Cable operators have a tricky transition from conditional access to digital rights management

With apologies to retransmission consent, there isn’t a single legal concept that has inspired more heartburn in more facets of content distribution than digital rights management (DRM).

Both issues are the source of considerable tsuris among content owners, content distributors and the general public. Yet, even though more and more consumers are suffering through increasingly frequent channel blackouts of increasing duration because of escalating retrans arguments, few have heard of retrans, not many of those much understand what it is and fewer still have strong opinions about the subject.

On the other hand, millions of consumers began purchasing digital music more than a decade ago and are fully aware that DRM is the thing that restricts them from transferring their downloads with the same impunity they have when they purchase music on physical media.

After music got digitized, then video did too, and studios adopted the DRM approach. Publishers followed suit with digital books. Now consumers have many of the same problems transferring movies and books that they have transferring music.

So a good percentage of consumers have a pretty good idea what DRM is; many of them find it at least an occasional aggravation; and plenty vociferously despise it with the same loathing they have for banks, airlines and their communications service providers.

But then it’s not just consumers. Nobody much likes DRM, for one reason or another.

Nobody can agree on a single DRM or small pool of DRMs to use – not Hollywood Studios; not manufacturers of smart TVs, mobile phones or tablets; not service providers. A recent example involved the Digital Entertainment Content Ecosystem consortium. DECE includes scores of companies backing UltraViolet, the so-called digital rights locker in the cloud.

Early last year, Wal-Mart and its Vudu streaming video subsidiary initiated a service based on UltraViolet, but consumers were disappointed to find that Disney was not participating and that the system, as Wal-Mart and Vudu deployed it, did not work with several popular playback devices in all circumstances.

For multichannel video programming distributors (MVPDs), negotiating separate arrangements with every individual content owner is nothing new. Before, however, the only ramifications of the process that were visible to viewers were if channels were added, subtracted or swapped, or if fees went up.

Such changes certainly inspired customer dissatisfaction, but at least viewers could comprehend what was going on when their service providers said something like, “We’re no longer carrying the Monster Truck Channel; we’ve replaced it with The Quilting Channel.” Well, there you have it, then.

A DRM system in a multi-screen environment should not only secure the content, but assure that the integrity of the apps on unmanaged devices is uncompromised. Provisioning of entitlements is critical, and still a challenge. Source: Azuki Systems.

But now, with DRM an intrinsic element of the relationship between video producers and video distributors, the ramifications for viewers are practically incomprehensible. “I can get channel A on my iPad at home, but not on my Android phone, and not at all at Starbucks, even on my iPad, but I can get Channel B anywhere at any time? Whaddaya say you just give me what I paid for whenever I want it?” Um, yeah, well, about that. … Part of the issue is legal – what is each subscriber entitled to, and under what circumstances? The answer depends on a number of circumstances, including how to stack release windows. But it also depends in some measure on the fractured nature of the DRM market.

Different manufacturers of different display devices rely on different DRM technologies.

Content owners often insist on approving a DRM before allowing their assets to be delivered using it. A video app might be available first for Apple iOS devices, and then for Android devices (or vice versa), because there are different ways of handling  video to prepare it for delivery to one or the other, including how to implement DRM, and as a practical matter, app developers have to build the versions in sequence.

The entire communications industry is slowly beginning to rally around a smaller handful of DRMs than there were three to five years ago, but there are still several, and many people would prefer if there were fewer still.

Years ago, “you needed a fairly secure computer,” said Tim Dodd, vice president and general manager at Neustar Media. “That was a requirement of the studios. They have a legitimate interest in protecting their content, just like stores have a legitimate interest in preventing shoplifting. But the requirements were at some point exceeded, or were at the upper bound of what the devices could sustain.

“Today, we’re all walking around with a sophisticated computer in our pockets called a smartphone that’s always connected to the network. The benefit is that you have real-time security, a powerful processor, and it’s capable of doing very interesting things. In some ways, things are becoming easier,” Dodd said.

Until recently, the one way to deliver secure video was on a dedicated channel optimized for video with a conditional access (CA) system, most likely from either Cisco or Motorola, or possibly from NDS. The essence of the approach was securing the channel, and it assumed that the only place the video could go after going through the set-top box was a television set.

Now there are several more delivery networks (multiple types of broadband, multiple flavors of wireless), and the display could be any of several different types of device (smart TV, tablet, smartphone, etc.), and the video being requested and transmitted might not go anywhere near a set-top box.

CA to DRM 

These days, to deliver secure video, the channels have to be securitized, or the devices, or both – if that last option is available. Different delivery networks are controlled by different service providers, and devices are from many different manufacturers. They can all be mixed and matched in myriad ways. Cable operators have to straddle two different means of delivery, through the traditional video channel and through new channels.

“We live in a different world when we want to pursue consumer-owned devices, without resorting to things like CableCards,” said Mike Hayashi, Time Warner Cable’s executive vice president of architecture, development and engineering. “It means we need to be flexible about being able to adapt to security components that do not necessarily belong to us.

“Classic video – delivering video over MPEG-2 transport with conditional access systems either from Motorola or Cisco, or some companies have NDS – that’s not going to go away overnight,” Hayashi continued. “We talk about what happens when they’re gone, and that’s an easy story. When they’re gone, we have DRM, and it’s wonderful. The thing is how to migrate seamlessly from point A to point B without impacting our customers,” Hayashi continued. “The customers have both technologies. Many of them have our settop boxes, many have devices that they own, but as far as they’re concerned, they want to watch HBO on any of those devices. That’s the challenge for us.”

On the other hand, the DRM approach has clear benefits of being able to provide abilities that are harder to enable through a set-top box.

“DRM offers features such as different behavior based upon rights. We may have an expiration date for some particular content; it may allow me to download to go,” Hayashi said. “These are incremental features DRM can enable.”

The issue is not conditional access versus a DRM approach, he cautioned. “You need to do both. If it’s a live linear channel that we stream to iPads and Android devices and PCs and Macs – there’s more of an element of security there, because it’s live, there’s nothing else happening. But when you’re looking at offering VOD through the same portal, you need to protect that particular content and its behavior. So it’s both,” Hayashi said.

“There’s an interesting gray area between conditional access and DRM,” Dodd agreed, “though it’s coming into starker relief with TV Everywhere and some of the over-thetop strategies, and execution of over-the-top comes into play. Conditional access is either yes or no. DRM lets you be more granular.”

The transition will be the tricky part, Dodd continued.

“How do you bridge delivery on conditional access with MPEG- 2 and content on IP, and how do you secure it? More interestingly, how do you bridge from say a set-top box and – not either, but and – still bring over the same content on IP to handsets, tablets and PCs. There may be some point at which you get away from the set-top box, but for now, you want to expand the ambit of what you’ve got.

So how do you do that? That IP bridge is really important. You do that at the headend? In the cloud? In the house with a very expensive box? What do you do? There are a lot of discussions about that, and it includes security and DRM.”

Choices 

Many video distributors already have some multi-screen experience, and the ability to take unsecured video files and “wrap” them with a DRM appropriate to the end device being served is common enough.

Hayashi agreed that the technology to handle DRM is known. The issues have to do with the number of them (“Dealing with one security method versus dealing with n? There’s the level of difficulty there.”) and the back office challenge of keeping track of each customer’s entitlements (“Do I have the ability to entitle my customer with the right level of services that they’ve paid for?”).

The other issue is that it is still too early in the multi-screen era to make assumptions about consumer behavior and consumer preferences for how to consume video.

“If I have to serve an Android product and an iPad product, they both do not use the same security methods. I have a couple of choices,” Hayashi explained. “One is: I deliver the signal in compliance natively to what those two systems prefer in terms of a secure method of delivery – in the case of Apple, it would be FairPlay.”

There are pitfalls to avoid there, cautioned Raj Nair, Azuki Systems’ CTO. Encryption is based on some exchange of code keys. “There are some solutions vendors call DRM, but they’re encryption schemes that neglect to take into account how the key is protected or secured. That’s a complete non-starter from a studio standpoint,” he said.

“The key is in the clear,” he continued. “So unless you do something on the client, you can’t easily protect the key. It’s not enough to say, ‘I’m using an encryption scheme, and therefore I’ve protected the content.’ The studios know this. Conditional access is one thing; this is a different ballgame – just encrypting the stream is not enough.”

So one option for a service provider to use to serve a consumer-owned device would be a security system native to the device, Hayashi said.

“Or I could look at packaging it differently and picking a DRM solution I could deliver to those devices and make it through my own player. In other words, you’d have to download my application that had security embedded in it.”

For service providers, however, that approach has yet to be proven.

“First, you have to look at the customer experience. Is that a barrier that you have to download an app? It’s not just about security itself; you have to consider the whole customer experience that goes with it,” Hayashi said.

Mobile DRM 

Video is increasingly going mobile. Azuki Systems built its video delivery system specifically for mobile delivery, including designing its own DRM. In the last year, the company’s platform has begun to gain traction with programmers that deliver their own video, notably HBO.

“A combination of things made it difficult to use existing DRMs,” Nair said. “First, you have consumer-owned devices, and they didn’t necessarily have any protection systems built in, which is still the case by and large.

Also, in our business, the content is delivered though apps, which are user-downloadable through app stores, which all have their own list of requirements and restraints.

“We had to worry about how to authenticate the device,” Nair continued. “We had to have mechanisms to blacklist devices if they were found to be leaky. We had to come up with schemes to authenticate the app itself, because the app downloaded is in somebody’s device, so you can’t take anything for granted. You have to assure the device is good and the app is intact.”

Nair explained that traditional DRM schemes were built with the expectation that what had to be protected was a unified file. But that doesn’t work with adaptive streaming over IP networks, because in ABR, streaming files are highly subdivided – “chunked” – and transmitted.

One of the techniques Azuki employs is key rotation.

“When you move from conditional access to a DRM situation, it can’t be file-based, it has to be based on a stream, with stream semantics, so that you can actually change the keys,” Nair said. “This is a challenge for some older DRMs that are file-based. I don’t know of a good solution of how you’d do key rotation with those.”

Another method designed to frustrate hackers is to periodically refresh the app.

“Any hackers working on it have to go back to the beginning. It’s easy to do, with no disruption to the user experience,” Nair said. “We’re in this evolution of DRM,” he continued. “There was this growth of a lot of devices – we seem to be getting over that hump. Now with what we have, perhaps we can achieve some uniformity with hardwarebased protections – and that’s not just the protection of a key, that’s also the output HDMI controls and other hardware enforcements.

But once you have a common set of hardware protection mechanisms that apps can take advantage of, then you would get a situation where you could use any particular DRM based on its feature set; due to the mechanisms, they’ll have the same level of robustness. That’s where we want to go.

“You’re not going to find a nirvana where everyone picks one system, but if you can agree on a few basic primitives and a few basic requirements, then you could allow for vendor differentiation, and I think that would be achievable.”

Ray Milius, executive vice president of programming and IT operations at Starz, said several of the manufacturers of products such as smart TVs and mobile devices are trying to find some common ground. “It would certainly be nice for those of us who have to develop apps if it were that way,” he said.

“It’s an issue in that there are a lot of different flavors out there, and different manufacturers will choose one that’s incompatible with us in a business sense,” Milius continued. “We can implement a different kind of technology for that, but we have to utilize something that’s been approved by the motion picture studios, and sometimes they’re a little slow to approve certain DRMs.

“We’re limited in the ones we can use. It’s not a huge limitation, we’re all complying with the studios, they recognize they have to get their content out there, we can deal with that in time.

But sometimes when someone comes out with the latest, greatest DRM, we’re limited by what the studios will allow,” Milius concluded.

“Three to five years ago, DRM was a big, scary, consumer-facing thing that turned off consumers for a bunch of reasons,” Dodd said. “If you went to some distribution sites, you’d have to have a specific type of Windows computer, with a specific type of hardware and software, or you couldn’t buy anything. In the past, the industry made DRM very obvious to consumers, with the result that people didn’t buy much.”

The second problem was consumers had to manage the files. Before the cloud, you had to download to one device, and if you wanted to move it to another, and consumers don’t want to manage that – it’s just a hassle.

So people didn’t buy digital.

And the last reason people didn’t buy digital was because different DRMs didn’t interoperate. You couldn’t move files from a PlayStation to an Xbox, or from one application to another, even on the same machine.

Fast-forward to today. With UltraViolet, you have interoperability. Because you have the cloud, you don’t have to be tied to one device because you can stream from anywhere – you’re no longer managing devices and copies. And you can now move from one device to another because it’s a common file format. DRM has now become transparent. UltraViolet is not a DRM; it uses common DRMs available in the market.

It’s just tucked in – transparent.

“We’re in a very interesting time of going from the classic method of securing video,” Hayashi said. “What we’re using today has its origins in not knowing what’s going on in the home, with the assumption it was going to our set-top boxes. That world is changing quickly. Migrating from that world to the world where I have to serve multiple devices, we’re in a transitional period, and that’s what makes it a challenging engineering environment.”