Applying Marlin TechnologyAGENDA
• Quick Introduction: How to build an end-to-end Marlin system in 30 minutes.
• Marlin Organization Overview
• Marlin Technology Primer
• Implementations of Marlin Specifications
◦ Content Packaging and Distribution Technology
◦ Marlin Server Technology
◦ Marlin Client Technology
• Implementation Security
• Q&A
Quick IntroductionBuild an End-to-End Marlin System
• Packaging clear-text content into a protected format
• Implementing a Marlin MS3 Streaming-only Server Solution
• Implementing a Marlin Broadband DRM Server Solution
• Implementing an HbbTV application content playback functionality
Marlin Organization OverviewWhat is Marlin?
Founded in 2005 by five companies: Intertrust, Panasonic, Philips, Samsung and Sony
• Marlin Developer Community (MDC)
• Marlin Partner Program (MPP)
• Marlin Trust Management Organization (MTMO)
• Marlin Organization Relationships
• Additional Information
Marlin Developer CommunityWhat is the the MDC?
• MDC formed in 2006 by Intertrust, Panasonic, Philips, Samsung, and Sony
• Charter is to develop open standards based DRM Specifications
• The community develops specification, reference and conformance test criteria
• Promotes Marlin technology worldwide
Marlin Partner ProgramWhat is the the MPP?
• Marlin Partner Program is a forum for solutions providers
• Over 35 partner companies provide expertise across the value chain
• Includes Technology Solutions Providers and System Integrator’s
• MPP membership includes non-commercial access to SDKs
Marlin Trust Management OrganizationWhat is the the MTMO?
• Sister organization to the MDC formed in 2006
• Provides compliance and robustness requirements
• Remediation Policy Management
• Manages Marlin PKI Root Certificates
• Delegation of Trust Services to Certified Trust Service Providers (TSP)
◦ Key and Trust Management Operations
Additional InformationMarlin Developer Community MDC (www.marlin-community.com)
Marlin Partner Program MPP (www.marlin-community.com/partner)
Marlin Trust Management Organization MTMO (www.marlin-trust.com)
Seacert Corporation (www.seacert.com)
Marlin Technology PrimerTopics
• Organization of the Specifications
• Why would you care about the Specifications
• Platform Technology & Delivery Systems
• Essential Broadband Service Protocols
• Overview - How Marlin Works
The Marlin SpecificationsOrganization
• As found in the Download Bundles on the MPP site:
• IPTV-ES (Supports a Japanese National Initiative. deployed in all connected TVs in Japan)
• Marlin Broadband (the bulk of Marlin DRM Technology)
• OMArlin (how to bridge OMA and Marlin)
• Other Specs and Guidelines
• Why care about the Specifications
• Referenced in compliance and conformance rules
• Licensee declares which specification version they implement
• Relevant if you are building an implementation from the specifications
Platform TechnologyPlatform & Delivery System Specifications
• NEMO Technology Platform
◦ Trusted communications framework
• Octopus DRM Technology Platform
◦ General-purpose DRM technical specification
• Marlin Core System
◦ Defines key and trust management functionality of Marlin
◦ Profiles the NEMO and Octopus technology platform specifications
• Deliver Systems
◦ Define how Platform Technology Specifications are applied to practical End-to-End DRM eco-systems
◦ Provide additional specifications to constrain the diversity implementation otherwise possible
NEMO Framework & Octopus DRMWhat is NEMO?
NEMO provides the trusted "plumbing" between the various functional components. NEMO combinesSOAP web services with SAML authorizations to provide end-to-end message integrity andconfidentiality protection, entity authentication, and role-based service authorization.
What is Octopus?
Octopus is a general-purpose DRM architecture composed of:
• Object Model used to model application specific entities and their relationship (Nodes and Link)
• Control Model represents rules and enforces governance (Plankton)
• Key Distribution System overlay (Scuba)
• Secure State Management (Seashell)
Marlin Core System (MCS)What is MCS?
The Marlin Core System Specification defines a common infrastructure for all Marlin Delivery Systemsto build upon. Fundamentally the goal of MCS is to enable interoperation among disparateimplementations of Marlin technology.
• Concretely specifies the NEMO security mechanisms, bindings and policies
• Defines the representation of Octopus Objects
• Defines the relationship of Octopus Objects to enable various business models
• Defines Octopus Control actions needed to govern access to A/V content
• Defines a Trust Model and a Key Management System
(Notable) Delivery Systems• Marlin Broadband Delivery System (MBB)
◦ Persistent content protection
◦ Flexible and extensible rights management
◦ Business models include: electronic sell-through, rental, and subscription
• Marlin Simple Stream Setup (MS3)
◦ Simple subset of Marlin Broadband
◦ Persistent content protection
◦ Streaming only
• Marlin IPTV-ES
◦ Streaming to Connected TVs, STBs & BluRay players
◦ Support for PVR
How Marlin WorksA simple Use Case Illustrated
• http://www.marlin-community.com/technology/how_marlin_works
Common Elements• Structured file and data structures
• Encrypted payloads
• Metadata
• Delivery Protocols
Marlin BBTS• Marlin Broadband Transport Stream Specification
• MPEG2-TS
• Based on ISO/IEC 62455
• Packet encryption: CBC with ANSI/SCTE block termination
• Optional single-key-layer mode
Packaging BBTS ContentContent Identification (program-based or service-based):
cid:marlin#P||serviceBaseCID||"@"||hex(program_CID_extension)cid:marlin#S||serviceBaseCID||"@"||hex(service_CID_extension)
Example:
cid:marlin#Purn:marlin:organization:example:video:1234@00000001
The content id (CID) is composed of a services namespace identifier and content item specific 32-bithex-encoded value.
serviceBaseCID = urn:marlin:organization:hms:bbtsservice_CID_extension = 0a0b0c0d
Content Key (128-bit value):
000102030405060708090a0b0c0d0e0f
Ts2Encrypt Command LineBBTS Encryption
Ts2Encrypt --keycid:marlin#Purn:marlin:organization:hms:bbts@0a0b0c0d::000102030405060708090a0b0c0d0e0f--rights-issuer http://example.combigbucksbunny-trailer.ts bigbucksbunny-trailer.bbts
BBTS Decryption
Ts2Decrypt --keycid:marlin#Purn:marlin:organization:hms:bbts@0a0b0c0d::000102030405060708090a0b0c0d0e0fbigbucksbunny-trailer.bbts bigbucksbunny-trailer.ts
Download the clear-text bigbucksbunny-trailer.ts
Ts2Info Command LineBBTS Information
Ts2Info bigbucksbunny-trailer.bbts
Marlin Protected file:Marlin content id iscid:marlin#Purn:marlin:organization:hms:bbts@0a0b0c0d::000102030405060708090a0b0c0d0e0fRights issuer url is http://example.com
DCF• Specified in OMA DCF 2.x
• Wrapper for any media type
• Bulk Encryption: AES 128 CBC, CTR
• ISO MP4 file format structure
• Standardized metadata: Content ID, Rights Issuer URL
• Custom headers for extensions
• Mime Type: application/vnd.oma.drm.dcf
• File Extensions: .odf, .oda (Audio), .odv (Video), .mra (Marlin Audio), .mrv (Marlin Video)
Packaging DCF ContentEncrypting DCF with mp4dcfpackager
mp4dcfpackager --method CBC--content-type audio/mp3--content-id urn:marlin:organization:example:01234--rights-issuer http://example.com--key 00112233445566778899aabbccddeeff:00000000000000000000000000000000song.mp3 song.mra
Unpackaging DCF
mp4decrypt --key 1:00112233445566778899aabbccddeeffsong.mra song-clear.odf
NB: resulting file is still in DCF format (cleartext). Use mp4extract to extract ‘odda’ box and cut first 8bytes
PDCF• Specified in OMA DCF 2.x
• For media in ISO MP4 containers
• Per-frame Encryption: AES 128 CBC, CTR
• ISO MP4 Encryption signaling (enca, encv)
• Custom headers for extensions
• Mime Type: video/mp4
• File Extensions: .mp4, .m4a (Audio), .m4v (Video), .mla (Marlin Audio), .mlv (Marlin Video)
Packaging PDCF ContentMP4 files packaged as PDCF content can have individual tracks encrypted with the same or differentkeys. For each protected track, a unique content id must be chosen.
Content Identification
audio: urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000100video: urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000101
Content Key
000102030405060708090a0b0c0d0e0f
Cryptographic Algorithm and Initialization Vector
OMA-PDCF-CTR0000000000000000
PDCF Packagingmp4encrypt Command Line
mp4encrypt --method OMA-PDCF-CTR--key 1:000102030405060708090a0b0c0d0e0f:0000000000000000--key 2:000102030405060708090a0b0c0d0e0f:0000000000000000--property
1:ContentId:urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000100--property
2:ContentId:urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000101bigbucksbunny-trailer.mp4 bigbucksbunny-trailer.mlv
mp4decrypt Command Line
mp4decrypt--key 1:000102030405060708090a0b0c0d0e0f:0000000000000000--key 2:000102030405060708090a0b0c0d0e0f:0000000000000000bigbucksbunny-trailer.mlv bigbucksbunny-trailer.mp4
Download the clear-text bigbucksbunny-trailer.mp4
Adaptive Streaming• Source audio & video is encoded at one or more bit-rate variants, with aligned GOPs (Group of
Pictures)
• Each variant is split into small segments (2-10 seconds) each with one or more GOPs
• An index provides a description, duration and location (URL) of segments
• Client retrieves the index, and segments one by one using HTTP
• Client can switch to a different bit-rate at each new segment
Marlin Mappings• Marlin Adaptive Streaming Specification -Simple Profile
• MPEG DASH
◦ MP4: Fragmented MP4 with Common Encryption (CENC, AES-128 CTR)
◦ MPEG2-TS: BBTS segments
• HLS
◦ BBTS segments (AES 128 CBC)
◦ Whole-segment encryption (AES-128 CBC)
HLS• draft-pantos-http-live-streaming-07
• Segments encrypted with BBTS or Bulk
Bulk:
◦ METHOD=AES-128 (MANDATORY) as specified in [HLS], §3.2.3
◦ IV (OPTIONAL) as specified in [HLS]
◦ CID="<ContentId>" (MANDATORY) content identifier
BBTS:
◦ METHOD=MARLIN-BBTS (MANDATORY)
◦ CID="<ContentId>" (MANDATORY) content identifier
HLS Packaging• Encrypt each segment (Bulk or BBTS)
• Use same key for all bit-rates
• BBTS: use Ts2AdaptiveAwareEncrypt to guarantee that IVs will match
MPEG DASH• ISO/IEC 23009-1 (Information technology — Dynamic adaptive streaming over HTTP (DASH) —
Part 1: Media presentation description and segment formats)
• ISO/IEC 23001-7 (Information technology — MPEG systems technologies — Part 7: Commonencryption in ISO base media file format files)
DASH MP4• Input must be GOP-aligned
• Fragment MP4 if not already fragmented mp4fragment tool
• Encrypt fragmented MP4 file
• Insert Marlin info in MPD
Marlin Server Side TechnologyServer Side Implementation Options
• Hosted Marlin Service
• Bluewhale Marlin Broadband Server
• Roll-your-own DRM Server
HMS Overview• A REST API for issuing rights to content
• Content packaging tools
• Sample clients and tools to verify your service implementation
• Simple and cost-effective to operate
Setting Up an HMS Service5 Easy Steps
• Set up an account
• Review the REST API
• Integrate DRM support into the content store interface
• Package the content
• Test the system with actual target devices or the command line
device simulators
Set Up an Account• Sign up for the service at https://www.hostedmarlin.com/
• Subsequent to sign up a customer authentication code is created
◦ This will be used to identify from your service to HMS
Review the REST API• HMS provides a simple REST API to issue rights to content
• The result of the REST API is either an MS3 compound URI or a
Marlin Broadband Action Token
• HMS Rest API documentation and tutorial are available at: https://www.hostedmarlin.com/help.
HMS Under the HoodTransaction Tokens
HMS operates by issuing transaction tokens to service providers that are then redeemed, by a mediaaware client application, to a DRM object such as a license for a particular content item.
HMS supports three types of transaction tokens:
• MS3 License
• Marlin Broadband License
• Marlin Broadband Registration
MS3 Transaction Token ParameterscustomerAuthenticator
The Customer Authenticator that was provided on the CMI web site.
contentId
For single content id the syntax is contentId=. For multiple contentIds the syntax is contentId.N=.
contentKey
For single content key the syntax is contentKey=. For multiple contentKeys the syntax iscontentKey.N=. The value of N must correspond with the contentId having the same value.
contentURL
This is the URL where the protected content can be downloaded. It will be embedded in thetransaction token (a URL for MS3 Licenses).
Acquiring an MS3 Transaction TokenGiven the following parameters:
customer authenticator: FOOBAR
content id: cid:marlin#Purn:marlin:organization:hms:bbts@0a0b0c0d
content key: 000102030405060708090a0b0c0d0e0f
A request for a transaction token could be acquired using curl:
curl 'https://eval.hostedmarlin.com/hms/ms3/token?&customerAuthenticator=FOOBAR&contentId=cid:marlin%23Purn:marlin:organization:hms:bbts@0a0b0c0d&contentKey=000102030405060708090a0b0c0d0e0f&contentURL=http://example.com/bigbucksbunny' > ms3_compound_uri.txt
In the above example, an errorFormat parameter was not specified so the default of HTML will beused. Alternatively errorFormat=json could have been added to the query string.
Redeeming an MS3 Transaction TokenAssuming the Marlin client has already been personalized (e.g. with WasabiSushiPersonalize) then thetransaction token (i.e., a MS3CompoundURI) can be redeemed for an MS3 Stream Access Statement.
Ms3SampleClient `cat ms3_compound_uri.txt`
--- MS3 Client 1.0 ---Retrieving URLhttps://eval.hostedmarlin.com:8443/hms/ms3/rights/?...SAS:Key 1:Content ID: f3b4309701e2ed67ff75a069df70f6f73ce202afKey Value: 000102030405060708090a0b0c0d0e0fAuthenticator:Flags: (none)Output Control: (0,0 hex)[No Extensions]Content URL: http://example.com/bigbucksbunny
Playing MS3 Protected MediaUsing the content id and content key the BBTS file can be decrypted and played:
Ts2Decrypt --keycid:marlin\#Purn:marlin:organization:hms:bbts@0a0b0c0d::000102030405060708090a0b0c0d0e0fbigbucksbunny-trailer.bbts decrypted.ts
For BBTS we can also use WasabiCopyMedia by providing the SAS directly:
WasabiCopyMedia -t video/MP2T `cat ms3_compound_uri.txt` decrypted.ts
And finally playback can by invoked with ffplay:
ffplay decrypted.ts
MBB License Acquisition TokencustomerAuthenticator
The Customer Authenticator that was provided on the CMI web site.
actionTokenType
This value should be 1 for Broadband License Transaction Token.
contentId
The syntax is contentId= or contentId.N= for multiple contentIds.
contentKey
The syntax is contentKey= or contentKey.N= for multiple contentKeys.
rightsType
This value is either BuyToOwn or Rental. Rental requires the rental.periodEndTime andrental.playDuration parameters.
Acquiring an MBB Action TokenGiven the following parameters:
customer authenticator: FOOBARaudiocontent id:urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000100content key:000102030405060708090a0b0c0d0e0f
video:content id:urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000101content key:000102030405060708090a0b0c0d0e0f
A request for a transaction token could be acquired using curl:
curl 'https://eval.hostedmarlin.com/hms/bb/token?actionTokenType=1&customerAuthenticator=FOOBAR&contentId.0=urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000100&contentKey.0=000102030405060708090a0b0c0d0e0f&contentId.1=urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000101&contentKey.1=000102030405060708090a0b0c0d0e0f&rightsType=BuyToOwn' > bb_license_action_token.xml
Redeeming an MBB License TokenAssuming the Marlin client has already been personalized (e.g. with WasabiSushiPersonalize) then thetransaction token (i.e., an ActionToken) can be redeemed for an MBB License.
WasabiSushiProcessToken --save-license license_device_bound.xml bb_license_action_token.xml
==== Sushi Token Processor V1.0 =======================================SDK API Version: 0.1.1.6SDK IMP Version: 1040000SDK IMP Build: 7157SDK IMP Details: (c) 2005-2010 Intertrust Technologies / Revision 7157OnEvent - > BEGIN [SHI_TRANSACTION_TYPE_SERVICE_TOKEN_PROCESSING]OnEvent - > PROGRESS: 0 of 3OnEvent - > PROGRESS: 1 of 3OnEvent - >> BEGIN [SHI_TRANSACTION_TYPE_LICENSE_ACQUISITION]OnEvent - >> PROGRESS: 0 of 2OnEvent - >> PROGRESS: 1 of 2OnEvent - >> EVENT: event type 9OnEvent - >> PROGRESS: 2 of 2OnEvent - >> END: code=0, message=''OnEvent - > PROGRESS: 2 of 3OnEvent - > PROGRESS: 3 of 3OnEvent - > END: code=0, message=''OnEvent - DONE======================================================================
Inspecting the MBB LicenseThe redemption of the Action Token resulted in receiving a file license_device_bound.xml. Tointerrogate the license supply the relevant contentIds to WasabiSushiAction:
WasabiSushiAction Perform Play license_device_bound.xmlurn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000100urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000101
==== Sushi Action V1.0 =============================================SDK API Version: 0.1.1.6SDK IMP Version: 1040000SDK IMP Build: 7157SDK IMP Details: (c) 2005-2010 Intertrust Technologies / Revision 7157Action Result: GRANTEDAction Result Info Flag(s):KEY 0 = 000102030405060708090a0b0c0d0e0fKEY 1 = 000102030405060708090a0b0c0d0e0f======================================================================
Playing MBB Protected MediaUsing the content id and content key the BBTS file can be decrypted and played:
mp4decrypt --key 1:000102030405060708090a0b0c0d0e0f--key 2:000102030405060708090a0b0c0d0e0fbigbucksbunny-trailer.mlv decrypted.mp4
And finally playback can by invoked with ffplay:
ffplay decrypted.mp4
MBB Registration Action TokencustomerAuthenticator
The Customer Authenticator that was provided on the CMI web site.
actionTokenType
This value should be 0 for Broadband Registration Action Token.
userId
The user id to associate with this user.
userKey
The user key to associate with this user.
Acquiring an MBB Registration TokenGiven the following parameters:
userId 12345678userKey 000102030405060708090a0b0c0d0e0f
Request the token using curl:
curl'https://eval.hostedmarlin.com/hms/bb/token?actionTokenType=0&customerAuthenticator=FOOBAR&userId=12345678&userKey=000102030405060708090a0b0c0d0e0f' > bb_registration_token.xml
Redeeming a Registration TokenAssuming the Marlin client has already been personalized (e.g. with WasabiSushiPersonalize) then thetransaction token (i.e., an ActionToken) can be redeemed for an MBB License.
WasabiSushiProcessToken bb_registration_token.xml==== Sushi Token Processor V1.0 =============================================SDK API Version: 0.1.1.6SDK IMP Version: 1040000SDK IMP Build: 7157SDK IMP Details: (c) 2005-2010 Intertrust Technologies / Revision 7157OnEvent - > BEGIN [SHI_TRANSACTION_TYPE_SERVICE_TOKEN_PROCESSING]OnEvent - > PROGRESS: ...OnEvent - >> BEGIN [SHI_TRANSACTION_TYPE_USER_REGISTRATION]OnEvent - >> PROGRESS: ...OnEvent - >> END: code=0, message=''OnEvent - > PROGRESS: 2 of 4OnEvent - >> BEGIN [SHI_TRANSACTION_TYPE_LINK_ACQUISITION]OnEvent - >> PROGRESS: ...OnEvent - >> END: code=0, message=''OnEvent - > PROGRESS: ...OnEvent - > END: code=0, message=''OnEvent - DONE======================================================================
User Bound License TokenTo request an Action Token for a user bound license you provide the same parameters for a devicebound license plus the user specific information supplied for registration.
The requisite parameters are:
customerAuthenticator, actionTokenType, contentId, contentKey, rightsType,userId, userKey
The command line request:
curl 'https://eval.hostedmarlin.com/hms/bb/token?actionTokenType=1&customerAuthenticator=FOOBAR&contentId.0=urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000100&contentKey.0=000102030405060708090a0b0c0d0e0f&contentId.1=urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000101&contentKey.1=000102030405060708090a0b0c0d0e0f&rightsType=BuyToOwn&userId=12345678&userKey=000102030405060708090a0b0c0d0e0f' >bb_user_bound_license_action_token.xml
Redeeming an User Bound LicenseAssuming the Marlin client has already been personalized (e.g. with WasabiSushiPersonalize) then thetransaction token (i.e., an ActionToken) can be redeemed for an MBB License.
WasabiSushiProcessToken --save-license license_user_bound.xmlbb_user_bound_license_action_token.xml
==== Sushi Token Processor V1.0 =============================================SDK API Version: 0.1.1.6SDK IMP Version: 1040000SDK IMP Build: 7157SDK IMP Details: (c) 2005-2010 Intertrust Technologies / Revision 7157OnEvent - > BEGIN [SHI_TRANSACTION_TYPE_SERVICE_TOKEN_PROCESSING]OnEvent - > PROGRESS: ...OnEvent - >> BEGIN [SHI_TRANSACTION_TYPE_LICENSE_ACQUISITION]OnEvent - >> PROGRESS: ...OnEvent - >> EVENT: event type 9OnEvent - >> PROGRESS: ...OnEvent - >> END: code=0, message=''OnEvent - > PROGRESS: ...OnEvent - > END: code=0, message=''OnEvent - DONE======================================================================
Inspecting the User LicenseThe redemption of the Action Token resulted in receiving a filebb_user_bound_license_action_token.xml.
To interrogate the license supply the relevant contentIds to WasabiSushiAction:
WasabiSushiAction Perform Play license_user_bound.xmlurn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000100urn:marlin:organization:hms:8puslic:00000000010f510070000000000000007f00000000000101
==== Sushi Action V1.0 =============================================SDK API Version: 0.1.1.6SDK IMP Version: 1040000SDK IMP Build: 7157SDK IMP Details: (c) 2005-2010 Intertrust Technologies / Revision 7157Action Result: GRANTEDAction Result Info Flag(s):KEY 0 = 000102030405060708090a0b0c0d0e0fKEY 1 = 000102030405060708090a0b0c0d0e0f======================================================================
Integrate DRM Support• To distribute content to various Marlin devices, you need to understand the interfaces required by
your customers’ devices
• The device will provide interfaces for processing Marlin Action Tokens or MS3 URLs as part of itscontent acquisition workflow. Typically, these interfaces are implemented through browser plug-ins that are invoked in JavaScript on your store’s web page
• In the request to HMS, you supply all the information necessary for a content license and HMSsends you back an Action Token or an MS3 URL to pass to your customer’s device
• Once you transfer the value retrieved from HMS to the device, the device’s Marlin DRM systemcontacts HMS and redeems the value to obtain the rights to the content
• Through this entire interaction, HMS does not store any of your data. All the necessaryinformation required to issue the content rights is encrypted in the Action Token or the MS3 URLreturned from the REST API
Package Content• A downloadable set of binary tools is available to encrypt content
• These tools allow you to encrypt and package MP4 and MPEG-2 TS media into Marlin-protectedcontent
• Tools also support other formats
End-to-End Testing• Verify using the supplied command line tools
• Verify using a Marlin-enabled device
Marlin Client Side TechnologyWasabi in-depth
• What is Wasabi
• Wasabi API
• Wasabi on Mobile
• Wasabi on STB/TV
• Wasabi for HTML5
Wasabi Documentation• Wasabi Developer's Guide
◦ High Level description of the APIs
◦ Tells which API is available for which system (desktop, mobile, STB)
• Wasabi SDK API C Developer's Guide
◦ In-depth documentation of the Wasabi C APIs
• Wasabi Extensions
◦ Addresses PlaylistProxy for mobile and Wasabi Chromium integration
Wasabi on MobileAvailability
• iOS and Android Platforms
HTTP Proxy functionalities
• License / MS3 SAS Evaluation
• Content Decryption
• Serves decrypted content (HLS format)
Use of the native player to render the content
• Connect to obfuscated local URL (to the proxy)
• Saves battery life
Playing a file (iOS example)// create and start the proxyWSB_PlaylistProxy* proxy = NULL;WSB_PlaylistProxy_Create(&proxy);WSB_PlaylistProxy_Start(proxy);
// get a proxy URL to feed the native playerconst char* proxy_url;WSB_PlaylistProxy_MakeUrl(proxy,
ms3_url,WSB_PPMST_SINGLE_FILE,NULL,&proxy_url);
// now feed the proxy_url to the player (iOS specific code)MPMoviePlayerControlller* player = NULL;player = [[MPMoviePlayerController alloc] initWithContentURL:proxy_url];[player play];...
// cleanup after content is done[player release];WSB_PlaylistProxy_Stop(proxy);WSB_PlaylistProxy_Destroy(proxy);
Wasabi on STB/TV: Main APIs• Sushi API
◦ Retrieves BB objects (Registration, Licenses)
◦ Access to DRM Metadata (Registration Status, etc...)
• WSB_LicenseStore
◦ Stores/Finds BB licenses based on Content IDs
• WSB_MediaFile
◦ Access to file/stream metadata (e.g. DRM Content ID)
• WSB_PlaybackEnabler
◦ Retrieves / Evaluates Rights (BB or MS3)
◦ Populates the Key Manager
Wasabi on STB/TV: Main APIs (cont'd)• WSB_KeyManager
◦ Stores the Keys to be used in the Media Stack
• WSB_EcmDecrypter (MPEG2TS)
◦ Works in conjunction with the Native Hardware Demux
◦ Decrypts traffic keys (Control Words) to be programmed in HW Demux
• Bento4 (MP4)
◦ General MP4/ISO/Common file format parsing library
◦ Supports PDCF/Common file format/IPMP encryption/decryption
Sushi and License Store (BB only)// create a license manager objectclass LicenseRetriever {public:
// forwarding methodstatic void OnEvent_(SHI_EngineListener self,
SHI_EngineEventType type,const SHI_EngineEvent* event) {
((LicenseRetriever*)self.instance)->OnEvent(type, event);}
// constructorLicenseRetriever() : m_DrmEngine(NULL), m_LicenseStore(NULL) {
// create a drm engine with ourselves as a listenerSHI_EngineConfig config;const SHI_EngineListenerInterface iface = { OnEvent_ };config.flags = 0;config.listener.iface = &iface;config.listener.instance = (SHI_EngineListenerInstance*)this;SHI_Engine_Create(&config, &m_DrmEngine);
WSB_LicenseStore_Open(&m_LicenseStore);};...
Sushi and License Store (cont'd)void OnEvent(SHI_EngineEventType type, const SHI_EngineEvent* event) {
switch(type) {case SHI_ENGINE_EVENT_LICENSE_DATA_RECEIVED: {
SHI_LicenseDataReceivedEvent* lic_event = NULL;lic_Event = (SHI_LicenseDataReceivedEvent*)event;WSB_LicenseStore_AddLicense(store, lic_event->data,
lic_event->size, NULL, NULL);break;
}...
}
WSB_Result ProcessToken(const char* lic_token) {return SHI_Engine_ProcessServiceToken(lic_token);
}
private:// membersSHI_Engine* m_DrmEngine;WSB_LicenseStore* m_LicenseStore;
};
// using our objectLicenseRetriever* retriever = new LicenseRetriever;retriever->ProcessToken(my_license_token);
Wasabi on STB/TV: BBTS ExampleUsing Wasabi with a Hardware DeMux
Wasabi on DesktopChoosing the right approach for your needs
• Build your own player using the WSB_Player API
◦ More work but more control
• Use our Chromium/Berkelium build
◦ The <video> and <audio> tags go through our secure media stack
◦ Interact with the DRM servers using our Javascript DRM API
Wasabi PlayerThe Wasabi Player API (WSB_Player) allows you to do the following
• Set Outputs (audio and video)
◦ You can specify which window you want to use to render your content
• Specifying your input
◦ Can be an MS3 or a content URL
◦ Use of dedicated schemes (hls:// for HLS, dash:// for DASH etc...) and/or mime types
• Playback Controls
◦ Pause, Stop, Seek, Volume
• Get Notified with Events
◦ Timecode, decoder state, drm state etc...
Chromium with WasabiYou Build your own player and content service using HTML5, JavaScript and CSS 3.
MS3 Example
<!DOCTYPE html><html lang="en"><head>
<meta charset="utf-8" /><title>MS3 Video Player Example</title>
</head><body>
<video controls width="480" height="320" id="video"><source src="https://hms-test.intertrust.com:8443/hms/ms3...">
</video></body></html>
Implementation SecurityKey and Trust Management
• Secure Key Box (aka Sockeye)
• How to get keys from Seacert
• Provisioning keys
◦ Factory
◦ Seacert Online Provisioning Service
◦ Custom
Secure Key Box (SKB)What Sockeye is?
• A means to protect access to secrets using state of the art technology.
• When using a proper SKB implementation, an application can work with keys and secret datawithout having access to them in memory.
• A proper implementation will use hardware-assisted security on capable processors, whiteboxcryptography on downloaded applications for PCs and Mobile, or other mechanisms that make it"very" difficult for a sophisticated attacker to exploit keys or secrets
What Sockeye is not?
• Sockeye is not for verifying trust
What Is Provided?• SKB (Secure Key Box) API in C
• SKB Documentation (Implementer’s Guide)
• SKB Test Suite
• SKB Software Implementation
◦ Fully implements the SKB API
◦ Provided as standalone source code
◦ No external dependencies
◦ May be used as a code base for porting and adapting
SKB API - Objects• SKB_Engine
• SKB_SecureData
◦ AES & RSA private Keys
◦ Arbitrary Data
• SKB_Transform
◦ Sign: HMAC, RSA
◦ Verify: HMAC
◦ Digest: SHA1, SHA256
• SKB_Cipher
◦ Encrypt/Decrypt, Normal/High Speed
• and more...
Trust Management for OTT EcosystemsWhat is Trust Management?
• A trust management framework allows independent entities to trust one another through a TrustAuthority that distributes risk and responsibilities among these entities
• A Digital Rights Management (DRM) framework may combine multiple types of trust managementrelationships
Role of the Trust AuthorityTo provide the framework for cooperation with three main functions:
• Originates and maintains agreements
• Provides framework for electronic credentials and licenses following a ecosystem defined TrustModel
◦ Entities get well-defined roles defining what services they are trusted to provide
◦ Trust delegation allows scalability of processes
◦ Remediation planning allows orderly maintenance of trust
• Actuates remediation processes
Implementing Trust ManagementTrust Authority Contractually:
• Sets criteria under which a device may receive cryptographic credentials -- compliance androbustness rules
• Authorizes issuance of device cryptographic credentials -- Registration Authority
• Requires service providers to rely on asserted properties of device as part of releasing contentkeys to device
Certification Authority Technically:
• Generates and manages Trust Anchors (and other) private keys
• Employs processes to prevent compromise of private keys
• Uses private keys to sign certificates only when authorized
• Provides remediation for issued certificates or credentials
Trust Authority and Certificate Authority need to be highly reliable or immune from faults
Trusted Device• Secure boot rooted in a hardware and/or tamper resilient trust mechanism
• Secure management of Ecosystem and DRM Keys
• Ensure integrity of trust anchors relied upon by the ecosystem authentication services and theDRM
• Supports authenticated communications between the device and ecosystem services
• May enable an application security model to ensure the integrity and trustworthiness ofapplications
SDKs and ToolsHow to get access to the code
Implementation technology is available from Intertrust.
The Wasabi Marlin Client SDK, Bluewhale Marlin Broadband Server and packaging tools are availablefor evaluation :
http://www.intertrust.com/agreements/code_eval
Information regarding the Intertrust's Hosted Marlin Service HMS may be found at:
https://www.hostedmarlin.com/
The media packaging tools are available from Bento4.com