1. Content protection for 4k
Studios’ Viewpoint
HDMI Link
DRM
9/17/2018
Sony Pictures Confidential

2. Sony Pictures Confidential
Starting Point
4k in the home is being driven by CE.
Studios show little interest in releasing 4k to the home.
Studios can and will likely wait for an enhanced content protection system before releasing 4k premium content.
Enhanced content protection debate has already started in Ultraviolet
Studios want enhanced content protection for HD
Implementers have proposed it for 4k, early window and 3D
Blu-ray was different. Both CE and studios wanted HD discs therefore compromises were made.
9/17/2018
Sony Pictures Confidential

3. Content Protection Overview
DRM
Link Protection – Last six feet
Protecting the content from the service provider all the way to the video buffers
Ultraviolet has 5 DRMs for improved interoperability
Today’s DRMs rely on renewable components to respond to security breaches
E.g. Adobe Flash player updates
Most DRMs today are “hack one, hack all”
When the DRM is compromised, all titles published to date are exposed
HDCP over HDMI interface
HDCP 1.x is compromised
HDCP 2.1 is much more secure
Sony 4k products only have HDCP 1.x
DTCP-IP
Link protection for DNLA
Not all Sony products with DNLA have DTCP-IP (that means there is no premium content over DNLA)
Some studios do not believe DTCP robustness requirements are good enough.
9/17/2018
Sony Pictures Confidential

4. HDCP Link Protection for HDMI
HDCP 1.0 published in 2003
56-bit proprietary encryption algorithm
Key generation algorithm secrets were reverse engineered so device keys can be generated by anyone
HDCP has no response for that scenario
HDCP 2.0 published in 2008, HDCP 2.1 published in 2011, HDCP 2.2 is in adopter review (as of 8/12)
HDCP 2.x has higher robustness requirements that HDCP 1.4
128-bit AES standard encryption
New security model, not vulnerable to same attack as HDCP 1.4
Studios will require HDCP 2.1 or later for 4k content.
Sony 4k TVs only support HDCP 1.4.
9/17/2018
Sony Pictures Confidential

5. AACS – Blu-ray’s Content Protection
Design started in 2002
Sony, Panasonic, Toshiba, Intel, Microsoft, IBM, Disney, Warner Bros
Different security models for CE and IT
Unique device certificates for hardware BD players because CE did not want to have to download new firmware
Shared device certificates for software BD players because cannot securely incorporate unique device certificates in software players
Response to a security breach is to revoke compromised device certificates
High definition analog outputs were permitted
Studios did not want analog outputs because analog outputs cannot be protected
CE needed to accommodate a legacy of several million HD TVs without digital inputs
Compromise was HD analog sunset in December 2010
Fox disliked AACS so much they introduced BD+
9/17/2018
Sony Pictures Confidential

6. AACS – Breach Management
Breach response is to revoke compromised certificates so that they cannot be used to play AACS content
When a device certificate compromised all Blu-ray discs mastered until that certificate is revoked can be ripped.
This is “hack one, hack all”
Revocation takes 3-6 months including due process for licensee
Revocation only protects discs mastered after the certificate was revoked
If a software player certificate is revoked consumers will have to update software players in order to play new discs.
If a hardware player certificate is revoked the player is bricked (since CE did not want to support renewability)
Makers of commercial ripping software obfuscate the certificates they are using making it very difficult to know which certificate to revoke
Some commercial ripping software is SaaS
Revocation only works at all until someone figures out how to hack a hardware player
When that happens AACS revokes the player certificate, pirate buys a new player, repeat
9/17/2018
Sony Pictures Confidential

7. What do we learn from AACS?
What it means for 4k
Legacy HDTVs with only analog outputs were accommodated only because all parties wanted HD discs.
“Hack one, hack all” has to be avoided.
Compromised certificates came from weak software implementations
Revocation does not work: too slow, cannot always tell which certificates to revoke, has an epic fail scenario.
Since studios aren’t in a hurry for 4k they are unlikely to accept lower security standards in “legacy” 4k products
Content protection needs to be per-title (or even per account) – no more hack one, hack all
Third party certification of security implementations
Continuous breach monitoring, rapid breach response, proactive breach response.
9/17/2018
Sony Pictures Confidential

8. Enhanced Content Protection
Select a security solution provider with a proven track record
Software diversity per title and even per account
Decode in Trusted Execution Environment
Protected right up to the video buffer
HDCP 2.2* required for output
Device keys protected by a Hardware Root of Trust
Require 3rd party verification of trusted DRM software
* HDCP 2.1 until HDCP 2.2 required by HDCP licensing terms
9/17/2018
Sony Pictures Confidential

9. Sony Pictures Confidential
Breach Management
Security provider monitors Internet (websites, chat rooms, IRC, etc) for indications of security breaches
Security provider works with manufacturers to identify circumventions used by attackers
Countermeasures developed and deployed immediately a breach is detected
Some new content may prevent playback on certain devices until player is up-to-date
“Tracing Traitors” mechanisms to track compromised implementations
9/17/2018
Sony Pictures Confidential

10. Content Protection Recommendations
SPE recommends engaging with an established security solutions provider
For example NDS, a Cisco company, has a long history in content security. While NDS does not have a current product that meets the requirements, they have the component technologies.
We can socialize the idea with the other studios
Avoid the 2-3 years to create a new content protection system
Longer if too many companies are involved
9/17/2018
Sony Pictures Confidential