DCI Specs - Digital Cinema Initiatives

which TLS-based authentication alone cannot do. At the time of installation the authorityfigure can provide visual inspection of the projector to assure it has not been tamperedwith.Once a projector is installed, the state of marriage is permanent (and monitored) until theauthority figure decides to separate the two SPBs (for whatever reason). In addition, thisspecification establishes logging requirements surrounding projector installation andmaintenance functions that record security-critical event information.It is mandatory that a projection system installation includes the marriage function perSection 9.4.3.6 Functional Requirements for Secure Processing Block Systems (notingthe permanently married exception provided for in that section). The marriage processshall require the supervision of a human authority figure, who shall examine projectorsas part of the marriage process to assure the associated SPB has not been tamperedwith.9.4.3. Theater Security OperationsThis section describes how equipment conforming to the security system is used in normaltheater operations. The show, expressed in a Show Playlist, consists of exhibition-arrangedsequences of compositions, any of which may be encrypted. One or more Rights Ownersmay supply Key Delivery Message(s) (KDMs) to provide all the content keys required for theShow Playlist.With respect to security, theater operations break down into four categories:1. Secure communications establishment and Secure Processing Block (SPB) deviceauthentication2. Pre-show preparations3. Playback4. Post playbackThe SMS is generally responsible for initiating activity within each category, except the last.9.4.3.1. Transport Layer Security (TLS) Establishment and SecureProcessing Block (SPB) AuthenticationExhibition has the liberty to power their equipment up and down as desired. However,the Security Managers (SM) must authenticate the equipment within their respectivesuites, and establish secure Transport Layer Security (TLS) sessions with each remoteSPB with each power-on.Note that the establishment of each TLS session enables the SM to authenticate theother party (SPB or SMS) to the session and provides for secure ITM communicationswithin the auditorium. The SM does not “trust” such party for security functions related tocontent playback, unless the identity of the party appears on the Trusted Device List(TDL) delivered in the Key Delivery Message (KDM) for that particular CompositionPlaylist (CPL) (see Section 9.4.3.5 Functions of the Security Manager (SM) and Section9.8 Digital Certificate, Extra-Theater Messages (ETM), and Key Delivery Messages(KDM) Requirements). Thus, device authentication and secure communications occursindependently of “trust”; the former being an exhibition equipment/infrastructure securityissue, the latter being specific to a Rights Owner and a composition. Where content isnot encrypted and no KDM/TDL exists, the SM does not invoke trust control.DCI Digital Cinema System Specification v.1.2 Page 104