Security Services Platform Documentation
Security Services Platform Documentation
Breadcrumbs

DVB/IPTV License Acquisition

1. Overview

SSP supports delivering DVB/IPTV licenses to two different kind of devices:

  1. Device integrating one of the Nagra Connect client flavors (NOCS, SKL, TKL)

  2. Device supporting the TVKeyCloud standard.

The following diagram describes the overall interactions between the clients and servers:

image2019-6-17_17-3-14.png


2. Device Activation

Before being able to request a license, a device supporting either the Nagra Connect client or the TVKeyCLoud standard needs to be activated:

  1. device integrating the Connect Client shall be provisioned with the Provisioning Service (PVS) managed by NAGRA in the cloud. This provisioning flow allows the personalization of the device for a given operator deployment and is detailed in here . This activation is normally done once. Nagra manages the configuration of the provisioning server to enable a device model to access an SSP instance.

  2. device integrating the TVKeyCloud standard shall be activated by calling the SSP TVKeyCloud activation proxy (TKAP) detailed in here. This activation is normally done once per month. SSP only accepts activating devices previously authorized in the SSP authorization server (ADM). If the device is correctly authorized to be activated, then TKAP will call the TVKeyCloud activation service (TKAS) in the cloud.


3. Device Authorization

To receive a DVB/IPTV license, and also to be activated for TVKeyCloud, a device needs to be authorized in the SSP ADM service based on one of the device identities:

  1. For device integrating the Connect Client, the deviceUniqueId reported by the Nagra Connect Client license request needs to be authorized in ADM by the operator SMS using the ADM "caSN" field. Details are here.

  2. For device supporting the TVKeyCloud standard, SSP supports two possibilities:

    1. using the ADM "caSN" field with the TVKeyCloud SoC UID like it is done with Connect. Details are here and this solution requires the Operator SMS to integrate the SSP DAS service to retrieve the TVKeyCloud SoC UID.

    2. using a random "_Id" field in the ADM and the same value as "deviceId" in a DevAuthN token in the TVKeyCloud initial activation request. Once the initial activation is done, the "caSN" will be automatically set in the ADM for the device and the DevAuthN token is no more mandatory.

The license server for DVB/IPTV (PLM) will use this device identity to look-up the device and its rights in the SSP Authorization Server, including the following checks:

  • The device exists in ADM

  • The device is in ENABLED status and belongs to an account in ACTIVE status.


4. Package-Based Licenses for DVB/IPTV Live

An access criteria is a set of products that give access to a linear channel previously defined in the system (refer to the Content and Product Definition section).

SSP protects all the live streams that share the same access criteria with the same keys and use those keys to protect CW embedded inside ECM messages. This reduces the number of keys to deliver and enables license pre-delivery in an efficient manner. SSP uses the same keys protecting CW between TVKeyCloud and Connect enabling the same broadcast or multicast stream protected by a single ECM stream to be consumed by device using the Nagra Connect Client and a TVKeyCloud standard client.


5. DVB/IPTV License Delivery Modes

The license request generation requires a flow between the application running in the device and either the Nagra Connect or the TVKeyCloud client, which is outside of the scope of this documentation. Please refer to either the Connect Client SDK kit or the TVKeyCLoud standard documentation for further details.

The set of keys including in the license depends of the type of license request. SSP PLM service supports different operations for DVB/IPTV:

  • three modes of license delivery for Connect: live pre-delivery, live post-delivery and DVR delivery.

  • only live pre-delivery for TVKeyCloud.

5.1. Live License Pre-delivery

In this mode, SSP will generate a license that includes all the keys required to access the live content for which the device has active rights during the configured pre-delivery window.

  • This typically spans across several days and takes care of the key rotation and scheduled links between content (channels or events) and products.

  • The default configuration of the pre-delivery window includes one day in the past, the current day and three days in the future.

  • This enables time-shift use cases like pause live TV and start-over.

  • STBs are instructed to renew their licenses in pre-delivery mode every day by default.

  • All these settings can be modified using the SSP configuration API (accessible only to Nagra administrators).

License pre-delivery is a key feature of SSP as:

  • It ensures that STBs have all the keys they need, therefore they do not need to request a new license when the user zaps between live channels.

  • It pre-delivers all those licenses in a smooth and throttled manner, avoiding peaks of license requests and ensuring the system's reliability.

5.2. Live License Post-delivery

In certain cases, the device may miss a license due to operational procedures, like a last minute change in the product line-up that happened between two successive license pre-delivery requests.

In such situation, the STB can trigger a license request in post-delivery mode, which means that it requests the license for a specific channel. In this case, SSP will generate a license that contains only the keys that provide access to that channel during the pre-delivery window (ex, -1 day + 3 days).

This method is only supported with the Nagra Connect client.

5.3. DVR License Delivery

To play back a recording (either local for STBs with that capacity) or a network based recording, the STB shall request a specific license in DVR mode.

In this scenario, SSP will compute the time when the recording was made, will verify that the account is enabled for DVR service and finally will verify that the account has an entitlement for that channel that was active when the recorded event was live.

If all those checks succeed, SSP will generate a license that grants play back of the recording (one single key).

For this to work, the recording shall contain the original flow of ECMs included in the live stream.

This method is only supported with the Nagra Connect client.