequent DVD disks issue by the studio.
But SPDC content can also be programmed to dynamically query playback environments and can include some attack detection logic, which runs while the content is playing, to decide if someone is trying to make an illegal copy or not.
Any system like this is only as secure as the virtual machine that it all plays on, which is what stops the casual pirate from being able to break into this set up, professional pirates are another matter and this is not aimed at them.
CRI must have been widely successful in preventing much of the piracy out there, which is what has brought this value to its intellectual property. Its revenue model was to charge no royalty to the consumer electronics manufacturers and instead bills the studios a few cents for each HD disk that is pressed using the technology.
Back in January, predictably, the AACS encryption system was broken, which was the first line of defense, and used on both DVD formats, HD and Blu-ray, when some encrypted files, along with their keys, were found on P2P sites. But clearly the BD group suffered less embarrassment here, as it was not fully hacked, and using SPDC, it will have been possible to contain many of the casual hacking attempts.
In addition to the $45 million up front in cash, the deal includes a significant number of warrants being transferred to CRI, exercisable for Macrovision stock, a portion of which are subject to performance milestones. What Macrovision gets out of the deal are CRI patents, security software, and related third party customer and partner agreements.
Already BD+ has been adopted by more than 20 companies, including major consumer electronics manufacturers and motion picture studios and once the deal is concluded, Macrovision will be the primary licensor of BD+ technology to studios.
The revenue will allow CRI to invest in the other areas of its business, which includes protecting smart cards and other electronic devices from Differential Power Analysis and related attacks. CRI is also widely understood to have designed defenses against DPA, a process whereby sensors on a chip can monitor its pathways in an attempt to find how and where a decryption key is applied or recorded. Defenses include setting up dummy signal paths to confuses the detection. CRI also wrote the SSL3 secure sockets layer security version for the IETF.