DCI Specs - Digital Cinema Initiatives

More documents

Recommendations

Info

failure) per Section 9.6.1.3 Digital Rights Management: Security EntityEquipment.• The AuthID token for the Playout Event Sub Type events shall carry the valueindicated by the SMS AuthorityID per Section 9.4.2.5 Screen ManagementSystem. Per section 9.4.2.6 Projection Systems, the AuthID token for theOperations Event Sub Type events shall indicate the identity of the authorityfigure responsible for the event.9.4.6.3.9. FIPS 140-2 Audit Mechanism RequirementsFIPS 140-2 requirements (see Section 9.5.2.5 FIPS 140-2 Requirements for Type 1Secure Processing Blocks) require audit (logging) mechanisms for certain modifiableoperating system environments for cryptographic modules. These specificationsrestrict the SPB operating environment to non-modifiable modes of implementation.Thus there are no additional FIPS 140-2 related logging requirements for Exhibitionsecurity devices for normal Digital Cinema operations.Logging requirements for SPB firmware code changes shall be implemented perSection 9.5.2.7 SPB Firmware Modifications.These device-change log records shallbe accessible using the log record specifications as given in this section.9.4.6.3.10. Logging FailuresThe secure logging subsystem is required to be operable as a prerequisite toplayback. Security Managers (SMs) shall not enable for playback (i.e., key) any suitefor which it has not collected log records from Secure Processing Blocks (SPBs) perSection 9.4.6.3.1 Logging Requirements item (8), or if there is any indication that anext playback will not record and report log records as required. Behavior of securitydevices (SPB or SE) shall be specified and designed to immediately terminateoperation, and require replacement, upon any failure of its secure logging operation.Resident log records, in failed SPBs and SEs shall not be purgeable except byauthorized repair centers, which are capable of securely recovering such log records.9.5. Implementation Requirements9.5.1. Digital CertificatesDigital Certificates are the means by which the Security Manager identifies other securitydevices, and is also used in establishing Transport Layer Security (TLS) connections. EachSecure Processing Block (SPB) shall:a) Carry exactly one Digital Cinema certificate, andb) SEs contained within an SPB shall share this one certificate (with their rolesappropriately noted as stated; see Section 5.3.4 Naming and Roles in SMPTE430-2 D-Cinema Operation - Digital Certificate)The make, model, device UUID and serial number of each certificated device shall becarried in the appropriate fields of the assigned certificate. This information shall also beplaced on the exterior of each device in a manner that is easily read by a human.Digital Cinema certificates shall use the X.509, Version 3 ITU standard (see [ITU-TRecommendation X.509 (1997 E): Information Technology – Open Systems Interconnection– The Directory: Authentication Framework, June 1997, and RFC3280]). This certificateDCI Digital Cinema System Specification v.1.2 Page 134
standard for Digital Cinema applications has been constrained in order to reduce thecomplexity and ambiguity that can occur in systems that use X.509 certificates.Detailed requirements for Digital Cinema Digital Certificates are given in Section 9.8.9.5.2. Robustness and Physical ImplementationsThis security system protects Digital Cinema content during transport and storage throughthe use of secret keys. Key secrecy is maintained in normal operations by cryptographictechniques dependent upon other secret keys. The physical protection afforded secret keys,and the content itself once decrypted, determine the robustness of the securityimplementation.Robustness is required for all modes of operation, both normal and abnormal. Robustness isa function of the quality of the implementation of security devices, Exhibition operationalprocedures, and the security system itself.9.5.2.1. Device Perimeter IssuesSecurity equipment design must provide physical perimeters around secrets notcryptographically protected. Secure Processing Block (SPB) security perimeterrequirements shall meet the following characteristics:• Tamper evident – Penetration of the security perimeter results in permanentalterations to the equipment that are apparent upon inspection. This is theleast robust perimeter, since it only reveals an attack after-the-fact, anddepends on a specific inspection activity.o SPB type 1 and SPB type 2 shall be tamper evident.• Tamper resistant – The security perimeter is difficult to penetratesuccessfully. Compromise of effective tamper resistant designs requires theattacker to use extreme care and/or expensive tooling to expose secretswithout physically destroying them and the surrounding perimeter(s).o SPB type 1 shall be tamper resistant, and SPB type 2 secure silicon shallbe tamper resistant.• Tamper detecting and responsive – The security perimeter and/or accessopenings are actively monitored. Penetration of the security perimetertriggers erasure of the protected secrets.o SPB type 1 shall be tamper responsive, and SPB type 2 secure siliconshall be tamper responsive.oSPB type 1 shall be permitted to have maintenance access doors orpanels, provided that their designs and tamper protections do not permitaccess (penetration) other than as specified in Section 9.5.2.3 Repair andRenewal.9.5.2.2. Physical Security of Sensitive DataSensitive data critical to the security of the Secure Processing Block (SPB) or SE (e.g.,private keys, LE/LD or content keys) is generically referred to as a Critical SecurityParameter (see Section 9.5.2.6 Critical Security Parameters and D-Cinema SecurityParameters). The security system defines levels of protection appropriate to each type ofCSP as well as plain text content. The levels of protection are described as follows:DCI Digital Cinema System Specification v.1.2 Page 135
Page 1 and 2:
Digital Cinema Initiatives, LLCDigi
Page 3 and 4:
Table of Contents1. OVERVIEW 151.1.
Page 5 and 6:
5.2.2. Packaging Fundamental Requir
Page 8 and 9:
7.5.5.1. Introduction..............
Page 10 and 11:
9.4.2.5. Screen Management System (
Page 12 and 13:
Table of FiguresFigure 1: System Ov
Page 14 and 15:
THIS PAGE LEFT BLANK INTENTIONALLYD
Page 16 and 17:
equirements for encrypting the esse
Page 18 and 19:
• This document specifies a basel
Page 20 and 21:
DCI Digital Cinema System Specifica
Page 22 and 23:
2.1.1. Major System Concepts2.1.1.1
Page 24 and 25:
2.1.1.8. ReelsFeature films have be
Page 26 and 27:
Metadata within the DCDM provides a
Page 28 and 29:
3.2.1.6. Transfer FunctionThe CIE X
Page 30 and 31:
The information, as shown in Table
Page 32 and 33:
AES Pair#/Ch# Channel # Label / Nam
Page 34 and 35:
3.3.4. File Format3.3.4.1. GeneralT
Page 36 and 37:
3.4.3. Timed Text Concepts and Requ
Page 38 and 39:
Page 40 and 41:
• All decoders shall decode each
Page 42 and 43:
Page 44 and 45:
5.2.2.3. InteroperableThe Packaging
Page 46 and 47:
Figure 6: Example Show PlaylistThe
Page 48 and 49:
Length (Value Length), followed by
Page 50 and 51:
which it was stopped or paused. It
Page 52 and 53:
5.3.4.2. Frame BoundariesThe Audio
Page 54 and 55:
• Rating• Aspect Ratio• Image
Page 56 and 57:
• Annotation Text parameter (opti
Page 58 and 59:
Page 60 and 61:
7.2.3.1. ReliabilityA key part of t
Page 62 and 63:
• Country• Rating• Aspect Rat
Page 64 and 65:
facility, while the system is in op
Page 66 and 67:
Exhibitor and the Distributor, data
Page 68 and 69:
7.5.2.2. Ingest InterfacesExcept fo
Page 70 and 71:
(channels) * hours * 60 min/hour *
Page 72 and 73:
7.5.4.2.4. UnpackagingAny packaged
Page 74 and 75:
7.5.6. Audio System7.5.6.1. Introdu
Page 76 and 77:
made up of Theater System devices a
Page 78 and 79:
DCI Digital Cinema System Specifica
Page 80 and 81:
8.2.2.3. Alternative ContentThe pro
Page 82 and 83:
With the projector turned off or wi
Page 84 and 85: Image ParametersNominal(Projected I
Page 86 and 87: Input Code Values Output Chromatici
Page 88 and 89: 8.4. Projector Interfaces8.4.1. Int
Page 90 and 91: • Lens Shift Up / Down• Lamp Mo
Page 92 and 93: • Essence Encryption and Cryptogr
Page 94 and 95: content keys and Trusted Device Lis
Page 96 and 97: Figure 14: Digital Cinema Security
Page 98 and 99: Figure 15 presents the two fundamen
Page 100 and 101: DCI Digital Cinema System Specifica
Page 102 and 103: 9.4.2.3. Media Blocks (MBs)The term
Page 104 and 105: which TLS-based authentication alon
Page 106 and 107: working with the security infrastru
Page 108 and 109: Figure 18: Show Playback Overview9.
Page 110 and 111: a. Playout shall be fully supported
Page 112 and 113: 9.4.5. Intra-Theater Communications
Page 114 and 115: 4. Projector SPB designs shall not
Page 116 and 117: the event, and zero all Critical Se
Page 118 and 119: window) shall be UTC.Security Manag
Page 120 and 121: . The SM shall independently authen
Page 122 and 123: 6. No broadcast RRP commands shall
Page 124 and 125: Functions of the Security Manager (
Page 126 and 127: Note: DCI reserves the right, at so
Page 128 and 129: • Is required to survive camcorde
Page 130 and 131: • Log Data - Security event infor
Page 132 and 133: using the GetEventList and GetEvent
Page 136 and 137: • Secure Silicon -Sensitive data
Page 138 and 139: secure silicon chip, input/output s
Page 140 and 141: FIPS 140-2 level 3 devices provide
Page 142 and 143: to the appropriate Section 9.4.5.2.
Page 144 and 145: those under the control of the Secu
Page 146 and 147: Security Managers (SMs) other than
Page 148 and 149: The above RSA asymmetric protection
Page 150 and 151: THIS PAGE LEFT BLANK INTENTIONALLYD
Page 152 and 153: CPRL Acronym for Component Position
Page 154 and 155: LTCMain TitlesMBMDMEMetadataMTBFMXF
Page 156: TDLTimed TextTLMTLSTMSTrack FileUDP
show all

DCI Specs - Digital Cinema Initiatives

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?