As Hollywood prepares for its transition to 4k video (four times the resolution of HD), it appears to be adopting a new approach to content protection, one that promotes more service flexibility and quicker time to market than previous approaches but carries other risks.  The recent publication of a best-practices document for content protection from MovieLabs, Hollywood’s R&D consortium, signals this new approach.

In previous generations of video technology, Hollywood studios got together with major technology companies and formed technology licensing entities to set and administer standards for content protection.  For example, a subset of the major studios teamed up with IBM, Intel, Microsoft, Panasonic, and Toshiba to form AACS LA, the licensing authority for the AACS content protection scheme for Blu-ray discs and (originally) HD DVDs.  AACS LA defines the technology specification, sets the terms and conditions under which it can be licensed, and performs other functions to maintain the technology.

A licensing authority like AACS LA (and there are a veritable alphabet soup of others) provides certainty to technology implementation including compliance, patent licensing, and interoperability among licensees.  It helps insulate the major studios from accusations of collusion by being a separate entity in which at most a subset of them participate.

As we now know, the licensing-authority model has its drawbacks.  One is that it can take the licensing authority several years to develop technology specs to a point where vendors can implement them — by which time they risk obsolescence.  Another is that it does not offer much flexibility in how the technology can adapt to new device types and content delivery paradigms.  For example, AACS was designed with optical discs in mind at a time when Internet video streaming was just a blip on the horizon.

A document published recently by MovieLabs signals a new approach.  MovieLabs Specification for Enhanced Content Protection is not really a specification, in that it is in nowhere near enough detail to be usable as the basis for implementations.  It is more a compendium of what we now understand as best practices for protecting digital video.  It contains room for change and interpretation.

The best practices in the document amount to a wish list for Hollywood.  They include things like:

• Techniques for limiting the impact of hacks to DRM schemes, such as requiring device as well as content keys, code diversity (a hack that works on one device won’t necessarily work on another), title diversity (a hack that works with one title won’t necessarily work on another), device revocation, and renewal of protection schemes.
• Proactive renewal of software components instead of “locking the barn door after the horse has escaped.”
• Component technologies that are currently considered safe from hacks by themselves, including standard AES encryption with minimum key length of 128 and version 2.2 or better of the HDCP scheme for protecting links such as HDMI cables (earlier versions were hacked).
• Hardware roots of trust on devices, running in secure execution environments, to limit opportunities for key leakage.
• Forensic watermarking, meaning that content should have information embedded in it about the device or user who requested it.

Those who saw Sony Pictures CTO Spencer Stephens’s talk at the  Anti-Piracy and Content Protection Summit in LA back in July will find much of this familiar.  Some of these techniques come from the current state of the art in content protection for pay TV services; for more detail on this, see my whitepaper The New Technologies for Pay TV Content Security.  Others, such as the forensic watermarking requirement, come from current systems for distributing HD movies in early release windows.  And some result from lessons learned from cracks to older technologies such as AACS, HDCP, and CSS (for DVDs).

MovieLabs is unable to act as a licensor of standards for content protection (or anything else, for that matter).  The six major studios set it up in 2005 as a movie industry joint R&D consortium modeled on the cable television industry’s CableLabs and other organizations enabled by the National Cooperative Research Act of 1984, such as Bellcore (telecommunications) and SEMATECH (semiconductors).  R&D consortia are allowed, under antitrust law, to engage in “pre-competitive” research and development, but not to develop technologies that are proprietary to their members.

Accordingly, the document contains a lot of language intended to disassociate these requirements from any actual implementations, standards, or studio policies, such as “Each studio will determine individually which practices are prerequisites to the distribution of its content in any particular situation” and “This document defined only one approach to security and compatibility, and other approaches may be available.”

Instead, the best-practices approach looks like it is intended to give “signals” from the major studios to content protection technology vendors, such as Microsoft, Irdeto, Intertrust, and Verimatrix, who work with content service providers.  These vendors will then presumably develop protection schemes that follow the best practices, with an understanding that studios will then agree to license their content to those services.

The result of this approach should be legal content services for next-generation video that get to market faster.  The best practices are independent of things like content delivery modalities (physical media, downloads, streaming) and largely independent of usage rules.  Therefore they should enable a wider variety of services than is possible with the traditional licensing authority paradigm.

Yet this approach has two drawbacks compared to the older approach.  (And of course the two approaches are not mutually exclusive.)  First is that it jeopardizes the interoperability among services that Hollywood craves — and has gone to great lengths to preserve in the UltraViolet standard.  Service providers and device makers can incorporate content protection schemes that follow MovieLabs’ best practices, but consumers may not be able to interoperate content among them, and service providers will be able to use content protection schemes to lock users in to their services.  In contrast, many in Hollywood are now nostalgic for the DVD because, although its protection scheme was easily hacked, it guaranteed interoperability across all players (at least all within a given geographic region).

The other drawback is that the document is a wish list provided by organizations that won’t pay for the technology.  This means that downstream entities such as device makers and service providers will treat it as the maximum amount of protection that they have to implement to get studio approval.  Because there is no license agreement that they have to sign to get access to the technology, the downstream entities are likely to negotiate down from there.  (Such negotiation already took place behind the scenes during the rollout of Blu-ray, as player makers refused to implement some of the more expensive protection features and some studios agreed to let them slip.)

Downstream entities are particularly likely to push back against some of MovieLabs’s best practices that involve costs and potential impairments of the user experience; examples include device connectivity to networks for purposes of authentication and revocation, proactive renewal of device software, and embedding of situation-specific watermarks.

Surely the studios understand all this.  The publication of this document by MovieLabs shows that Hollywood is willing to entertain dialogues with service providers, device makers, and content protection vendors to speed up time-to-market of legitimate video services and ensure that downstream entities can innovate more freely.  How much protection will the studios will ultimately end up with when 4k video reaches the mainstream?  It will be very interesting to watch over the next couple of years.