Security and Standards: Risks and Rewards

By Suzana Brady, RIST Forum Chairwoman

In the past, satellite distribution and private data links were the only options for contributing and distributing video content. That’s no longer the case – the Internet is now recognised by many to be a cost efficient, flexible, and effective alternative to satellite or private links for contribution and distribution of video content. However, when transporting valuable broadcast video content over the Internet, maintaining security, and adhering to robust standards is critical. Security needs to be integrated into all aspects of the workflow. 

The risks of transmitting valuable broadcast content without adequate safeguards are substantial, ranging from unauthorized access to interception by malicious third parties. If this happens, content could be tampered with or copied and illegally distributed and pirated. If this were to happen to a broadcaster or other media company, there would likely be a significant financial impact, as well as major damage to reputation.

However, if media organisations implement robust security measures, broadcast content can be transported securely over the Internet. This makes IP a viable alternative for replacing or supplementing traditional distribution methods. Get IP right and broadcasters are rewarded with cost savings, improved flexibility, and a simplified transport set up process.

Key Security Considerations

When transporting content over the Internet, the content travels on a public network over at least one ISP, on route to its end destination, Therefore, it’s critical that measures are in place so that when in flight, the content is kept secure to prevent people from accessing, taking, or copying it without permission. 

Additionally, it’s also crucial that steps are taken to verify that content senders and receivers are genuine and not unauthorised third parties that have hijacked the content and that are masquerading as someone or somewhere else. Put simply, if a broadcaster or content provider is sending valuable broadcast content, such as sports or other premium content, they need to know that it won’t be intercepted, or tampered with, possibly without their knowledge, as it traverses the Internet from point A to B. Next, care must also be taken to ensure that equipment and workflow components are secure and protected from compromise. 

The key to addressing these security challenges is to adhere to implemented procedures and measures that are recognised and vetted by data security experts as being robust and effective, such as those used by the financial and banking sector. The RIST (Reliable Internet Stream Transport) protocol adheres to strict standards and uses precisely these kinds of security measures to ensure that content is kept secure when transported over the Internet. 

Maintaining Content Security in Transit

There are different methods for ensuring that data remains secure after leaving the sender as it travels to the receiver. One way to do this is to open a secure connection between the sender and receiver, or receivers if content is being sent in a one-to-many scenario. When a secure tunnel or VPN is established, all external access must flow through a VPN or similar secure connection, and access must be either from a trusted IP or trusted source/destination. 

Additional measures such as the use of authorization and authentication with certification, key rotation, strong encryption while in transit, and firewalls to restrict remote access all help to further strengthen security. 

Encryption and Authentication

While there are several proprietary transport protocols available for broadcasters to use that do address security to some degree, they don’t always incorporate robust enough measures to ensure that content remains secure throughout the entire process. RIST Main and Advanced Profiles incorporate both encryption and authentication to keep content secure and have two security models: namely Pre-Shared Key (PSK) which allows communication between anyone with the pre-shared secret pass key, and Datagram Transport Layer Security (DTLS) which includes separate encryption and authentication. When sending content to multiple receivers, RIST can use PSK with passphrases because that supports one-to-many communications.

In the PSK security model, all participants are made aware of a passphrase before content is transported. This pre-shared passphrase is used to generate the secret key that encrypts and decrypts the content. The endpoints of this solution are pre-configured with the passphrase, which is then combined with a random number generated by the sender and transmitted with the content. Using this method, the sender can rotate the random number, which should be done regularly for security purposes. If the key becomes compromised at any point, a mechanism is built in to change the key, ensuring the continued security of the content.

DTLS works differently, using asymmetric encryption which is essentially a dual key system, with a private key and a public key. The data encrypted with the public key (which does not need to be confidential) can only be decrypted by the private key. This transaction is based on the concept of key/certificate pairs, in which the key is kept secret and the certificate derived from the key is made public. The certificate is used as a way of communicating a device’s public key to other devices. It can be signed by a designated Certificate Authority (CA) which is essentially a trusted third party. The certificate enables devices involved in sending and receiving content to present the certificate to check if they can approve the connection. The certificate on its own does not enable the content to be decrypted – this can only be done when the private key is known by both parties. 

Video contribution over the Internet has been a reality for many years, but security cannot be an afterthought – it needs to be designed in from the beginning.  Authentication is as important as content protection, especially for contribution feeds that go directly to air.  

Risks Versus Rewards

There remains a lingering reluctance among some broadcasters to use the Internet to send their valuable broadcast content, in part because of security concerns. RIST has set out to dispel those concerns by incorporating security methods that are proven to be effective, and that have been vetted by experts. 

By establishing a secure tunnel between start and end points, using encryption and authentication, as well as other measures such as key rotation, and equipment security features, RIST keeps content secure while it is being transported over the Internet. 

Naturally, there are security risks to sending content over an open network such as the Internet. However, provided security is considered at the earliest stage when designing an IP contribution and distribution workflow and not just considered as an afterthought, those risks can be mitigated. And once those risks are allayed, its plain to see that the rewards that broadcasters stand to gain by adopting the Internet for contribution and distribution far outweigh the potential risks. 

The methods used in RIST have been in use for several years now and have been vetted by security experts. DTLS uses the same techniques as banks and other financial institutions for access through the Internet.