IPTV Security Protecting High-Value Digital Contents

David Ramirez Alcatel-Lucent, UK

John Wiley & Sons, Ltd

Contents

Preface About the Author

xv xvii

1 Introduction to IPTV 1.1 Introduction 1.2 General Threats to IPTV Deployments 1.2.1 Access Fraud 1.2.2 Unauthorized Broadcasting 1.2.3 Access Interruption 1.2.4 Content Corruption

1 1 3 4 5 5 6

2 Principles Supporting IPTV 2.1 History of Video and Television 2.1.1 Television 2.2 Viewing Experience of Video 2.2.1 Line Scanning 2.2.2 Video Resolution 2.2.3 Number of Pictures per Second 2.2.4 Aspect Ratio 2.2.5 Video Compression Method 2.3 Video Compression 2.3.1 MPEG-2 2.3.2 H.263 2.3.3 MPEG-4 2.4 TCP/IP Principles 2.4.1 Addresses 2.4.2 Routing 2.4.2.1 IP Packet 2.5 Summary References Bibliography

9 9 10 15 15 15 16 16 16 16 17 18 18 19 19 20 20 21 22 22

viil

Contents

3 IPTV Architecture 3.1 High-level Architecture 3.1.1 Service Types 3.2 Functional Architecture for the IPTV Service 3.2.1 Content Provision 3.2.2 Content Delivery 3.2.3 IPTV Control 3.2.4 Subscriber Functions 3.2.5 Security 3.3 Detailed IPTV Architecture 3.3.1 Head End (IPTV Service Provider) 3.3.1.1 Critical Elements of the Head End 3.3.1.2 Content Input 3.3.1.3 MPEG Video Encoder 3.3.1.4 IP Encapsulator 3.3.1.5 Video Transcoder 3.3.1.6 Content Management Server 3.3.1.7 Video Repository 3.3.1.8 Digital Rights Management 3.3.1.9 Video Streaming Server 3.3.1.10 Subscriber Interaction 3.3.2 Transport and Aggregation Network (IPTV Network Provider) 3.3.2.1 RP and RTSP 3.3.2.2 RTSP 3.3.2.3 Ismacryp 3.3.2.4 PIM 3.3.2.5 MSDP 3.3.2.6 DSM-CC 3.3.2.7 Internet Service Provider 3.3.2.8 DSLAM 3.3.3 Home End (Subscriber) 3.3.3.1 Set Top Box 3.4 Summary References

23 23 25 25 26 26 26 26 27 28 28 29 30 32 33 34 34 35 36 37 37 40 49 49 51 52 53 53 53 53 57 58 61 62

4 Intellectual Property 4.1 Introduction 4.2 Supporting Technology 4.2.1 Symmetrie Key Cryptography 4.2.2 Asymmetrie Key Cryptography 4.2.3 Hybrid Encryption 4.2.4 Hash- Digest 4.2.5 Commonly Used Algorithms 4.2.6 Public Key Infrastructure and ITU-TRecommendation X.509 4.2.7 Operation ofPKI 4.2.8 Secure Socket Layer and Transport Layer Security 4.3 General Mechanisms for Content Protection 4.3.1 CPS 4.3.2 CAS 4.3.3 DRM

63 63 73 73 74 74 74 75 76 80 81 82 82 83 83

Contents

IX

4.4 Operation of DRM on IPTV 4.4.1 DRM Applied toVOD 4.4.2 DRM Applied to Broadcast TV 4.4.3 Smart Cards and DRM 4.4.4 Storage Protection 4.4.4.1 VCPS 4.4.4.2 CPRM/CPPM (CPSA) 4.4.5 OpenDRMs 4.4.5.1 SDMI 4.4.5.2 OMA DRM 4.4.5.3 DMP 4.4.5.4 MPEG21 4.4.5.5 MPEG21 REL Data Model 4.4.5.6 DVB-CPCM 4.4.5.7 DVB-CBMS 4.4.5.8 PERM 4.4.5.9 DCAS 4.4.5.10 DReaM 4.4.5.11 OpenIPMP 4.4.5.12 OpenCA 4.4.5.13 PachyDRM 4.4.6 Interoperability Proposais 4.4.6.1 Coral 4.4.6.2 DMP 4.4.6.3 SmartRight 4.4.6.4 SVP 4.4.6.5 OpenCP 4.4.6.6 OMArlin 4.5 Watermarking and Fingerprinting 4.5.1 History 4.5.2 Steganography Techniques 4.5.3 Watermarking and Fingerprinting Principles 4.5.4 Typical Attacks 4.5.5 Forensic Use of Digital Fingerprints 4.6 WWW? (What Went Wrong?) 4.6.1 Introduction 4.6.2 Satellite Television 4.6.3 DVD Protection 4.6.4 AACS on Blue-Ray and HD-DVD 4.6.5 Videos Over the Web 4.7 Authentication 4.8 Sinnmary References Bibliography

86 87 88 88 89 89 89 89 89 90 90 91 91 91 91 92 92 92 93 93 93 93 93 94 94 94 95 95 95 95 98 99 101 103 105 105 106 107 108 110 111 111 112 113

5

115

Existing Threats to IPTV Implementations Co-authored by Andrew R. McGee, Frank A. Bastry and David Ramirez 5.1 Introduction to IPTV Threats 5.1.1 Specific Threats to IPTV Environments 5.2 IPTV Service Provider - Head End 5.2.1 Video Feeds - Live or Prerecorded (Physical Media, OTA, etc.)

118 120 125 126

Contents

X

5.2.2 5.2.3 5.2.4 5.2.5 5.2.6 5.2.7 5.2.8 5.2.9 5.2.10 5.2.11 5.2.12 5.2.13 5.2.14 5.2.15 5.2.16 5.2.17 5.2.18 5.2.19

Video Switch Ingest Gateway (Video Capture) Platform SW/OS - Stored/Running Content Management System Content Metadata from Video Repository MPEG-2 Content from Video Repository MPEG-4 Content Load Balancer Software Master Video Streaming Software CA/DRM Service SRTP Keys Ismacryp Key Key Management Protocol CA/DRM Service Administration VOD Application - Cached Video Content Metadata Cached MPEG-2/MPEG-4 Content (Primary and Secondary Storage) Video Streaming Software Local Ad Insertion Authentication Information (e.g. User ID(s) and Passwordfs)) 5.2.20 Local Ad Metadata 5.2.21 Local Ad MPEG-2/MPEG-4 Content 5.2.22 Local Ad Insertion Tracking Information 5.2.23 nPVR Application Recorded/Stored Content Metadata 5.2.24 Recorded/Stored MPEG-2/MPEG-4 Content 5.2.25 nPVR/Video Recording Software 5.3 IPTV Network Provider - Transport and Aggregation Network 5.3.1 Protocol Vulnerabilities 5.3.2 Content Distribution Service: Unicast Content Propagation - FTP or Other Transport Protocol 5.3.3 Multicast Content Propagation 5.3.3.1 IGMPv2/v3 (Snooping) 5.3.3.2 PIM (SM, SSM, Snooping) 5.3.3.3 MBGP 5.3.3.4 MSDP 5.3.3.5 MFTP 5.3.3.6 RTP 5.3.4 QoS Signaling (RSVP, Difßerv) 5.3.5 Management of Content Distribution Service 5.3.6 Connection Management Service 5.3.6.1 DSM-CC Protocol 5.3.6.2 RTSP Protocol 5.3.6.3 MPEG-2 Video Stream 5.3.6.4 MPEG-4 Video Stream 5.3.6.5 DSM-CC 5.3.6.6 RTSP 5.4 IPTV Subscriber - Home End 5.4.1 Set Top Box 5.4.2 STB Executing Software 5.4.2.1 DRM Software 5.4.2.2 Middleware Client SW

126 121 127 127 128 128 128 129 129 129 129 130 130 131 131 131 132 132 132 133 133 133 134 134 134 134 137 137 137 138 139 139 140 141 141 142 142 143 143 143 144 144 145 145 145 147 147 147

Contents

xi

5.4.2.3 STB Platform SW 5.4.2.4 DVR/PVR 5.4.2.5 STB Credentials 5.4.2.6 Digital Certificate (Software Provider) 5.4.2.7 STB Digital Certificate 5.4.2.8 Public Keys (Used for Digital Certificates) 5.4.3 STB User Storage 5.4.3.1 Downloaded Content 5.4.3.2 User-created Content 5.4.3.3 STB Smart Card 5.4.3.4 STB Credentials 5.4.3.5 STB Digital Certificate 5.4.3.6 STB High-definition Output Interface 5.4.3.7 DVI 5.4.4 Residential Gateway 5.4.5 DSLAM 5.4.5.1 Audience Metering Information 5.4.5.2 Fraud Control Information 5.4.5.3 IP Filters 5.4.6 Broadcast/Multicast TV VLAN Service 5.4.6.1 Decryption Keys 5.4.6.2 CWMP 5.4.6.3 NTP/SNTP 5.4.7 Broadcast/Multicast TV Application 5.4.7.1 MPEG-2 and MPEG-4 Video Stream 5.4.7.2 DSM-CC 5.4.8 Middleware Application 5.4.8.1 EPG 5.4.8.2 Menüs 5.4.8.3 Subscriber Credentials 5.4.8.4 Purchasing Information 5.4.8.5 Digital Certificates (Content Provider) 5.4.8.6 Parental Controls 5.4.8.7 PVR/DVR Application 5.4.8.8 User-sourced Content 5.4.9 Application Management 5.4.9.1 IPTV Usage Information 5.4.9.2 IPTV Billing Information 5.5 Conclusion

148 148 149 150 150 151 151 151 152 152 152 153 153 154 154 154 154 155 155 156 156 157 157 158 158 158 158 158 159 159 160 161 161 162 162 163 163 164 165

6 Countering the Threats 6.1 Securing the Basis 6.1.1 Hardening Operating Systems 6.1.2 Business Continuity 6.1.3 Intrusion Detection/Intrusion Prevention 6.1.4 Network Firewalls 6.1.5 Fraud Prevention 6.1.6 DRM-CAS 6.2 Head End (IPTV Service Provider) 6.2.1 Critical Elements of the Head End 6.2.2 Content Input

167 167 167 172 173 IIA 175 176 176 176 \11

xii

Contents

6.2.2.1 Satellite Feed 6.2.2.2 Premium and Direct-feed Content, Pre-encoded Content Ready to be Encapsulated 6.2.2.3 Physical Media 6.2.3 MPEG Video Encoder and Video Transcoder Functions 6.2.4 IP Encapsulator 6.2.5 Content Management Server 6.2.6 Video Repository 6.2.7 Digital Rights Management 6.2.8 Video Streaming Server 6.2.8.1 IGMPv2/v3 6.2.8.2 MBGP 6.2.8.3 MSDP 6.2.8.4 RTP 6.2.8.5 RTSP Packets 6.2.8.6 RSVP 6.2.9 Middleware Server 6.3 Aggregation and Transport Network 6.3.1 DSLAM 6.3.1.1 Access and Session Control 6.3.1.2 Routing 6.3.1.3 User Segregation 6.3.1.4 Quality of Service 6.3.1.5 Virtual Networks and Virtual Circuits 6.3.1.6 802.1X Authentication 6.3.2 Firewalls 6.4 Home End 6.4.1 Residential Gateway 6.4.1.1 Filtering 6.4.1.2 Quality of Service 6.4.2 Set Top Box 6.4.2.1 Secure Processor 6.4.2.2 DRM 6.4.2.3 Output Protection 6.5 Secure IPTV a Reality References

\11

Appendix 1 Converged Video Security Al.l Introduction AI.2 Threats to IPTV Deployments AI.3 Protecting Intellectual Property AI .4 VOD and Broadcast AI.5 Smart Cards and DRM AI.6 Countering the Threats AI.6.1 Threat References Al.6.2 Threat Models

205 205 205 206 207 208 208 210 211

Appendix 2 Federated Identity in IPTV Environments A2.1 Introduction A2.2 IPTV Federated Identity Solutions A2.2.1 SAMLfor Security

217 217 217 218

178 179 179 180 182 182 184 187 188 188 188 188 189 189 189 190 190 191 193 193 194 194 195 196 197 197 197 198 198 198 200 200 201 202

Contents

xiii

A2.2.1.1 The SAML Process A2.2.1.2 Reviewing Existing Standards A2.3 Applicability to an IPTV Security Environment A2.3.1 Internal Applications A2.3.2 Set Top Box Security A2.4 Video on Demand

218 220 220 220 221 221

Appendix 3 Barbarians at the Gate A3.1 Barbarians at the Gate A3.2 How to Break an IPTV Environment A3.3 Network Under Siege A3.3.1 Confldentiality A3.3.2 Integrity A3.3.3 Availability A3.4 Countermeasures A3.4.1 Set Top Box A3.4.2 DSLAM A3.4.3 Routing A3.4.4 User Segregation A3.4.5 Quality of Service A3.4.6 Virtual Networks and Virtual Circuits A3.5 Conclusion

223 223 224 224 224 225 225 225 225 226 227 228 228 229 229

Index

231