Security

Security, Encryption and Decryption of content, are perhaps difficult to borrow a security model from another industry.

DCI agreed that movies will be symmetrically encrypted using the public encryption algorithm AES (Advanced Encryption Standard), 128-bit keys. The handling of security keys must meet the needs of both content owners and cinema owners.

With traditional film print sent to the cinema for contracted to show the movie, Cinema is entitled to play the movie with a common standard Film Projector. From a business operations viewpoint, the cinema owners enjoy the movie to be capable of playing on all screens. Especially for the cinema with multiple screens, popular box-office success movie may move to large screens, and the less popular movie may move to smaller screens. Distributors used to negotiate up-front for best placement, but the cinema owners are to balance that placement with maximize income generation. Movie prints that are at the hand of Cinema complex owners may move freely within their complex's screens. This is one of the distribution problem which requires a solution.

In digital cinema, this screening entitlement is transferred through receipt of both the digital print and the security key. Security key will only work on specific equipment, like playback Server and Digital Projector.

In a Digital Cinema screening system there will be a secure devices along with factory/manufacturer-installed digital certificate. These certificates will include both a private and a public key. If handled properly, the private key will never be exposed to other machines or seen by human eyes. The public key is not secret information, and to be freely distributed. Content encrypted/DCP using the public key can only be decrypted by the private key.

Before sending the movie key to the theatre, it must first be encrypted to protect it.

The RSA public key encryption, utilizing the public key of the device that will decrypt it. To enable 10 screens to play a movie in a multiplex, 10 key-sets must be sent. The message used to send each key-set is called a Key Delivery Message, or KDM.

Sending the right keys to the right location requires a significant effort to keep track of the equipment in each theatre complex location. This is no small task, as equipment can be moved to another location, repaired, or replaced. Without the right keys, equipment cannot play the movies for which the theatre complex has contracted. 

The Cinemas will have to manage the task of providing Key Fulfillment Services with updated equipment lists.

The device for communicating equipment information to a Key Fulfillment Service is called the Facility List. Based on the certificate public keys provided in the Facility List, a set of KDMs (or a single KDM containing all keys for a complex) will be created and sent to the cinema. Of course, the Key Fulfillment Service that sends the keys will have the opportunity to check the public keys to make sure that they're valid. They can do so with the aid of the Certificate Authority at which the root certificate for each key is registered.

Sophisticated Digital Rights Management (DRM)'s business-to-business relationship between distributors and exhibitors is not needed.

In digital cinema, the security key will have one "dark screen rule". If the key is attempted to be used outside of the engagement time window, the movie won't play, i.e., the screen will be dark. New digital Water-mark/Forensic Marking would be applied as to prevent common form of content theft.

Another area strongly related to security is the logging of events for business monitoring by the content owners.