FR2895630A1 - SECURE AND AUTOMATED SYSTEM FOR DISTRIBUTING, PROGRAMMING AND READING DIGITAL AUDIOVISUAL CONTENTS - Google Patents

Abstract

Secure and automated system for distributing, programming and reading digital audiovisual contents. This invention enables the distribution and playback of pre-recorded digital audio-visual content in multiple, remote rooms that are equipped for this purpose. exploit audiovisual content in a secure and extensible way. The invention uses for this purpose a network of secure servers (1, 2, 3, 4) controlled from a remotely accessible user interface (1). Network elements are not locally controllable. A history of the actions of the system is recorded (3) and can be consulted from the user interface (1). This system is particularly intended for the distribution and the projection of films in theaters.

Description

Field of application The invention described in this document allows the

  distribution, programming and playback of digital audio-visual content pre-recorded in multiple remote rooms. This invention is more particularly intended for the use of the cinema.

  State of the art Currently, the distribution of films for the cinema is mainly carried out thanks to copies made on film.

  With the introduction of digital technologies in the film industry, it gradually became clear that a film could be produced entirely and used in digital form. In this field, production and post-production techniques have taken a leap forward in broadcasting techniques, in particular because of the need for cinemas to equip themselves with expensive projection systems. In addition, the equipment of rooms in digital equipment assumes an adaptation of the distribution system: it is no longer a question of transporting film. Digital film distribution services on physical media (DVD-RAMs, hard disks) have thus emerged. However, these services, as for the transport of reels, require heavy logistics to transport the films. In addition, the copies transit between several intermediaries, increasing the risk of theft and piracy. An alternative to these services is to create a digital movie distribution network. This route has already been described in several patents, such as US 2003/0204851, WO 02/057848, WO 99/66728 or US 2002/0038460. The systems and methods proposed vary, in particular, according to the technologies used for transmission (satellite, wired) and the type of data transported (audio-video streams, computer files). To facilitate the adoption of digital cinema by all players in the industry, attempts at standardization have recently emerged. In the United States, the Digital Cinema Initiative (DCI), a body of seven major US studios, has made recommendations that should be standardized by the Society of Motion Picture & Television Engineers (SMPTE). In France, the French Association of Standardization (AFNOR), under 2895630 -2- the aegis of the Higher Commission for Image and Sound Techniques (CST), will soon publish the S27-100 standard on the electronic projection of the digital cinema type. This standard should be consistent with that defined by SMPTE. 5 The problems confronting the distribution of digital audiovisual works are mainly related to the following issues: security, with the aim of protecting the rights holders of films, particularly against theft, illegal copying 10 or illegal exploitation . the cost, resulting from the need to purchase new equipment and related to the operation of the new systems. extensibility, to allow easy adoption by all stakeholders in the industry (studios, distributors, operators ...) and 15 to be able to equip all cinemas regardless of their geographical location. the respect of digital cinema standards newly established or in the process of being.

  SUMMARY OF THE INVENTION The invention consists in a secure and automated system for distributing, programming and reading digital audiovisual contents, processed in the form of computer files. The entire process, from the support of the original files to their playback in multiple remote locations equipped for the projection of audiovisual works, is done in a secure environment. Three categories of users have access to this system: the studios, which include any holder of an audiovisual work in the form of digital files, in particular the production studios. the distributors; which bring together all the intermediaries in the distribution chain of audiovisual works. operators, owners of theaters equipped for the projection of audiovisual works. In addition to these users, administrators ensure the maintenance and security of the system. Each user has their own personal account. He accesses this account using a computer and 2895630 -3-by connecting, via a secure connection, to a website that serves as the user interface for the system. Each account is created by an administrator after ensuring the identity of the user, preferably during a physical meeting. The user's profile is stored in a database during this step and becomes his means of identification with other users. The encryption keys that the user will later use to connect to the system are also generated at this time. They are certified by an administrator and given to the user. The relations between the users are mainly defined by three concepts: An exploitation authorization gives the right to an operator user to exploit an audiovisual work, that is to say to organize projection sessions thereof. Operating authorizations are limited either in time or by a maximum number of screening sessions. They are also allocated according to the geographical location of the audiovisual equipment of the operators. 20 A distribution authorization gives the right to a distributor user to assign all or part of this authorization to another distributor and / or to grant operating authorizations to user operators, within the limits defined by his own distribution authorization. The 25 distribution authorizations are characterized by a spatial dimension (geographical coverage) and a temporal dimension (start date and duration of the authorization). The assignment of a portion of a distribution authorization is not necessarily exclusive of the right to grant operating authorizations for the same party. For any new audiovisual work introduced in the system, the first distribution authorization is issued by an administrator to the distributor who has requested it. The limits of this first authorization are determined according to the terms of the distributor's 35 distribution agreement. • An introductory permit, issued by a distributor, allows a studio to introduce a new audiovisual work into the system. This authorization may be limited in time. A single authorization of introduction may be granted for each distribution authorization granted by a director. 5 These authorizations have no regulatory character, it is simply a terminology specific to this document to designate the concepts necessary for the distribution and exploitation of audiovisual works present in the system. The reading of an audiovisual work, that is to say the decoding of one or more audiovisual files in audio and video streams, operation under control of the system, is strictly subject to these authorizations and is the subject of computer feedback. An operator can not exploit a work without the knowledge of the distributor whose operating license he has received. The system consists of a set of computer servers connected by two secure networks: one to control the system (control network), the other to transfer audiovisual works (distribution network). The control network is a point-to-point network which may be in the form of a virtual private network whose support is the Internet. The communication protocols used must ensure the good transmission of messages between the nodes. The control network is used in particular to transport the messages of the network application that governs the system 25 and a module is installed on each server. This network also allows administrators to perform remote system maintenance.

  The distribution network and the control network are not necessarily distinct. They can be merged when the chosen distribution method does not require a different infrastructure than the one used for the control network. Regardless of the file transfer method used, it is required that it is secure and reliable in that it maintains the integrity of the files. The following methods are particularly distinguished: broadcast. Files are sent via satellite, for example, and do not pass through the control network. The storage servers must be connected to a transmitter and each read server must be connected to a receiving antenna. • point-to-multipoint (multicast) transfer. The files 5 can transit through the same secure network as the control messages if it allows the use of a point-to-multipoint protocol. Conversely, files can be transferred using encrypted datagrams transported over a point-to-multipoint network that is not protected. 10 point-to-point transfer (unicast). In this case too, the control network and the distribution network may be one. The system is composed of five different types of servers, which can be located either on the same machine or on separate machines: The storage servers are used to store audiovisual works as long as they have to remain in the system. The entry points are special cases of storage servers which are intended to accommodate the original copies of audiovisual works introduced into the system. These servers are accessible from outside the system so that studios can copy new audiovisual works. • Playback servers are equipped with media players that decode audiovisual files in audio and video streams and transmit them encrypted to sound systems and projection systems. These servers are installed in the premises of the operators, connected to their equipment. However, they do not have a user interface and are protected against attempts at local use (for example: physical protection, encrypted memories, etc.). In an automated projection room, they can also control the automation system (for example: management of the intensity of the light environment, the opening / closing of a possible curtain masking a projection screen, etc. ). ^ A database server is used to record all the information necessary for the proper functioning of the system (for example, the terms of the permissions) as well as to save the computer logs for the most significant actions performed by the system. the elements of the system (restart of a server, transfer of an audiovisual work between two servers, instants of beginning and end of the reading of an audiovisual work, etc.). • A web server allows you to implement the system user interface as a dynamic website. The actions of the users are either stored in the database or transmitted to the network application that controls the system. Since the system supports the reading of audiovisual works, it must respect precisely the programming schedules defined by the operators. For that, it is necessary to synchronize the servers of the system on a reference clock. This synchronization can be implemented by means of software installed on each server and using the Network Time Protocol (NTP), for example.

  The user interface and unique way of controlling the system 20 is a dynamic website. On the one hand, this site makes it possible to record the entries of the users in a database and to consult the information which is stored there. On the other hand, when user actions involve immediate processing, the site transmits the corresponding messages directly to a network application that drives the system. Depending on their category, users can perform different operations from the website. The possible actions for a distributor are: to grant an authorization of introduction to a studio, when a director has delivered to the distributor the authorization of prior distribution. withdraw an authorization of introduction, in order to prevent any subsequent modification of the work once it has been introduced into the system. record for the other users the description 35 of an audiovisual work of which it holds a distribution authorization. • grant distribution and / or exploitation authorizations to other distributors within the limits of its own authorizations. • consult a history of events relating to audiovisual works for which he holds distribution authorizations; events including actions performed by users to whom it has granted permissions. The possible actions for a studio are: 10 to consult the terms of the authorizations of introduction which have been allotted to it. confirm the end of the download of an audiovisual work on an entry point. check that the system supports files that are downloaded. Finally, the possible actions for an operator are: to consult the descriptions of audiovisual works present in the system. establish and consult the programming of screenings sessions 20 of the audiovisual works he has chosen and which will be screened with his equipment. to consult a history of the actions which it has carried out and which have been carried out by the reading servers situated on its premises. control these same servers in real time. The commands 25 include starting, stopping, pausing and resuming a reading, without this list being exhaustive. From these various actions, those related to the introduction permissions and the real-time control of the read server are transmitted to the network application described below. The other actions result in the execution of queries on the database. Thus, the creation and the granting of authorizations are carried out in the form of read / write operations in database. The terms of an authorization are first entered by a user and are recorded in the database. The consultation of this information makes it possible to identify the users to whom the authorization applies as well as to deduce the actions it gives them. 2895630 -8- The network application that controls the system consists of a central module that interacts with the website and modules installed on each server that allow the application to control the software needed to implement the commands. of 5 users. Without limitation, the application also has the role of optimizing the use of the system, particularly in terms of the amount of storage space, bandwidth between each server, programming deadlines to be respected.

  When the network application receives a message corresponding to the assignment of an entry authorization, it creates a directory on an entry point. This directory is created with write rights that are assigned only to the studio holding the release permission. The studio, via a secure connection, can then copy in this directory the audiovisual work that is the object of the authorization of introduction. The opposite operation (download a file from the server) is prohibited. When the introductory authorization is withdrawn or expires, the writing rights are withdrawn. The audiovisual work can no longer be modified.

  An audiovisual work can be introduced into the system in two forms. Either in a single file including, for example but not limited to, images, soundtrack, subtitles and metadata. Either in these same elements in separate files. In the second case, the files are only assembled after being transferred to the reading server. This method makes it possible to adapt to different version constraints (different languages, for example subtitles) while optimizing the amount of data to be transferred to the reading servers.

  The programming done by the operators generates the majority of the actions carried out by the network application. The central module of the application regularly reads the contents of the database. When it detects a new programming, the application starts two processes: the transfer of the audiovisual work to the reading server concerned and the programming of the application module located on the server for that it starts playback at times determined by programming. The transfer of the files is ensured by using the distribution network described above. The reading server 5 can be programmed by means of an application that makes it possible to use the server clock to schedule events (sending signals to another application, for example).

  The real-time control of a read server is through direct interaction between the web site, the network application, and the media player installed on the read server. The user's command is successively transmitted from the website to the central module of the network application, from the central module to the module installed on the reading server, from the latter to the multimedia player. The result of the action is sent in reverse by the same way for this information to be finally posted on the website, for the operator who initiated the order. If this command causes a conflict with the established scheduling (for example, when the end of one play and the beginning of the next overlap because of a pause during the first play), the application proposes to the user a new scheduling of programming.

  Finally, the network application manages the recording of computer returns related to the use of the system. These returns are saved locally on each server and are also duplicated in the database. Users can then consult a history of the returns that concern them from the website. If a loss of connectivity occurs between a server and the network, the recorded computer returns are transmitted to the database server as soon as the network is functional again. In order to ensure that the database information is up-to-date, the network application modules can query the database for the latest information that has been received by the database. The output of the system is materialized by the connections between the reading servers and the various equipment of the places where they are installed: digital projectors, sound systems, automation systems. Since the links between the system and these 5 devices are not considered reliable, the streams that result from the decoding of the audiovisual files are encrypted to prevent an unauthorized person from intercepting and recording them. The equipment recipients of these streams must therefore be equipped with a decryption system and key management. This requires that the system and related equipment use the same method, a standard such as X.509 certificates. Before transmission, the streams can also be marked by watermarks inserted by the media player (watermarking). The information contained in these watermarks can thus gather information that uniquely identifies a projection session (location, date, time). This is to identify the origin of an illegal copy that would be recorded by filming a projection screen during a session. The insertion of watermarks can also be performed by the storage servers on the source files before each transfer to a read server. This would identify the source of a leak if stolen files were found.

  To conclude, a typical use of the system follows the following process: • An administrator assigns a distribution authorization to a distributor under the terms of a distribution agreement that the distributor has. ^ The distributor assigns the authorization of introduction which corresponds to his own distribution authorization to a studio. • The studio copies the constituent files of an audiovisual work on an entry point. ^ The distributor. withdraw the authorization of introduction. • The distributor assigns one or more other distributors with distribution authorizations. Within the limits defined by its distribution authorization, each distributor may in turn grant all or part of its authorization to another intermediary or may grant operating authorizations to operators. From the website, an authorized operator selects the audiovisual work and assigns to him the dates and times of the sessions during which he wishes to screen it. ^ The network application transfers the work from the storage server where it is present to the read server. The scheduling of the programming is also transmitted to the reading server. • At times predetermined by the operator, the network application decodes the audiovisual works through a media player installed on the server. ^ The operator wants to temporarily stop a projection. It connects to the site and controls the interruption of playback. The network application then stops the multimedia player and proposes, if necessary, a new layout of the programming to the operator.

  The system can be made in different versions than the one described above. According to particular embodiments: the introduction of an audiovisual work into the system can be performed by copying to an entry point of a physical medium (DVD-RAM type or hard disk, for example) containing the 'artwork. The operation must be performed in the presence of an administrator since it requires local access to the server which must not compromise the security of the system. Instead of being in the form of a web site, the user interface can be integrated into client modules of the network application that controls the system, which modules are installed on the personal computer of each user. These modules connect to the central module and exchange with it messages similar to those exchanged, in the description above, between the website and the central module of the network application. Instead of being decoded on servers on the premises of the operator, the files are decoded on a remote reading server and the audio and video streams are transported through the distribution network to the equipment. projection (streaming). When an operator's computer and its reading server are placed on the same local network, a website only accessible from this local network can be installed on the reading server so that the operator can control it without go through the Internet. This method can also be implemented by means of a network application of which a server module is installed on the read server and a client module is installed on the operator's computer.

  Presentation of drawings Figure 1 shows a version of the system and highlights the different equipment that make it up. FIG. 2 shows the main software components and communication protocols used to implement a version of the system according to FIG. 1. FIG. 3 represents an alternative for the real-time control of a reading server from an accessible web site only. 20 from a local network.

  DETAILED DESCRIPTION OF THE INVENTION The invention can be assembled in its entirety with components, hardware and software widely available on the market. The website (20) and the network application (14) are exceptions and may have to be created entirely. The following statement details one of the possible implementations of the system. In different versions, several items, including software, may be substituted by others for similar functionality. In this example, the control network and the distribution network are combined into a single secure network in which each server included in the invention (1, 2, 3, 4) is integrated. The network can be assembled as a virtual private network (9) over the Internet to which each read server is connected by an xDSL link. For example, it can be used for this IPSec protocol (Internet Protocol Security) in ESP mode (Encapsulating 2895630 - 13 - Security Payload). Encryption can be achieved using the Advanced Encryption Standard (CBC) algorithm with a 128-bit key (see RFC # 3602 of the Internet Engineering Task Force). Depending on the purpose of the system, the protocols and encryption methods can be modified to comply with the standards in force. Management of the keys needed to encrypt the connections between the elements of the network but also to encrypt the connections between the system and the external elements (users (5, 10 6, 7), administrators (8), projection equipment (a, b , c)) can be performed using certificates according to the X.509v3 standard. The certification authority issuing valid certificates in the system is controlled by administrators. Each user (natural person) and each element of the system is assigned a certificate of its own, renewed regularly. Exceptionally, certificates may be issued by a non-system certification authority, if accepted by the administrators. This particularly concerns the certificates of projection equipment (digital projectors (a), public address systems (b)) which can be issued by the manufacturers and allocated during manufacture. In addition to the use of encryption techniques, the elements of the network must include standard security programs such as firewalls, intrusion detection systems (network and system), antivirus, etc. As for the number of communication ports used by the applications, it must be kept to the strict minimum necessary. Software must also be regularly updated. For this, only administrators have full access to server operating systems. The computers from which they operate must therefore also be secure. In general, administrators - and users - must comply with current good security practices. 35 The servers are not considered to be placed in a

  reliable environment. This concerns more particularly reading servers that are not located in protected premises. 2895630 -14-Also, server content is protected against a local attack. For each server, the use and administration being remote, the operating system must be set to allow access only through a network connection. 5 Since there is no need for local user interface (keyboard, screen, ...), it is removed and the servers are locked in locked safes. This protection can only be temporarily removed for maintenance operations to replace a defective component. Only the on / off and reset switches remain accessible so that the server can be (re) started without the intervention of specialized personnel. This protection is not sufficient, however, in the case where a malicious person has enough time to force physical protection. The memories are therefore also protected at the logic level. The operating system and audiovisual files are placed in different memories. The memories containing the audiovisual files are encrypted, the key is itself encrypted, protected by a password known only to administrators, and stored with the operating system. This makes it possible to start the server without having to enter a password from a local interface. When accessing encrypted memory, the operating system is running and an administrator can remotely take over to enter the password. The servers are equipped with the standard components found in any computer (hard disks, RAM, processor, graphics cards, etc.). The performance of the assembly must however comply with the standards in force according to the purpose of the system. To prevent a failure due to a hard disk failure, the servers can be equipped with multiple disks coupled with the use of RAID (Redundant Array of Independent Disks) technology.

  From the software point of view, in addition to the operating system and the network application, the servers (1, 2, 3, 4) are equipped with: 2895630 - ^ a website (20), user interface of the system, for the web server (1). ^ a database management system (19) for the database server (3). • SFTP servers (15) for the entry points (2). • FTP servers (16) for the storage servers (2). • FTP clients (17) and media players (18) for the reading servers (4). • An NTP client, installed on each server, to synchronize all the servers with a reference clock. There are NTP servers available for this purpose on the Internet. For security reasons, a proxy server is used to link public NTP servers to system servers. Three types of access to the system can be made from outside: write access (10) to certain directories of entry point memories. This is the access reserved for studios (5) 20 to introduce new audiovisual works into the system. It is done via a secure connection type SFTP (Secure File Transfer Protocol), for example. The SFTP server used is then configured so that the reverse operation (downloading a file from the server) is prohibited. 25 access to the system user interface (11), available at studios (5), distributors (6) and operators (7). This interface is implemented in the form of a website, users access it using the Internet browser installed on their personal computers. The connection is secured using SSL (Secure Socket Layer) or Transport Layer Security (TLS). ^ full access to operating systems and server applications (12). This access is via a secure connection, SSH type (Secure Shell), and it is reserved for only 35 administrators (8). 2895630 -16- The system's user interface is a dynamic website (20): its content is in particular a function of the information stored in the database and the actions performed by the users. In order to interrogate the database and transmit messages to the network application, the writing of the web pages requires the use of a scripting language that can be interpreted by the web server. For example, HTML, CSS, PHP and Javascript are widely deployed technologies that create pages that meet the needs of the system. The network application (14) can be carried out indifferently using programming languages such as C / C ++, Java, etc. All control messages exchanged between servers (read commands, sending computer returns, etc.) must be sent using a reliable point-to-point protocol (example: TCP). With regard to the multimedia files, these can be transferred through the virtual private network through a client / server application (16, 17) using the FTP protocol, for example. In the case presented in FIG. 2, the distribution network (13) and the control network (9) form a single network.

  FIG. 3 shows another embodiment of the real-time control of the read server by an operator (7). Instead of controlling the read server from the overall website of the system 25 (1), the operator uses another web site, installed on the read server (4). In this case, the read server control messages no longer pass through the network application. In addition, if the operator's computer and the control server are located in the same premises, this prevents the messages from going through the Internet. In the specific case of FIG. 3, the configuration makes it possible to isolate communications from the read server (4) from communications on the operator's network (7) through a router and a firewall (21). This configuration also makes it possible to integrate the control interface of the read server in the global interface 35 of the system in a manner that is transparent to the user. The web pages can be nested within each other while the router directs HTTP requests to the correct web site depending on whether the destination address is a public address on the Internet or a private address belonging to the network. local read server.

  Industrial application The system according to the invention is particularly intended for the distribution, programming and playback of any type of digital film (commercials, trailers, feature films, etc.) in theaters.

Claims (10)

claims   1) A secure and automated system for distributing, programming and reading digital audiovisual content, characterized by: ^ a set of remotely controlled and secure computer servers, particularly protected against local use. • Secure network (s) for system control and maintenance and file transfer between servers. • a website available on the Internet through which users control the system. Possible actions include: the description of audiovisual works, the management of authorizations for the introduction, distribution and exploitation of audiovisual works between users of the system, the. programming and automated reading of audio-visual works, the transfer of files constituting audio-visual works, the real-time control of a reading server, the consultation of computer returns. a network application that implements the actions ordered by the users. a database for storing all information useful for the operation of the system and relating to the use thereof, including computer returns.   2) System according to the first claim characterized in that the transfer of files is achieved by a broadcast method, point to multipoint (multicast) or point-to-point (unicast).   3) System according to any one of the preceding claims characterized in that the remote control of the read server is performed from a website installed on the read server.   4) System according to any one of the preceding claims, characterized in that the user interface of the system and / or read servers is integrated into programs installed on the users' personal computers. 2895630 -19-   5) System according to any one of the preceding claims characterized in that the maintenance and security are provided remotely by administrators from computers connected to the control network. 5   6) System according to any one of the preceding claims characterized in that watermarking (watermarking) are introduced: • in the audio and video streams generated by the media players installed on the reading servers. • in audiovisual files before each transfer of these files to a different reading server.   7) System according to any one of the preceding claims characterized in that the encryption keys used are stored in certificates issued by administrators 15 according to the X509 standard.   8) System according to any one of the preceding claims characterized in that it is protected by security programs such as firewalls, antivirus, network or system intrusion detection systems, encryption / decryption systems.   9) System according to any one of the preceding claims characterized in that the memories of the servers containing the audiovisual files are encrypted, using a key which is itself encrypted, stored with the operating system of the server, and protected by a password known only to administrators.   10) System according to any preceding claim characterized in that the introduction of new audiovisual works is performed by secure remote access to a server entry point or by copying physical media.