Playing safe

The key issues and threats involved in a comprehensive security solution for IPTV are very similar to those you see in the cable and satellite arenas. Of course, the two-way connectivity of IPTV delivery gives you a number of additional advantages, in terms of security monitoring, being able to update the client systems on a frequent basis, traffic flow restriction and being able to manipulate the security of that traffic flow. Software-based content security, where Verimatrix made its name, started in the IPTV world before it became a mainstream subject in the cable and satellite marketplace.

The key drawbacks of a card-based system, supported by legacy vendors in the marketplace, are the cost of the card itself –when you set up the network or buy a set-top box – and the cost of the logistics involved in updating that card on a two, three or four-year basis. The logistics cost dominates: it’s very expensive to issue cards to existing boxes in the field, then talk people through the process of upgrading them. We can offer an easier alternative in the IP world by providing a downloadable and upgradable form of security, through a component in the box.

Initially it’s just avoiding overhead costs and allowing a sleeker, more operational paradigm. Security calls, obfuscation features, memory checking: all these kinds of things are offered by the SSC vendor in fundamental set-top-box chipsets, as IP systems get more sophisticated. These requirements start in lower cost countries, but it’s a common feature of pretty much every request for proposal we get nowadays.

Intel’s recent HDCP breach is a specific instance of where there’s a master piece of information which someone leaked. All of the implementation relying on that information can be compromised in one way or another. And that’s an unfortunate design for systems of this type. You don’t want a lack of renewability for something that is a core secret.

If you can’t prevent people from viewing things in an unauthorised fashion, it’s very difficult to charge people for viewing them in an authorised fashion. You’ve got to be able to turn off a subscription or you can’t charge for its features. Around the world we’ve found an enormous variety of ways that people create that kind of monetisation environment. Some have a subscription where people pay a monthly sum of cash, where you get a regular cash flow. Some people favour transactional models where you save up and buy a movie, or something like that, on an infrequent basis. Some people have pre-paid tokens – you buy a scratch-card, you’re able to see the code, and you’re allowed to watch a certain amount of TV. There’s an enormous variety of models.

The thing that is exciting us is cost-platform monetisation, where recommendations will direct you to content so you don’t have to scroll through enormous unwieldy guides. We’re also seeing people using social networking to help friends and recommend viewing experiences, an interesting cross-fertilisation. We’ve got to work with operators on the business model they think will provide them with the competitive edge. And that’s really the imperative for us, that we can support a variety of these models. We don’t favour one.

We saw operators, particularly in the early days of IPTV, who thought studios were being ridiculously paranoid about security. The studios were applying models that they were used to for content management. But now of course IPTV is a big industry: it may not be as big as satellites but there’s lots of money flowing across the table. If you don’t have the adequate security mechanisms in place then you stand to miss out on a lot of money. And piracy tends to follow sale of networks.

I wouldn’t say that operators have been complacent, but obviously the larger the scale of the operation, the more the bottom line matters. So security is very much more a central concern of the large-scale operators now. IP versus cable or satellite is frankly just the matter of a different wire, the same kind of techniques and challenges exist. We shouldn’t really put IPTV in a separate category to these other network types because, while from an operator’s point of view it’s a different form of network, for a consumer it’s just TV.

Security is a complex issue, and many people argue that it has no role to play, that it gets in the way of enjoyment. But in fact it is an essential ingredient of the business, and TV is a pretty big business worldwide. To have the ability to create a ‘charge for this, charge for that’ kind of environment will be a tough landscape to navigate for all elements of the value chain.