Upload
bernadette-bailey
View
215
Download
0
Embed Size (px)
Citation preview
Sony Pictures Confidential 1
RVU Security Solution for 4kAugust 18th, 2014
8/17/2014
Sony Pictures Confidential 2
Problem Statement
• RVU relies on DTCP-IP for security• DTCP-IP does not meet the MovieLabs specifications for Enhanced
Content Protection• DTCP-IP does not meet SPE’s requirements for 4k/UHD content
protectio
8/17/2014
Sony Pictures Confidential 3
Key Security Requirements GapsRequirement Comments
The system shall have the ability to revoke and renew code signatures if these are used as part of the system’s root of trust.
Not in robustness rules
The system shall have the ability to revoke individual devices or classes of devices. No requirement to assign keys in any consistent manner
The system shall allow HDCP 2.2 or better to be required by content Not supported
The system shall allow other outputs to be selectable by content. Not supported
The platform shall implement a secure media pipeline that provides end-to-end protection that encompasses, at a minimum, decryption through to protected output. This secure media pipeline shall include protecting secrets (including keys and derivative key material) and both compressed and decompressed video samples from access by any non-authorized source.
Not in robustness rules
The platform shall support a secure processing environment isolated by hardware mechanisms running only authenticated code for performing critical operations. The security of this environment must have been proven with extensive testing
Not in robustness rules
The platform shall be able to protect memory of the secure execution environment against access from untrusted code & devices.
Not in robustness rules
The platform shall support runtime integrity checking of secure applications. Not in robustness rules
The platform shall support a secure chain of trust for code that executes in the secure execution environment. The root of this trust shall be securely provisioned, e.g., permanently factory burned.
Not in robustness rules
The platform shall support a device-unique private key for protecting stored secrets. It shall be:
• securely provisioned, e.g., permanently factory burned using encrypted communication in the facility so that keys are not revealed in network or other operational logs,
Not all devices
• usable in certain crypto ops, but never visible even to trusted software, Not in robustness rules
The compliance of the system and the robustness of its implementation shall be certified by a combination of 3rd parties and trusted implementers
Self-certification
Necessary cryptographic elements, e.g., code signing keys, for an implementation shall not be issued until that implementation has been certified.
Self-certification
8/17/2014 This list is NOT definitive
Sony Pictures Confidential 4
Elements of the Proposed Solution
1. Requirements for security measures to supplement DTCP-IP security2. A White List of devices that meet the additional security
requirements3. A protocol for cryptographic authentication of devices against the
White List4. A process for revocation and renewability of devices or class of
devices in the event of a security breach5. Framework for enforcement of compliance with the additional
security requirements
8/17/2014
Sony Pictures Confidential 5
Security Requirements Gap OptionsRequirement Mitigation
The system shall have the ability to revoke and renew code signatures if these are used as part of the system’s root of trust.
Device, model and software version in identifiers in authentication protocol
The system shall have the ability to revoke individual devices or classes of devices. Device, model and software version in identifiers in authentication protocol
The system shall allow HDCP 2.2 or better to be required by content Signal in authentication protocol
The system shall allow other outputs to be selectable by content. Signal in authentication protocol
The platform shall implement a secure media pipeline that provides end-to-end protection that encompasses, at a minimum, decryption through to protected output. This secure media pipeline shall include protecting secrets (including keys and derivative key material) and both compressed and decompressed video samples from access by any non-authorized source.
Enhanced robustness requirements
The platform shall support a secure processing environment isolated by hardware mechanisms running only authenticated code for performing critical operations. The security of this environment must have been proven with extensive testing
Enhanced robustness requirements
The platform shall be able to protect memory of the secure execution environment against access from untrusted code & devices.
Enhanced robustness requirements
The platform shall support runtime integrity checking of secure applications. Enhanced robustness requirements
The platform shall support a secure chain of trust for code that executes in the secure execution environment. The root of this trust shall be securely provisioned, e.g., permanently factory burned.
Enhanced robustness requirements
The platform shall support a device-unique private key for protecting stored secrets. It shall be:
• securely provisioned, e.g., permanently factory burned using encrypted communication in the facility so that keys are not revealed in network or other operational logs,
Enhanced robustness requirements
• usable in certain crypto ops, but never visible even to trusted software, Enhanced robustness requirements
The compliance of the system and the robustness of its implementation shall be certified by a combination of 3rd parties and trusted implementers
Third party certification
Necessary cryptographic elements, e.g., code signing keys, for an implementation shall not be issued until that implementation has been certified.
Third party certification
8/17/2014
Sony Pictures Confidential 6
Authentication Protocol Overview
1. Device ID is obtained from TLS with Supplemental Data Auth as part of DTCP client certificate that is exchanged. Other information will be securely exchanged (Make/Model #/Serial #/MAC/UUID/SW Version, etc.)
2. Set-top box checks for Device ID in the service operator’s white list, and performs other verifications: SW version, etc.
3. Set-top box and TV perform Authenticated Key Exchange (AKE)4. During, DTCP AKE, Set-top box checks for Device ID in the
revocation List (service Renewability Message)5. Device ID from Authentication must be the same as in AKE8/17/2014
Sony Pictures Confidential 7
White List
• DirecTV maintains a White List in the STB• Authentication protocol requests are checked against the White List• Device authenticates to WL: connection proceeds• Device partially authenticates to WL: system renewability initiated• Device does not authenticate: connection rejected• Device in DTCP SRM: connection rejected per DTLA rules
• Devices are added to the White List subject to compliance with enhanced (or individual studio) requirements
8/17/2014
Sony Pictures Confidential 8
Enforcement
• RVU certification does not address security• RVU relies on DTCP-IP security, DTLA adopter license terms enforce DTCP-IP
compliance.• DTLA adopters license offers protection against non-compliant DTCP
devices:10.4 Equitable Relief10.5 Damages Measure and Limitation (up $8M)10.6 Third-Party-Beneficiary Rights
• But DTLA adopter’s license terms will not apply to any augmentation of DTCP-IP security• Where does enforcement of device compliance come from?8/17/2014
Sony Pictures Confidential 9
Next Steps
1. Full protocol specification from Sony2. Proposal from Sony and SPE for enhanced robustness and
compliance• Modeled after HDCP 2.2 requirements
3. Discussion on enforcement mechanism4. Review of solution against MovieLabs specification
8/17/2014