Page 52

EETE JUNE 2013

Data Security Security facets of premium content protection on Android devices By Dana Neustadter conected and mobile devices are revolutionizing premium video distribution and consumption. These powerful devices are high-definition (HD) video capable with impressive highresolution touch screens that provide an immersive, intuitive and compelling video experience to their users. They enable traditional service providers to extend their offerings beyond the existing delivery models and are enabling totally new business models and opportunities. The ability to store, distribute and share programs using such attractive devices allows not only for on-device viewing, but also the ability to “mirror” or wirelessly display programming on other large displays anywhere near the device. We focus particularly on Android in this article because of its increasing market and the challenges its open hardware and software ecosystems present. Android represents both a growing opportunity and a fundamental change in the way distributors view devices, users and what they can or cannot do with their devices on the network. No longer is the distributor’s market limited to owners of a few proprietary devices viewing programming delivered over proprietary networks: Android devices now include a growing ecosystem of smartphones, tablets, set top boxes and other inexpensive capable devices that are all potential outlets for subscription, pay-per-view, overthe top and video-on-demand services. Connected consumers demand ubiquitous connectivity, streaming and sharing of high definition content among their devices, from anywhere at any time. Content providers still need to protect their investments and are demanding that content is protected into the device, on the device and out of the device. Distributors are highly motivated to roll out mass deployments of services and applications via new business models to satisfy the customer demand. To address A typical application for a TrustZone-enabled Android device such as a smartphone or tablet is to wirelessly transmit highdefinition media content to an HDTV via the Miracast WiFi Display technology. In this application, authorization of the HDTV decryption of the program content is performed inside the TrustZone TEE. Decryption keys for the program are never available in decrypted form outside the TEE. this technology (r)evolution, simple conditional access via hardened ICs, proprietary locked down software applications or smart cards is no longer sufficient. Robust platform security is crucial to meet these requirements, and it needs to be designed in from the lowest levels of the SoC applications processors right through to the applications that run on them and carry their data to and from the cloud. Multimedia entertainment applications drive both the high performance demands on new devices and high bandwidth usage on wireless networks. The most demanding applications are those that deliver multimedia content to users to render on HD displays. Premium content and services applications are exemplified by HD video and music distribution services. Content and service providers want to make easy access to their products available to legitimate users, while also protecting themselves from unauthorized redistribution of or access to those services and content. These uses require that devices have a trustworthy component that may be used to authorize access to the provider’s products while remaining secure against compromise by malicious users. Netflix is a good case in point. Netflix is available now on a wide range of Android devices, but many of them cannot receive HD content. The reason is simple: today most Android devices make content owners suspicious of their suitability for premium content. And the lack of a reliable assurance of a trusted element in the devices means that every device model produced by manufacturers must be evaluated on its own. Given the large number of device models on the market and the rapid development cycle of new models, content providers and producers simply give up on trying to capture this market as a category. In an attempt to change this situation, there has been a move from wide open to trusted Android devices. These trusted devices incorporate a secure subsystem beyond the reach of the Android operating system that can include cryptographic keys and credentials together with security algorithms and protocols that can be used to provide protected services to Android applications. The leading technology for these devices today is ARM TrustZone. ARM’s processors are the outright market leader in smartphones and tablets, but also increasingly in other market segments such as set-top boxes and media players. TrustZone enables hardware-enforced software security via a Trusted Execution Environment (TEE). TrustZone is now a standard feature of the ARM processor architecture. However, this alone is not sufficient for end-to-end security solutions, which require a well-defined set of APIs for applications to use to pass data to and from secure services running inside TrustZone. To facilitate multiple separate secure services, a secure OS operating inside TrustZone is used. The Global Platform TEE initiative is one attempt to develop a standardized secure OS. Efforts are presently underway to provide features important to content protection such as protected data path between security engines and the graphics processing unit. Other Dana Neustadter is Director of Product Management at Elliptic Technologies -www.elliptictech.com – She can be reached at danan@elliptictech.com 44 Electronic Engineering Times Europe June 2013 www.electronics-eetimes.com


EETE JUNE 2013
To see the actual publication please follow the link above