CI Plus Overview Presentation
Transcription
CI Plus Overview Presentation
CI Plus Overview 11th November 2011 www.ci-plus.com CI Plus Limited Liability Partnership (LLP) Table of Content Page: • • • • • One Page Overview of CI Plus History of Common Interface Requirements & Scope with CI Plus CI Plus System Overview CI Plus Specification 3 4 8 10 11 PCMCIA CI CA - SAC (Secure Authenticated Channel) - Authentification - Protection of TS (Transport Stream) with CC (Content Control) - URI (Usage Rules Information) - Revocation, Shunning - Interactivity with MHP CA API • CI Plus Administration - SC CA Conditional Access CAM CA Module CI Common Interface PCMCIA Personal Computer Memory Card International Association SC Smart Card 21 CI+ LLP, Certificate Agent & Test Center CI+ Documentation Flow Chart of Certification & Licensing Licensee Overview • Summary • Document History • Abbreviations 2 / 29 CI-CAM file: ci-plus_overview.ppt 26 27 28 Disclaimer: All text and images that are presented herein are just for illustration purposes about the principles of CI Plus. The presentation may contain inaccuracies or errors. It does not necessarily reflect the most recent status of technical and licence relevant documents of CI Plus. www.ci-plus.com - CI Plus LLP Issue with v1 and Solution with One P age O v er v i • 1997-02 Quite old standard EN 50221 (DVB-CI v1) with unencrypted CAM output • 2006-09 Closed DVB TM-CIT group after missing consensus • • • • 2007-07 2008-01 2008-11 2009-03 ew CI+ Forum founded by 6 companies CI Plus Spec v1.0 with encrypted CAM output CI+ forum replaced by CI Plus LLP Appointment of Trustcenter & Test facility • 2011-04 DVB adopts future development of CI Plus specification • 2011-05 SMiT becomes 7th partner in CI Plus LLP Encrypted PCMCIA Interface Encrypted TV Signal not encrypted IDTV additional Usage Rules for A/D output and storage x Copy of original digital content is impossible! x encrypted STB, Recorder, ... 3 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP History of Common Interface (CI) 1997-02: 1999-11: 2002-01: 2006-09: Standard DVB CI v1 (EN 50221) Extension ETSI TS 101 699 EU directive for CI in IDTV with > 30cm Start of DVB TM-CIT group (to close security gaps with new CI v2 ...) Closed after missing consensus on technology 2007-07: 2007-12 2008-01 2008-11 2009-02 2009-02 2009-03 2009-05 2010-12 2011-01 Founding CI+ Forum by 6 companies CI Plus Specification draft CI Plus Specification v1.0 Disbanding of CI+ Forum & creation of CI Plus LLP (UK Limited Liability Partnership) CI Plus Specification v1.1 TC TrustCenter GmbH appointed DTV Labs Ltd. appointed test facility CI Plus Specification v1.2 Negotiations about continuation of specification under DVB CI Plus Specification v1.3 2011-04 2011-05 DVB adopts development of CI Plus spec beyond v1.3 SMiT becomes 7th partner in CI Plus LLP 4 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP DVB-CI & CI Plus - Usage for SD/HDTV Set-Top-Box with integrated Decrypton-System SDTV Smart Card Display or IDTV SDTV (Only for few content used or permitted) Smart Card with DVB-CI SDTV 5 / 29 file: ci-plus_overview.ppt Smart Card with CI+ www.ci-plus.com - CI Plus LLP DVB CI - First Generation Standard v1 • • • • CI-Module used with smartcard containing key-informationen CI-Module remove the encryption of protected content The output of CI-Module is unencrypted Due to this, most content providers prefer integrated solutions because of higher security Encrypted Televion Signal Encrypted Televion Signal Smartcard CI-Module PCMCIA Interface Copy of original digital content is possible No Encryption Plasma / LCD IDTV 6 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Protection of Content • Based on existing DVB-CI Standard • Main requirement: achieving the same level of security as embedded solutions • CI Plus Modul and Receiver - Calculation & Usage of a secure key for content protection - Secure, authentificated channel for critical system messages • The output of modul is encrypted • Only certified devices are supported Encrypted Television Signal Smartcard Encrypted Television Signal CI Plus Module PCMCIA Interface Copy of original digital content is not possible! Local Encryption Plasma / LCD IDTV 7 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Scope of Protection CA Conditional Access CC Content Control 8 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Scope of Compatibility CA Module (CAM) DVB CI CI Plus Host Host & Module DVB-CI mode Host in DVB-CI mode 9 / 29 file: ci-plus_overview.ppt Module in DVB-CI mode* * DVB-CI mode operation permitted by network operator Host & Module CI Plus mode www.ci-plus.com - CI Plus LLP CI Plus - System Overview CA CC CI CAM 10 / 29 Conditional Access Content Control Common Interface Conditional Access Module file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Specification History 2007-12 2008-01 2009-02 2009-05 Specification Draft Specification v1.0 Specification v1.1 Specification v1.2 • Change number 002, effective 2009-04-23 (Security Extension) - Summary: Errata of v1.1, CICAM CIS CI Plus compatibility advertisement • Change number 005, effective 2011-03-01 (Security Extension) - Summary: Security fix for CI Plus Host to check for “Brand ID” in a CI Plus CICAM device certificate during authentication. 2011-01 Specification v1.3 • Change number 007, effective 2012-08-01 - Summary: Extensions of PVR related functionality, CAS protected recording removed, Parental Control Clarifications, Low Speed Communication Resource, Extended CI Tuning Resource, Operator Profile 2011-10 Specification v1.3.1 • Change number 013, effective 2012-08-01 - Summary: Errata of v1.3, implementation guidelines 11 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Specification v1.3 Chapter: 1-3 4 5 6 7 8 9 10 11 12 13 14 12 / 29 Pages: Scope, References, Definitions, ... 19 System Overview 4 Theory of Operation 47 Authentication Mechanisms 16 Secure Authenticated Channel 12 Content Key Calculations 5 Public Key Infrastr. & Certificate Details 9 Host Service Shunning 5 Command Interface 22 CI Plus Application Level MMI 12 CI Plus MMI Resource 4 Other CI Extensions 52 Annex A...N 109 Total: 316 file: ci-plus_overview.ppt file: ci_plus_specification_v1.3.pdf date: 2011-01-14 www.ci-plus.com - CI Plus LLP CI Plus - Specification v1.3 Change Key changes of v1.3 compared to v1.2 • • • • • • Extensions to PVR related functionality. CAS protected recording removed. Parental Control Extensions & Clarifications. Optimization of Low Speed Communication Resource & IP support. Extension to CI Tuning Resource to support Cable VOD Applications. Introduction of an Operator Profile. Change Notice with References • • • • • • • • • • • • • • • • • • • • • prng_seed per manufacturer [5.3] URI version 2 [5.7.5.2] Digital Only Token [5.7.5.3] Content license [5.10] Parental Control [5.11] Recording and Storage [5.12] Host Authentication [Table 6.3, step 13, item d] Certificates, Service operator ID [9.3.6] Host shunning, SDT absent [10.4] Version 2 of CC resource [11.3] SAS APDU clarifications [11.4, Annex M.2.1] MHEG profile extensions [12.8] Low Speed Communications v3 [14.1] IP connection by name [14.2.1.2] Application MMI clarifications [14.4] Application MMI File Caching [14.5] Host Control v2 [14.6] Operator Profile [14.7, Annex N] APDU clarifications [Annex E] CIS Feature Identification [G.3.2] Removal of PVR Resource [v1.2, 15] 13 / 29 file: ci-plus_overview.ppt Details of changes: file: ciplus_change_notice_007.pdf date: 2011-01-21 file: 2011-03-10_ci-plus_specification_v1.3_diff_v1.2.pdf date: 2011-03-10 www.ci-plus.com - CI Plus LLP CI Plus - Protocols 1. 2. 3. 4. Compare CI+ versions supported by IDTV and CAM. If both sides have the same auth key, they have performed a successful authentication with each other. CI+ CAM and IDTV authenticate each other to make sure the opposite device is a valid CI+ device. The Secure Authenticated Channel (SAC) is used for transmission of security-related messages between CAM and IDTV. 1. Host Capability Evaluation 2. Auth Key Verification 3. Authentication 4. SAC Key Calculation 5. URI Version Negotiation 6. 5. 6. 7. 8. URI Acknowledgement Usage Rules Information (URI) version negotiation 7. CC Key Calculation to find a URI version that is supported on both sides. URI transmission and acknowledgement used by CAM to send a set of usage rules information to the IDTV. 8. SRM Acknowledgement Content Control (CC) key calculation used by both sides to calculate keys for scrambling /descrambling of transport stream (TS). System Renewability Message (SRM) transmission and acknowledgement is used from CI+ CAM to transfer SRM for HDCP and DTCP-IP to the IDTV. 14 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Transport Stream Output Protection Host and CICAM Capabilities: • DES-56-ECB Data Encryption Standard, 56-bit key, Electronic Code Book (USA 1999-10, Federal Information Processing Standards, FIPS 46-3) • AES-128-CBC Advanced Encryption Standard, 128-bit key, Cipher Block Chaining (USA 2000-10, National Institute of Standards and Technology, NIST, FIPS 197) 15 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Authentication Supported Authentication Phases per Service Mode: • Basic Service Mode • Registered Service Mode example: - Requires upstream communication to HE (Head End) DH = Diffie-Hellman key exchange 16 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Devices & external Interfaces CI Plus IDTV Signals / Interfaces Devices STB/PVR time shifted recording (optional) Analogue PAL / NTSC / SECAM RGB / YUV / S-Video Display Digital HDMI / HDCP DTCP-IP Encrypted Content, paired to receiver: the content cannot be copied without authorization.. 17 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Usage Rules Information (URI) URI initial default value for host, e.g. after channel change: • • • • • • • protocol version emi_copy_control_info aps_copy_control_info ict_copy_control_info rct_copy_control_info rl_copy_control_info reserved bits = 0x01 = 0b11 = 0b00 = 0b0 = 0b0 = 0b000000 = 0b0 URI Mapping Table: • Analog Output (MV, APS, CGMS, ICT) • Digital Output (HDCP, DTCP, SPDIF) • Digital Storage (AACS, CPRM, VCPS) (Encryption Mode Indicator) (Analog copy Protection System) (Image Constraint Trigger/Token) (Redistribution Control Trigger) (Retention Limit, default 90 min) Analog Digital Digital Storage URI see e.g. Digital Transmission Content Protection, www.dtcp.com • Specification 2007-10, rev 1.51 18 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Mechanisms of Revocation Host Service Shunning • Host shunning state determined from Service Descriptor Table (SDT) • Shunning active: Service can only be descrambled by CI+ Module • Shunning non active: Service can be descrambled by DVB-CI or CI+ Module Host Revocation • Certificate Revocation List (CRL) transmitted to CICAM black-lists a host • Certificate White List (CWL) can revert a previous revocation of a host • Level of revocation granularity: 1. Unique host 2. Range of hosts 3. Certain model 4. Certain brand Revocation by CAS • Possible, but out of CI Plus specification scope 19 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Additional Interactivity with Consumer CI Plus Browser • Enables to CI Plus modules to display graphics with menues, pictures, logos, ... in a common method on all CI Plus receivers/displays Allows easy interaction with default remote control Support of MHP CA API • Enables to the broadcasted MHP applikation to communicate with a CA Smartcard inside the CI Plus module Country- and Language Support • Enables CI Plus modules to use the same language in menues, which is already defined by user in the receiver setting. 20 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - LLP, Certificate Agent & Test Center CI Plus LLP contact details: • CI Plus LLP, www.ci-plus.com, • Pannell House, Park Street, Guildford, Surrey GU1 4HN, UK • CI Plus LLP registered (no OC341596) in England & Wales CI Plus LLP authorized Certificate Agent: • TC TrustCenter GmbH, www.trustcenter.de • Sonninstrasse 24-28, 20097 Hamburg, Germany Tel/Fax: +49.40.808026-0/-126 Mail: [email protected] CI Plus LLP approved Test Facility: • Digital TV Labs Ltd., www.digitaltv-labs.com • Venturers House, King Street, Bristol, BS1 4PB, UK Tel/Fax: +44.117.915-4018/-4088 Mail: [email protected] 21 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - Documentation Documents on www.ci-plus.com • CI Plus Specification v1.3 - Detailed Specification for Receiver and Module with change notes 002, 005 & 007 www.ci-plus.com/index.php?page=download • Supplementary Specification v1.3 - Requirements for host revocation/shunning • Implementations Guidelines v1.0 • Registration Application - Application for test and registration of a device • CI Plus Logo Guidelines & Archive • Test Specification v1.0 - Definition of test- and registration process Documents on www.trustcenter.de • On-Boarding Guideline • Interim License Agreement (ILA) www.trustcenter.de/solutions/consumer_electronics.htm - Compliance and Robustness Rule... • Certificate Supply Agreement (CSA) • Forms: Identification, Administrator Authorization, Brand On-Boarding, Registration Application • Robustness Certification Checklist 22 / 29 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP CI Plus - License Agreement with Exhibits A-L 23 / 29 A: Device Type B: Robustness Rules C: Compliance Rules for Host Device D: Compliance Rules for CICAM Device E: URI Mapping Table G: Robustness Rules Checklist H: Confidentiality Agreement I: Fee schedule J: Registration Procedure K: Change Procedure L: Revocation Procedure file: ci-plus_overview.ppt Host Device CICAM Device Robustness Rules Compliance Rules Confidentiality Agreement www.ci-plus.com - CI Plus LLP CI Plus - Implementation ... CI Plus LLP (Limited Liability Partnership) At Website Public Specification, License Agreement (incl. Compliance and Robustness) Test Partner Sign License Agreement €15,000 registration/yearly Receive License specs and Test technology New device Robustness Checklist Device Testing Result Robustness Checklist € 5,000/device type Trust Authority (TA) Device Manufacturer of CI Plus Module / Host Device Registration Production Credentials Device Testing Result Test of Device or Self-Test-Registration (after registration of 2 different device types) Certification Authority (CA) TC Trust Center 24 / 29 file: ci-plus_overview.ppt Order Certificates (keys) € 500/10.000 devices Deliver Certificates (keys) www.ci-plus.com - CI Plus LLP CI Plus - Licensees Publication - 29 Components Licensees - 54 Hosts Licensees - 6 Modules Licensees www.trustcenter.de/consumer_electronics_licensees_module.htm www.trustcenter.de/consumer_electronics_licensees_host.htm 25 / 29 file: ci-plus_overview.ppt www.trustcenter.de/consumer_electronics_licensees_host_module.htm • Licensees of CI Plus are published with homepage URL on website of TrustCenter • 89 Licensees on 2011-10-10 www.ci-plus.com - CI Plus LLP CI Plus - Summary • CI Plus is based on DVB-CI standard and is downward compatible • Encrypted communication over the CI/CI+ interface - Secure & authenticated channel for critical system messages - Encrypted transmission of digital content from CI+ modul towards the host device • Implementation - Licensing & administration of Certificates managed by independant Trust-Center - Certification of end user devices & CI+ modules in a digital TV laboratory • Future proof with URI (Usage Rules Information) für UPnP, CPCM, CSA3, DTCP, DLNA, ... Internet LAN PVR 26 / 29 file: ci-plus_overview.ppt STB www.ci-plus.com - CI Plus LLP Document History 2009-07-06 2011-11-11 27 / 29 Creation and first publication on www.ci-plus.com Specification v1.3, DVB resumption, SMiT membership, updated CIP contact detail, licensee overview, reformatting to 16:9 file: ci-plus_overview.ppt www.ci-plus.com - CI Plus LLP Abbreviations AACS AES API CA CAM CAS CC CDA CE CGMS CI CIP CIv1 CI Plus CM CPRM CRL CWL CSA DES DLNA DOT DVB DRM DTCP DTVL EU FFW 28 / 29 Advanced Access Content System aacsla.com Advanced Encryption Standard Application Programming Interface Conditional Access Conditional Access Module (DVB-CI or CI Plus) Conditional Access System Content Control Content Distributor Agreement (contract with CI Plus) Consumer Electronics Copy Generation Management System Common Interface CI Plus LLP ci-plus.com DVB CI version 1.0 dvb.org Common Interface Plus ci-plus.com Commercial Module (of DVB) Content Protection for Recordable Media 4centity.com Certificate Revocation List Certificate White List Certificate Supply Agreement Data Encryption Standard Digital Living Network Alliance dlna.org Digital Only Token Digital Video Broadcasting dvb.org Digital Rights Management Digital Transmission Content Protection dtcp.com Digital TV Labs (CI Plus) digitaltv-labs.com Europe europa.eu Fast Forward (PVR function) file: ci-plus_overview.ppt HDCP HDD HDMI ICT IDTV ILA LCD LLP MHP MPAA PCMCIA PVR SAC SC SDT SOC SMiT SPDIF STB TA TC TM TS USB URI VCPS High-bandwidth Digital Content Protection Hard Disk Drive High Definition Multimedia Interface hdmi.org Image Constraint Token Integrated Digital tuner Television Interim License Agreement Liquid Crystal Display Limited Liability Partnership Multimedia Home Platform Motion Picture Association of America mpaa.org Personal Computer Memory Card International Association Personal Video Recorder Secure Authenticated Channel Smart Card Service Descriptor Table Selectable Output Control Shenzen State Micro Technology Co. Ltd. Sony/Philips Digital Interconnect Format Set Top Box Trust Authority (e.g TC for CI Plus) TrustCenter GmbH trustcenter.de Technical Module (of DVB) Transport Stream Universal Serial Bus Usage Rules Information Video Content Protection System Version: 2011-11-11 www.ci-plus.com - CI Plus LLP Thank you for your interest www.ci-plus.com CI Plus LLP www.ci-plus.com DVB www.dvb.org TC TrustCenter GmbH www.trustcenter.de Digital TV Labs Ltd. www.digitaltv-labs.com CI Plus Limited Liability Partnership (LLP)