OPTIMIZING MULTISCREEN TV DELIVERY WITH A SECURE VIDEO PLAYER WHITE PAPER - AUGUST 2015
SECURE – ENGAGING – EVERYWHERE
DTV.NAGRA.COM
2
EXECUTIVE SUMMARY This paper looks at the market needs and challenges that pay-TV service providers face when deploying multiscreen TV solutions on third-party consumer electronic (CE) devices such as PCs, tablets, and smartphones. It evaluates the alternative solutions that are available for addressing the needs of both content owners and service customers, and it examines the potential business benefits of choosing an operator-controlled solution delivered by a trusted content-security partner. The paper is based around the following key themes :
+
CE devices use a wide range of fast-evolving OS platforms, streaming standards, DRM products.
+
Pay-TV service providers face significant challenges in delivering OTT multiscreen services to these ever-changing CE devices.
+
They are dependent on decisions taken by device manufacturers and sudden changes in browser or operating platforms can be very disruptive and have a negative impact on pay-TV customers and service providers.
+
Google’s recent withdrawal of support for the NPAPI plug-in on its Chrome browser is a case in point and has caused problems for some leading pay-TV service providers.
+
Service providers could opt for common encryption DRMs for their OTT TV services, hoping to solve all their interoperability issues, but this approach will only address part of the technical and business challenges.
+
A better option is an operator-controlled secure player solution delivered by a trusted content security partner that ensures a consistent user experience across all devices while providing value over the entire lifecycle of CE devices.
FURTHER INFORMATION NAGRA has published a range of additional information on the MediaLive Secure Player portal which can be found at https://medialive.nagra.com. To discuss your requirements for a Secure Player deployment in your organization, please contact your Account Manager or email us at dtv@nagra.com
3
CHALLENGES IN MAXIMIZING THE REACH OF OTT DEVICES OTT TV services are increasingly important to pay-TV service providers as they deploy multiscreen offerings to complement their core services and to compete more effectively with Internet-based rivals. But delivering them over consumer electronic (CE) devices such as PCs, tablets, smartphones, video game consoles, and smart TVs presents several significant challenges regardless of the operator’s network type – whether telco, cable, or satellite. Many of these challenges result from the fact that – unlike the pay-TV set-top-box environment – service providers do not have control of the open devices, which use a wide range of operating systems and standards. CHALLENGE #1 : KEEPING CONTROL
some service providers, this potentially presents a very
OVER DEVICE PLATFORMS
significant challenge. For example, Google’s decision
Service providers are dependent upon strategic and
led Sky and BT Sport to encourage their subscribers
technological decisions taken by device manufacturers
to move from Chrome to Firefox or Internet Explorer 3.
and software providers. This can leave them vulnerable, for example, to changes in browser pl atfor ms
The theoretical solution to the problem is greater OTT
used on PCs and to the Android and iOS operating
standardization, which would enable service providers
systems of mobile devices. This can also mean that
to increase their efficiency and reduce the risk in
multiscreen TV applications that worked previously
delivering OTT services. While there has been some
may suddenly stop streaming content, creating havoc
technical progress in simplifying streaming formats,
with subscribers and leading to calls to customer-care
codecs, and DRM, the reality is that standardization is
centers, dissatisfaction with the operator, damage to
an ever-evolving process that brings alignment over
its brand, and loss of revenue . Rather than cement
time but is not the panacea to all market needs in the
and strengthen the relationship between pay-TV service
short term. A more pragmatic approach is required.
1
providers and their customers, OTT TV – if not deployed carefully – could potentially end up undermining
CHALLENGE #2 : KEEPING CONTROL
customer confidence.
OVER CONTENT SECURITY Service providers also need to ensure that content
The latest example of this kind of potentially disruptive
security standards are not compromised by choosing
change is Google’s decision to implement the HTML5
a vertical, per-device, per-platform and per-browser
Encrypted Media Extensions (EME) standard to manage
vendor approach, and that content licensing complexities
DRM content in the Chrome browser, while phasing
are not increased by having to deal with multiple DRM
out support for the Netscape Plug-in API (NPAPI) (see
vendors. Pay-TV service providers should not forget that
Case Study 1). The withdrawal of support for NPAPI
the very Silicon Valley giants (i.e. Apple, Google, and
– on which Microsoft’s Silverlight streaming media
Microsoft among others) that sometimes unilaterally
application framework and its PlayReady DRM depend –
define their proprietary technologies are also their
will affect pay-TV subscribers whose service providers
competitors in delivering OTT TV. As a result, dependency
use these players to provide video content within a
on the strategies of these companies increases business
Chrome browser. Given that the share of the Google
risk levels for service providers.
Chrome PC browser users is estimated to be more than 52% 2 of a typical pay-TV operator’s subscriber base and that Silverlight and PlayReady are widely used by
4
CHALLENGE #3 : KEEPING CONTROL
As well as streaming standards and DRMs, it is
OVER THE TV EXPERIENCE
important to include the overall and consistent control
Another fundamental requirement is the provision of
of the TV experience delivered across multiple devices
a consistent set of pay-TV-centric features and use
that also interact with each other.
cases, available across all devices and platforms. Such capabilities are best provided by a secure player,
Understanding the longer-term implications of
with features such as multiple audio tracks, subtitles,
technical decisions related to OTT and multiscreen
dynamic advertising, and trick modes, as well as use
TV content delivery and their impact on business is
cases such as casting or sharing between devices.
absolutely key for the success of service providers.
1
According to consulting firm nScreenMedia, US and European pay-TV operators are spending an estimated $2.8 billion of their almost $10 billion annual network and maintenance expenses to directly address multiscreen service delivery failures
2
http://www.rapidtvnews.com/2015071539066/pay-tv-operators-spend-billions-to-address-multiscreen-delivery-failures.html
An estimated 52% of World Wide Web users use Google Chrome as their browser on their personal computers, according to StatCounter.com
3
“Sky has no plans to fix Chrome compatibility after Google’s Silverlight shun”, The Inquirer, May 1, 2015 http://www.theinquirer.net/inquirer/news/2383624/google-will-kill-microsoft-silverlight-in-chrome-by-disabling-npapi-plug-in
5
CASE STUDY 1 : GOOGLE CHROME Google’s decision to withdraw support for NPAPI on its Chrome browser created a potential challenge for pay-TV service providers who were faced by a significant percentage of their base not being able to watch their content via a Chrome browser. After Google announced the change in September 2013, NAGRA started developing a solution so that affected premium content could continue to be delivered securely to Chrome browsers. Google’s new Pepper Plug-in API (PPAPI), which
extension via the online Chrome Web Store, so it can be
replaces NPAPI, is intended to increase security for
easily installed by end-users. Updates are performed
browsers as it provides a direct link to a sandboxed
via the operator’s Chrome Web Store account and easily
environment where the code is executed – Chrome’s
installed to the end-user’s Chrome browser.
Native Client (NaCI) – and provides greater stability, as the code is executed in a separate thread rather than in
With this solution, NAGRA ensures that pay-TV service
the main browser thread. It is also designed to facilitate
providers who had been using Silverlight and PlayReady
code portability across different platforms.
can continue to provide video services to their Chrome customers with only a simple action required by the
Google’s justification for its action is that PPAPI/NaCl
subscriber. As a result, service providers do not have
is more advanced and allows plug-ins to work more
to adopt another DRM (i.e.Google Widevine) and player
seamlessly and securely within Chrome. However, the
or point their subscribers to use Firefox, IE or Safari
move needs to be considered in the context of the wider
browsers instead of Chrome.
commercial battle between Google and Microsoft and the fact that it may push service providers towards
NAGRA continues to deliver the NPAPI secure player
adopting Google’s Widevine DRM.
plug-in for Internet Explorer (on Windows), Firefox (Windows and OSX), and Safari (OSX), ensuring support
NAGRA’s new PPAPI/NaCI browser plug-in is packaged as the NAGRA MediaLive Secure Player for Chrome, and integrates NAGRA anyCAST PRM, NAGRA’s studioapproved DRM. It is fully compliant with the new HTML5 Chrome browser security architecture. The secureplayer browser plug-in is delivered as a Chrome
6
for all major browsers.
MARKET AND TECHNOLOGY CHALLENGES In addition to the challenges pay-TV service providers face in maximizing device reach, there are also several complex technology-based challenges that need to be considered to ensure the delivery of a high-quality video product : +
+
Selection of a reliable OTT streaming standard
+
Deployment of rich multiscreen TV user
to provide an optimal solution in a complex and
experiences that ensure superior TV-centric
fragmented environment;
services across all screens;
Selection of proven content-security solutions
+
Addressing an ever-evolving, growing range of
that provide the best technology to deliver secure
devices and platforms while ensuring fast time
content to all screens;
to market and optimized costs for launching services to new screens.
OTT STREAMING STANDARDS :
many different versions of the same content still adds
WHAT ARE THEY, WHAT IS COMING NEXT ?
operational complexity.
Standards and Fragmentation: No Panacea
The video and pay-TV industries have tried to confront
V ideo streaming over the Internet has evolved
this situation by creating a common format through the
tremendously over the past decade. Adaptive bitrate
DASH Industry Forum, created in 2012. The vision here
(ABR) streaming formats such as Apple HLS and
involves the combination of the DASH adaptive bitrate
Microsof t HS S have emerged, along w ith A E S
streaming format with the CENC common encryption
encryption and interoperable DRM products. Despite
scheme for protecting content 4.
this, there has been considerable fragmentation in the s tr eaming for mat s and DRMs that ar e
In addition, feature fragmentation both from a DRM and
implemented on specific devices, creating the need
Video Player perspective are also an issue. Indeed, while
to re-encode and re-encrypt content several times
modern browsers include a video player and support
in order to reach as broad a range of devices as
for a DRM, the supported feature set varies from one
possible. While more recent origin servers allow to
browser to another. For instance, one given subtitle
re-encrypt content on the fly, hence removing the
format supported on one browser is not on another.
need for ever-increasing storage, having to deal with
4
NAGRA was shortlisted (and won the runner-up award) at the IBC 2013 Innovation Awards for the first commercial deployment of DASH/CENC in the market.
SERVICE PROVIDERS SHOULD ASSUME THE CONTINUATION OF A FRAGMENTED MARKET AND PLAN TO PROVIDE AN ABSTRACTION LAYER – IN THE FORM OF A SECURE PLAYER SOFTWARE CLIENT – TO MANAGE THE DIFFERENT STANDARDS AND PLATFORMS.
7
DASH and CENC as New Alternatives
The positive news is that DASH has started to replace
CENC allows encr yption to be done once, with
legacy Microsoft HSS and Adobe HDS formats and
decryption performed across multiple DRM clients as
is expected to become the industr y standard ABR
required. In theory, this allows a substantial reduction
format. The very nature of next-generation streaming
in the complexity of both content preparation and
standards is to decouple the file format from the actual
packaging workflows. A single secured file can be
DRM used and ensure that multiple DRMs can coexist.
played out across multiple devices which each support
Indeed, we can expect to see more devices emerge
a specific DRM client product.
with their own native DRM when it makes sense for the device vendor.
In practice though, fragmentation remains extensive. Apple, for instance, imposes its own HLS streaming
Planning for Evolving Standards : Being Pragmatic
standard on its devices and has not yet adopted
The technology industr y is notorious for defining
DASH. In addition, some legacy CE devices with older-
“standards” that take several release cycles to dislodge
generation browsers do not natively support DASH and
previous-generation technologies. In this context, it
rely on NPAPI Microsoft or Adobe plug-ins to play back
would be wise for service providers to take a pragmatic
DRM-protected content. Moreover, the different options
stance and consider that standardization is always
that one can select within the DASH specification can
likely to be a highly desirable outcome rather than a
also lead to fragmentation, as the specification provides
sure reality. So they should assume the continuation of
the choice of several audio codecs, different encryption
a fragmented market and plan to provide an abstraction
schemes and other specific features.
layer – in the form of a secure player software client – to manage the different standards and products.
SELECTED ABR STREAMING STANDARDS HLS (HTTP Live Streaming)
Proprietary : Apple, for QuickTime X and iOS
HSS (HTTP Smooth Streaming)
Proprietary : Microsoft, for Silverlight plug-in
HDS (HTTP Dynamic Streaming)
Proprietary : Adobe, for Flash plug-in
DASH (Dynamic Adaptive Streaming over HTTP)
MPEG and ISO international standard
CENC (Common Encryption Scheme)
Enables the same encrypted file to be used by different DRM systems
NAGRA IS INVOLVED IN THE DASH STANDARDIZATION EFFORT AND IS THE LEAD EDITOR OF THE RECENTLY RELEASED CONTENT PROTECTION INFORMATION EXCHANGE FORMAT (CPIXF), A SPECIFICATION THAT ALLOWS DRM LICENSE SERVICE PROVIDERS TO PERFORM EASIER PREINTEGRATION WITH OTHER COMPONENTS OF THE STREAMING BACKEND SUCH AS ENCODERS AND CDNS, HENCE DELIVERING SIGNIFICANT COST 8 SAVINGS WHILE IMPROVING TIME TO MARKET AND AGILITY.
CONTENT SECURITY : HOW TO DELIVER
support only PlayReady, without allowing the option of
THE BEST CONTENT ON EVERY SCREEN
implementing another DRM product.
Pay-TV service providers typically seek to license the
As a result, service providers find themselves forced
best available Hollywood and live TV content, which
into relationships with multiple DRM vendors, one
implies high protection requirements as rights holders
for each vendor-controlled platform on which they
are wary of piracy and its impact on the business model
want their content to play out. This has three major
of the entire content value chain.
implications :
Approved DRM Products and
(1) It increases the complexity and costs of content
Robust Client Implementations Delivering HD content to high-resolution screens including tablets, PCs, and game consoles requires
rights negotiations ; (2) Some content may not get the same rights, or face a different liability on different platforms ;
the use of various pieces of technology to maximize
(3) Service providers are left with little control over
content security. This includes advanced content-
the way that the DRM products evolve on a given
protection technology based on DECE and DTLA studio-
platform.
approved DRM products, as well as sophisticated software techniques such as whitebox cryptography,
Optimizing this increasingly complex situation is a key
secure video paths, sunrise key change, output
requirement.
control, software obfuscation and hardening, and – when available – Hardware Root of Trust to ensure the
Support for Multi-Usage Scenarios
proper client implementation of the DRM module and
Another important issue concerns content-usage
the overall security of the client platform.
rules. For Hollywood studios and other rights holders, the rights to view content on a small screen are worth
In the browser environment, the World Wide Web
significantly less than those for viewing the same
Consortium (W3C) has worked at defining a secure
content in HD on a large flat-panel display. Preventing
architecture for implementing DRMs using either the
users from casting content without authorization has
native HTML5 Embedded Media Extension (EME) or
become a big concern in rights negotiations. A secure
through secured plug-ins.
player solution that can manage this requirement and ensure that content is played out on the intended
DRM Vendor Choice
screens as laid down in the negotiated contract (with
With EME and CENC, content can be encrypted once at
secure reporting back to the content rights owners)
the head-end and multiple DRM servers can be used to
offers significant value to service providers.
generate licenses for specific DRM clients. However, the DRM implementation carried out by browser vendors
Other rules for distributing and sharing content –
such as Google has tended to be restrictive for service
usually managed by the DRM system head-end and
providers: only one DRM is natively supported. Thus they
implemented in a secure-player client – can be defined
are implicitly forced to use a proprietary consumer-
by content type or by device. They need to be securely
device DRM such as Google Widevine. Fortunately,
transported to the device, which means that rooted
newer generation browser plug-in frameworks such as
device and jailbreak detection is also required to ensure
Chrome PPAPI – that include auto-update capabilities –
that the usage rules are not tampered with.
can also be used, thereby avoiding a total dependency on a single DRM vendor; this is the approach that NAGRA has taken. However, some less widely deployed devices, such as the Microsoft Xbox games console,
9
BEYOND SECURITY :
There are several key aspects to the deployment of a
WHY A VIDEO PLAYER IS REQUIRED
secure video player :
Beyond confronting the challenges involved in managing
CDNs : The ability to dynamically select the best source
a multi-DRM environment, service providers face other
of content implies that algorithms are embedded into
requirements to ensure that their OTT TV services
the secure player to optimize the user experience
function optimally. These include the provision of :
and the costs of streaming content.
+
Video trick modes
+
Multi-CDN interfacing and dynamic selecting
retrieved from the backend and used by the player,
+
Multi-audio, close captioning and
especially in the context of advanced use cases
multi-language subtitles
such as local storage of downloaded content for
+
Parental and playout control
offline playback and side-loading of content to other
+
Dynamic Advertising Insertion (DAI)
devices.
+
Detailed user-behaviour analytics
DRM servers : Key information needs to be securely
Analytics : Measuring the Quality of Experience (QoE) All these functions need to be packaged together on the
by capturing deep data on player and user behaviour
client side before interfacing with backend systems, and
enables the improvement of products and services.
this is best achieved with a secure video player. Ad platforms : With Dynamic Ad Inser tion being In the early days of OTT TV, the licensing of premium
imposed by more content providers, it is important
content was mainly a DRM issue. But these new
to deploy smart interfaces with leading advertising
requirements – which result from the huge uptake in
delivery and tracking systems (such as Freewheel,
OTT TV consumption – have set new expectations that
Omniture, ComScore, and Nielsen). A secure player
increase the need for service providers to adopt a multi-
can include ID3 demuxing capabilities to control
purpose, multi-platform secure player solution.
ad-skipping and disable the search bar during ad play-out and thereby have a direct impact on the price of ads sold and revenues shared with content providers. Player packaging : The way the secure player is packaged also has to be taken into consideration. Having access to a browser plug-in for HTML5/JS app development on PC platforms or an SDK for native app development on iOS/Android platforms allows the development of rich user experiences. Another attractive option is a packaged app that embeds HTML rendering capabilities, enabling the development of apps using HTML/JS with the same back-end business logic that is portable across multiple platforms, leading to lower app maintenance and deployment costs.
10
Customer UEX Native/HTML – JavaScript DRM & Player APIs Player Core I/O Adaptive Streaming Stack
H.264, AAC A/V Synch
Video Trick Modes Close Captioning, Subtitle Rendering
Download Management
Output Control
Upgrade Management
Device Management
Security Core License Management
Rooting /Jailbreak Detection
Cryptography
SECURE VIDEO PLAYER OVERVIEW In scenarios where such a generic secure player
process to manage, in which different technologies
cannot be deployed – games consoles, for instance –
and skills are required to deliver robust applications
a platform-specific solution may be required, with the
at the lowest cost and with the highest level of
core secure-player principles and APIs implemented
customer satisfaction.
using a specific DRM client and file-streaming format, adding controlled multi-DRM capabilities to the
Anticipating Evolution
overall platform.
For service providers, the standardization of streaming technologies and the availability of some open-source
EVER-EVOLVING DEVICE PLATFORMS : WHY
player components like dash.js can help reduce costs,
AN OTT TV APP CONSTANTLY NEEDS UPDATING
but there are other issues to address. The overall challenge of managing app evolutions across a large
Accelerated Device Update Lifecycles
number of client platforms and devices adds risks and
A new phenomenon in the CE industry over the past
costs to home-grown OTT TV operations. For instance,
five years has been the accelerated pace of innovation
staying ahead of rapid platform evolution often means
brought on by frequent software renewals during the
having dedicated technical staff who are involved with
lifecycle of a hardware device. In the smartphone and
leading software vendors and developer communities.
tablet segment, Apple and Google update their OS and
This represents a fixed cost that can be significant for
app platforms several times a year, while desktop
service providers in the early phases of deployment
browsers are also regularly improved by software
or which have a geographically constrained customer
vendors, with software updates automatically pushed
base. Opting out of such involvement, however, could
to users. Similar approaches have systematically
lead to a risky situation where service providers could
emerged for OTT streaming boxes and casting sticks,
face a service blackout.
games consoles and connected T Vs. Ensuring that video content is always seamlessly played out on all supported devices can quickly become a complex
11
KEY APPROACHES TO CONSIDER As previously discussed, modern multiscreen TV-streaming services require a secure video player that has at its core both an operator-controlled studio-approved DRM product and a secure-client implementation that delivers advanced TV features. In this section, we analyze the benefits and limitations of each approach. GENERIC OR OPERATOR-CONTROLLED DRM :
can access the OTT TV service within the same home
WHICH APPROACH BEST ADDRESSES
requires specific DRM license management features
THE INDUSTRY’S NEW NEEDS ?
– most of which are not provided by the CE vendors’ generic DRM products. This can lead to three main
Consumer Electronics DRM Products
problems for pay-TV service providers – (1) security
At first glance, the adoption of DASH and CENC along
loopholes; (2) missing or incomplete content rights;
with the implementation of new Web browser standards
(3) missing or incomplete use-case support – with the
should greatly simplify the delivery of DRM-protected
latter two impacting user experience.
content to different devices that natively support CE DRM clients such as Microsoft PlayReady, Google
An operator-controlled DRM product provides the same
Widevine, Adobe PrimeTime, or InterTrust Marlin. In
core features and content-protection capabilities as a
theory, all that would then be needed is a multi-DRM
generic DRM as well as the required flexibility and extra
backend key server to establish the proper interfaces
features that allow service providers to stay ahead
with the different DRM systems.
of the competition. By packaging such an operatorcontrolled DRM product within a secure player that
This approach is relatively simple to implement on the
delivers similar capabilities across multiple device
server side and does not require deep integration on the
platforms, service providers have a powerful tool for
client side. But it forces service providers to surrender
delivering a superior, seamless consumer experience.
significant control to the Silicon Valley giants which
They are also able to benefit from the strengths of a
provide DRM products for an increasingly important
product that is published by a focused security provider.
aspect of their pay-TV operations. Moreover, it can constrain service providers, preventing them from
So a service provider should make use of an operator-
evolving their platforms to satisfy content-provider
controlled DRM as much as possible, packaged within a
licensing requirements or to offer more advanced
secure player, and restrict the use of third-party DRMs
services.
to scenarios where the limitations and constraints of the target platform are fully acknowledged.
Operator-controlled DRM products As more devices are used to access TV content within the connected home – either on-demand (unicast) or live (unicast and multicast) – the rules for content sharing and usage need to be defined centrally, at the head-end, and then applied to the different devices in the home, usually through a secure-player client that leverages specific DRM rules. For instance, transferring a PVR recording to a tablet or starting to watch a movie on a PC and then casting it to a TV set while limiting the number of concurrent viewers who
12
DO-IT-YOURSELF (DIY) VERSUS VENDOR PLAYER
In addition, the risks of being late to market, or of not
SOLUTIONS : W HICH A PPROACH TO INCRE A SE
being able to support some key devices and therefore
DEVICE REACH AND REDUCE COSTS ?
disappointing subscribers, can have a negative impact on customer acquisition and increase churn.
Multiscreen TV is all about extending device reach to address the diverse needs of subscribers while
Vendor Secure-Player Solutions
ensuring the delivery of quality pay-TV experiences to
Vendor solutions typically leverage secure-player
all selected devices. This is better delivered by using
products deployed worldwide and can provide huge
a secure player that can be developed in-house or
economies of scale, allowing ser vice providers to
sourced from a software vendor.
benefit from vendor expertise and firepower. This approach helps improve time-to-market and delivers
DIY Secure Players
leading solutions that are widely deployed by some of
The DIY approach gives service providers control and
the TV industry’s most demanding players.
flexibility on how they implement their multiscreen clients and apps, but the cost and complexity of
Vendor solutions also offer access to an advanced
addressing an ever-increasing range of PCs, tablets,
developer portal to get greater product insight and
smartphones, and other devices – all implementing
more effective and comprehensive online technical
advanced frontend and backend secure-player and
support from the vendor’s product-support teams.
service-management features – can become significant.
13
SECURE PLAYER BUSINESS BENEFITS As demonstrated in this paper, choosing a secure-player solution based on an operator-controlled DRM provides several benefits that translate into a fast ROI while reducing risks in terms of customer satisfaction, costs overruns, and content-security risks. Pros
Cons
DRM Generic CE DRM
• • •
Operator-controlled DRM
• • • •
DRM provided by CE players / Silicon Giants Core cloud-to-device features provided Low-cost solution
•
More flexibility for service providers Full range of connected home features Superior customer experience Operator remains fully in control through its security partner
•
Some devices (eg Xbox) require additional specific DRM (multiDRM headend solution required)
Limited specific security integration needs on the client side Flexibility in developing browser-based solutions or native apps
•
Limitations in delivering consistent TV-centric features across all browsers and devices Surrenders significant degree of control to CE players (DRM, user experience)
All the advantages of an operator-controlled DRM Multi-DRM headend manages proprietary devices Consistent, advanced TV-centric features across devices, management complexity transferred to security specialist Future-proof, maintained over lifecycle
•
• •
Lack of some TV-centric functions Risk of dependency on CE player strategies / competitors Need to manage multiple security liability agreements
Secure Video Player Own player based on Web standards and multi-DRM headend
•
Secure player product with operator-controlled DRM
•
•
• •
•
•
Integrated solution, requiring managing a strategic relationship with a dedicated, long-term focused partner vendor
DRM AND SECURE VIDEO PLAYER: ANALYZING ALTERNATIVE SOLUTIONS
Beyond these business considerations, a secure player, such as NAGRA’s MediaLive Secure Player, must address these key functional value points : +
+
Premium content on every screen : ensure
+
Ease of use and smart advertising : offer intuitive
the delivery of HD content on almost any
content navigation capabilities, such as smart
screen, meeting the most demanding security
seeking within content, while ensuring the
requirements from content owners while enabling
implementation of dynamic advertising insertion in
content sharing between devices ;
a controlled and user-friendly context ;
TV-centric features : deliver a rich user experience
+
Seamless multiscreen TV : provide seamless
with advanced service capabilities such as parental
integration with cloud PVR capabilities for
control, subtitles, close captioning, and multi-
start-over and catch-up TV services – including
audio tracks ;
download-to-go capabilities – that truly contribute to transform the TV experience on any screen.
14
CASE STUDY 2 : NAGRA’S MEDIALIVE SECURE PLAYER NAGRA’s experience has shown that customers used to managing STBs can find the addition of multiscreen solutions both challenging and a significant overhead. NAGRA manages this through our comprehensive approach. NAGRA’s Secure Player product line is designed to take
With so many devices available (for Android there are
away some of the costs and risks of staying on top of
now over 20,000 models), the MediaLive Secure Player
fast-evolving technologies and devices by mutualizing
technology is first validated on the most popular devices,
the development and maintenance of products across a
covering over 95% of the general market. We provide
large portfolio of customers. NAGRA also offers a variety
tools for customers to test additional, less-deployed
of standard and premium player maintenance and support
local devices. The new MediaLive online customer
services, including a beta program for new releases.
portal http://medialive.nagra.com gives customer
NAGRA closely follows the iOS and Android evolutions
engineering organisations access to straightforward
and is involved in the DASH Industry Forum, which helps
information about the MediaLive Secure Player, its APIs
anticipate the directions of new releases. NAGRA’s
and the latest product information.
leadership position in the security industry means we are on top of this complex area and apply product direction as appropriate, for the benefit of all customers.
MEDIALIVE Secure Player The Medialive Secure Player is a secure media player that delivers protected services and content to open devices running on Windows, iOS and Android by leveraging anyCAST PRM, NAGRA's DECE and DTLA-approved DRM.
Video Player
DRM Content Protection
Multiscreen
Secure Player SDKs
HTML Secure Players
Adaptive Streaming / OTT
Audience Measurement
Subtitles & Multi-Audio
Download Manager
15
CONCLUSION : FACING THE FUTURE WITH CONFIDENCE Consumer electronics products, both hardware and software, are evolving quickly, and nowhere is this clearer than in the video capability of connected devices. This means that pay-TV service providers need both
In conclusion, an approach based on a proven vendor
expertise and economies of scale to lower costs and
solution like the NAGRA MediaLive Secure Player
improve performance if they are to remain ahead of the
provides the following short-term tangible benefits to
curve and provide superior products and services to a
pay-TV service providers :
growing and increasingly diverse population of users and devices.
+
Best content on every screen
+
Better device reach
As this paper has demonstrated, the optimal approach
+
Enhanced and consistent QoE
to safeguarding an investment in OTT T V ser vices
+
Lower operational costs
delivered to CE devices is a secure-player solution
+
Fewer business risks
based on an operator-controlled DRM. In addition, it ensures that ser vice providers are Working with an experienced content-security specialist
protected from potentially disruptive changes by CE
such as NAGRA also ensures that future challenges
software providers and stay in control of their OTT
can be met. NAGRA has more than 20 years of industry
TV services as technology evolves and as consumer
experience in securing the business models of some
viewing habits develop.
of the world’s largest pay-TV service providers. It has delivered multiscreen OTT TV solutions to more than 20 leading pay-TV operators worldwide.
16
17
GLOSSARY Adaptive Bit-r ate Streaming, a technique for
ABR
distributing video over unmanaged IP networks for which both international and proprietary standards
DASH
Dynamic Adaptive Streaming over HTTP, an MPEG and ISO international ABS streaming standard.
exist. Advanced Encr yption Standard, also known as Rijndael (its original name), a specification for the
AES
encr yption of electronic data established by the
DASH JavaScript is an open source reference client
dash.js
US National Institute of Standards and Technology
implementation for the playback of MPEG DASH via Javascript and compliant.
(NIST) in 2001. Digital Enter tainment Content Ecosystem, a
API
A pplic ation Progr amming Inter f ace, a set of
consortium of major Hollywood studios, consumer
routines, protocols, and tools for building software
electronics manufacturers and retailers, network
applications. An API defines functionalities that are independent of their respective implementations,
DECE
hardware vendors, systems integrators and DRM vendors which creates rules and back-end systems
which allows definitions and implementations to vary
to manage those rules that enable consumers to
without compromising the interface.
share purchased digital content between registered consumer-electronics devices. Digital Right s Management, a cl ass of copy protection technologies used by hardware and
A technique for transferring Internet-delivered video
Casting
content from a computer or a mobile device to a TV
DRM
display
software manufacturers, publishers copyright holders, and individuals to authorize and control the use of digital content and protect intellectual property rights. Digital Transmission Licensing Administrator, created by a consortium of technology companies in 1999 to license the Digital Transmission Content Protection (DTCP) technology which ensures
CENC
Common Encr yption Scheme, enables the same encrypted file to be used by different DRM systems.
DTLA
consumers’ reasonable and customar y right to make personal-use copies and enjoy digital content that is networked throughout the home. DTCP has been widely adopted in consumer electronics products including set-top boxes, digital TVs, and Blu-Ray and DVD recorders. E n c r y p te d M e d i a E x te n s i o n s , a W 3 C d r a f t specification for providing a communication channel
Use of cloud computing technology to deliver T V
Cloud TV
ser vices, where play-out technology is based in the cloud rather than at a cable, satellite or telco
between web browsers and DRM software, allowing
EME
the use of HTML5 video to play back DRM-wrapped content such as streaming video services without
operator’s head-end.
the need for third-party plugins such as Adobe Flash or Microsoft Silverlight.
Content delivery network (or content distribution network), a distributed system of servers deployed
CDN
in multiple data centres across the Internet, which allows content (including live streaming media and on-demand video) to be served to end-users with
A hardware component that is secure in design
Hardware Root of Trust
and inherently trusted to perform one or more security-critical functions, such as measuring and/ or verifying software and protecting cryptographic keys.
high availability and high performance. Dynamic Advertising Insertion, allows adver tisements within streaming on-demand
DAI
content to be changed by operators, thereby enabling adver tising to be targeted at specific groups of subscribers. DAI is increasingly imposed by content providers.
18
HDS
HTTP Dynamic Streaming, Adobe ABS streaming standard for Flash plugin.
GLOSSARY HLS
HSS
HTTP Live Streaming, Apple ABS streaming standard for QuickTime X and iOS. HTTP
Smooth
Streaming,
Microsoft
ABS
streaming standard for the Silverlight plugin.
PPAPI
PrimeTime
Technologies Corporation with four consumer electronics companies: Sony, Panasonic, Philips,
Video Recorder or DVR), a consumer electronics
PVR
storage device.
ID3 is a metadata container most often used
A security mechanism for separating running
in conjunction with the MP3 audio file format. It allows information such as the title, artist,
programs. A sandbox is often used to execute
Sandbox
untested code, or untrusted programs from
album, track number, and other information
unverified third parties, suppliers, untrusted
about the file to be stored in the file itself.
users and untrusted websites.
The use of multiple DRM systems at the backend
Multi-DRM
device or application software that records video in digital format to a local or networked (nPVR)
and Samsung.
ID3
Adobe proprietary DRM system.
Personal video recorder (also known as Digital
Open-standard DRM developed by Intertrust
Intertrust Marlin
Pepper Plugin API, Google replacement for NPAPI.
to deliver content to a range of devices that use
SDK
different DRM formats.
Software Development kit, a set of tools for developing software.
Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86, ARN or MIPS native code in a sandbox, allowing the
NaCI
safe running of native code from a web browser, independent of the user operating system, allowing web-based applications to run at near-
Secure Video Player
A video player that incorporates DRM and antihacking techniques to ensure content protection.
native speeds. It may also be used for securing browser plugins, as well as other applications.
NAGRA anyCAST PRM
Provides
DECE
and
DTLA-approved
DRM
protection of high-value content on both closed
architecture,
first
developed
for
Netscape
browsers in 1995, used by many web browsers.
Sunrise key change
The deliberate act of creating obfuscated code
Obfuscation
conceal its purpose (security through obscurity)
Ability for a DRM system of automatically change the content key on a Live channel, for example once per day.
A feature of digital video systems including PVRs
that is difficult for humans to understand. Programmers may deliberately obfuscate code to
Microsoft proprietary streaming media application framework.
and open devices.
Netscape Plugin API, a cross-platform plugin
NPAPI
Silverlight
and video-on-demand systems that mimics the
Trick modes
visual feedback given during fast-forward and rewind operations that were provided by analogue
or its logic, in order to prevent tampering or deter
systems such as VCRs. Trick play manipulates the
reverse engineering.
video stream to include only a subset of frames.
White-box cryptography, a cryptographic system
OSX
Apple operating system for personal computers.
Whitebox
designed to be secure even when its internals are viewed.
OTT TV
PlayReady
Over-the-top TV is TV delivered via the web over unmanaged IP systems.
Widevine
Google proprietary DRM system.
Microsoft proprietary DRM system.
19
KUDELSKI, NAGRA, OPENTV, SMARDTV and their respective logos are trademarks, registered trademarks or service marks of Kudelski SA and/or its affiliates. All other trademarks are the property of their respective owners. All product and application features and specifications are subject to change at the sole discretion of Nagravision SA at any time and without notice.
design: diabolo.com
© 2015 Nagravision SA - All rights reserved.
SECURE – ENGAGING – EVERYWHERE 20
DTV.NAGRA.COM