DCI Specs - Digital Cinema Initiatives

. The SM shall independently authenticate each remote SPB using a dedicatedTLS session.c. SMs shall enable multiple Link Encryption operation only when the SM receives aKDM whose TDL contains only the identities of the remote SPBs identified duringTLS authentication. This matching is an indication to the SM that the multipleLink Encryption operation has been approved by the content owner.d. The image processor (LD/LE) device shall be protected by a type 1 SPB. ThisSPB shall meet the requirements of Section 9.4.3.6.2.1 Normative Requirementsfor LD/LE SPB Devices.e. The SM shall independently key each remote SPB for Link Encryption operationusing standardized Intra-Theater security Messaging per Section 9.4.5.f. The SM shall not support the use of more than one image processor SPB for anyLDB/projector system.g. The two Link Encryption stages of the image processor configuration may usethe same LE key(s). The SM shall key the multiple LDB/projector configurationusing different LE keys for each LDB/projector system.9.4.5. Intra-Theater CommunicationsThis Section discusses requirements for communications necessary to support securityfunctions in each auditorium. Depending upon facility communications network designs,there may be both intra-auditorium as well as theater-wide networks and these may bephysically one network. The security system requires and addresses only the intraauditoriumnetwork, over which Intra-Theater (security) Messages (ITM) are employed.Intra-Theater Message(s) (ITMs) are described for communications between the SMS andSM, and between the SM and remote Secure Processing Blocks (SPBs). Note that,depending upon SPB designs, the numbers of SPBs used, and the mix of Security Entities(SEs) within them may vary.9.4.5.1. Transport Layer Security Sessions, End Points and Intra-TheaterMessagingThe Transport Layer Security (TLS) standard has been selected to provide protection forITMs within the theater. As part of establishing TLS communications sessions, bothparties, to the connection, present their digital certificates to achieve mutualauthentication. The authentication shall utilize digital certificates as defined in Section9.8, which facilitate a cryptographic process that identifies the SMS and each SPBdevice to the SM.The SM and SMS shall both conduct their intra-theater security messaging under TLSprotection (IETF RFC 2246).All TLS end points shall be within the physical protection perimeter of the associatedSPB. No SPB requirements are placed on the SMS.9.4.5.2. Intra-Theater Message DefinitionsThis section identifies the set of Intra-Theater Message Request Response Pairs(RRPs) to be standardized. These are required to support interoperability andnormative operational and security behavior of SPB systems.DCI Digital Cinema System Specification v.1.2 Page 120