Content protection for 4k Studios’ Viewpoint HDMI Link DRM 9/17/2018 Sony Pictures Confidential

Sony Pictures Confidential Starting Point 4k in the home is being driven by CE. Studios show little interest in releasing 4k to the home. Studios can and will likely wait for an enhanced content protection system before releasing 4k premium content. Enhanced content protection debate has already started in Ultraviolet Studios want enhanced content protection for HD Implementers have proposed it for 4k, early window and 3D Blu-ray was different. Both CE and studios wanted HD discs therefore compromises were made. 9/17/2018 Sony Pictures Confidential

Content Protection Overview DRM Link Protection – Last six feet Protecting the content from the service provider all the way to the video buffers Ultraviolet has 5 DRMs for improved interoperability Today’s DRMs rely on renewable components to respond to security breaches E.g. Adobe Flash player updates Most DRMs today are “hack one, hack all” When the DRM is compromised, all titles published to date are exposed HDCP over HDMI interface HDCP 1.x is compromised HDCP 2.1 is much more secure Sony 4k products only have HDCP 1.x DTCP-IP Link protection for DNLA Not all Sony products with DNLA have DTCP-IP (that means there is no premium content over DNLA) Some studios do not believe DTCP robustness requirements are good enough. 9/17/2018 Sony Pictures Confidential

HDCP Link Protection for HDMI HDCP 1.0 published in 2003 56-bit proprietary encryption algorithm Key generation algorithm secrets were reverse engineered so device keys can be generated by anyone HDCP has no response for that scenario HDCP 2.0 published in 2008, HDCP 2.1 published in 2011, HDCP 2.2 is in adopter review (as of 8/12) HDCP 2.x has higher robustness requirements that HDCP 1.4 128-bit AES standard encryption New security model, not vulnerable to same attack as HDCP 1.4 Studios will require HDCP 2.1 or later for 4k content. Sony 4k TVs only support HDCP 1.4. 9/17/2018 Sony Pictures Confidential

AACS – Blu-ray’s Content Protection Design started in 2002 Sony, Panasonic, Toshiba, Intel, Microsoft, IBM, Disney, Warner Bros Different security models for CE and IT Unique device certificates for hardware BD players because CE did not want to have to download new firmware Shared device certificates for software BD players because cannot securely incorporate unique device certificates in software players Response to a security breach is to revoke compromised device certificates High definition analog outputs were permitted Studios did not want analog outputs because analog outputs cannot be protected CE needed to accommodate a legacy of several million HD TVs without digital inputs Compromise was HD analog sunset in December 2010 Fox disliked AACS so much they introduced BD+ 9/17/2018 Sony Pictures Confidential

AACS – Breach Management Breach response is to revoke compromised certificates so that they cannot be used to play AACS content When a device certificate compromised all Blu-ray discs mastered until that certificate is revoked can be ripped. This is “hack one, hack all” Revocation takes 3-6 months including due process for licensee Revocation only protects discs mastered after the certificate was revoked If a software player certificate is revoked consumers will have to update software players in order to play new discs. If a hardware player certificate is revoked the player is bricked (since CE did not want to support renewability) Makers of commercial ripping software obfuscate the certificates they are using making it very difficult to know which certificate to revoke Some commercial ripping software is SaaS Revocation only works at all until someone figures out how to hack a hardware player When that happens AACS revokes the player certificate, pirate buys a new player, repeat 9/17/2018 Sony Pictures Confidential

What do we learn from AACS? What it means for 4k Legacy HDTVs with only analog outputs were accommodated only because all parties wanted HD discs. “Hack one, hack all” has to be avoided. Compromised certificates came from weak software implementations Revocation does not work: too slow, cannot always tell which certificates to revoke, has an epic fail scenario. Since studios aren’t in a hurry for 4k they are unlikely to accept lower security standards in “legacy” 4k products Content protection needs to be per-title (or even per account) – no more hack one, hack all Third party certification of security implementations Continuous breach monitoring, rapid breach response, proactive breach response. 9/17/2018 Sony Pictures Confidential

Enhanced Content Protection Select a security solution provider with a proven track record Software diversity per title and even per account Decode in Trusted Execution Environment Protected right up to the video buffer HDCP 2.2* required for output Device keys protected by a Hardware Root of Trust Require 3rd party verification of trusted DRM software * HDCP 2.1 until HDCP 2.2 required by HDCP licensing terms 9/17/2018 Sony Pictures Confidential

Sony Pictures Confidential Breach Management Security provider monitors Internet (websites, chat rooms, IRC, etc) for indications of security breaches Security provider works with manufacturers to identify circumventions used by attackers Countermeasures developed and deployed immediately a breach is detected Some new content may prevent playback on certain devices until player is up-to-date “Tracing Traitors” mechanisms to track compromised implementations 9/17/2018 Sony Pictures Confidential

Content Protection Recommendations SPE recommends engaging with an established security solutions provider For example NDS, a Cisco company, has a long history in content security. While NDS does not have a current product that meets the requirements, they have the component technologies. We can socialize the idea with the other studios Avoid the 2-3 years to create a new content protection system Longer if too many companies are involved 9/17/2018 Sony Pictures Confidential