DCI Specs - Digital Cinema Initiatives

9.6.2. “Trust” and the Trusted Device List (TDL)In a “trust” relationship, it is said “A trusts B regarding X”. More specifically, the relying partyA believes that B will behave in certain predictable ways under a certain range of conditions.This behavior-based definition can apply both to business relationships and to the moreformalized regime of standardized security devices. And in fact, a useful Digital Cinema trustsystem must bridge the former to the latter.When a Distributor trusts a piece of equipment, his level of confidence in its behavior isbased on several factors such as those in Table 23FactorRoot of Trust1 Robust equipment design Manufacturer and certification organization2 Reliable manufacturing process Manufacturer3 Properly installed Installer and organization operating device4 Properly maintained (e.g., required firmware orsecurity updates)5 Properly managed (configured, inspected andoperated in accordance with expectations duringoperational life)Organization operating device,manufacturer and certification organizationOrganization operating device6 Has not been tampered with before or after installation Organization operating device, certificationorganizationTable 23: Factors Supporting Trust in a Security DeviceProtecting the content keys under a full range of potential situations can be a complex task,representing a set of behaviors involving rules and policy that meet the requirements ofthese specifications and (optionally) the particular business relationship. To simplify trustissues for the Digital Cinema environment, the TDL approach to equipment trustcommunications has been defined. In this approach, Rights Owners will indicate theirapproval of specific trusted equipment to be used in conjunction with an engagement byplacing the identification of trusted equipment (Secure Processing Blocks and projectors)into the Key Delivery Messages (KDMs) that are sent to Security Managers. SecurityManagers will trust and accept devices so listed for all security functions subject to thedevice’s certificate declared roles (see Section 9.5.1 Digital CertificatesThe content of TDLs (e.g., facility-wide, auditorium-specific, inclusive of spares) shall beaccording to business party agreement, and is out of scope of these specifications.9.6.2.1. Trust DomainsThe SM Security Domain is represented by the collection of security devices associatedwith a single SM that work together to perform a security function. In this system, the SMSecurity Domain and its Trust Domain 31 are equal, and in the theater these domains area single auditorium equipment suite. Multiple trust domains are typically used (chained)together to achieve overall security management objectives (e.g., distributing contentkeys from post-production to Distribution and Exhibition via multiple KDMs).The SM functions as an anchor for a given Trust Domain. For convenience, thisspecification uses descriptors such as Distributor SM, Auditorium SM, etc., but it will berecognized that the security system does not mandate any particular topology for31 Trust Domain areas also exist for post-production and distribution, but are out of scope.DCI Digital Cinema System Specification v.1.2 Page 145