DCI Specs - Digital Cinema Initiatives

• Secure Silicon –Sensitive data can only be compromised by a physicalattack on a secure Integrated Circuit storing the data.a. Secure integrated circuits used for Digital Cinema security applicationsshall be of the type designed to resist physical and logical attacks, andshall ensure that a physical attack destroys CSPs prior to exposure.Devices meeting the “secure silicon” level of protection shall only berequired to meet FIPS 140-2 level 3 row (area) five: "physical securityrequirements.”b. Secure silicon level protection shall be used within both SPB type 1 andSPB type 2, with such protection continuously provided (including ifpowered down) for all SE and Secure Processing Block (SPB) privatekeys and content image keys.c. Image keys may be stored outside of the secure silicon that performedKDM decryption, provided that such storage meets the requirements ofSection 9.7.4 Protection of Content Keys. Device private keys, whetherencrypted or not, shall not exist outside of the secure silicon device.• Secure Processing Block (SPB) Hardware Module – Sensitive data willonly be exposed by penetration of a physical barrier, which surrounds theelectronics.a. All Secure Processing Block (SPB) module designs shall implementhardware module perimeter protection that prevents access to internalcircuitry and detects opening of the module perimeter. Further protectionof keys and clear text content should use techniques such as buryingsensitive traces, applying tamper resistant integrated circuit coverings,and tamper responsive circuitry. Detailed SPB type 1 and SPB type 2physical protection requirements are defined below in Section 9.5.2.4Specific Requirements for Type 2 Secure Processing Blocks and Section9.5.2.5 FIPS 140-2 Requirements for Type 1 Secure Processing Blocks.b. Other than the SMS, no Security Entity (SE) shall exist outside theprotection of a SPB type 1.• Software – Protection implemented in software can be compromised throughmodifications to the software, inspection of memory, or monitoring of bussignals.a. Software protection methods shall not be used to protect Critical SecurityParameter or content essence.9.5.2.3. Repair and RenewalThe following address restrictions on repair and renewal of Secure Processing Blocks(SPBs) and associated cryptographic parameters:• Type 1 SPBs may be field replaceable (as an entire SPB module) byExhibition, but shall not be field serviceable (e.g., SPB type 1 maintenanceaccess doors shall not be open-able in the field).• The secure silicon device, contained within a SPB type 2, shall not be fieldserviceable, but may be field replaceable. It shall not be accessible duringnormal SPB type 2 operation or non-security-related servicing.• Repair and renewal processes for an SPB type 1 and SPB type 2 shall beDCI Digital Cinema System Specification v.1.2 Page 136