Early Home Theater VOD Content Protection Schedule Version July11 2012.docx

Schedule A EARLY WINDOW VOD & PPV

Content Protection Requirements And Obligations

This Schedule A is attached to and a part of that certain [______Agreement, dated ______(the “Agreement”), between/among ______]. All defined terms used but not otherwise defined herein shall have the meanings given them in the Agreement.

General Content Security & Service Implementation

Content Protection System. All content delivered to, output from or stored on a device must be protected by a contentprotection system that includes digital rights management,conditional access systems and digital output protection (such system, the “Content Protection System”).

The Content Protection System shall:

(i)be approved in writingby Licensor (including any upgrades or new versions, which Licensee shall submit to Licensor for approval upon such upgrades or new versions becoming available),

(ii)be fully compliant with all the compliance and robustness rules associated therewith, and

(iii)use only thoserights settings, if applicable, that are approved in writing by Licensor.

  1. Encryption.
  2. The Content Protection System shall use cryptographic algorithms for encryption, decryption, signatures, hashing, random number generation, and key generation and the utilize time-tested cryptographic protocols and algorithms, and offer effective security equivalent to or better than AES 128 (as specified in NIST FIPS-197) or ETSI DVB CSA3.
  3. New keys must be generated each time content is encrypted. A single key shall not be used to encrypt more than one piece of content or more data than is considered cryptographically secure.
  4. The content protection system shall only decrypt streamed content into memory temporarily for the purpose of decoding and rendering the content and shall never write decrypted content (including, without limitation, portions of the decrypted content) or streamed encrypted content into permanent storage. Memory locations used to temporarily hold decrypted content should be securely deleted and overwritten as soon as possible after the content has been rendered.
  5. Keys, passwords, and any other information that are critical to the cryptographic strength of theContent Protection System (“critical security parameters”, CSPs) may never be transmitted or permanently or semi-permanently stored in unencrypted form. Memory locations used to temporarily hold CSPs must be securely deleted and overwritten as soon as possible after the CSP has been used.
  6. Decryption of (i) content protected by the Content Protection System and (ii) CSPs (as defined in Section 2.1 below) related to the Content Protection System shall take place in an isolated processing environment.Decrypted content must be encrypted during transmission to the graphics card for rendering
  7. The Content Protection System shall encrypt the entirety of the A/V content, including, without limitation, all video sequences, audio tracks, sub pictures, menus, subtitles, and video angles. Each video frame must be completely encrypted.
  8. Key Management.
  9. The Content Protection System must protect all CSPs. CSPs shall include, without limitation, all keys, passwords, and other information which are required to maintain the security and integrity of the Content Protection System.
  10. CSPs shall never be transmitted in the clear or transmitted to unauthenticated recipients (whether users or devices.
  11. Integrity.
  12. The Content Protection System shall maintain the integrity of all protected content. The Content Protection System shall detect any tampering with or modifications to the protected content from its originally encrypted form.
  13. Each installation of the Content Protection System on an end user device shall be individualized and thus uniquely identifiable. [For example, if the Content Protection System is in the form of client software,and is copied or transferred from one device to another device, it will not work on such other device without being uniquely individualized.]
  14. The Licensed Service shall prevent the unauthorized delivery and distribution of Licensor’s content (for example, user-generated / user-uploaded content) and shall use reasonable efforts to filter and prevent such occurrences.

Digital Rights Management

AnyDigital Rights Management used to protect Licensed Content must support the following:

  1. A valid license, containing the unique cryptographic key/keys, other necessary decryption information, and the set of approved usage rules, shall be required in order to decrypt and play eachpiece of content.
  2. Each license shall bound to either a (i) specific individual end user device or (ii) domain of registered end user devices in accordance with the approved usage rules.
  3. Licenses bound to individual end user devices shall be incapable of being transferred between such devices.
  4. Licenses bound to a domain of registered end user devices shall ensure that such devices are only registered to a single domain at a time. An online registration service shall maintain an accurate count of the number of devices in the domain (which number shall not exceed the limit specified in the usage rules for such domain). Each domain must be associated with a unique domain ID value.
  5. If a license is deleted, removed, or transferred from a registered end user device, it must not be possible to recover or restore such license except from an authorized source.

Conditional Access Systems

AnyConditional Access System used to protect Licensed Content must support the following:

9.1.1.Content shall be protected by a robust approved scrambling or encryption algorithm in accordance section 1 above.

9.1.2.ECM’s shall be required for playback of content, and can only be decrypted by those Smart Cards or other entities that are authorized to receive the content or service. Control words must be updated and re-issued as ECM’s at a rate that reasonably prevents the use of unauthorized ECM distribution, for example, at a rate of no less than once every 7 seconds.

9.1.3.Control Word sharing shall be prohibited, The Control Word must be protected from unauthorized access.

Protection Against Hacking

  1. Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing.
  2. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers).
  3. The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.
  4. The Content Protection System shall employ tamper-resistant software. Examples of tamper resistant software techniques include, without limitation:
  5. Code and data obfuscation: The executable binary dynamically encrypts and decrypts itself in memory so that the algorithm is not unnecessarily exposed to disassembly or reverse engineering.
  6. Integrity detection: Using one-way cryptographic hashes of the executable code segments and/or self-referential integrity dependencies, the trusted software fails to execute and deletes all CSPs if it is altered prior to or during runtime.
  7. Anti-debugging: The decryption engine prevents the use of common debugging tools.
  8. Red herring code: The security modules use extra software routines that mimic security modules but do not have access to CSPs.
  9. The Content Protection System shall implement secure internal data channels to prevent rogue processes from intercepting data transmitted between system processes.
  10. The Content Protection System shall prevent the use of media player filters or plug-ins that can be exploited to gain unauthorized access to content (e.g., access the decrypted but still encoded content by inserting a shim between the DRM and the player).

REVOCATION AND RENEWAL

  1. The Content Protection System shall provide mechanismsthat revoke, upon written notice from Licensor of its exercise of its right to require such revocation in the event any CSPs are compromised,(a) the instance of the Content Protection System with the compromised CSPs, and (b) any and all playback licensesissued to (i) specific individual end user device or (ii) domain of registered end user devices.
  2. The Content Protection System shall be renewable and securely updateable in event of a breach of security or improvement to the Content Protection System.
  3. The Licensee shall have a policy which ensures that clients and servers of the Content Protection System are promptly and securely updated in the event of a security breach (that can be rectified using a remote update) being found in the Content Protection System and/or its implementations in clients and servers.

ACCOUNT AUTHORIZATION

  1. Content Delivery. Content, licenses, control words and ECM’s shall only be delivered from a network service to registered devices associated with an account with verified credentials. Account credentials must be transmitted securely to ensure privacy and protection against attacks.
  2. Services requiring user authentication:

The credentials shall consist of at least a User ID and password of sufficient length to prevent brute force attacks.

Licensee shall take steps to prevent users from sharing account credentials. In order to prevent unwanted sharing of such credentials, account credentials may provide access to any of the following (by way of example):

­purchasing capability (e.g. access to the user’s active credit card or other financially sensitive information)

­administrator rights over the user’s account including control over user and device access to the account along with access to personal information.

RECORDING

  1. PVR Requirements. Any device receiving playback licenses must not implement any personal video recorder capabilities thatallow recording, copying, or playback of any protected content.
  2. Copying. The Content Protection System shall prohibit recording of protected content onto recordable or removable media.

Outputs

  1. Analog Outputs.

No analog outputs are allowed at all.

  1. Digital Outputs.

Protected digital outputs only are allowed and suchdigital outputs shall meet the requirements listed in this section.

24.1.The Content Protection System shall prohibit digital output of decrypted protected content. Notwithstanding the foregoing, a digital signal may be output if it is protected and encrypted by High Definition Copy Protection (“HDCP”) or other output protection approved in writing by Licensor. Defined terms used but not otherwise defined in this Digital Outputs Section shall have the meanings given them in the HDCP license agreements, as applicable.

24.1.1.A device that outputs decrypted protected content provided pursuant to the Agreement using HDCP shall:

24.1.1.1.If requested by Licensor, at such a time as mechanisms to support SRM’s are available, deliver a file associated with the protected content named “HDCP.SRM” and, if present, pass such file to the HDCP source function in the device as a System RenewabilityMessage; and

24.1.1.2.Verify that the HDCP Source Function is fully engaged and able to deliver the protected content in a protected form, which means:

24.1.1.2.1.HDCP encryption is operational on such output,

24.1.1.2.2.Processing of the System Renewability Message associated with the protected content, if any, has occurred as defined in the HDCP Specification, at such a time as mechanisms to support SRM’s are available, and

24.1.1.2.3.There is no HDCP Display Device or Repeater on such output whose Key Selection Vector is in such System Renewability Message at such a time as mechanisms to support SRM’s are available.

  1. Upscaling: Device may scale Included Programs in order to fill the screen of the applicable display; provided that Licensee’s marketing of the Device shall not state or imply to consumers that the quality of the display of any such upscaled content is substantially similar to a higher resolution to the Included Program’s original source profile (i.e. SD content cannot be represented as HD content).

Embedded Information

  1. Watermarking. The Content Protection System or playback device must not remove or interfere with any embedded watermarks in licensed content.
  2. Embedded Information. Licensee’s delivery systems shall “pass through” any embedded copy control information without alteration, modification or degradation in any manner;
  3. Notwithstanding the above, anyalteration, modification or degradation of such copy control information and or watermarking during the ordinary course of Licensee’s distribution of licensed content shall not be a breach of this Embedded Information Section.

Geofiltering

  1. Licensee shall take affirmative, reasonable measures to restrict access to Licensor’s content to within the territory in which the content has been licensed.
  2. Licensee shall periodically review the effectiveness of its geofiltering measures (or those of its provider of geofiltering services) and perform upgrades so as to maintain “state of the art” geofiltering capabilities. This shall include, for IP-based systems, the blocking of known proxies.
  3. Without limiting the foregoing, Licensee shall utilize geofiltering technology in connection with each Customer Transaction that is designed to limit distribution of Included Programs to Customers in the Territory, and which consists of (i) IP address look-up to check for IP address within the Territory and (ii) either (A) with respect to any Customer who has a credit card on file with the Licensed Service, Licensee shall confirm that the country code of the bank or financial institution issuing such credit card corresponds with a geographic area that is located within the Territory, with Licensee only to permit a delivery if the country code of the bank or financial institution issuing such credit card corresponds with a geographic area that is located within the Territory or (B) with respect to any Customer who does not have a credit card on file with the Licensed Service, Licensee will require such Customer to enter his or her home address (as part of the Customer Transaction) and will only permit the Customer Transaction if the address that the Customer supplies is within the Territory.

Network Service Protection Requirements.

  1. All licensed content must be received and stored at content processing and storage facilities in a protected and encrypted format using a “state of the art” protection system.
  2. Document security policies and procedures shall be in place. Documentation of policy enforcement and compliance shall be continuously maintained.
  3. Access to content in unprotected format must be limited to authorized personnel and auditable records of actual access shall be maintained.
  4. Physical access to servers must be limited and controlled and must be monitored by a logging system.
  5. Auditable records of access, copying, movement, transmission, backups, or modification of content must be securely stored for a period of at least three years.
  6. Content servers must be protected from general internet traffic by “stateoftheart” protection systems including, without limitation, firewalls, virtual private networks, and intrusion detection systems. All systems must be regularly updated to incorporate the latest security patches and upgrades.
  7. All facilities which process and store content must be available for Motion Picture Association of America and Licensor audits upon the request of Licensor.
  8. At Licensor’s written request, security details of the network services, servers, policies, and facilities that are relevant to the security of the Licensed Service (together, the “Licensed Service Security Systems”) shall be provided to the Licensor, and Licensor reserves the right to subsequently make reasonable requests for improvements to the Licensed Service Security Systems. Any substantial changes to the Licensed Service Security Systemsmust be submitted to Licensor for approval, if Licensor has made a prior written request for such approval rights.
  9. Content must be returned to Licensor or securely destroyed pursuant to the Agreement at the end of such content’s license period including, without limitation, all electronic and physical copies thereof.

Time-Delimited Requirements

  1. Secure Clock. For all content which has a time-based window (e.g. VOD, catch-up, SVOD) associated with it, the Content Protection System shall implement a secure clock. The secure clock must be protected against modification or tampering and detect any changes made thereto. If any changes or tampering are detected, the Content Protection System must revoke the licenses associated with all content employing time limited license or viewing periods.

Early Window and High-Definition Requirements

In addition to the foregoing requirements, all HD content and all Early Window content is subject to the following set of requirements:

  1. HD content is expressly prohibited from being delivered to and playable on General Purpose Computer Platforms (e.g. PCs, Mobile Phones, Tablets)

Early Window content Requirements

In addition to the foregoing requirements, all Early Window content (both SD and HD) is subject to the following set of content protection requirements:

42.Additional Watermarking Requirements.

  1. Physical media players manufactured by licensees of the Advanced Access Content System are required to detect audio and/or video watermarks during content playback after 1st Febrary, 2012 (the “Watermark Detection Date”). Licensee shall require, within two (2) years of the Watermark Detection Date, that any new devices capable of playing AACS protected Blu-ray discs and capable of receiving and decrypting protected high definition content from the Licensed Service that can also receive content from a source other than the Licensed Service shall detect and respond to the embedded state and comply with the corresponding playback control rules. [INFORMATIVE explanatory note: many studios, including Sony Pictures, insert the Verance audio watermark into the audio stream of the theatrical versions of its films. In combination with Verance watermark detection functions in Blu-ray players, the playing of counterfeit Blu-rays produced using illegal audio and video recording in cinemas is prevented. All new Blu-ray players MUST now support this Verance audio watermark detection. The SPE requirement here is that (within 2 years) any devices that Licensees deploy (i.e. actually make available to subscribers) which can play Blu-ray discs (and so will support the audio watermark detection) AND which also support internet delivered content, must use the exact same audio watermark detection function on internet delivered content as well as on Blu-ray discs, and so prevent the playing of internet-delivered films recorded illegally in cinemas. Note that this requirement only applies if you deploy device yourself, and these devices support both the playing of Blu-ray content and the delivery of internet services (i.e. are connected Blu-ray players). No server side support of watermark is required by Licensee systems.]

At such time as physical media players manufactured by licensees of the Advanced Access Content System are required to detect audio and/or video watermarks during content playback (the “Watermark Detection Date”), Licensee shall require, within two (2) years of the Watermark Detection Date, that any new devices capable of receiving and decrypting protected high definition content from the Licensed Service that can also receive content from a source other than the Licensed Service shall detect and respond to the embedded state and comply with the corresponding playback control rules.