Common use of Generic Internet Streaming Requirements Clause in Contracts

Generic Internet Streaming Requirements. The requirements in this section 7 apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used). The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS applications shall include functionality whith detects if the iOS device on which they execute has been “jailbroken” and shall disable all access to protected content and keys if the device has been jailbroken. Protection Against Hacking Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.

Generic Internet Streaming Requirements. The requirements in this section 7 apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 only apply if the Adobe Flash product is used to provide the Content Protection System. Adobe Flash Access 2.0 or later versions of this product are approved for streaming. Licensee must make reasonable commercial efforts to comply with Adobe compliance and robustness rules for Flash Server products at such a time when they become commercially available. The requirements in this section 9 only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 3 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). The SSL connection used to obtain the content encryption key shall use both server and client authentication. The client key must be stored securely within the application using obfuscation or a similar method of protection. It is acceptable for the client key used for SSL client authentication to be the same for all instances of the application. Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used)the application. The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of implementing http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations applications shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, applications shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. The requirements in this section “Streaming over SSL” only apply if streaming over SSL is used to provide the Content Protection System. There are no compliance and robustness rules associated with SSL nor any licensing framework to ensure that implementations of SSL are robust and compliant. Streaming over SSL is not therefore a Licensor preferred option and Licensee shall make commercially reasonable efforts to migrate from streaming over SSL to streaming by one of the UItraViolet approved DRMs or other streaming method supporting compliance and robustness rules and a licensing framework ensuring implementations meet these rules. Streaming of High Definition (HD) content over SSL is not permitted unless explicitly authorized by Licensor elsewhere in this Agreement. Streams shall be encrypted using AES-128 encryption or SSL cipher of similar strength and industry acceptance. The content encryption key shall be delivered encrypted. The SSL handshake used to begin the session shall use both client and server authentication. The client key must be stored securely within the application using obfuscation or a similar method of protection. Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. If outputs are not allowed then Licensee shall make commercially reasonable efforts to only deliver content to devices that do not support any output. Applications implementing streaming over SSL shall use APIs provided by the resident device OS for delivery and display of content to the greatest possible extent. That is, applications shall include functionality whith detects if NOT contain implementations of SSL, decryption, de-compression etc but shall use the iOS device on which they execute has been “jailbroken” provisioned OS APIs to perform these functions to the greatest extent possible. Applications shall follow all relevant OS developer best practices and shall disable all access to protected content by this method or otherwise ensure the applications are as secure and keys if the device has been jailbrokenrobust as possible. Protection Against Hacking Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.

Generic Internet Streaming Requirements. The requirements in this section 7 apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 only apply if the Adobe Flash product is used to provide the Content Protection System. Adobe Flash Access 2.0 or later versions of this product are approved for streaming. Licensee must make reasonable commercial efforts to comply with Adobe compliance and robustness rules for Flash Server products at such a time when they become commercially available. The requirements in this section 9 only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). The SSL connection used to obtain the content encryption key shall use both server and client authentication. The client key must be stored securely within the application using obfuscation or a similar method of protection. It is acceptable for the client key used for SSL client authentication to be the same for all instances of the application. Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used)the application. The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of implementing http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations applications shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, applications shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. The requirements in this section “Streaming over SSL” only apply if streaming over SSL is used to provide the Content Protection System. There are no compliance and robustness rules associated with SSL nor any licensing framework to ensure that implementations of SSL are robust and compliant. Streaming over SSL is not therefore a Licensor preferred option and Licensee shall make commercially reasonable efforts to migrate from streaming over SSL to streaming by one of the UItraViolet approved DRMs or other streaming method supporting compliance and robustness rules and a licensing framework ensuring implementations meet these rules. Streaming of High Definition (HD) content over SSL is not permitted unless explicitly authorized by Licensor elsewhere in this Agreement. Streams shall be encrypted using AES-128 encryption or SSL cipher of similar strength and industry acceptance. The content encryption key shall be delivered encrypted. The SSL handshake used to begin the session shall use both client and server authentication. The client key must be stored securely within the application using obfuscation or a similar method of protection. Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. If outputs are not allowed then Licensee shall make commercially reasonable efforts to only deliver content to devices that do not support any output. Applications implementing streaming over SSL shall use APIs provided by the resident device OS for delivery and display of content to the greatest possible extent. That is, applications shall include functionality whith detects if NOT contain implementations of SSL, decryption, de-compression etc but shall use the iOS device on which they execute has been “jailbroken” provisioned OS APIs to perform these functions to the greatest extent possible. Applications shall follow all relevant OS developer best practices and shall disable all access to protected content by this method or otherwise ensure the applications are as secure and keys if the device has been jailbrokenrobust as possible. Protection Against Hacking Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.

Generic Internet Streaming Requirements. The requirements in this section 7 5. apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 6. only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used). The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS applications shall include functionality whith detects if the iOS device on which they execute has been “jailbroken” and shall disable all access to protected content and keys if the device has been jailbroken. Protection Against Hacking Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.

Generic Internet Streaming Requirements. The requirements in this section 7 5 apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT not cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 6 only apply if the Adobe Flash product is used to provide the Content Protection System. Adobe Flash Access 2.0 or later versions of this product are approved for streaming. Licensee must make reasonable commercial efforts to comply with Adobe compliance and robustness rules for Flash Server products at such a time as they become commercially available. The requirements in this section 7 only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein). The requirements in this section “Apple http live streaming” 8 only apply if Apple http live streaming is used to provide the Content Protection System. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedulethis Schedule 1. No APIs that permit stream output shall be used in applications (where applications are used). The client shall NOT not cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations shall NOT not contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS applications Licensor content streamed to YouView clients shall: be protected using “Device authentication and encrypted content delivery” using Xxxxxx Simple Secure Streaming (MS3) as specified in section 3.5, “Device authentication and encrypted content delivery” of Chapter X of the YouView Core Technical Specifications, Version 1.0, or be protected using Xxxxxx Broadband as specified in “Device authentication and encrypted content delivery”, as specified in section 3.6 of Chapter X of the YouView Core Technical Specifications, Version 1.0. NOT be streamed by any other YouView method. Download of Licensor content to YouView clients shall include functionality whith detects if use Xxxxxx Broadband as specified in “Device authentication and encrypted content delivery” as specified in section 3.6 of Chapter X of the iOS device on which they execute has been YouView Core Technical Specifications, Version 1.0, only. Download of Sony Pictures Entertainment content over any other YouView method is not permitted. In all cases, outputs shall be as protected as specified in section 3.9 “jailbrokenOutput controls” of Chapter X of the YouView Core Technical Specifications, and Licensee shall disable in all access to protected content and keys if the device has been jailbrokencases signal that HDCP shall be applied. Protection Against Hacking Any system used to protect content must support the following: Playback licenses, revocation certificates, certificates and security-critical data shall be cryptographically protected against tampering, forging, forging and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology designed to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks. The Content Protection System shall employ tamper-resistant software. Examples of tamper resistant software techniques include, without limitation: Code and data obfuscation: The executable binary dynamically encrypts and decrypts itself in memory so that the algorithm is not unnecessarily exposed to disassembly or reverse engineering.

Generic Internet Streaming Requirements. The requirements in this section 7 apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 only apply if the Adobe Flash product is used to provide the Content Protection System. Adobe Flash Access 2.0 or later versions of this product are approved for streaming. Licensee must make reasonable commercial efforts to comply with Adobe compliance and robustness rules for Flash Server products at such a time when they become commercially available. The requirements in this section 9 only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Apple http live streaming is only permitted if secured by Verimatrix VCAS3.0. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. [intentionally omitted] The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used). The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS applications shall include functionality whith detects if the iOS device on which they execute has been “jailbroken” and shall disable all access to protected content and keys if the device has been jailbroken. Protection Against Hacking Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.

Generic Internet Streaming Requirements. The requirements in this section 7 8 apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Use of Approved DRM for HLS key management. Licensee shall migrate from NOT use of the Apple-provisioned key management and storage for http live streaming (“HLS”) (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) for protection of Licensor content between Licensee servers and end user devices but shall use (for the protection of keys used to use of encrypt HLS streams) an industry accepted DRM or secure streaming method which is governed approved by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframeLicensor under section 2 of this Schedule. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser, subject to requirement “Use of Approved DRM for HLS Key Management” above. The URL from which Where the m3u8 manifest file provisioned HLS implementation is requested used (e.g. so that native media processing can be used), the connection between the approved DRM client and the native HLS implementation shall be unique to each requesting clientrobustly and effectively secured (e.g. by mutual authentication of the approved DRM client and the native HLS implementation). The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used). Licensor content shall NOT be transmitted over Apple Airplay and applications shall disable use of Apple Airplay. The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS applications shall include functionality whith which detects if the iOS device on which they execute has been “jailbroken” and shall disable all access to protected content and keys if the device has been jailbroken. Protection Against Hacking Playback licenses, revocation certificates, Revocation and security-critical data Renewal The Licensee shall be cryptographically protected against tampering, forging, ensure that clients and spoofing. The servers of the Content Protection System shall employ industry accepted tamper-resistant technology on hardware are promptly and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging toolssecurely updated, and intercepting unencrypted content where necessary, revoked, in memory buffers). The the event of a security breach (that can be rectified using a remote update) being found in the Content Protection System and/or its implementations in clients and servers. Licensee shall ensure that patches including System Renewability Messages received from content protection technology providers (e.g. DRM providers) and content providers are promptly applied to clients and servers. Account Authorisation Content Delivery. Content, licenses, control words and ECM’s shall only be designed, as far as is commercially delivered from a network service to registered devices associated with an account with verified credentials. Account credentials must be transmitted securely to ensure privacy and technically reasonable, to be resistant to “break once, break everywhere” protection against attacks.

Generic Internet Streaming Requirements. The requirements in this section 7 apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 only apply if the Adobe Flash product is used to provide the Content Protection System. Adobe Flash Access 2.0 or later versions of this product are approved for streaming. Licensee must make reasonable commercial efforts to comply with Adobe compliance and robustness rules for Flash Server products at such a time when they become commercially available. The requirements in this section 9 only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). The SSL connection used to obtain the content encryption key shall use both server and client authentication. The client key must be stored securely within the application using obfuscation or a similar method of protection. It is acceptable for the client key used for SSL client authentication to be the same for all instances of the application. Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used)the application. The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of implementing http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations applications shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, applications shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. The requirements in this section “Streaming over SSL” only apply if streaming over SSL is used to provide the Content Protection System. There are no compliance and robustness rules associated with SSL nor any licensing framework to ensure that implementations of SSL are robust and compliant. Streaming over SSL is not therefore a Licensor preferred option and Licensee shall make commercially reasonable efforts to migrate from streaming over SSL to streaming by one of the UItraViolet approved DRMs or other streaming method supporting compliance and robustness rules and a licensing framework ensuring implementations meet these rules. Streaming of High Definition (HD) content over SSL is not permitted unless explicitly authorized by Licensor elsewhere in this Agreement. Streams shall be encrypted using AES-128 encryption or SSL cipher of similar strength and industry acceptance. The content encryption key shall be delivered encrypted. The SSL handshake used to begin the session shall use both client and server authentication. The client key must be stored securely within the application using obfuscation or a similar method of protection. Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. If outputs are not allowed then Licensee shall make commercially reasonable efforts to only deliver content to devices that do not support any output. Applications implementing streaming over SSL shall use APIs provided by the resident device OS for delivery and display of content to the greatest possible extent. That is, applications shall include functionality whith detects if NOT contain implementations of SSL, decryption, de-compression etc but shall use the iOS device on which they execute has been “jailbroken” provisioned OS APIs to perform these functions to the greatest extent possible. Applications shall follow all relevant OS developer best practices and shall disable all access to protected content by this method or otherwise ensure the applications are as secure and keys if the device has been jailbrokenrobust as possible. Protection Against Hacking Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.

Generic Internet Streaming Requirements. The requirements in this section 7 7. apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 8. only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used). The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS applications shall include functionality whith detects if the iOS device on which they execute has been “jailbroken” and shall disable all access to protected content and keys if the device has been jailbroken. Protection Against Hacking Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.

Generic Internet Streaming Requirements. The requirements in this section 7 apply in all cases where Internet streaming is supported. Streams shall be encrypted using AES 128 (as specified in NIST FIPS-197) or other robust, industry-accepted algorithm with a cryptographic strength and key length such that it is generally considered computationally infeasible to break. Encryption keys shall not be delivered to clients in a cleartext (un-encrypted) state. The integrity of the streaming client shall be verified by the streaming server before commencing delivery of the stream to the client. Licensee shall use a robust and effective method (for example, short-lived and individualized URLs for the location of streams) to ensure that streams cannot be obtained by unauthorized users. The streaming client shall NOT cache streamed media for later replay but shall delete content once it has been rendered. The requirements in this section 8 only apply if the Adobe Flash product is used to provide the Content Protection System. Adobe Flash Access 2.0 or later versions of this product are approved for streaming. Licensee must comply with Adobe compliance and robustness rules for Flash Access Server products at such a time they become commercially available. The requirements in this section 9 only apply if the Microsoft Silverlight product is used to provide the Content Protection System. Microsoft Silverlight is approved for streaming if using Silverlight 4 or later version. When used as part of a streaming service only (with no download), Playready licenses shall only be of the the SimpleNonPersistent license class. If Licensor uses Silverlight 3 or earlier version, within 4 months of the commencement of this Agreement, Licensee shall migrate to Silverlight 4 (or alternative Licensor-approved system) and be in full compliance with all content protection provisions herein. The requirements in this section “Apple http live streaming” only apply if Apple http live streaming is used to provide the Content Protection System. Licensee shall migrate from use of http live streaming (implementations of which are not governed by any compliance and robustness rules nor any legal framework ensuring implementations meet these rules) to use of an industry accepted DRM or secure streaming method which is governed by compliance and robustness rules and an associated legal framework, within a mutually agreed timeframe. Http live streaming on iOS devices may be implemented either using applications or using the provisioned Safari browser. The URL from which the m3u8 manifest file is requested shall be unique to each requesting client. The m3u8 manifest file shall only be delivered to requesting clients/applications that have been authenticated in some way as being an authorized client/application. The streams shall be encrypted using AES-128 encryption (that is, the METHOD for EXT-X-KEY shall be ‘AES-128’). The content encryption key shall be delivered via SSL (i.e. the URI for EXT-X-KEY, the URL used to request the content encryption key, shall be a https URL). Output of the stream from the receiving device shall not be permitted unless this is explicitly allowed elsewhere in the schedule. No APIs that permit stream output shall be used in applications (where applications are used). The client shall NOT cache streamed media for later replay (i.e. EXT-X-ALLOW-CACHE shall be set to ‘NO’). iOS implementations (either applications or implementations using Safari and Quicktime) of http live streaming shall use APIs within Safari or Quicktime for delivery and display of content to the greatest possible extent. That is, implementations shall NOT contain implementations of http live streaming, decryption, de-compression etc but shall use the provisioned iOS APIs to perform these functions. iOS applications, where used, shall follow all relevant Apple developer best practices and shall by this method or otherwise ensure the applications are as secure and robust as possible. iOS applications shall include functionality whith detects if the iOS device on which they execute has been “jailbroken” and shall disable all access to protected content and keys if the device has been jailbroken. Protection Against Hacking Playback licenses, revocation certificates, and security-critical data shall be cryptographically protected against tampering, forging, and spoofing. The Content Protection System shall employ industry accepted tamper-resistant technology on hardware and software components (e.g., technology to prevent such hacks as a clock rollback, spoofing, use of common debugging tools, and intercepting unencrypted content in memory buffers). The Content Protection System shall be designed, as far as is commercially and technically reasonable, to be resistant to “break once, break everywhere” attacks.