nagra - optimizing multiscreen tv delivery with a secure video player
Post on 25-Jul-2016
225 Views
Preview:
DESCRIPTION
TRANSCRIPT
SECURE – ENGAGING – EVERYWHERE
DTV.NAGRA.COM
OPTIMIZING MULTISCREEN TV DELIVERY WITH A
SECURE VIDEO PLAYER
WHITE PAPER - AUGUST 2015
2
3
+ CE devices use a wide range of fast-evolving OS platforms, streaming standards, DRM products.
+ Pay-TV service providers face significant challenges in delivering OTT multiscreen services
to these ever-changing CE devices.
+ They are dependent on decisions taken by device manufacturers and sudden changes in browser or operating
platforms can be very disruptive and have a negative impact on pay-TV customers and service providers.
+ Google’s recent withdrawal of support for the NPAPI plug-in on its Chrome browser is a case
in point and has caused problems for some leading pay-TV service providers.
+ Service providers could opt for common encryption DRMs for their OTT TV services, hoping to solve all their
interoperability issues, but this approach will only address part of the technical and business challenges.
+ A better option is an operator-controlled secure player solution delivered by a trusted content
security partner that ensures a consistent user experience across all devices while providing
value over the entire lifecycle of CE devices.
This paper looks at the market needs and challenges that pay-TV service providers face when deploying multiscreen
TV solutions on third-party consumer electronic (CE) devices such as PCs, tablets, and smartphones. It evaluates
the alternative solutions that are available for addressing the needs of both content owners and service customers,
and it examines the potential business benefits of choosing an operator-controlled solution delivered by a trusted
content-security partner. The paper is based around the following key themes :
EXECUTIVE SUMMARY
FURTHER INFORMATION
NAGRA has published a range of additional information on the MediaLive Secure Player portal which can be
found at https://medialive.nagra.com.
To discuss your requirements for a Secure Player deployment in your organization, please contact your Account
Manager or email us at dtv@nagra.com
4
CHALLENGE #1 : KEEPING CONTROL
OVER DEVICE PLATFORMS
Service providers are dependent upon strategic and
technological decisions taken by device manufacturers
and software providers. This can leave them vulnerable,
for example, to changes in browser platforms
used on PCs and to the Android and iOS operating
systems of mobile devices. This can also mean that
multiscreen TV applications that worked previously
may suddenly stop streaming content, creating havoc
with subscribers and leading to calls to customer-care
centers, dissatisfaction with the operator, damage to
its brand, and loss of revenue 1. Rather than cement
and strengthen the relationship between pay-TV service
providers and their customers, OTT TV – if not deployed
carefully – could potentially end up undermining
customer confidence.
The latest example of this kind of potentially disruptive
change is Google’s decision to implement the HTML5
Encrypted Media Extensions (EME) standard to manage
DRM content in the Chrome browser, while phasing
out support for the Netscape Plug-in API (NPAPI) (see
Case Study 1). The withdrawal of support for NPAPI
– on which Microsoft’s Silverlight streaming media
application framework and its PlayReady DRM depend –
will affect pay-TV subscribers whose service providers
use these players to provide video content within a
Chrome browser. Given that the share of the Google
Chrome PC browser users is estimated to be more than
52% 2 of a typical pay-TV operator’s subscriber base
and that Silverlight and PlayReady are widely used by
some service providers, this potentially presents a very
significant challenge. For example, Google’s decision
led Sky and BT Sport to encourage their subscribers
to move from Chrome to Firefox or Internet Explorer 3.
The theoretical solution to the problem is greater OTT
standardization, which would enable service providers
to increase their efficiency and reduce the risk in
delivering OTT services. While there has been some
technical progress in simplifying streaming formats,
codecs, and DRM, the reality is that standardization is
an ever-evolving process that brings alignment over
time but is not the panacea to all market needs in the
short term. A more pragmatic approach is required.
CHALLENGE #2 : KEEPING CONTROL
OVER CONTENT SECURITY
Service providers also need to ensure that content
security standards are not compromised by choosing
a vertical, per-device, per-platform and per-browser
vendor approach, and that content licensing complexities
are not increased by having to deal with multiple DRM
vendors. Pay-TV service providers should not forget that
the very Silicon Valley giants (i.e. Apple, Google, and
Microsoft among others) that sometimes unilaterally
define their proprietary technologies are also their
competitors in delivering OTT TV. As a result, dependency
on the strategies of these companies increases business
risk levels for service providers.
OTT TV services are increasingly important to pay-TV service providers as they deploy multiscreen offerings to
complement their core services and to compete more effectively with Internet-based rivals. But delivering them
over consumer electronic (CE) devices such as PCs, tablets, smartphones, video game consoles, and smart TVs
presents several significant challenges regardless of the operator’s network type – whether telco, cable, or
satellite. Many of these challenges result from the fact that – unlike the pay-TV set-top-box environment – service
providers do not have control of the open devices, which use a wide range of operating systems and standards.
CHALLENGES IN MAXIMIZING THE REACH OF OTT DEVICES
5
CHALLENGE #3 : KEEPING CONTROL
OVER THE TV EXPERIENCE
Another fundamental requirement is the provision of
a consistent set of pay-TV-centric features and use
cases, available across all devices and platforms.
Such capabilities are best provided by a secure player,
with features such as multiple audio tracks, subtitles,
dynamic advertising, and trick modes, as well as use
cases such as casting or sharing between devices.
As well as streaming standards and DRMs, it is
important to include the overall and consistent control
of the TV experience delivered across multiple devices
that also interact with each other.
Understanding the longer-term implications of
technical decisions related to OTT and multiscreen
TV content delivery and their impact on business is
absolutely key for the success of service providers.
1 According to consulting firm nScreenMedia, US and European pay-TV operators are spending an estimated
$2.8 billion of their almost $10 billion annual network and maintenance expenses to directly address
multiscreen service delivery failures
http://www.rapidtvnews.com/2015071539066/pay-tv-operators-spend-billions-to-address-multiscreen-delivery-failures.html
2 An estimated 52% of World Wide Web users use Google Chrome as their browser on their personal
computers, according to StatCounter.com
3 “Sky has no plans to fix Chrome compatibility after Google’s Silverlight shun”, The Inquirer, May 1, 2015
http://www.theinquirer.net/inquirer/news/2383624/google-will-kill-microsoft-silverlight-in-chrome-by-disabling-npapi-plug-in
6
Google’s new Pepper Plug-in API (PPAPI), which
replaces NPAPI, is intended to increase security for
browsers as it provides a direct link to a sandboxed
environment where the code is executed – Chrome’s
Native Client (NaCI) – and provides greater stability, as
the code is executed in a separate thread rather than in
the main browser thread. It is also designed to facilitate
code portability across different platforms.
Google’s justification for its action is that PPAPI/NaCl
is more advanced and allows plug-ins to work more
seamlessly and securely within Chrome. However, the
move needs to be considered in the context of the wider
commercial battle between Google and Microsoft and
the fact that it may push service providers towards
adopting Google’s Widevine DRM.
NAGRA’s new PPAPI/NaCI browser plug-in is packaged
as the NAGRA MediaLive Secure Player for Chrome,
and integrates NAGRA anyCAST PRM, NAGRA’s studio-
approved DRM. It is fully compliant with the new HTML5
Chrome browser security architecture. The secure-
player browser plug-in is delivered as a Chrome
extension via the online Chrome Web Store, so it can be
easily installed by end-users. Updates are performed
via the operator’s Chrome Web Store account and easily
installed to the end-user’s Chrome browser.
With this solution, NAGRA ensures that pay-TV service
providers who had been using Silverlight and PlayReady
can continue to provide video services to their Chrome
customers with only a simple action required by the
subscriber. As a result, service providers do not have
to adopt another DRM (i.e.Google Widevine) and player
or point their subscribers to use Firefox, IE or Safari
browsers instead of Chrome.
NAGRA continues to deliver the NPAPI secure player
plug-in for Internet Explorer (on Windows), Firefox
(Windows and OSX), and Safari (OSX), ensuring support
for all major browsers.
Google’s decision to withdraw support for NPAPI on its Chrome browser created a potential challenge for pay-TV
service providers who were faced by a significant percentage of their base not being able to watch their content
via a Chrome browser. After Google announced the change in September 2013, NAGRA started developing a
solution so that affected premium content could continue to be delivered securely to Chrome browsers.
CASE STUDY 1 : GOOGLE CHROME
7
OTT STREAMING STANDARDS :
WHAT ARE THEY, WHAT IS COMING NEXT ?
Standards and Fragmentation: No Panacea
Video streaming over the Internet has evolved
tremendously over the past decade. Adaptive bitrate
(ABR) streaming formats such as Apple HLS and
Microsof t HSS have emerged, along with AES
encryption and interoperable DRM products. Despite
this, there has been considerable fragmentation
in the streaming formats and DRMs that are
implemented on specific devices, creating the need
to re-encode and re-encrypt content several times
in order to reach as broad a range of devices as
possible. While more recent origin servers allow to
re-encrypt content on the fly, hence removing the
need for ever-increasing storage, having to deal with
many different versions of the same content still adds
operational complexity.
The video and pay-TV industries have tried to confront
this situation by creating a common format through the
DASH Industry Forum, created in 2012. The vision here
involves the combination of the DASH adaptive bitrate
streaming format with the CENC common encryption
scheme for protecting content 4.
In addition, feature fragmentation both from a DRM and
Video Player perspective are also an issue. Indeed, while
modern browsers include a video player and support
for a DRM, the supported feature set varies from one
browser to another. For instance, one given subtitle
format supported on one browser is not on another.
In addition to the challenges pay-TV service providers face in maximizing device reach, there are also several
complex technology-based challenges that need to be considered to ensure the delivery of a high-quality
video product :
+ Selection of a reliable OTT streaming standard
to provide an optimal solution in a complex and
fragmented environment;
+ Selection of proven content-security solutions
that provide the best technology to deliver secure
content to all screens;
+ Deployment of rich multiscreen TV user
experiences that ensure superior TV-centric
services across all screens;
+ Addressing an ever-evolving, growing range of
devices and platforms while ensuring fast time
to market and optimized costs for launching
services to new screens.
4 NAGRA was shortlisted (and won the runner-up award) at the IBC 2013 Innovation Awards for the first
commercial deployment of DASH/CENC in the market.
SERVICE PROVIDERS SHOULD ASSUME THE CONTINUATION OF A
FRAGMENTED MARKET AND PLAN TO PROVIDE AN ABSTRACTION LAYER
– IN THE FORM OF A SECURE PLAYER SOFTWARE CLIENT – TO MANAGE
THE DIFFERENT STANDARDS AND PLATFORMS.
MARKET AND TECHNOLOGYCHALLENGES
8
DASH and CENC as New Alternatives
CENC allows encr yption to be done once, with
decryption performed across multiple DRM clients as
required. In theory, this allows a substantial reduction
in the complexity of both content preparation and
packaging workflows. A single secured file can be
played out across multiple devices which each support
a specific DRM client product.
In practice though, fragmentation remains extensive.
Apple, for instance, imposes its own HLS streaming
standard on its devices and has not yet adopted
DASH. In addition, some legacy CE devices with older-
generation browsers do not natively support DASH and
rely on NPAPI Microsoft or Adobe plug-ins to play back
DRM-protected content. Moreover, the different options
that one can select within the DASH specification can
also lead to fragmentation, as the specification provides
the choice of several audio codecs, different encryption
schemes and other specific features.
The positive news is that DASH has started to replace
legacy Microsoft HSS and Adobe HDS formats and
is expected to become the industry standard ABR
format. The very nature of next-generation streaming
standards is to decouple the file format from the actual
DRM used and ensure that multiple DRMs can coexist.
Indeed, we can expect to see more devices emerge
with their own native DRM when it makes sense for the
device vendor.
Planning for Evolving Standards : Being Pragmatic
The technology industry is notorious for defining
“standards” that take several release cycles to dislodge
previous-generation technologies. In this context, it
would be wise for service providers to take a pragmatic
stance and consider that standardization is always
likely to be a highly desirable outcome rather than a
sure reality. So they should assume the continuation of
a fragmented market and plan to provide an abstraction
layer – in the form of a secure player software client –
to manage the different standards and products.
HLS (HTTP Live Streaming) Proprietary : Apple, for QuickTime X and iOS
HSS (HTTP Smooth Streaming) Proprietary : Microsoft, for Silverlight plug-in
HDS (HTTP Dynamic Streaming) Proprietary : Adobe, for Flash plug-in
DASH (Dynamic Adaptive Streaming over HTTP) MPEG and ISO international standard
CENC (Common Encryption Scheme)Enables the same encrypted file to be used
by different DRM systems
SELECTED ABR STREAMING STANDARDS
NAGRA IS INVOLVED IN THE DASH STANDARDIZATION EFFORT AND IS
THE LEAD EDITOR OF THE RECENTLY RELEASED CONTENT PROTECTION
INFORMATION EXCHANGE FORMAT (CPIXF), A SPECIFICATION THAT
ALLOWS DRM LICENSE SERVICE PROVIDERS TO PERFORM EASIER PRE-
INTEGRATION WITH OTHER COMPONENTS OF THE STREAMING BACKEND
SUCH AS ENCODERS AND CDNS, HENCE DELIVERING SIGNIFICANT COST
SAVINGS WHILE IMPROVING TIME TO MARKET AND AGILITY.
9
CONTENT SECURITY : HOW TO DELIVER
THE BEST CONTENT ON EVERY SCREEN
Pay-TV service providers typically seek to license the
best available Hollywood and live TV content, which
implies high protection requirements as rights holders
are wary of piracy and its impact on the business model
of the entire content value chain.
Approved DRM Products and
Robust Client Implementations
Delivering HD content to high-resolution screens
including tablets, PCs, and game consoles requires
the use of various pieces of technology to maximize
content security. This includes advanced content-
protection technology based on DECE and DTLA studio-
approved DRM products, as well as sophisticated
software techniques such as whitebox cryptography,
secure video paths, sunrise key change, output
control, software obfuscation and hardening, and –
when available – Hardware Root of Trust to ensure the
proper client implementation of the DRM module and
the overall security of the client platform.
In the browser environment, the World Wide Web
Consortium (W3C) has worked at defining a secure
architecture for implementing DRMs using either the
native HTML5 Embedded Media Extension (EME) or
through secured plug-ins.
DRM Vendor Choice
With EME and CENC, content can be encrypted once at
the head-end and multiple DRM servers can be used to
generate licenses for specific DRM clients. However, the
DRM implementation carried out by browser vendors
such as Google has tended to be restrictive for service
providers: only one DRM is natively supported. Thus they
are implicitly forced to use a proprietary consumer-
device DRM such as Google Widevine. Fortunately,
newer generation browser plug-in frameworks such as
Chrome PPAPI – that include auto-update capabilities –
can also be used, thereby avoiding a total dependency
on a single DRM vendor; this is the approach that
NAGRA has taken. However, some less widely deployed
devices, such as the Microsoft Xbox games console,
support only PlayReady, without allowing the option of
implementing another DRM product.
As a result, service providers find themselves forced
into relationships with multiple DRM vendors, one
for each vendor-controlled platform on which they
want their content to play out. This has three major
implications :
(1) It increases the complexity and costs of content
rights negotiations ;
(2) Some content may not get the same rights, or face
a different liability on different platforms ;
(3) Service providers are left with little control over
the way that the DRM products evolve on a given
platform.
Optimizing this increasingly complex situation is a key
requirement.
Support for Multi-Usage Scenarios
Another important issue concerns content-usage
rules. For Hollywood studios and other rights holders,
the rights to view content on a small screen are worth
significantly less than those for viewing the same
content in HD on a large flat-panel display. Preventing
users from casting content without authorization has
become a big concern in rights negotiations. A secure
player solution that can manage this requirement
and ensure that content is played out on the intended
screens as laid down in the negotiated contract (with
secure reporting back to the content rights owners)
offers significant value to service providers.
Other rules for distributing and sharing content –
usually managed by the DRM system head-end and
implemented in a secure-player client – can be defined
by content type or by device. They need to be securely
transported to the device, which means that rooted
device and jailbreak detection is also required to ensure
that the usage rules are not tampered with.
10
BEYOND SECURITY :
WHY A VIDEO PLAYER IS REQUIRED
Beyond confronting the challenges involved in managing
a multi-DRM environment, service providers face other
requirements to ensure that their OTT TV services
function optimally. These include the provision of :
+ Video trick modes
+ Multi-CDN interfacing and dynamic selecting
+ Multi-audio, close captioning and
multi-language subtitles
+ Parental and playout control
+ Dynamic Advertising Insertion (DAI)
+ Detailed user-behaviour analytics
All these functions need to be packaged together on the
client side before interfacing with backend systems, and
this is best achieved with a secure video player.
In the early days of OTT TV, the licensing of premium
content was mainly a DRM issue. But these new
requirements – which result from the huge uptake in
OTT TV consumption – have set new expectations that
increase the need for service providers to adopt a multi-
purpose, multi-platform secure player solution.
There are several key aspects to the deployment of a
secure video player :
CDNs : The ability to dynamically select the best source
of content implies that algorithms are embedded into
the secure player to optimize the user experience
and the costs of streaming content.
DRM servers : Key information needs to be securely
retrieved from the backend and used by the player,
especially in the context of advanced use cases
such as local storage of downloaded content for
offline playback and side-loading of content to other
devices.
Analytics : Measuring the Quality of Experience (QoE)
by capturing deep data on player and user behaviour
enables the improvement of products and services.
Ad platforms : With Dynamic Ad Insertion being
imposed by more content providers, it is important
to deploy smart interfaces with leading advertising
delivery and tracking systems (such as Freewheel,
Omniture, ComScore, and Nielsen). A secure player
can include ID3 demuxing capabilities to control
ad-skipping and disable the search bar during ad
play-out and thereby have a direct impact on the
price of ads sold and revenues shared with content
providers.
Player packaging : The way the secure player is
packaged also has to be taken into consideration.
Having access to a browser plug-in for HTML5/JS
app development on PC platforms or an SDK for
native app development on iOS/Android platforms
allows the development of rich user experiences.
Another attractive option is a packaged app that
embeds HTML rendering capabilities, enabling
the development of apps using HTML/JS with the
same back-end business logic that is portable
across multiple platforms, leading to lower app
maintenance and deployment costs.
11
In scenarios where such a generic secure player
cannot be deployed – games consoles, for instance –
a platform-specific solution may be required, with the
core secure-player principles and APIs implemented
using a specific DRM client and file-streaming format,
adding controlled multi-DRM capabilities to the
overall platform.
EVER-EVOLVING DEVICE PLATFORMS : WHY
AN OTT TV APP CONSTANTLY NEEDS UPDATING
Accelerated Device Update Lifecycles
A new phenomenon in the CE industry over the past
five years has been the accelerated pace of innovation
brought on by frequent software renewals during the
lifecycle of a hardware device. In the smartphone and
tablet segment, Apple and Google update their OS and
app platforms several times a year, while desktop
browsers are also regularly improved by software
vendors, with software updates automatically pushed
to users. Similar approaches have systematically
emerged for OTT streaming boxes and casting sticks,
games consoles and connected TVs. Ensuring that
video content is always seamlessly played out on all
supported devices can quickly become a complex
process to manage, in which different technologies
and skills are required to deliver robust applications
at the lowest cost and with the highest level of
customer satisfaction.
Anticipating Evolution
For service providers, the standardization of streaming
technologies and the availability of some open-source
player components like dash.js can help reduce costs,
but there are other issues to address. The overall
challenge of managing app evolutions across a large
number of client platforms and devices adds risks and
costs to home-grown OTT TV operations. For instance,
staying ahead of rapid platform evolution often means
having dedicated technical staff who are involved with
leading software vendors and developer communities.
This represents a fixed cost that can be significant for
service providers in the early phases of deployment
or which have a geographically constrained customer
base. Opting out of such involvement, however, could
lead to a risky situation where service providers could
face a service blackout.
LicenseManagement
Rooting /JailbreakDetection
CryptographyUpgrade
ManagementDevice
Management
DRM & Player APIs
Player Core
Security Core
Customer UEXNative/HTML – JavaScript
I/O AdaptiveStreaming
Stack
H.264, AACA/V Synch
Video Trick Modes
Close Captioning, Subtitle Rendering
DownloadManagement
OutputControl
SECURE VIDEO PLAYER OVERVIEW
12
GENERIC OR OPERATOR-CONTROLLED DRM :
WHICH APPROACH BEST ADDRESSES
THE INDUSTRY’S NEW NEEDS ?
Consumer Electronics DRM Products
At first glance, the adoption of DASH and CENC along
with the implementation of new Web browser standards
should greatly simplify the delivery of DRM-protected
content to different devices that natively support CE
DRM clients such as Microsoft PlayReady, Google
Widevine, Adobe PrimeTime, or InterTrust Marlin. In
theory, all that would then be needed is a multi-DRM
backend key server to establish the proper interfaces
with the different DRM systems.
This approach is relatively simple to implement on the
server side and does not require deep integration on the
client side. But it forces service providers to surrender
significant control to the Silicon Valley giants which
provide DRM products for an increasingly important
aspect of their pay-TV operations. Moreover, it can
constrain service providers, preventing them from
evolving their platforms to satisfy content-provider
licensing requirements or to offer more advanced
services.
Operator-controlled DRM products
As more devices are used to access TV content within
the connected home – either on-demand (unicast)
or live (unicast and multicast) – the rules for content
sharing and usage need to be defined centrally, at the
head-end, and then applied to the different devices
in the home, usually through a secure-player client
that leverages specific DRM rules. For instance,
transferring a PVR recording to a tablet or starting to
watch a movie on a PC and then casting it to a TV set
while limiting the number of concurrent viewers who
can access the OTT TV service within the same home
requires specific DRM license management features
– most of which are not provided by the CE vendors’
generic DRM products. This can lead to three main
problems for pay-TV service providers – (1) security
loopholes; (2) missing or incomplete content rights;
(3) missing or incomplete use-case support – with the
latter two impacting user experience.
An operator-controlled DRM product provides the same
core features and content-protection capabilities as a
generic DRM as well as the required flexibility and extra
features that allow service providers to stay ahead
of the competition. By packaging such an operator-
controlled DRM product within a secure player that
delivers similar capabilities across multiple device
platforms, service providers have a powerful tool for
delivering a superior, seamless consumer experience.
They are also able to benefit from the strengths of a
product that is published by a focused security provider.
So a service provider should make use of an operator-
controlled DRM as much as possible, packaged within a
secure player, and restrict the use of third-party DRMs
to scenarios where the limitations and constraints of
the target platform are fully acknowledged.
As previously discussed, modern multiscreen TV-streaming services require a secure video player that has
at its core both an operator-controlled studio-approved DRM product and a secure-client implementation
that delivers advanced TV features. In this section, we analyze the benefits and limitations of each approach.
KEY APPROACHES TO CONSIDER
13
DO-IT-YOURSELF (DIY) VERSUS VENDOR PLAYER
SOLUTIONS : WHICH APPROACH TO INCREA SE
DEVICE REACH AND REDUCE COSTS ?
Multiscreen TV is all about extending device reach
to address the diverse needs of subscribers while
ensuring the delivery of quality pay-TV experiences to
all selected devices. This is better delivered by using
a secure player that can be developed in-house or
sourced from a software vendor.
DIY Secure Players
The DIY approach gives service providers control and
flexibility on how they implement their multiscreen
clients and apps, but the cost and complexity of
addressing an ever-increasing range of PCs, tablets,
smartphones, and other devices – all implementing
advanced frontend and backend secure-player and
service-management features – can become significant.
In addition, the risks of being late to market, or of not
being able to support some key devices and therefore
disappointing subscribers, can have a negative impact
on customer acquisition and increase churn.
Vendor Secure-Player Solutions
Vendor solutions typically leverage secure-player
products deployed worldwide and can provide huge
economies of scale, allowing service providers to
benefit from vendor expertise and firepower. This
approach helps improve time-to-market and delivers
leading solutions that are widely deployed by some of
the TV industry’s most demanding players.
Vendor solutions also offer access to an advanced
developer portal to get greater product insight and
more effective and comprehensive online technical
support from the vendor’s product-support teams.
14
Pros
DRM
Secure Video Player
Cons
Generic CE DRM • DRM provided by CE players / Silicon Giants• Core cloud-to-device features provided• Low-cost solution
• Lack of some TV-centric functions• Risk of dependency on CE player strategies / competitors• Need to manage multiple security liability agreements
• More flexibility for service providers• Full range of connected home features• Superior customer experience• Operator remains fully in control through its security partner
• Some devices (eg Xbox) require additional specific DRM (multi- DRM headend solution required)
Operator-controlledDRM
Own player based on Web standards and multi-DRM headend
• Limited specific security integration needs on the client side• Flexibility in developing browser-based solutions or native apps
• Limitations in delivering consistent TV-centric features across all browsers and devices• Surrenders significant degree of control to CE players (DRM, user experience)
• All the advantages of an operator-controlled DRM• Multi-DRM headend manages proprietary devices• Consistent, advanced TV-centric features across devices, management complexity transferred to security specialist• Future-proof, maintained over lifecycle
• Integrated solution, requiring managing a strategic relationship with a dedicated, long-term focused partner vendor
Secure player product with operator-controlled DRM
+ Premium content on every screen : ensure
the delivery of HD content on almost any
screen, meeting the most demanding security
requirements from content owners while enabling
content sharing between devices ;
+ TV-centric features : deliver a rich user experience
with advanced service capabilities such as parental
control, subtitles, close captioning, and multi-
audio tracks ;
+ Ease of use and smart advertising : offer intuitive
content navigation capabilities, such as smart
seeking within content, while ensuring the
implementation of dynamic advertising insertion in
a controlled and user-friendly context ;
+ Seamless multiscreen TV : provide seamless
integration with cloud PVR capabilities for
start-over and catch-up TV services – including
download-to-go capabilities – that truly contribute
to transform the TV experience on any screen.
Beyond these business considerations, a secure player, such as NAGRA’s MediaLive Secure Player, must
address these key functional value points :
DRM AND SECURE VIDEO PLAYER: ANALYZING ALTERNATIVE SOLUTIONS
As demonstrated in this paper, choosing a secure-player solution based on an operator-controlled DRM provides
several benefits that translate into a fast ROI while reducing risks in terms of customer satisfaction, costs
overruns, and content-security risks.
SECURE PLAYER BUSINESS BENEFITS
15
NAGRA’s Secure Player product line is designed to take
away some of the costs and risks of staying on top of
fast-evolving technologies and devices by mutualizing
the development and maintenance of products across a
large portfolio of customers. NAGRA also offers a variety
of standard and premium player maintenance and support
services, including a beta program for new releases.
NAGRA closely follows the iOS and Android evolutions
and is involved in the DASH Industry Forum, which helps
anticipate the directions of new releases. NAGRA’s
leadership position in the security industry means we are
on top of this complex area and apply product direction as
appropriate, for the benefit of all customers.
With so many devices available (for Android there are
now over 20,000 models), the MediaLive Secure Player
technology is first validated on the most popular devices,
covering over 95% of the general market. We provide
tools for customers to test additional, less-deployed
local devices. The new MediaLive online customer
portal http://medialive.nagra.com gives customer
engineering organisations access to straightforward
information about the MediaLive Secure Player, its APIs
and the latest product information.
NAGRA’s experience has shown that customers used to managing STBs can find the addition of multiscreen
solutions both challenging and a significant overhead. NAGRA manages this through our comprehensive approach.
CASE STUDY 2 : NAGRA’S MEDIALIVE SECURE PLAYER
MEDIALIVESecure Player
The Medialive Secure Player is a secure media player that delivers protected services and content to open devices running on Windows, iOS and Android by leveraging anyCAST PRM,
NAGRA's DECE and DTLA-approved DRM.
Video Player DRM Content Protection Multiscreen
Secure Player SDKs HTML Secure Players Adaptive Streaming / OTT
Audience Measurement Subtitles & Multi-Audio Download Manager
16
This means that pay-TV service providers need both
expertise and economies of scale to lower costs and
improve performance if they are to remain ahead of the
curve and provide superior products and services to a
growing and increasingly diverse population of users
and devices.
As this paper has demonstrated, the optimal approach
to safeguarding an investment in OTT TV services
delivered to CE devices is a secure-player solution
based on an operator-controlled DRM.
Working with an experienced content-security specialist
such as NAGRA also ensures that future challenges
can be met. NAGRA has more than 20 years of industry
experience in securing the business models of some
of the world’s largest pay-TV service providers. It has
delivered multiscreen OTT TV solutions to more than
20 leading pay-TV operators worldwide.
In conclusion, an approach based on a proven vendor
solution like the NAGRA MediaLive Secure Player
provides the following short-term tangible benefits to
pay-TV service providers :
+ Best content on every screen
+ Better device reach
+ Enhanced and consistent QoE
+ Lower operational costs
+ Fewer business risks
In addition, it ensures that service providers are
protected from potentially disruptive changes by CE
software providers and stay in control of their OTT
TV services as technology evolves and as consumer
viewing habits develop.
Consumer electronics products, both hardware and software, are evolving quickly, and nowhere is this
clearer than in the video capability of connected devices.
CONCLUSION : FACING THE FUTURE WITH CONFIDENCE
17
18
ABR
Adaptive Bit-rate Streaming, a technique for distributing video over unmanaged IP networks for which both international and proprietary standards exist.
DASHDynamic Adaptive Streaming over HTTP, an MPEG and ISO international ABS streaming standard.
AES
Advanced Encryption Standard, also known as Rijndael (its original name), a specification for the encryption of electronic data established by the US National Institute of Standards and Technology (NIST) in 2001.
dash.jsDASH JavaScript is an open source reference client implementation for the playback of MPEG DASH via Javascript and compliant.
API
Application Programming Inter face, a set of routines, protocols, and tools for building software applications. An API defines functionalities that are independent of their respective implementations, which allows definitions and implementations to vary without compromising the interface.
DECE
Digital Enter tainment Content Ecosystem, a consortium of major Hollywood studios, consumer electronics manufacturers and retailers, network hardware vendors, systems integrators and DRM vendors which creates rules and back-end systems to manage those rules that enable consumers to share purchased digital content between registered consumer-electronics devices.
CastingA technique for transferring Internet-delivered video content from a computer or a mobile device to a TV display
DRM
Digital Rights Management, a class of copy protection technologies used by hardware and software manufacturers, publishers copyright holders, and individuals to authorize and control the use of digital content and protect intellectual property rights.
CENCCommon Encryption Scheme, enables the same encrypted file to be used by different DRM systems.
DTLA
Digital Transmission Licensing Administrator, created by a consortium of technology companies in 1999 to license the Digital Transmission Content Protection (DTCP) technology which ensures consumers’ reasonable and customary right to make personal-use copies and enjoy digital content that is networked throughout the home. DTCP has been widely adopted in consumer electronics products including set-top boxes, digital TVs, and Blu-Ray and DVD recorders.
Cloud TV
Use of cloud computing technology to deliver TV services, where play-out technology is based in the cloud rather than at a cable, satellite or telco operator’s head-end.
EME
Encr ypted Media E x tensions , a W 3C dr af t specification for providing a communication channel between web browsers and DRM software, allowing the use of HTML5 video to play back DRM-wrapped content such as streaming video services without the need for third-party plugins such as Adobe Flash or Microsoft Silverlight.
CDN
Content delivery network (or content distribution network), a distributed system of servers deployed in multiple data centres across the Internet, which allows content (including live streaming media and on-demand video) to be served to end-users with high availability and high performance.
Hardware Root
of Trust
A hardware component that is secure in design and inherently trusted to perform one or more security-critical functions, such as measuring and/or verifying software and protecting cryptographic keys.
DAI
D y n a m i c A d v e r t i s i n g I n s e r t i o n , a l l o w s adver tisements within streaming on-demand content to be changed by operators, thereby enabling advertising to be targeted at specific groups of subscribers. DAI is increasingly imposed by content providers.
HDSHTTP Dynamic Streaming, Adobe ABS streaming standard for Flash plugin.
GLOSSARY
19
HLSHTTP Live Streaming, Apple ABS streaming standard for QuickTime X and iOS.
PPAPI Pepper Plugin API, Google replacement for NPAPI.
HSSHTTP Smooth Streaming, Microsoft ABS streaming standard for the Silverlight plugin.
PrimeTime Adobe proprietary DRM system.
IntertrustMarlin
Open-standard DRM developed by Intertrust Technologies Corporation with four consumer electronics companies: Sony, Panasonic, Philips, and Samsung.
PVR
Personal video recorder (also known as Digital Video Recorder or DVR), a consumer electronics device or application software that records video in digital format to a local or networked (nPVR) storage device.
ID3
ID3 is a metadata container most often used in conjunction with the MP3 audio file format. It allows information such as the title, artist, album, track number, and other information about the file to be stored in the file itself.
Sandbox
A security mechanism for separating running programs. A sandbox is often used to execute untested code, or untrusted programs from unverified third parties, suppliers, untrusted users and untrusted websites.
Multi-DRMThe use of multiple DRM systems at the backend to deliver content to a range of devices that use different DRM formats.
SDKSoftware Development kit, a set of tools for developing software.
NaCI
Google Native Client (NaCl) is a sandboxing technology for running a subset of Intel x86, ARN or MIPS native code in a sandbox, allowing the safe running of native code from a web browser, independent of the user operating system, allowing web-based applications to run at near-native speeds. It may also be used for securing browser plugins, as well as other applications.
Secure Video
Player
A video player that incorporates DRM and anti-hacking techniques to ensure content protection.
NAGRAanyCAST
PRM
Provides DECE and DTLA-approved DRM protection of high-value content on both closed and open devices.
Silverlight Microsoft proprietary streaming media application framework.
NPAPINetscape Plugin API, a cross-platform plugin architecture, first developed for Netscape browsers in 1995, used by many web browsers.
Sunrise key
change
Ability for a DRM system of automatically change the content key on a Live channel, for example once per day.
Obfuscation
The deliberate act of creating obfuscated code that is difficult for humans to understand. Programmers may deliberately obfuscate code to conceal its purpose (security through obscurity) or its logic, in order to prevent tampering or deter reverse engineering.
Trick modes
A feature of digital video systems including PVRs and video-on-demand systems that mimics the visual feedback given during fast-forward and rewind operations that were provided by analogue systems such as VCRs. Trick play manipulates the video stream to include only a subset of frames.
OSX Apple operating system for personal computers. WhiteboxWhite-box cryptography, a cryptographic system designed to be secure even when its internals are viewed.
OTT TVOver-the-top TV is TV delivered via the web over unmanaged IP systems.
Widevine Google proprietary DRM system.
PlayReady Microsoft proprietary DRM system.
GLOSSARY
20
KUDELSKI, NAGRA, OPENTV, SMARDTV and their respective logos are trademarks, registered trademarks or service marks of Kudelski SA and/or its affiliates.
All other trademarks are the property of their respective owners.
All product and application features and specifications are subject to change at the sole discretion of Nagravision SA at any time and without notice.
© 2015 Nagravision SA - All rights reserved.
SECURE – ENGAGING – EVERYWHERE
DTV.NAGRA.COM
de
sig
n:
dia
bo
lo.c
om
top related