Video has evolved from a simple service watched on conventional television to a complex offering of services watched anything, anywhere, anytime. Hardware-based security solutions, or smart cards, were developed in a period when video was watched exclusively on television sets, using set-top boxes. Today, however, video is increasingly watched on PCs and mobile devices, as well as televisions, and service providers need a content security solution that can adapt to support all of these platforms. Software-based security solutions have emerged as a compelling option that offers the flexibility to support set-tops, PCs and mobile devices. While hardware-based solutions are suitable for set-tops, they are impractical for PCs and inapplicable to the diverse range of mobile devices. Software-based security has become the choice of the vast majority of IPTV deployments, representing the new wave of pay-TV service providers.

The evolution to multi-device, multi-service, converged video

Until fairly recently, video meant one thing: TV received terrestrially from over-the-air broadcasters, or via cable or satellite. Pay-TV services, delivered via cable or satellite, relied on set-tops, which tuned in the appropriate channels, converted the signals to the right frequency for television receivers, and (perhaps most importantly) provided endpoint security for the video signals. This endpoint security, called conditional access (CA), tried to ensure that only those subscribers who were entitled to receive the video content could actually view it. Hardware-based security systems excelled in this environment, since hardware (the set-top) was required in order to watch pay content. Satellite systems introduced an additional constraint in that the transmission system was inherently one-way - from the satellite to the receiver. Satellite service providers needed a robust security solution that did not depend on a physical connection between the network and set-tops, which was well-suited for smart card-based systems. Set-tops were useless without a valid smart card, and in the worst case, if the entire security system was compromised; the smart cards had to be replaced by subscribers in the field.

Jump forward to today, however, and the entire video environment has changed.

Cable and satellite service providers still use set-tops of course, but those boxes have far more intelligence and much better connectivity than those of the past. Cable set-tops now have extensive two-way connections, and satellite operators are adding Internet connections to their set-tops in order to offer Video-on-Demand and interactive services. And, IPTV services, usually offered by telcos, have entered markets around the world and leverage IP set-tops that inherently have high-speed two-way connectivity.

These set-tops can do much more than their predecessors. Their processing power (for video decryption and decompression, as well as for displaying electronic program guides and running sophisticated interactive applications) rivals that of personal computers. They can do in software what used to require dedicated hardware, and it is that power that shifts the balance in favor of software-based security for set-tops.

Finally, adoption of mobile video is exploding in markets around the world, most strongly in Asia. A service provider may supply a video channel to set-tops, PCs and mobile devices simultaneously. Content providers demand that all of these clients provide similar content protection. In a "watch anything, anywhere, anytime" world, service providers are challenged to simultaneously preserve customer convenience and provide adequate security.

Surpassing hardware-based content security in a multi-device, multi-service world

Hardware-based security was developed for a world of set-tops with limited intelligence and little or no two-way connectivity. Hardware-based systems use physical tokens, generally smart cards, with built-in microprocessors and many layers of protection to keep their security schemes from being compromised. They can work in a completely standalone mode, needing no communication back to a central server in order to maintain their security. In addition, they do not rely on the intelligence of the host device (the set-top) in order to function'the set-top can be fairly dumb, but robust security can still be maintained. However, the strengths of hardware-based security have become weaknesses in today's world. Piracy has become a sophisticated business, where analysis and reverse engineering of removable tokens or cracking their communication with the host CPU has evolved very rapidly. The vast majority of modern set-tops are perfectly capable of handling security functions using a combination of software and security features embedded in their CPUs, so the extra hardware cost required to support physical tokens is not necessary. Securing video on PCs presents more challenges for hardware-based security. Very few PCs have smart card reader, so implementing security requires either an external smart card reader connected via USB, or a memory stick-like device connected to a USB port (usually called a "dongle"). Similarly, mobile devices are not generally engineered for hardware-based security.

Other than the SIM card slots in GSM phones (SIMs are essentially smart cards), there is no way whatsoever to attach an external device to a mobile device for decryption.

The bottom line is this: It is impossible to deploy a hardware-based solution across a multi-device, multi-service subscriber base. Even if it was technically possible to do so, it is impractical for cost, upgradeability and customer satisfaction reasons. The solution is software-based security. A software-based security system takes advantage of the intelligence of the client and high-speed two-way communications to provide a high level of security.

Why software based security is ideal for today's video services environment

No hardware changes are required to set-tops, PCs or mobile devices in order to implement software-based security. In fact, many set-tops that were built to support hardware-based security can also support software-based security.

Individual clients can be secured without user intervention. The software security client can be installed at the factory, in the service provider's warehouse, at retail locations, or can even be downloaded when the subscriber first connects the device to the network. In every case, the subscriber does not need to know, or care, about the kind of security being implemented.

Individual client services are securely revoked. As soon as the head-end is either instructed to change or cut off service to a client, or detects that security on a client has been compromised (through identifying a cloned client), that client's security can be revoked and access to the content terminated. The user cannot bypass security through a hardware hack.

New client software is reissued electronically and invisibly directly from the head-end

With software, in the event of a mass update, there is no complicated consumer education program, no physical distribution of smart cards or other physical tokens, and no customer service burden.

The power of software based security in a multi-device, multi-service environment

There are two key components of security in today's environment: Conditional access (CA), which has been discussed in detail, and digital rights management (DRM). CA determines whether or not a given user or device has access to particular content, and DRM determines what the user or device can do with the content. In a multi-device, multi-service environment, the CA and DRM systems may not necessarily come from the same vendor, but it is essential that they work together, transparently to the end user. Different devices often use different DRM systems, and the service provider needs to support native DRM systems on the devices that they support. Only software-based security solutions have the ability to interface and harmonize with multiple DRM schemes, which enables a unified approach to all types of devices from a single head-end.

The overall impact of this type of approach for a pay-TV operator is to support the widest variety of devices and services in a manner that provides great subscriber transparency.

Obviously, there is room for both hardware- and software-based security solutions in the market; each service provider has to make its own decision. The vast majority of IPTV service providers have adopted software-based security solutions. These operators, that have to support a multi-device, multi-service environment in order to offer triple-play and quadruple-play packages, have gone with software-based security.

Three worldwide initiatives, the Coral Consortium, the Marlin Development Community and the Open Mobile Alliance, are working to bring interoperability to DRM systems, and have attracted members from industry leaders in both hardware and software-based security.

Hardware-based security was the right solution when it was developed, but it cannot deal with the new world of set-tops, PCs and mobile devices, all receiving video services from the same service providers. That is why software-based security is the right solution for today. It works transparently with set-tops, PCs and mobile phones. It provides an equal level of security to the best of the hardware solutions. When necessary, it can be updated "on the fly," in seconds, virtually invisibly to subscribers. For today's service providers, with their mix of devices and services, software-based security is the answer.