The pay-media service provider earns revenues by making content available to paying customers only. A vital part of this business model is the provider’s ability to ensure that payment is received in return for accessed content. When valuable media assets are hacked or pirated, this model is compromised, harming providers and often, in the long run, its subscribers.
How high is the cost of piracy? The Cable and Satellite Broadcasting Association of Asia (CASBAA) estimates that the aggregate 2003 losses across all sectors of the Asia-Pacific pay-TV industry as a result of piracy to be E1.29 billion — and that is in the Asia Pacific region alone. An even higher total is forecast for 2004, and figures are expected to rise in the future worldwide.
This drop in revenues limits pay-media operators in their ability to purchase rights to premium content. What is more, these losses and the expenditures intended to fight piracy must eventually be recovered through an increase in subscription rates.
Conditional-access (CA) technology offers service providers the ability to grant viewers access to specific programming once payment has been received. CA systems also offer providers a means of targeting content distribution geographically to meet program-rights agreements. Furthermore, CA systems facilitate parental control by restricting access to certain types of programming.
Figure 1. The essential components of a conditional-access system. Click here to see an enlarged diagram.
CA components
To enable this content to be delivered to paying customers, CA systems make use of a secure cipher to scramble both the audio and video components of a broadcast signal. Typically, a set-top box (STB) de-scrambles the signal for presentation on a TV set for viewing. (See Figure 1.)
Signal scrambling, or encryption, is the first of three components in a CA system. The European Digital Video Broadcasting (DVB) group has developed a standardized Common Scrambling Algorithm (CSA) for the scrambling and descrambling of digital content. It currently serves as the broadcasting industry’s de facto scrambling algorithm. This algorithm is used to scramble transport-stream packets containing video, audio and data content. It is primed or seeded by a key or control word, which is generated by the CA head-end system and changed at a rate of about once every 10 seconds.
These electronic keys are the second component of the secure-access system. They also are encrypted before being inserted into transport-stream packets and are then transmitted across the pro-vider’s networks to the end user’s STB. Additional encrypted CA messages, known as Entitlement Management Messages (EMMs) and Entitlement Control Messages (ECMs), are sent along with the encrypted media and control words.
Both ECMs and EMMs are decrypted by the end user’s smart card — a programmable microchip stored within the customer’s STB. EMMs are decrypted first because they convey information related to the status of the subscription. Once a user’s access privileges have been authenticated, the receiver is authorized to decrypt ECMs and, in turn, the control words that enable decryption of the original program content. This layered approach assists in making CA systems robust to pirate attacks.
The third and final piece to the CA puzzle is the subscriber management system (SMS). A complete database of all the subscribers in the pay-broadcasting network, the SMS ensures that only viewers entitled to view the scrambled programs are able to do so. Using smart card data, including serial number, unique identifier, entitlements and other housekeeping information, the SMS performs accounting operations and issues commands to the CA system to enable or disable products for subscribers. In an interactive system, it is also responsible for collecting each subscriber’s interactive pay per view (IPPV) information and generating invoices.
Managing piracy
The need for a secure CA system to incorporate these components stems from the increase in, and growing sophistication of, pay-media piracy. In the United States alone, the estimated number of hackers or pirates stands at nearly half a million. For the pay-media provider, risk management, combined with advanced content protection technology, has become an essential part of doing business.
Because no technology may be guaranteed to be immune to piracy, several strategies are followed by each party involved in the delivery of content from the head-end to the subscriber. The CA vendor constantly improves its security technology, whether or not a threat from hackers is present. These improvements make it more difficult for pirates to attempt hacks in the first place, significantly reducing the overall risk of piracy. Sophisticated field trial testing, undertaken both internally and by outside auditors, helps to ensure the reliability and security of the CA product before it goes to market.
Likewise, the service operator must be committed to ensuring scrupulous security in the systems it deploys. This includes physical isolation of the CA system and its network, auditing and recording all CA system changes, and careful tracking and correlation with customer care and billing system databases. By keeping up-to-date with advances in security technology, the pay-media provider offers pirates a moving target that is much harder to hit.
In the event of a security breach, the CA vendor must also commit to providing its clients with full support, working to resolve the problem quickly so that the service operator may continue normal business operations. By offering customers anti-piracy insurance schemes that meet their particular needs, the CA vendor can help achieve rapid remedies.
Keeping one step ahead
Related anti-piracy programs are designed to identify and analyze potential threats. These offer both CA vendors and service providers a proactive tool for maintaining the security of their assets. Such programs might include surveillance of suspected piracy offenders, monitoring of piracy-related Internet communities, and scrutinizing possible advertising and distribution channels for pirated devices. Anti-piracy programs also strive to identify component suppliers for pirate devices; establish relationships with other CA vendors to maximize investigative efforts; cooperate with law enforcement agencies in identifying, tracking and prosecuting piracy offenders; and support the development of anti-piracy legislation at local, national and international levels.
As long as there is a demand for premium media content, the threat of piracy will remain with us. The combined efforts of pay-media service providers and content protection technology companies are thus necessary to minimize this threat and safeguard the service provider’s ability to offer subscribers access to premium content at attractive rates. By deploying a secure, field-proven CA solution, pay-media providers considerably reduce the risk of piracy and protect the valuable assets on which their bottom line depends.
Norman Lievaart is a technical consultant for Irdeto Access.
