NAGRA - Optimizing Multiscreen TV Delivery with a Secure Video Player

OPTIMIZING MULTISCREEN TV DELIVERY WITH A SECURE VIDEO PLAYER WHITE PAPER - AUGUST 2015

SECURE – ENGAGING – EVERYWHERE

DTV.NAGRA.COM

2

EXECUTIVE SUMMARY This paper looks at the market needs and challenges that pay-TV service providers face when deploying multiscreen TV solutions on third-party consumer electronic (CE) devices such as PCs, tablets, and smartphones. It evaluates the alternative solutions that are available for addressing the needs of both content owners and service customers, and it examines the potential business benefits of choosing an operator-controlled solution delivered by a trusted content-security partner. The paper is based around the following key themes :

+

CE devices use a wide range of fast-evolving OS platforms, streaming standards, DRM products.

+

Pay-TV service providers face significant challenges in delivering OTT multiscreen services to these ever-changing CE devices.

+

They are dependent on decisions taken by device manufacturers and sudden changes in browser or operating platforms can be very disruptive and have a negative impact on pay-TV customers and service providers.

+

Google’s recent withdrawal of support for the NPAPI plug-in on its Chrome browser is a case in point and has caused problems for some leading pay-TV service providers.

+

Service providers could opt for common encryption DRMs for their OTT TV services, hoping to solve all their interoperability issues, but this approach will only address part of the technical and business challenges.

+

A better option is an operator-controlled secure player solution delivered by a trusted content security partner that ensures a consistent user experience across all devices while providing value over the entire lifecycle of CE devices.

FURTHER INFORMATION NAGRA has published a range of additional information on the MediaLive Secure Player portal which can be found at https://medialive.nagra.com.

To discuss your requirements for a Secure Player deployment in your organization, please contact your Account Manager or email us at dtv@nagra.com

3

CHALLENGES IN MAXIMIZING THE REACH OF OTT DEVICES OTT TV services are increasingly important to pay-TV service providers as they deploy multiscreen offerings to complement their core services and to compete more effectively with Internet-based rivals. But delivering them over consumer electronic (CE) devices such as PCs, tablets, smartphones, video game consoles, and smart TVs presents several significant challenges regardless of the operator’s network type – whether telco, cable, or satellite. Many of these challenges result from the fact that – unlike the pay-TV set-top-box environment – service providers do not have control of the open devices, which use a wide range of operating systems and standards.

CHALLENGE #1 : KEEPING CONTROL

some service providers, this potentially presents a very

OVER DEVICE PLATFORMS

significant challenge. For example, Google’s decision

Service providers are dependent upon strategic and

led Sky and BT Sport to encourage their subscribers

technological decisions taken by device manufacturers

to move from Chrome to Firefox or Internet Explorer 3.

and software providers. This can leave them vulnerable, for example, to changes in browser pl atfor ms

The theoretical solution to the problem is greater OTT

used on PCs and to the Android and iOS operating

standardization, which would enable service providers

systems of mobile devices. This can also mean that

to increase their efficiency and reduce the risk in

multiscreen TV applications that worked previously

delivering OTT services. While there has been some

may suddenly stop streaming content, creating havoc

technical progress in simplifying streaming formats,

with subscribers and leading to calls to customer-care

codecs, and DRM, the reality is that standardization is

centers, dissatisfaction with the operator, damage to

an ever-evolving process that brings alignment over

its brand, and loss of revenue . Rather than cement

time but is not the panacea to all market needs in the

and strengthen the relationship between pay-TV service

short term. A more pragmatic approach is required.

1

providers and their customers, OTT TV – if not deployed carefully – could potentially end up undermining

CHALLENGE #2 : KEEPING CONTROL

customer confidence.

OVER CONTENT SECURITY Service providers also need to ensure that content

The latest example of this kind of potentially disruptive

security standards are not compromised by choosing

change is Google’s decision to implement the HTML5

a vertical, per-device, per-platform and per-browser

Encrypted Media Extensions (EME) standard to manage

vendor approach, and that content licensing complexities

DRM content in the Chrome browser, while phasing

are not increased by having to deal with multiple DRM

out support for the Netscape Plug-in API (NPAPI) (see

vendors. Pay-TV service providers should not forget that

Case Study 1). The withdrawal of support for NPAPI

the very Silicon Valley giants (i.e. Apple, Google, and

– on which Microsoft’s Silverlight streaming media

Microsoft among others) that sometimes unilaterally

application framework and its PlayReady DRM depend –

define their proprietary technologies are also their

will affect pay-TV subscribers whose service providers

competitors in delivering OTT TV. As a result, dependency

use these players to provide video content within a

on the strategies of these companies increases business

Chrome browser. Given that the share of the Google

risk levels for service providers.

Chrome PC browser users is estimated to be more than 52% 2 of a typical pay-TV operator’s subscriber base and that Silverlight and PlayReady are widely used by

4

CHALLENGE #3 : KEEPING CONTROL

As well as streaming standards and DRMs, it is

OVER THE TV EXPERIENCE

important to include the overall and consistent control

Another fundamental requirement is the provision of

of the TV experience delivered across multiple devices

a consistent set of pay-TV-centric features and use

that also interact with each other.

cases, available across all devices and platforms.

Such capabilities are best provided by a secure player,

Understanding the longer-term implications of

with features such as multiple audio tracks, subtitles,

technical decisions related to OTT and multiscreen

dynamic advertising, and trick modes, as well as use

TV content delivery and their impact on business is

cases such as casting or sharing between devices.

absolutely key for the success of service providers.

1

According to consulting firm nScreenMedia, US and European pay-TV operators are spending an estimated $2.8 billion of their almost $10 billion annual network and maintenance expenses to directly address multiscreen service delivery failures

2

http://www.rapidtvnews.com/2015071539066/pay-tv-operators-spend-billions-to-address-multiscreen-delivery-failures.html

An estimated 52% of World Wide Web users use Google Chrome as their browser on their personal computers, according to StatCounter.com

3

“Sky has no plans to fix Chrome compatibility after Google’s Silverlight shun”, The Inquirer, May 1, 2015 http://www.theinquirer.net/inquirer/news/2383624/google-will-kill-microsoft-silverlight-in-chrome-by-disabling-npapi-plug-in

5

CASE STUDY 1 : GOOGLE CHROME Google’s decision to withdraw support for NPAPI on its Chrome browser created a potential challenge for pay-TV service providers who were faced by a significant percentage of their base not being able to watch their content via a Chrome browser. After Google announced the change in September 2013, NAGRA started developing a solution so that affected premium content could continue to be delivered securely to Chrome browsers.

Google’s new Pepper Plug-in API (PPAPI), which

extension via the online Chrome Web Store, so it can be

replaces NPAPI, is intended to increase security for

easily installed by end-users. Updates are performed

browsers as it provides a direct link to a sandboxed

via the operator’s Chrome Web Store account and easily

environment where the code is executed – Chrome’s

installed to the end-user’s Chrome browser.

Native Client (NaCI) – and provides greater stability, as the code is executed in a separate thread rather than in

With this solution, NAGRA ensures that pay-TV service

the main browser thread. It is also designed to facilitate

providers who had been using Silverlight and PlayReady

code portability across different platforms.

can continue to provide video services to their Chrome customers with only a simple action required by the

Google’s justification for its action is that PPAPI/NaCl

subscriber. As a result, service providers do not have

is more advanced and allows plug-ins to work more

to adopt another DRM (i.e.Google Widevine) and player

seamlessly and securely within Chrome. However, the

or point their subscribers to use Firefox, IE or Safari

move needs to be considered in the context of the wider

browsers instead of Chrome.

commercial battle between Google and Microsoft and the fact that it may push service providers towards

NAGRA continues to deliver the NPAPI secure player

adopting Google’s Widevine DRM.

plug-in for Internet Explorer (on Windows), Firefox (Windows and OSX), and Safari (OSX), ensuring support

NAGRA’s new PPAPI/NaCI browser plug-in is packaged as the NAGRA MediaLive Secure Player for Chrome, and integrates NAGRA anyCAST PRM, NAGRA’s studioapproved DRM. It is fully compliant with the new HTML5 Chrome browser security architecture. The secureplayer browser plug-in is delivered as a Chrome

6

for all major browsers.

MARKET AND TECHNOLOGY CHALLENGES In addition to the challenges pay-TV service providers face in maximizing device reach, there are also several complex technology-based challenges that need to be considered to ensure the delivery of a high-quality video product : +

+

Selection of a reliable OTT streaming standard

+

Deployment of rich multiscreen TV user

to provide an optimal solution in a complex and

experiences that ensure superior TV-centric

fragmented environment;

services across all screens;

Selection of proven content-security solutions

+

Addressing an ever-evolving, growing range of

that provide the best technology to deliver secure

devices and platforms while ensuring fast time

content to all screens;

to market and optimized costs for launching services to new screens.

OTT STREAMING STANDARDS :

many different versions of the same content still adds

WHAT ARE THEY, WHAT IS COMING NEXT ?

operational complexity.

Standards and Fragmentation: No Panacea

The video and pay-TV industries have tried to confront

V ideo streaming over the Internet has evolved

this situation by creating a common format through the

tremendously over the past decade. Adaptive bitrate

DASH Industry Forum, created in 2012. The vision here

(ABR) streaming formats such as Apple HLS and

involves the combination of the DASH adaptive bitrate

Microsof t HS S have emerged, along w ith A E S

streaming format with the CENC common encryption

encryption and interoperable DRM products. Despite

scheme for protecting content 4.

this, there has been considerable fragmentation in the s tr eaming for mat s and DRMs that ar e

In addition, feature fragmentation both from a DRM and

implemented on specific devices, creating the need

Video Player perspective are also an issue. Indeed, while

to re-encode and re-encrypt content several times

modern browsers include a video player and support

in order to reach as broad a range of devices as

for a DRM, the supported feature set varies from one

possible. While more recent origin servers allow to

browser to another. For instance, one given subtitle

re-encrypt content on the fly, hence removing the

format supported on one browser is not on another.

need for ever-increasing storage, having to deal with

4

NAGRA was shortlisted (and won the runner-up award) at the IBC 2013 Innovation Awards for the first commercial deployment of DASH/CENC in the market.

SERVICE PROVIDERS SHOULD ASSUME THE CONTINUATION OF A FRAGMENTED MARKET AND PLAN TO PROVIDE AN ABSTRACTION LAYER – IN THE FORM OF A SECURE PLAYER SOFTWARE CLIENT – TO MANAGE THE DIFFERENT STANDARDS AND PLATFORMS.

7

DASH and CENC as New Alternatives

The positive news is that DASH has started to replace

CENC allows encr yption to be done once, with

legacy Microsoft HSS and Adobe HDS formats and

decryption performed across multiple DRM clients as

is expected to become the industr y standard ABR

required. In theory, this allows a substantial reduction

format. The very nature of next-generation streaming

in the complexity of both content preparation and

standards is to decouple the file format from the actual

packaging workflows. A single secured file can be

DRM used and ensure that multiple DRMs can coexist.

played out across multiple devices which each support

Indeed, we can expect to see more devices emerge

a specific DRM client product.

with their own native DRM when it makes sense for the device vendor.

In practice though, fragmentation remains extensive.

Apple, for instance, imposes its own HLS streaming

Planning for Evolving Standards : Being Pragmatic

standard on its devices and has not yet adopted

The technology industr y is notorious for defining

DASH. In addition, some legacy CE devices with older-

“standards” that take several release cycles to dislodge

generation browsers do not natively support DASH and

previous-generation technologies. In this context, it

rely on NPAPI Microsoft or Adobe plug-ins to play back

would be wise for service providers to take a pragmatic

DRM-protected content. Moreover, the different options

stance and consider that standardization is always

that one can select within the DASH specification can

likely to be a highly desirable outcome rather than a

also lead to fragmentation, as the specification provides

sure reality. So they should assume the continuation of

the choice of several audio codecs, different encryption

a fragmented market and plan to provide an abstraction

schemes and other specific features.

layer – in the form of a secure player software client – to manage the different standards and products.

SELECTED ABR STREAMING STANDARDS HLS (HTTP Live Streaming)

Proprietary : Apple, for QuickTime X and iOS

HSS (HTTP Smooth Streaming)

Proprietary : Microsoft, for Silverlight plug-in

HDS (HTTP Dynamic Streaming)

Proprietary : Adobe, for Flash plug-in

DASH (Dynamic Adaptive Streaming over HTTP)

MPEG and ISO international standard

CENC (Common Encryption Scheme)

Enables the same encrypted file to be used by different DRM systems

NAGRA IS INVOLVED IN THE DASH STANDARDIZATION EFFORT AND IS THE LEAD EDITOR OF THE RECENTLY RELEASED CONTENT PROTECTION INFORMATION EXCHANGE FORMAT (CPIXF), A SPECIFICATION THAT ALLOWS DRM LICENSE SERVICE PROVIDERS TO PERFORM EASIER PREINTEGRATION WITH OTHER COMPONENTS OF THE STREAMING BACKEND SUCH AS ENCODERS AND CDNS, HENCE DELIVERING SIGNIFICANT COST 8 SAVINGS WHILE IMPROVING TIME TO MARKET AND AGILITY.

CONTENT SECURITY : HOW TO DELIVER

support only PlayReady, without allowing the option of

THE BEST CONTENT ON EVERY SCREEN

implementing another DRM product.

Pay-TV service providers typically seek to license the

As a result, service providers find themselves forced

best available Hollywood and live TV content, which

into relationships with multiple DRM vendors, one

implies high protection requirements as rights holders

for each vendor-controlled platform on which they

are wary of piracy and its impact on the business model

want their content to play out. This has three major

of the entire content value chain.

implications :

Approved DRM Products and

(1) It increases the complexity and costs of content

Robust Client Implementations Delivering HD content to high-resolution screens including tablets, PCs, and game consoles requires

rights negotiations ; (2) Some content may not get the same rights, or face a different liability on different platforms ;

the use of various pieces of technology to maximize

(3) Service providers are left with little control over

content security. This includes advanced content-

the way that the DRM products evolve on a given

protection technology based on DECE and DTLA studio-

platform.

approved DRM products, as well as sophisticated software techniques such as whitebox cryptography,

Optimizing this increasingly complex situation is a key

secure video paths, sunrise key change, output

requirement.

control, software obfuscation and hardening, and – when available – Hardware Root of Trust to ensure the

Support for Multi-Usage Scenarios

proper client implementation of the DRM module and

Another important issue concerns content-usage

the overall security of the client platform.

rules. For Hollywood studios and other rights holders, the rights to view content on a small screen are worth

In the browser environment, the World Wide Web

significantly less than those for viewing the same

Consortium (W3C) has worked at defining a secure

content in HD on a large flat-panel display. Preventing

architecture for implementing DRMs using either the

users from casting content without authorization has

native HTML5 Embedded Media Extension (EME) or

become a big concern in rights negotiations. A secure

through secured plug-ins.

player solution that can manage this requirement and ensure that content is played out on the intended

DRM Vendor Choice

screens as laid down in the negotiated contract (with

With EME and CENC, content can be encrypted once at

secure reporting back to the content rights owners)

the head-end and multiple DRM servers can be used to

offers significant value to service providers.

generate licenses for specific DRM clients. However, the DRM implementation carried out by browser vendors

Other rules for distributing and sharing content –

such as Google has tended to be restrictive for service

usually managed by the DRM system head-end and

providers: only one DRM is natively supported. Thus they

implemented in a secure-player client – can be defined

are implicitly forced to use a proprietary consumer-

by content type or by device. They need to be securely

device DRM such as Google Widevine. Fortunately,

transported to the device, which means that rooted

newer generation browser plug-in frameworks such as

device and jailbreak detection is also required to ensure

Chrome PPAPI – that include auto-update capabilities –

that the usage rules are not tampered with.

can also be used, thereby avoiding a total dependency on a single DRM vendor; this is the approach that NAGRA has taken. However, some less widely deployed devices, such as the Microsoft Xbox games console,

9

BEYOND SECURITY :

There are several key aspects to the deployment of a

WHY A VIDEO PLAYER IS REQUIRED

secure video player :

Beyond confronting the challenges involved in managing

CDNs : The ability to dynamically select the best source

a multi-DRM environment, service providers face other

of content implies that algorithms are embedded into

requirements to ensure that their OTT TV services

the secure player to optimize the user experience

function optimally. These include the provision of :

and the costs of streaming content.

+

Video trick modes

+

Multi-CDN interfacing and dynamic selecting

retrieved from the backend and used by the player,

+

Multi-audio, close captioning and

especially in the context of advanced use cases

multi-language subtitles

such as local storage of downloaded content for

+

Parental and playout control

offline playback and side-loading of content to other

+

Dynamic Advertising Insertion (DAI)

devices.

+

Detailed user-behaviour analytics

DRM servers : Key information needs to be securely

Analytics : Measuring the Quality of Experience (QoE) All these functions need to be packaged together on the

by capturing deep data on player and user behaviour

client side before interfacing with backend systems, and

enables the improvement of products and services.

this is best achieved with a secure video player.

Ad platforms : With Dynamic Ad Inser tion being In the early days of OTT TV, the licensing of premium

imposed by more content providers, it is important

content was mainly a DRM issue. But these new

to deploy smart interfaces with leading advertising

requirements – which result from the huge uptake in

delivery and tracking systems (such as Freewheel,

OTT TV consumption – have set new expectations that

Omniture, ComScore, and Nielsen). A secure player

increase the need for service providers to adopt a multi-

can include ID3 demuxing capabilities to control

purpose, multi-platform secure player solution.

ad-skipping and disable the search bar during ad play-out and thereby have a direct impact on the price of ads sold and revenues shared with content providers.

Player packaging : The way the secure player is packaged also has to be taken into consideration.

Having access to a browser plug-in for HTML5/JS app development on PC platforms or an SDK for native app development on iOS/Android platforms allows the development of rich user experiences.

Another attractive option is a packaged app that embeds HTML rendering capabilities, enabling the development of apps using HTML/JS with the same back-end business logic that is portable across multiple platforms, leading to lower app maintenance and deployment costs.

10

Customer UEX Native/HTML – JavaScript DRM & Player APIs Player Core I/O Adaptive Streaming Stack

H.264, AAC A/V Synch

Video Trick Modes Close Captioning, Subtitle Rendering

Download Management

Output Control

Upgrade Management

Device Management

Security Core License Management

Rooting /Jailbreak Detection

Cryptography

SECURE VIDEO PLAYER OVERVIEW In scenarios where such a generic secure player

process to manage, in which different technologies

cannot be deployed – games consoles, for instance –

and skills are required to deliver robust applications

a platform-specific solution may be required, with the

at the lowest cost and with the highest level of

core secure-player principles and APIs implemented

customer satisfaction.

using a specific DRM client and file-streaming format, adding controlled multi-DRM capabilities to the

Anticipating Evolution

overall platform.

For service providers, the standardization of streaming technologies and the availability of some open-source

EVER-EVOLVING DEVICE PLATFORMS : WHY

player components like dash.js can help reduce costs,

AN OTT TV APP CONSTANTLY NEEDS UPDATING

but there are other issues to address. The overall challenge of managing app evolutions across a large

Accelerated Device Update Lifecycles

number of client platforms and devices adds risks and

A new phenomenon in the CE industry over the past

costs to home-grown OTT TV operations. For instance,

five years has been the accelerated pace of innovation

staying ahead of rapid platform evolution often means

brought on by frequent software renewals during the

having dedicated technical staff who are involved with

lifecycle of a hardware device. In the smartphone and

leading software vendors and developer communities.

tablet segment, Apple and Google update their OS and

This represents a fixed cost that can be significant for

app platforms several times a year, while desktop

service providers in the early phases of deployment

browsers are also regularly improved by software

or which have a geographically constrained customer

vendors, with software updates automatically pushed

base. Opting out of such involvement, however, could

to users. Similar approaches have systematically

lead to a risky situation where service providers could

emerged for OTT streaming boxes and casting sticks,

face a service blackout.

games consoles and connected T Vs. Ensuring that video content is always seamlessly played out on all supported devices can quickly become a complex

11

KEY APPROACHES TO CONSIDER As previously discussed, modern multiscreen TV-streaming services require a secure video player that has at its core both an operator-controlled studio-approved DRM product and a secure-client implementation that delivers advanced TV features. In this section, we analyze the benefits and limitations of each approach.

GENERIC OR OPERATOR-CONTROLLED DRM :

can access the OTT TV service within the same home

WHICH APPROACH BEST ADDRESSES

requires specific DRM license management features

THE INDUSTRY’S NEW NEEDS ?

– most of which are not provided by the CE vendors’ generic DRM products. This can lead to three main

Consumer Electronics DRM Products

problems for pay-TV service providers – (1) security

At first glance, the adoption of DASH and CENC along

loopholes; (2) missing or incomplete content rights;

with the implementation of new Web browser standards

(3) missing or incomplete use-case support – with the

should greatly simplify the delivery of DRM-protected

latter two impacting user experience.

content to different devices that natively support CE DRM clients such as Microsoft PlayReady, Google

An operator-controlled DRM product provides the same

Widevine, Adobe PrimeTime, or InterTrust Marlin. In

core features and content-protection capabilities as a

theory, all that would then be needed is a multi-DRM

generic DRM as well as the required flexibility and extra

backend key server to establish the proper interfaces

features that allow service providers to stay ahead

with the different DRM systems.

of the competition. By packaging such an operatorcontrolled DRM product within a secure player that

This approach is relatively simple to implement on the

delivers similar capabilities across multiple device

server side and does not require deep integration on the

platforms, service providers have a powerful tool for

client side. But it forces service providers to surrender

delivering a superior, seamless consumer experience.

significant control to the Silicon Valley giants which

They are also able to benefit from the strengths of a

provide DRM products for an increasingly important

product that is published by a focused security provider.

aspect of their pay-TV operations. Moreover, it can constrain service providers, preventing them from

So a service provider should make use of an operator-

evolving their platforms to satisfy content-provider

controlled DRM as much as possible, packaged within a

licensing requirements or to offer more advanced

secure player, and restrict the use of third-party DRMs

services.

to scenarios where the limitations and constraints of the target platform are fully acknowledged.

Operator-controlled DRM products As more devices are used to access TV content within the connected home – either on-demand (unicast) or live (unicast and multicast) – the rules for content sharing and usage need to be defined centrally, at the head-end, and then applied to the different devices in the home, usually through a secure-player client that leverages specific DRM rules. For instance, transferring a PVR recording to a tablet or starting to watch a movie on a PC and then casting it to a TV set while limiting the number of concurrent viewers who

12

DO-IT-YOURSELF (DIY) VERSUS VENDOR PLAYER

In addition, the risks of being late to market, or of not

SOLUTIONS : W HICH A PPROACH TO INCRE A SE

being able to support some key devices and therefore

DEVICE REACH AND REDUCE COSTS ?

disappointing subscribers, can have a negative impact on customer acquisition and increase churn.

Multiscreen TV is all about extending device reach to address the diverse needs of subscribers while

Vendor Secure-Player Solutions

ensuring the delivery of quality pay-TV experiences to

Vendor solutions typically leverage secure-player

all selected devices. This is better delivered by using

products deployed worldwide and can provide huge

a secure player that can be developed in-house or

economies of scale, allowing ser vice providers to

sourced from a software vendor.

benefit from vendor expertise and firepower. This approach helps improve time-to-market and delivers

DIY Secure Players

leading solutions that are widely deployed by some of

The DIY approach gives service providers control and

the TV industry’s most demanding players.

flexibility on how they implement their multiscreen clients and apps, but the cost and complexity of

Vendor solutions also offer access to an advanced

addressing an ever-increasing range of PCs, tablets,

developer portal to get greater product insight and

smartphones, and other devices – all implementing

more effective and comprehensive online technical

advanced frontend and backend secure-player and

support from the vendor’s product-support teams.

service-management features – can become significant.

13

SECURE PLAYER BUSINESS BENEFITS As demonstrated in this paper, choosing a secure-player solution based on an operator-controlled DRM provides several benefits that translate into a fast ROI while reducing risks in terms of customer satisfaction, costs overruns, and content-security risks.

Pros

Cons

DRM Generic CE DRM

• • •

Operator-controlled DRM

• • • •

DRM provided by CE players / Silicon Giants Core cloud-to-device features provided Low-cost solution

•

More flexibility for service providers Full range of connected home features Superior customer experience Operator remains fully in control through its security partner

•

Some devices (eg Xbox) require additional specific DRM (multiDRM headend solution required)

Limited specific security integration needs on the client side Flexibility in developing browser-based solutions or native apps

•

Limitations in delivering consistent TV-centric features across all browsers and devices Surrenders significant degree of control to CE players (DRM, user experience)

All the advantages of an operator-controlled DRM Multi-DRM headend manages proprietary devices Consistent, advanced TV-centric features across devices, management complexity transferred to security specialist Future-proof, maintained over lifecycle

•

• •

Lack of some TV-centric functions Risk of dependency on CE player strategies / competitors Need to manage multiple security liability agreements

Secure Video Player Own player based on Web standards and multi-DRM headend

•

Secure player product with operator-controlled DRM

•

•

• •

•

•

Integrated solution, requiring managing a strategic relationship with a dedicated, long-term focused partner vendor

DRM AND SECURE VIDEO PLAYER: ANALYZING ALTERNATIVE SOLUTIONS

Beyond these business considerations, a secure player, such as NAGRA’s MediaLive Secure Player, must address these key functional value points : +

+

Premium content on every screen : ensure

+

Ease of use and smart advertising : offer intuitive

the delivery of HD content on almost any

content navigation capabilities, such as smart

screen, meeting the most demanding security

seeking within content, while ensuring the

requirements from content owners while enabling

implementation of dynamic advertising insertion in

content sharing between devices ;

a controlled and user-friendly context ;

TV-centric features : deliver a rich user experience

+

Seamless multiscreen TV : provide seamless

with advanced service capabilities such as parental

integration with cloud PVR capabilities for

control, subtitles, close captioning, and multi-

start-over and catch-up TV services – including

audio tracks ;

download-to-go capabilities – that truly contribute to transform the TV experience on any screen.

14

CASE STUDY 2 : NAGRA’S MEDIALIVE SECURE PLAYER NAGRA’s experience has shown that customers used to managing STBs can find the addition of multiscreen solutions both challenging and a significant overhead. NAGRA manages this through our comprehensive approach.

NAGRA’s Secure Player product line is designed to take

With so many devices available (for Android there are

away some of the costs and risks of staying on top of

now over 20,000 models), the MediaLive Secure Player

fast-evolving technologies and devices by mutualizing

technology is first validated on the most popular devices,

the development and maintenance of products across a

covering over 95% of the general market. We provide

large portfolio of customers. NAGRA also offers a variety

tools for customers to test additional, less-deployed

of standard and premium player maintenance and support

local devices. The new MediaLive online customer

services, including a beta program for new releases.

portal http://medialive.nagra.com gives customer

NAGRA closely follows the iOS and Android evolutions

engineering organisations access to straightforward

and is involved in the DASH Industry Forum, which helps

information about the MediaLive Secure Player, its APIs

anticipate the directions of new releases. NAGRA’s

and the latest product information.

leadership position in the security industry means we are on top of this complex area and apply product direction as appropriate, for the benefit of all customers.

MEDIALIVE Secure Player The Medialive Secure Player is a secure media player that delivers protected services and content to open devices running on Windows, iOS and Android by leveraging anyCAST PRM, NAGRA's DECE and DTLA-approved DRM.

Video Player

DRM Content Protection

Multiscreen

Secure Player SDKs

HTML Secure Players

Adaptive Streaming / OTT

Audience Measurement

Subtitles & Multi-Audio

Download Manager

15

CONCLUSION : FACING THE FUTURE WITH CONFIDENCE Consumer electronics products, both hardware and software, are evolving quickly, and nowhere is this clearer than in the video capability of connected devices.

This means that pay-TV service providers need both

In conclusion, an approach based on a proven vendor

expertise and economies of scale to lower costs and

solution like the NAGRA MediaLive Secure Player

improve performance if they are to remain ahead of the

provides the following short-term tangible benefits to

curve and provide superior products and services to a

pay-TV service providers :

growing and increasingly diverse population of users and devices.

+

Best content on every screen

+

Better device reach

As this paper has demonstrated, the optimal approach

+

Enhanced and consistent QoE

to safeguarding an investment in OTT T V ser vices

+

Lower operational costs

delivered to CE devices is a secure-player solution

+

Fewer business risks

based on an operator-controlled DRM. In addition, it ensures that ser vice providers are Working with an experienced content-security specialist

protected from potentially disruptive changes by CE

such as NAGRA also ensures that future challenges

software providers and stay in control of their OTT

can be met. NAGRA has more than 20 years of industry

TV services as technology evolves and as consumer

experience in securing the business models of some

viewing habits develop.

of the world’s largest pay-TV service providers. It has delivered multiscreen OTT TV solutions to more than 20 leading pay-TV operators worldwide.

16

17

GLOSSARY Adaptive Bit-r ate Streaming, a technique for

ABR

distributing video over unmanaged IP networks for which both international and proprietary standards

DASH

Dynamic Adaptive Streaming over HTTP, an MPEG and ISO international ABS streaming standard.

exist.

Advanced Encr yption Standard, also known as Rijndael (its original name), a specification for the

AES

encr yption of electronic data established by the

DASH JavaScript is an open source reference client

dash.js

US National Institute of Standards and Technology

implementation for the playback of MPEG DASH via Javascript and compliant.

(NIST) in 2001.

Digital Enter tainment Content Ecosystem, a

API

A pplic ation Progr amming Inter f ace, a set of

consortium of major Hollywood studios, consumer

routines, protocols, and tools for building software

electronics manufacturers and retailers, network

applications. An API defines functionalities that are independent of their respective implementations,

DECE

hardware vendors, systems integrators and DRM vendors which creates rules and back-end systems

which allows definitions and implementations to vary

to manage those rules that enable consumers to

without compromising the interface.

share purchased digital content between registered consumer-electronics devices.

Digital Right s Management, a cl ass of copy protection technologies used by hardware and

A technique for transferring Internet-delivered video

Casting

content from a computer or a mobile device to a TV

DRM

display

software manufacturers, publishers copyright holders, and individuals to authorize and control the use of digital content and protect intellectual property rights.

Digital Transmission Licensing Administrator, created by a consortium of technology companies in 1999 to license the Digital Transmission Content Protection (DTCP) technology which ensures

CENC

Common Encr yption Scheme, enables the same encrypted file to be used by different DRM systems.

DTLA

consumers’ reasonable and customar y right to make personal-use copies and enjoy digital content that is networked throughout the home. DTCP has been widely adopted in consumer electronics products including set-top boxes, digital TVs, and Blu-Ray and DVD recorders.

E n c r y p te d M e d i a E x te n s i o n s , a W 3 C d r a f t specification for providing a communication channel

Use of cloud computing technology to deliver T V

Cloud TV

ser vices, where play-out technology is based in the cloud rather than at a cable, satellite or telco

between web browsers and DRM software, allowing

EME

the use of HTML5 video to play back DRM-wrapped content such as streaming video services without

operator’s head-end.

the need for third-party plugins such as Adobe Flash or Microsoft Silverlight.

Content delivery network (or content distribution network), a distributed system of servers deployed

CDN

in multiple data centres across the Internet, which allows content (including live streaming media and on-demand video) to be served to end-users with

A hardware component that is secure in design

Hardware Root of Trust

and inherently trusted to perform one or more security-critical functions, such as measuring and/ or verifying software and protecting cryptographic keys.

high availability and high performance.

Dynamic Advertising Insertion, allows adver tisements within streaming on-demand

DAI

content to be changed by operators, thereby enabling adver tising to be targeted at specific groups of subscribers. DAI is increasingly imposed by content providers.

18

HDS

HTTP Dynamic Streaming, Adobe ABS streaming standard for Flash plugin.

GLOSSARY HLS

HSS

HTTP Live Streaming, Apple ABS streaming standard for QuickTime X and iOS. HTTP

Smooth

Streaming,

Microsoft

ABS

streaming standard for the Silverlight plugin.

PPAPI

PrimeTime

Technologies Corporation with four consumer electronics companies: Sony, Panasonic, Philips,

Video Recorder or DVR), a consumer electronics

PVR

storage device.

ID3 is a metadata container most often used

A security mechanism for separating running

in conjunction with the MP3 audio file format.

It allows information such as the title, artist,

programs. A sandbox is often used to execute

Sandbox

untested code, or untrusted programs from

album, track number, and other information

unverified third parties, suppliers, untrusted

about the file to be stored in the file itself.

users and untrusted websites.

The use of multiple DRM systems at the backend

Multi-DRM

device or application software that records video in digital format to a local or networked (nPVR)

and Samsung.

ID3

Adobe proprietary DRM system.

Personal video recorder (also known as Digital

Open-standard DRM developed by Intertrust

Intertrust Marlin

Pepper Plugin API, Google replacement for NPAPI.

to deliver content to a range of devices that use

SDK

different DRM formats.

Software Development kit, a set of tools for developing software.

Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86, ARN or MIPS native code in a sandbox, allowing the

NaCI

safe running of native code from a web browser, independent of the user operating system, allowing web-based applications to run at near-

Secure Video Player

A video player that incorporates DRM and antihacking techniques to ensure content protection.

native speeds. It may also be used for securing browser plugins, as well as other applications.

NAGRA anyCAST PRM

Provides

DECE

and

DTLA-approved

DRM

protection of high-value content on both closed

architecture,

first

developed

for

Netscape

browsers in 1995, used by many web browsers.

Sunrise key change

The deliberate act of creating obfuscated code

Obfuscation

conceal its purpose (security through obscurity)

Ability for a DRM system of automatically change the content key on a Live channel, for example once per day.

A feature of digital video systems including PVRs

that is difficult for humans to understand.

Programmers may deliberately obfuscate code to

Microsoft proprietary streaming media application framework.

and open devices.

Netscape Plugin API, a cross-platform plugin

NPAPI

Silverlight

and video-on-demand systems that mimics the

Trick modes

visual feedback given during fast-forward and rewind operations that were provided by analogue

or its logic, in order to prevent tampering or deter

systems such as VCRs. Trick play manipulates the

reverse engineering.

video stream to include only a subset of frames.

White-box cryptography, a cryptographic system

OSX

Apple operating system for personal computers.

Whitebox

designed to be secure even when its internals are viewed.

OTT TV

PlayReady

Over-the-top TV is TV delivered via the web over unmanaged IP systems.

Widevine

Google proprietary DRM system.

Microsoft proprietary DRM system.

19

KUDELSKI, NAGRA, OPENTV, SMARDTV and their respective logos are trademarks, registered trademarks or service marks of Kudelski SA and/or its affiliates.

All other trademarks are the property of their respective owners.

All product and application features and specifications are subject to change at the sole discretion of Nagravision SA at any time and without notice.

design: diabolo.com

© 2015 Nagravision SA - All rights reserved.

SECURE – ENGAGING – EVERYWHERE 20

DTV.NAGRA.COM