IPTV SECURITY
CONTENTS INTRODUCTION TO IPTV 11 INTRODUCTION 12 GENERAL THREATS TO IPTV DEPLOYMENTS 121 ACCESS FRAUD 122 UNAUTHORIZED BROADCASTING 123 ACCESS INTERRUPTION 124 CONTENT CORRUPTION PRINCIPLES SUPPORTING IPTV 21 HISTORY OF VIDEO AND TELEVISION 211 TELEVISION 22 VIEWING EXPERIENCE OF VIDEO 221 LINE SCANNING 222 VIDEO RESOLUTION 223 NUMBER OF PICTURES PER SECOND 224 ASPECT RATIO 225 VIDEO COMPRESSION METHOD 23 VIDEO COMPRESSION 24 TCP/IP PRINCIPLES 241 ADDRESSES 242 ROUTING 2421 IP PACKET 25 SUMMARY REFERENCES BIBLIOGRAPHY IPTV ARCHITECTURE 31 HIGH-LEVEL ARCHITECTURE 311 SERVICE TYPES 32 FUNCTIONAL ARCHITECTURE FOR THE IPTV SERVICE 321 CONTENT PROVISION 322 CONTENT DELIVERY 323 IPTV CONTROL 324 SUBSCRIBER FUNCTIONS 325 SECURITY 33 DETAILED IPTV ARCHITECTURE 331 HEAD END (IPTV SERVICE PROVIDER) CRITICAL ELEMENTS OF THE HEAD END CONTENT INPUT MPEG VIDEO ENCODER IP ENCAPSULATOR VIDEO TRANSCODER CONTENT MANAGEMENT SERVER VIDEO REPOSITORY DIGITAL RIGHTS MANAGEMENT VIDEO STREAMING SERVER 33110 SUBSCRIBER INTERACTION 332 TRANSPORT AND AGGREGATION NETWORK (IPTV NETWORK PROVIDER) 3321 RP AND RTSP 3322 RTSP 3323 ISMACRYP 3324 PIM 3325 MSDP 3326 DSM-CC 3327 INTERNET SERVICE PROVIDER 3328 DSLAM 333 HOME END (SUBSCRIBER) 3331 SET TOP BOX 34 SUMMARY INTELLECTUAL PROPERTY 41 INTRODUCTION 42 SUPPORTING TECHNOLOGY 421 SYMMETRIC KEY CRYPTOGRAPHY 422 ASYMMETRIC KEY CRYPTOGRAPHY 423 HYBRID ENCRYPTION 424 HASH – DIGEST 425 COMMONLY USED ALGORITHMS 427 OPERATION OF PKI 428 SECURE SOCKET LAYER AND TRANSPORT LAYER SECURITY 43 GENERAL MECHANISMS FOR CONTENT PROTECTION 431 CPS 432 CAS 433 DRM 44 OPERATION OF DRM ON IPTV 441 DRM APPLIED TO VOD 442 DRM APPLIED TO BROADCAST TV 443 SMART CARDS AND DRM 444 STORAGE PROTECTION VCPS CPRM/CPPM (CPSA) 445 OPEN DRMS SDMI OMA DRM DMP MPEG21 REL DATA MODEL DVB-CPCM DVB-CBMS PERM DCAS 44510 DREAM 44511 OPENIPMP 44512 OPENCA 44513 PACHYDRM 446 INTEROPERABILITY PROPOSALS CORAL SMARTRIGHT SVP OPENCP OMARLIN 45 WATERMARKING AND FINGERPRINTING 451 HISTORY 452 STEGANOGRAPHY TECHNIQUES 453 WATERMARKING AND FINGERPRINTING PRINCIPLES 454 TYPICAL ATTACKS 455 FORENSIC USE OF DIGITAL FINGERPRINTS 46 WWW? (WHAT WENT WRONG?) 461 INTRODUCTION 462 SATELLITE TELEVISION 463 DVD PROTECTION 464 AACS ON BLUE-RAY AND HD-DVD 465 VIDEOS OVER THE WEB 47 AUTHENTICATION 48 SUMMARY EXISTING THREATS TO IPTV IMPLEMENTATIONS CO-AUTHORED BY ANDREW R MCGEE, FRANK A BASTRY AND DAVID RAMIREZ 51 INTRODUCTION TO IPTV THREATS SPECIFIC THREATS TO IPTV ENVIRONMENTS 52 IPTV SERVICE PROVIDER – HEAD END VIDEO FEEDS – LIVE OR PRERECORDED (PHYSICAL MEDIA, OTA, ETC) VIDEO SWITCH INGEST GATEWAY (VIDEO CAPTURE) PLATFORM SW/OS – STORED/RUNNING CONTENT MANAGEMENT SYSTEM CONTENT METADATA FROM VIDEO REPOSITORY MPEG-2 CONTENT FROM VIDEO REPOSITORY MPEG-4 CONTENT LOAD BALANCER SOFTWARE 5210 MASTER VIDEO STREAMING SOFTWARE 5211 CA/DRM SERVICE 5212 SRTP KEYS 5213 ISMACRYP KEY 5214 KEY MANAGEMENT PROTOCOL 5215 CA/DRM SERVICE ADMINISTRATION 5216 VOD APPLICATION – CACHED VIDEO CONTENT METADATA 5217 CACHED MPEG-2/MPEG-4 CONTENT (PRIMARY AND SECONDARY STORAGE) 5218 VIDEO STREAMING SOFTWARE 5219 LOCAL AD INSERTION AUTHENTICATION INFORMATION (EG USER ID(S) AND PASSWORD(S)) 5220 LOCAL AD METADATA 5221 LOCAL AD MPEG-2/MPEG-4 CONTENT 5222 LOCAL AD INSERTION TRACKING INFORMATION 5223 NPVR APPLICATION RECORDED/STORED CONTENT METADATA 5224 RECORDED/STORED MPEG-2/MPEG-4 CONTENT 5225 NPVR/VIDEO RECORDING SOFTWARE 53 IPTV NETWORK PROVIDER – TRANSPORT AND AGGREGATION NETWORK PROTOCOL VULNERABILITIES CONTENT DISTRIBUTION SERVICE: UNICAST CONTENT PROPAGATION – FTP OR OTHER TRANSPORT PROTOCOL MULTICAST CONTENT PROPAGATION 5331 IGMPV2/V3 (SNOOPING) 5332 PIM (SM, SSM, SNOOPING) 5333 MBGP 5334 MSDP 5335 MFTP 5336 RTP QOS SIGNALING (RSVP, DIFFSERV) MANAGEMENT OF CONTENT DISTRIBUTION SERVICE CONNECTION MANAGEMENT SERVICE 5361 DSM-CC PROTOCOL 5362 RTSP PROTOCOL 5363 MPEG-2 VIDEO STREAM 5364 MPEG-4 VIDEO STREAM 5365 DSM-CC 5366 RTSP 54 IPTV SUBSCRIBER – HOME END SET TOP BOX STB EXECUTING SOFTWARE 5421 DRM SOFTWARE 5422 MIDDLEWARE CLIENT SW 5423 STB PLATFORM SW 5424 DVR/PVR 5425 STB CREDENTIALS 5426 DIGITAL CERTIFICATE (SOFTWARE PROVIDER) 5427 STB DIGITAL CERTIFICATE 5428 PUBLIC KEYS (USED FOR DIGITAL CERTIFICATES) 543 STB USER STORAGE 5431 DOWNLOADED CONTENT 5432 USER-CREATED CONTENT 5433 STB SMART CARD 5434 STB CREDENTIALS 5435 STB DIGITAL CERTIFICATE 5436 STB HIGH-DEFINITION OUTPUT INTERFACE 5437 DVI 544 RESIDENTIAL GATEWAY 545 DSLAM 5451 AUDIENCE METERING INFORMATION 5452 FRAUD CONTROL INFORMATION 5453 IP FILTERS 546 BROADCAST/MULTICAST TV VLAN SERVICE 5461 DECRYPTION KEYS 5462 CWMP 5463 NTP/SNTP 547 BROADCAST/MULTICAST TV APPLICATION 5471 MPEG-2 AND MPEG-4 VIDEO STREAM 5472 DSM-CC 548 MIDDLEWARE APPLICATION 5481 EPG 5482 MENUS 5483 SUBSCRIBER CREDENTIALS 5484 PURCHASING INFORMATION 5485 DIGITAL CERTIFICATES (CONTENT PROVIDER) 5486 PARENTAL CONTROLS 5487 PVR/DVR APPLICATION 5488 USER-SOURCED CONTENT 549 APPLICATION MANAGEMENT 5491 IPTV USAGE INFORMATION 5492 IPTV BILLING INFORMATION 55 CONCLUSION COUNTERING THE THREATS 61 SECURING THE BASIS 611 HARDENING OPERATING SYSTEMS 612 BUSINESS CONTINUITY 613 INTRUSION DETECTION/INTRUSION PREVENTION 614 NETWORK FIREWALLS 615 FRAUD PREVENTION 616 DRM–CAS 62 HEAD END (IPTV SERVICE PROVIDER) 621 CRITICAL ELEMENTS OF THE HEAD END 622 CONTENT INPUT 6221 SATELLITE FEED 6222 PREMIUM AND DIRECT-FEED CONTENT, PRE-ENCODED CONTENT READY TO BE ENCAPSULATED 6223 PHYSICAL MEDIA 623 MPEG VIDEO ENCODER AND VIDEO TRANSCODER FUNCTIONS 624 IP ENCAPSULATOR 625 CONTENT MANAGEMENT SERVER 626 VIDEO REPOSITORY 627 DIGITAL RIGHTS MANAGEMENT 628 VIDEO STREAMING SERVER 6282 MBGP 6283 MSDP 6284 RTP 6285 RTSP PACKETS 6286 RSVP 629 MIDDLEWARE SERVER 63 AGGREGATION AND TRANSPORT NETWORK 631 DSLAM 6311 ACCESS AND SESSION CONTROL 6312 ROUTING 6313 USER SEGREGATION 6314 QUALITY OF SERVICE 6315 VIRTUAL NETWORKS AND VIRTUAL CIRCUITS 6316 8021X AUTHENTICATION 632 FIREWALLS 64 HOME END 641 RESIDENTIAL GATEWAY 6411 FILTERING 6412 QUALITY OF SERVICE 642 SET TOP BOX 6421 SECURE PROCESSOR 6422 DRM 6423 OUTPUT PROTECTION 65 SECURE IPTV A REALITY INTRODUCTION TO IPTV 11 INTRODUCTION TELEVISION IS ONE OF THE INVENTIONS THAT HAS SHAPED THE WAY SOCIETY AND CULTURE HAS EVOLVED IN THE PAST 60 YEARS BACK IN 1940, THE FIRST COMMERCIAL TELEVISION BROADCAST STARTED A REVOLUTION, SHOWING PEOPLE OF ALL AGES HOW OTHERS LIVED OUTSIDE THEIR TOWNS AND CITIES TELEVISION HAD A POWERFUL EFFECT, SHRINKING THE WORLD AND CREATING A UNIFIED VIEW OF HOW THINGS WERE IN 1969, ARPANET WAS CREATED, AND A NEW STAGE IN COMMUNICATIONS STARTED THEN, IN 1983, THE CORE PROTOCOL OF ARPANET WENT FROM NCP (NETWORK CONTROL PROTOCOL) TO TCP/IP (TRANSFER CONTROL PROTOCOL/INTERNET PROTOCOL) AND THE INTERNET WAS BORN BOTH THE TV AND THE INTERNET HAVE REVOLUTIONIZED THE WAY WE LIVE WE NOW HAVE TV CHANNELS PROVIDING INFORMATION 24 HOURS A DAY, AND THE INTERNET FACILITATING BOTH COMMUNICATION AND COMMERCE SEVERAL COMMON AREAS BETWEEN THE TWO HAVE FINALLY DRAWN THE TECHNOLOGIES INTO MERGING, CREATING IPTV (INTERNET PROTOCOL TELEVISION) THERE ARE SOME DIFFERENCES BETWEEN IPTV AND IP VIDEO ALTHOUGH THE TWO TERMS ARE VERY SIMILAR, THERE IS A CLEAR DISTINCTION IN THE WAY THE MARKET IS USING THE TWO IPTV CAN BE USED TO REFER TO COMMERCIAL OFFERINGS BY SERVICE PROVIDERS WITH VERY CLOSE ACCESS TO THE SUBSCRIBER AND OFFERS A NUMBER OF TV CHANNELS WITH A SIMILAR LOOK AND FEEL TO STANDARD TELEVISION IP VIDEO IS MORE COMMON WITHIN WEBSITES AND PORTALS, OFFERING DOWNLOADABLE CONTENTS AND, IN SOME CASES, EVEN TV SHOWS AND MOVIES DOWNLOADED ON DEMAND IF IT HAS A NUMBER OF CHANNELS AND ACCEPTABLE QUALITY, IT WOULD BE CALLED IPTV IPTV IS A NEW TECHNOLOGY THAT ENABLES MUCH MORE FLEXIBILITY TO MANAGE CONTENTS AND FACILITATES DIRECT INTERACTION WITH THE SOURCES OF CONTENT, IMPROVING THE FEEDBACK AND FUTURE PLANNING THE CUSTOMER EXPERIENCE IS GREATLY IMPROVED BY ALLOWING MORE CONTROL OVER THE TYPE OF CONTENTS IMMEDIATELY AVAILABLE, AS WELL AS TWO-WAY COMMUNICATION WITH CONTENT PROVIDERS A FEW YEARS AGO, ANOTHER NEW TECHNOLOGY SHOCKED THE ENTERTAINMENT INDUSTRY – THE INFAMOUS NAPSTER ENABLED PEOPLE TO SHARE MUSIC AND MOVIES IN AN UNPRECEDENTED WAY WITH IPTV SECURITY THIS TECHNOLOGY IT WAS NOT JUST THE CASE OF A NEIGHBOR LENDING A VHS TAPE WITH AN OLD MOVIE WITH NAPSTER, PEOPLE SHARED PRERELEASE ALBUMS AND VIDEOS, CREATING SIGNIFICANT LOSSES FOR THE MUSIC INDUSTRY AND MOVIE STUDIOS NAPSTER WAS EVENTUALLY SHUT DOWN IN 2001, BUT SEVERAL PEER-TO-PEER (P2P) NETWORKS APPEARED AND THE PHENOMENON GREW DRAMATICALLY, REACHING MILLIONS OF USERS WORLDWIDE CHECKING E-MULE WOULD CONFIRM AN AVERAGE USER BASE OF 600–900 MILLION USERS WORLDWIDE AT THE SAME TIME, SEVERAL PROVIDERS HAVE STARTED TO OFFER LEGAL DOWNLOADS TO THE GENERAL PUBLIC ANYONE CAN BUY MUSIC AND VIDEO FILES THE ENTERTAINMENT INDUSTRY HAS ADDED DIGITAL RIGHTS MANAGEMENT (DRM) CAPABILITIES TO THE FILES AND APPLICATIONS USED TO REPRODUCE THE CONTENTS, WHICH ENABLES A SUSTAINABLE MODEL FOR SALES OF DIGITAL CONTENT RECENTLY, SOME ONLINE STORES HAVE EVEN REMOVED DRM TO CALM THE COMPLAINTS FROM THEIR SUBSCRIBERS RELATED TO FAIR USE OF THE CONTENTS USERS FEEL THAT, ONCE THEY HAVE PAID FOR CONTENT, THEY SHOULD BE ABLE TO ENJOY IT ON ANY DEVICE, AND DRM IS BLOCKING THAT FAIR USE POSSIBILITY THE RECENTLY BORN IPTV INDUSTRY WILL NEED TO ADDRESS THE SAME ISSUES THAT ONCE AFFECTED THE DIGITAL MEDIA DISTRIBUTORS CUSTOMERS TEND TO SHARE INFORMATION, AND OVER THE YEARS THERE HAVE BEEN A NUMBER OF VERY CLEVER PIECES OF SOFTWARE THAT ENABLE PEOPLE TO SHARE INFORMATION AND CONTENT A RECENT EXAMPLE OF THE PHENOMENON IS FREENET, A REPORTEDLY HEADLESS NETWORK OF NODES, STORING ENCRYPTED SECTIONS OF CONTENT AND SENDING IT TO ANYONE WHO REQUESTS A PARTICULAR PIECE OF DATA WITH FREENET IT IS VERY DIFFICULT TO FIND WHO IS SHARING ILLEGAL MATERIAL, AND HENCE THE ENFORCEMENT OF INTELLECTUAL PROPERTY RIGHTS AND COPYRIGHT RESTRICTIONS BECOMES MORE DIFFICULT ONE OF THE MAIN RISKS FACED BY THE INDUSTRY IS THE RISE OF THOUSANDS OF ‘HOME-MADE STATIONS’ WILLING TO BROADCAST DRM-PROTECTED CONTENTS ONE EXAMPLE OF THE TECHNOLOGY THAT WILL COME IN THE FUTURE IS VIDEOLAN THIS SOFTWARE ENABLES MULTIMEDIA STREAMING OF MPEG- 2, MPEG-4, DVDS, SATELLITE AND TERRESTRIAL TV ON A HIGH-BANDWIDTH NETWORK BROADCAST OR UNICAST IF FREENET AND VIDEOLAN MEET, THEN THERE WILL BE THOUSANDS OF ENCRYPTED STATIONS BROADCASTING CONTENT OUTSIDE ANY CONTROL OF REGULATORS HOWEVER, THE IPTV INDUSTRY NOT ONLY HAS DRM AND CONTENT PROTECTION ISSUES, CUSTOMERS ARE USED TO AN ALWAYS-ON SERVICE WITH CONSISTENT QUALITY IPTV WOULD HAVE TO MAINTAIN HIGH LEVELS OF AVAILABILITY TO CONVINCE SUBSCRIBERS THAT THIS IS A VIABLE OPTION WITH A WORLDWIDE TREND IN PRIVACY PROTECTION LAWS, ALL THE INFORMATION SENT AND RECEIVED FROM THE CUSTOMER MUST BE PROTECTED FROM THIRD PARTIES TRYING TO CAPTURE INFORMATION THE WIRELESS LAN/WAN MARKETS ARE A PRIME EXAMPLE THAT BAD PUBLICITY HAPPENS TO GOOD PEOPLE IT MANAGERS ARE NOT PURCHASING THE TECHNOLOGY BECAUSE OF FEAR, UNCERTAINTY AND DOUBT AROUND THE POTENTIAL RISKS OF DEPLOYING WIRELESS NETWORKS MANY PROBLEMS THAT HAVE AFFECTED THE CABLE AND SATELLITE INDUSTRY IN THE PAST WILL GRADUALLY MIGRATE TO THE IPTV SERVICE PROVIDERS, WITH THE INCREASED IMPACT OF IPTV PROVIDING A TWO- WAY COMMUNICATION THAT INCLUDES LOGICAL PATHS CONNECTING TVS TO THE INTERNET, AND WITH THAT ENVIRONMENT COME COMPUTER WORMS AND VIRUSES IPTV SERVICE PROVIDERS MUST ENSURE THAT SUBSCRIBERS ARE NOT ABLE TO ATTACK THE SERVERS PROVIDING CONTENTS, AND ALSO PROTECT SUBSCRIBERS FROM THE INTERNET AND OTHER SUBSCRIBERS MOST IMPORTANTLY, THE SHARED INFRASTRUCTURE WITH OTHER SERVICES HAS TO BE PROTECTED ALL THOSE RISKS AND THREATS MUST BE ADDRESSED TO ACHIEVE A PROFITABLE BUSINESS MODEL THE FOLLOWING CHAPTERS OF THIS BOOK WILL COVER SOME OF THE BASIC MEASURES REQUIRED TO IMPLEMENT IPTV SECURITY CHAPTER 1 WILL COVER AN INITIAL REFERENCE TO THREATS TO IPTV INFRASTRUCTURES, INCLUDING KNOWN ATTACKS AND EFFECTS ON THE IPTV SOLUTION INTRODUCTION TO IPTV CHAPTER 2 WILL COVER REFERENCES TO THE IPTV ARCHITECTURE, OPERATION, ELEMENTS AND KNOWN REQUIREMENTS THIS WILL PROVIDE THE NOVICE WITH BACKGROUND TO UNDERSTAND THE TECHNOLOGY CHAPTER 3, UNDER THE TITLE OF INTELLECTUAL PROPERTY, WILL COVER THE REQUIREMENTS THAT CONTENT OWNERS HAVE PLACED ON SERVICE PROVIDERS TO PROTECT CONTENTS FROM UNAUTHORIZED ACCESS CHAPTER 4 PROVIDES A TECHNICAL OVERVIEW OF THE THREATS FACED BY IPTV AND HOW THESE CAN AFFECT THE INFRASTRUCTURE AND APPLICATIONS CHAPTER 5 IS BASED ON THE INTERNATIONAL TELECOMMUNICATIONS UNION (ITU) X805, A STANDARD THAT COVERS END-TO-END SECURITY FOR COMMUNICATION NETWORKS CHAPTER 6 WILL PROVIDE A SUMMARY OF THE TECHNOLOGY, THREATS AND COUNTERMEASURES THE MATERIAL FOUND IN THIS BOOK WILL ALLOW READERS TO UNDERSTAND THE BASIC CONCEPTS SUPPORTING IPTV AND EXISTING THREATS TO THE IPTV ENVIRONMENT, AND WILL PROVIDE A STRUCTURED APPROACH TO DEFINING WHAT COUNTERMEASURES ARE RELEVANT AND REQUIRED FOR THE APPROPRIATE PROTECTION OF THE IPTV ENVIRONMENT 12 GENERAL THREATS TO IPTV DEPLOYMENTS IPTV MARKET GROWTH AND ADOPTION IS BENEFITING FROM THE INCREASED BANDWIDTH AVAILABLE AS PART OF NEW BROADBAND SERVICES ON A NUMBER OF DIFFERENT TECHNOLOGIES DSL, CABLE, MOBILE PHONES AND WIMAX ARE JUST A FEW EXAMPLES OF THE TYPE OF TECHNOLOGIES NOW OFFERING ENOUGH BANDWIDTH FOR ACCEPTABLE SERVICE LEVELS AND CUSTOMER EXPERIENCE IT IS IMPORTANT TO REMEMBER THAT THE IPTV BUSINESS MODEL IS BASED ON THE GENERAL PUBLIC BEING ABLE TO ACCESS INTELLECTUAL PROPERTY OWNED BY THIRD PARTIES AND BEING DISTRIBUTED BY SERVICE PROVIDERS BOTH CONTENT OWNERS AND SERVICE PROVIDERS DERIVE THEIR REVENUES FROM THE SECURE OPERATION OF THE SERVICE IF CONTENT WERE DISCLOSED IN DIGITAL FORM AND FULL QUALITY, THEN THE POTENTIAL REVENUE WOULD BE GREATLY REDUCED THE SYMBIOTIC RELATIONSHIP BETWEEN CONTENT OWNERS AND SERVICE PROVIDERS DEPENDS ON THE USE OF TECHNOLOGICAL MECHANISMS TO REDUCE THE RISK OF UNAUTHORIZED RELEASE OF THE DIGITAL MEDIA MOST CASES INCLUDE THE USE OF DRM AND OTHER SECURITY SOLUTIONS TO ENSURE CONTROL OVER THE DISTRIBUTION AND ACCESS WHAT ARE THE THREATS, RISKS AND VULNERABILITIES THAT THE INDUSTRY IS TRYING TO OVERCOME? THERE ARE TWO MAIN AREAS OF CONCERN: 1 THE UNDERLYING COMMUNICATION TECHNOLOGY USED TO SEND THE CONTENT TO THE SUBSCRIBERS THIS IS COMPOSED OF THE NETWORKING EQUIPMENT AND COMMUNICATION EQUIPMENT LINKING THE DISPLAY TO THE SOURCE OF DATA 2 THE SECOND AREA IS THE IPTV-RELATED EQUIPMENT THIS IS A SERIES OF ELEMENTS DESIGNED TO OPERATE THE IPTV SERVICE AND PROVIDE ACCESS AND INFORMATION TO ENABLE THE SERVICE TO OPERATE COMPARED WITH TRADITIONAL VOICE/DATA NETWORKS OR CABLE TV INFRASTRUCTURE, THREATS TO AN IPTV ENVIRONMENT ARE FAR MORE SEVERE THE WHOLE ENVIRONMENT CAN BE AFFECTED BY A SINGLE COMPUTER WORM IPTV ENVIRONMENTS ARE FORMED BY HOMOGENEOUS HARDWARE AND SOFTWARE PLATFORMS IN MOST CASES, ONE OR TWO OPERATING SYSTEMS WOULD BE USED FOR ALL THE SET TOP BOXES DEPLOYED, BUT, IF A COMPUTER WORM WERE TO AFFECT THE NETWORK, THEN A MINIMUM OF 50% OF ALL SET TOP BOXES (AND SUBSCRIBERS) WOULD BE OUT OF SERVICE FOR A PERIOD OF TIME CARRIERS ALSO NEED TO ENSURE THAT QUALITY OF SERVICE IS PROTECTED TO COMPLY WITH CUSTOMER’S EXPECTATIONS AND SERVICE LEVEL AGREEMENTS (SLA) IPTV SECURITY THOSE TWO MAIN AREAS OF CONCERN CAN BE TRANSLATED INTO SPECIFIC THREATS AND RISKS TO THE IPTV SERVICE 121 ACCESS FRAUD ACCESS FRAUD IS ONE OF THE OLDEST FORMS OF FRAUD WITHIN PREMIUM/PAID TV THIS SITUATION HAPPENS WHEN AN INDIVIDUAL CIRCUMVENTS THE CONVENTIONAL ACCESS MECHANISMS TO GAIN UNAUTHORIZED ACCESS TO TV CONTENTS WITHOUT PAYING A SUBSCRIPTION OR INCREASING THE ACCESS GRANTED AN EXAMPLE OF THE TYPE OF THREATS FACED BY IPTV VENDORS COMES FROM THE SATELLITE TV INDUSTRY FOR YEARS THEY HAVE BEEN FIGHTING ACCESS FRAUD THE WIDESPREAD NATURE OF FRAUD HAS CAUSED, DURING RECENT YEARS, SOME SATELLITE TV COMPANIES TO START TAKING LEGAL ACTION AGAINST DEFENDANTS FOR UNAUTHORIZED ACCESS TO TV CONTENT A WHOLE INDUSTRY WAS DEVELOPED AROUND THE PROVISIONING OF MODIFIED ACCESS CARDS ALLOWING UNLIMITED ACCESS TO TV PACKAGES AND ERODING THE REVENUE OF SATELLITE TV VENDORS THE EXPERIENCE OF THE SATELLITE TV INDUSTRY SHOWS THAT FRAUDSTERS GO TO GREAT LENGTHS TO BREAK THE EXISTING SECURITY MEASURES THIS INCLUDES CRACKING THE SMART CARD PROTECTION USED FOR THE SET TOP BOXES AND DISTRIBUTING CLONED ‘FREE ACCESS’ CARDS EVEN THOUGH THE SATELLITE TV PROVIDERS MODIFIED THE CARDS, FRAUDSTERS HAVE MANAGED TO FIND ALTERNATIVE WAYS TO BREAK THE SAFEGUARDS INCORPORATED IN THE NEW RELEASES, AND THIS CYCLE IS REPEATED CONSTANTLY NOW THAT VIDEO TECHNOLOGY HAS ENTERED THE IP WORLD, THE LEVEL OF THREATS HAS ESCALATED – VULNERABILITIES THAT HAVE BEEN SOLVED IN OTHER, MORE MATURE TECHNOLOGIES ARE STILL PART OF THE NEW IPTV SYSTEMS THERE IS A RECENT EXAMPLE OF A MAJOR TV PROVIDER STOPPING THEIR ONLINE CONTENT DISTRIBUTION OWING TO SECURITY VULNERABILITIES BEING FOUND AND EXPLOITED ON THE DIGITAL RIGHTS MANAGEMENT TECHNOLOGY PROTECTING THE CONTENT THERE COULD BE NUMEROUS VULNERABILITIES DISCOVERED ON IPTV SYSTEMS WHILE THE INFRASTRUCTURE REACHES A HIGHER MATURITY LEVEL IT IS IMPORTANT TO ENSURE THAT THE UNDERLYING PLATFORM HAS THE STATE OF THE ART IN RELATION TO SECURITY MECHANISMS AND PROCEDURES THIS WILL ADD PROTECTION LAYERS TO THE ENVIRONMENT AND WILL LIMIT THE EFFECT OF VULNERABILITIES DISCOVERED ANOTHER RELEVANT EXAMPLE IS THE CONSTANT BATTLE BETWEEN CABLE OPERATORS AND USERS IN MANY CASES, CABLE MODEMS HAVE BEEN MODIFIED TO UNCAP THE ACCESS TO THE NETWORK THIS SITUATION IS PRESENTED WHEN SOMEONE HAS ACCESS TO THE CONFIGURATION FUNCTION OF THE CABLE MODEM VIA THE SOFTWARE INTERFACE OR, IN SOME CASES, EVEN ACCESS TO HARDWARE COMPONENTS WITHIN THE CABLE MODEM AND THE BANDWIDTH AND OTHER RESTRICTIONS ARE REMOVED THERE ARE SITES ON THE INTERNET WHERE MODIFIED CABLE MODEMS ARE OFFERED, AS WELL AS KITS AND INSTRUCTIONS TO MODIFY THE CONFIGURATION AND REMOVE THE BANDWIDTH LIMITATIONS IPTV IS TRANSFERRED NOT ONLY TO SET TOP BOXES BUT ALSO TO COMPUTERS AND HANDHELD DEVICES THIS FACILITATES THE PROCESS OF BREAKING THE SECURITY OF CONTENTS INTRUDERS COULD MANIPULATE OR MODIFY THE BEHAVIOR OF THEIR IPTV CLIENT AND EXTRACT THE CONTENT IN DIGITAL FORM READY TO BE COPIED OR BROADCAST SIMPLE SOFTWARE MODIFICATIONS INTRODUCED BY HACKERS ALLOW THEM TO BREAK THE ENCRYPTION SYSTEM AND OTHER SECURITY MEASURES, OR EVEN CAPTURE AND REDISTRIBUTE THE CONTENTS USING PEER-TO-PEER NETWORKS THE MAIN FACT RELATED TO ACCESS FRAUD IS THAT, IN ORDER FOR AN IPTV SYSTEM TO WORK, END-USERS HAVE TO BE PROVIDED WITH THE ENCRYPTED CONTENT, ENCRYPTION ALGORITHM AND THE ENCRYPTION KEYS ANYONE FAMILIAR WITH THESE TECHNOLOGIES WILL TELL YOU THAT YOU HAVE LOST THE GAME AT THAT POINT AS YOU NO LONGER HAVE CONTROL OVER THE CONTENT HISTORICALLY, THESE INTRODUCTION TO IPTV TYPES OF ENVIRONMENT SHOW THAT EVENTUALLY SOMEONE WILL BE ABLE TO BREAK THE PROTECTIONS AND RELEASE THE CONTENT ACCESS FRAUD IS REDUCED GREATLY BY THE IMPLEMENTATION OF DIFFERENT TECHNOLOGIES INTENDED TO BLOCK ANY ATTEMPT AT UNAUTHORIZED ACCESS, FOR EXAMPLE: • THE STB HAS A DRM CLIENT NEEDING TO LIAISE WITH THE DRM APPLICATION TO RECEIVE THE VALID KEYS FOR THE CONTENT ANY THIRD PARTY WITH ACCESS TO THE CONTENT WILL NOT BE ABLE TO DECRYPT THE INFORMATION AS NO VALID KEYS HAVE BEEN ISSUED FOR THEM • COMMUNICATION WITH THE MIDDLEWARE SERVERS IS PROTECTED USING SSL, AND STBS CAN BE AUTHENTICATED, ENSURING THAT ONLY VALID SYSTEMS ARE ACCESSING THE CONTENT • DSLAMS ARE ABLE TO VALIDATE THAT ONLY VALID SUBSCRIBERS ARE ABLE TO CONNECT TO THE NETWORK AND COMMUNICATE WITH THE MIDDLEWARE SERVERS THE PHYSICAL LINE USED FOR ACCESS TO THE NETWORK IS MAPPED WITH THE MAC AND IP ADDRESS USED BY THE SUBSCRIBER AND IS VALIDATED TO ENSURE AUTHORIZED ACCESS THE DSLAM WILL BLOCK ANY ACCESS BETWEEN SYSTEMS, AVOIDING PEER-TO-PEER CONNECTIONS THAT MAY RESULT IN HACKING INCIDENTS OR UNAUTHORIZED ACCESS TO CONTENT 122 UNAUTHORIZED BROADCASTING IPTV CONTENTS ARE DISTRIBUTED IN DIGITAL FORMAT, SIMPLIFYING THE WORK OF ANY INDIVIDUAL WITH AN INTEREST IN COPYING OR BROADCASTING THE CONTENTS ONE OF THE ARGUMENTS IN THE CAMPAIGN AGAINST MOVIE PIRACY IS THAT BOOTLEG DVDS TEND TO BE RECORDINGS MADE AT THE CINEMA BY PEOPLE USING HANDHELD CAMERAS HOWEVER, WITH DIGITAL CONTENT BROADCAST AS PART OF AN IPTV SERVICE THERE IS NO DIFFERENCE BETWEEN PIRATE AND ORIGINAL CONTENT A MAJOR IMPACT ON THE SATELLITE TV INDUSTRY HAS BEEN FRAUDSTERS SELLING MODIFIED ‘ALL ACCESS’ SMART CARDS BASED ON MODIFICATIONS TO VALID SMART CARDS AND RECEIVERS IF FRAUDSTERS ARE SUCCESSFUL AT THE SAME TYPE OF ATTACK WITHIN AN IPTV ENVIRONMENT, THEY WILL BE ABLE TO CREATE ‘ALL ACCESS’ IPTV SET TOP BOXES OR CARDS AS A RESULT, THE IPTV INDUSTRY FACES AN ENTIRELY NEW THREAT – WITH BROADCASTING STATIONS RESIDING ON EVERY HOME PC, HACKERS WOULD BE ABLE TO REDISTRIBUTE THE BROADCAST STREAM TO OTHER COMPUTERS ALL OVER THE WORLD THERE ARE SOME KNOWN CASES WHERE INDIVIDUALS HAVE OFFERED REDISTRIBUTION OF SPORT EVENTS, CHARGING INTERESTED PEOPLE A SMALL FRACTION OF THE COMMERCIAL COST OF ACCESSING THE CONTENT TAKING AS AN EXAMPLE THE WIDESPREAD EFFECT OF PEER-TO-PEER NETWORKS AND HOW EASY IT IS TO USE ONE OF THESE ENVIRONMENTS TO DISTRIBUTE LARGE AMOUNTS OF DATA, IT IS TECHNICALLY FEASIBLE TO SET UP A PEER-TO-PEER NETWORK USED TO DISTRIBUTE BROADCAST IPTV CONTENT ONE SINGLE SOURCE COULD BE USED TO DELIVER CONTENTS TO NONPAYING VIEWERS AROUND THE WORLD THIS IS A CLEAR DANGER TO THE BUSINESS MODEL FOLLOWED BY CONTENT OWNERS AND SERVICE PROVIDERS A VALID SUBSCRIBER COULD TAKE DIGITAL CONTENT AND USE PEER-TO-PEER NETWORKS TO DISTRIBUTE THE HIGH-QUALITY CONTENT TO A LARGE AUDIENCE, ELIMINATING THE NEED FOR THOSE VIEWERS TO PAY FOR THE CONTENT OR MAINTAIN ANY SUBSCRIPTION TO COMMERCIAL TV SERVICES ALL THE TECHNOLOGY PIECES ARE AVAILABLE FOR THIS SITUATION TO ARISE 123 ACCESS INTERRUPTION TELEVISION IS A SERVICE THAT PEOPLE TAKE FOR GRANTED – THE PUBLIC EXPECTS TO CLICK THE BUTTON AND GET SOMETHING ON THE SCREEN IF AN INTRUDER WERE ABLE TO DAMAGE THE INFRASTRUCTURE OR IPTV SECURITY ONE OF THE SERVICE COMPONENTS, THEN CUSTOMERS WOULD LOOSE ACCESS TO THEIR SERVICES, CAUSING A LOSS OF CONFIDENCE IN THE SERVICE CABLE OPERATORS OFFER A PRETTY MUCH RELIABLE SERVICE, AND CUSTOMERS WOULD COMPARE THE RELIABILITY OF IPTV NETWORKS AGAINST OTHER SOLUTIONS SECURITY AND RELIABILITY MUST BE BUILT INTO THE ARCHITECTURE TO ENSURE THAT THE SERVICE IS ALWAYS AVAILABLE AND ANY INTERRUPTIONS ARE QUICKLY SOLVED THE WAY MOST IPTV SOLUTIONS ARE DEPLOYED CREATES A NUMBER OF RISKS, ESPECIALLY FROM FAST- REPLICATING ATTACKS SUCH AS THE ONES FROM WORMS AND VIRUSES A WORM CAPABLE OF ATTACKING THE SET TOP BOXES COULD BRING DOWN SEVERAL HUNDRED THOUSAND BOXES IN SECONDS AND, PROPERLY CODED, WOULD CAUSE AN OUTAGE OF WEEKS WHILE TECHNICAL SUPPORT PEOPLE RECOVERED THE BOXES TO THEIR ORIGINAL STATE SIMILAR ATTACKS COULD BE LAUNCHED AGAINST WEB-BASED MIDDLEWARE SERVERS, LEAVING ALL VIEWERS WITHOUT ACCESS TO THEIR ELECTRONIC PROGRAMMING GUIDE STBS TEND TO HAVE THE SAME OPERATING SYSTEM WITHIN A PARTICULAR SERVICE PROVIDER IF THE CENTRAL SERVER WERE INFECTED BY A WORM OR VIRUS, IT WOULD BE A MATTER OF SECONDS BEFORE ALL STBS WERE INFECTED, EASILY BRINGING THE SERVICE DOWN THE MAJOR WEAKNESSES WITHIN THE IPTV ENVIRONMENT, RELATED TO ACCESS INTERRUPTION, ARE AS FOLLOWS: • MIDDLEWARE SERVERS, EVEN IF DEPLOYED IN A HIGH-AVAILABILITY ENVIRONMENT, ARE A SINGLE POINT OF FAILURE IF VULNERABILITY WERE EXPLOITED ON THE SERVERS, THEN INTRUDERS COULD SHUT DOWN THE MIDDLEWARE SERVERS • DENIAL OF SERVICE IS ALSO A MAJOR RISK WITHIN THE MIDDLEWARE SERVERS IF THERE ARE NO APPROPRIATE MECHANISMS, INTRUDERS COULD SEND A NUMBER OF INVALID REQUESTS TO THE MIDDLEWARE SERVER, BLOCKING ACCESS BY VALID USERS • DSLAMS TEND TO HAVE THE SAME OPERATING SYSTEM IF AN INTRUDER IS CAPABLE OF AFFECTING THE CONFIGURATION OF A NUMBER OF DSLAMS, THEN THOUSANDS OF USERS WOULD BE LEFT WITHOUT SERVICE AN ADDITIONAL PROBLEM IS THAT SOME DSLAMS TEND TO BE DEPLOYED IN RURAL AREAS WITH LIMITED ACCESS BY SUPPORT PERSONNEL, AND RECOVERING SERVICE MAY TAKE FROM SEVERAL HOURS TO SEVERAL DAYS • STBS TEND TO RUN KNOWN OPERATING SYSTEMS, AND A WORM EXPLOITING VULNERABILITY ON THOSE SYSTEMS COULD SHUT DOWN ALL STBS SIMULTANEOUSLY, EVEN DISABLING THE STB PERMANENTLY UNTIL A TECHNICIAN HAS PHYSICAL ACCESS TO THE SYSTEM • RESIDENTIAL GATEWAYS PRESENT THE SAME TYPE OF RISK A MASSIVE ATTACK COULD SHUT DOWN ALL RGS AND LEAVE CUSTOMERS WITHOUT ACCESS • THERE ARE SIMILAR RISKS WITHIN THE IPTV CORE COMPONENTS FOR EXAMPLE, IF AN INTRUDER WERE TO DISABLE THE BROADCAST SERVER OR VIDEO-ON-DEMAND SERVER AT THE REGIONAL HEAD END, THOUSANDS OF SUBSCRIBERS WOULD LOOSE ACCESS TO THE SERVER THIS IS VALID FOR THE DRM AND OTHER IPTV COMPONENTS AT THE HEAD END IN GENERAL, THE WHOLE INFRASTRUCTURE SHOULD BE DESIGNED FOLLOWING AN APPROACH OF HIGH AVAILABILITY 124 CONTENT CORRUPTION THE RESOURCES AND FUNDING REQUIRED TO BROADCAST OVER-THE-AIR FAKE SIGNALS ARE SO LARGE THAT THIS IS SOMETHING USUALLY LEFT FOR MILITARY USE THERE ARE NO FREQUENT CASES OF PEOPLE STARTING THEIR OWN TV STATION AND BLASTING THEIR MESSAGE TO LARGE REGIONS OF A CITY OR EVEN ACROSS CITIES CABLE OPERATORS HAVE TO THEIR ADVANTAGE THAT ANY MODIFICATION TO THE SIGNAL REQUIRES PHYSICAL ACCESS AND CAN BE EASILY TRACKED INTRODUCTION TO IPTV