What’s New in NMOS: Latest in Control and Security

Presenters : Jed Deame - Nextera

Year : 2019

dlp_document_download : AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 1 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 C U R A T E D B Y What's New in NMOS? A Tutorial on the Latest in Video over IP Control and Security Jed Deame , CEO Nextera Video I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Outline •What’s New with What’s Old ‒IS-04 (Registration & Discovery) ‒IS-05 (Connection Management) ‒Gap Analysis •What’s New ‒IS-08 (Audio Mapping) ‒IS-09 (System Discovery) ‒BCP -002 (Grouping) ‒BCP -003 (Security) ‒IS-10 (Authorization API) AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 2 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What is NMOS again? •NMOS is the Networked Media Open Specification , developed by the Advanced Media Workflow Association (AMWA) •Delivered in the form of an open specification on the AMWA website •Enables ST -2110 equipment to seamlessly interoperate across vendors and facilities Brings push -button simplicity to Video over IP Routing 3 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What does NMOS Do? 4 ST2110 Hardware ST2110 Controller AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 3 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 How does NMOS Work? •Through a set of Application Program Interface (APIs) •Exposed via http as: http://<IP Address>/x -nmos /<API Name>/… •Examples: ‒http://192.168.10.2/x -nmos /node/v1.2/self ‒http://192.168.10.2/x -nmos /query/v1.2/nodes ‒http://192.168.10.2/x -nmos Ichannelmapping /v1.0/map ‒http://192.168.10.2/x -nmos Ichannelmapping /v1.0/outputs ‒http://192.168.10.2/x -nmos /auth/v1.0/certs 5 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 The Basics of NMOS 6 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 4 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What’s New with What’s Old: IS -04 (Registration & Discovery) 7 Consists of 3 API’s (Application Programming Interfaces) Node API Registration API Query API Current version 1.3 (elevated Sept 5) I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Latest IS -04 Feature Support AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 5 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What’s New with What’s Old : IS -05 (Connection Management) •Current version 1.1 (elevated Sept 5) •IS-05 is an API which provides the means to create a connection between Senders and Receivers •Enables switching through "activations" •Activations can be immediate, relative, or absolute •Supports FEC and redundant streams 9 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Latest IS -05 Feature Support AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 6 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Gap Analysis What’s missing? 1. Audio break -away routing 2. Mechanism to set global parameters for a system 3. Security I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What’s New: IS -08 (Audio Mapping) 12 •Inputs Outputs Map I/O Audio routing/shuffling facility with 4 APIs: •Combine individual channels from multiple sources into any output Provides SDI -router -like capabilities AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 7 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 NAB IP Showcase IS -08 Audio Demo •Multi -vendor demonstration of Audio Mapping •3x 16 -channel Senders •2x 16 -channel Receivers 13 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 IS -08 Mapping Controls 14 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 8 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 NAB IP Showcase IS -08 Demo 15 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What’s New: IS -09 (System Resource) •Provides a single API resource (via the path /global) with the following: •"System ID", assigned randomly at each facility •Protocol: http or https •Version: Indicate NMOS API versions supported •Server Priority: Helps with Bonjour/Avahi discovery •Extensible for DNS -SD Advertisement of system resources such as RDS (Registration and Discovery Server) 16 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 9 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What’s New: BCP -002 (Grouping) •Best practices for grouping NMOS resources •Uses the 'tags' resource in IS -04 in order to achieve 'natural grouping' of Senders and Receivers •Ex) Video, Audio, and ANC from a specific device •Uses " grouphinW " tag I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Grouping Example Playout server sender with 1 video & 2 audio flows 18 Video 1 group: "Playout Master" Video 1 role: "Primary" Audio 1 group: "Playout Master" Audio 1 role: "Audio 1 – 2ch" Audio 2 group: "Playout Master" Audio 2 role: "Audio 2 – 5.1ch" AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 10 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Grouping Example 19 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What’s New: BCP -003 (Security) 20 BCP -003 -01 Uses Transport Layer Security (TLS) in order to encrypt communications between API servers and their clients (https) BCP -003 -02 (Work In Progress) covers client authorization for the NMOS APIs. AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 11 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What’s New: IS -10 (Authorization API) •Accompanies the BCP -003 -02 specification to restrict what users are authorized to change in an NMOS system. •Work in Progress I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What’s New: IS -10 (Authorization API) 22 Exposes /register_client endpoint Discoverable using unicast and/or multicast DNS using the '_nmos -auth._tcp' service name Requires the use of TLS when sending requests using password authentication (https) AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 12 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Public Key Infrastructure (PKI) •A set of roles, policies, and procedures needed to create, manage, distribute, use, store & revoke digital certificates and manage public -key encryption 23 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 NMOS BCP -003 -02 Example Broadcast Controller IP Source Authentication Server IP Destination Auth Request (OAuth) Token (JWT) Essence Flow (2110) Activation (JWT) Activation (JWT) Public Key 24 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 13 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Core Technologies 25 PKI (Public Key Infrastructure) HTTPS (http over TLS) Connection Security (Encrypted Control Signals) REST (HTTPS PUT & GET) JSON (Key -Value Parameter sets) OAuth 2.0 (Open Authorization) Clients Authenticate with Authentication Server JWT (JSON Web Token) Client Authorization (issue access tokens) – RSA with SHA -256 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 NMOS Security Goals 26 Confidentiality - Data passing between client and the APIs is unreadable to third parties. Identification - The client can check whether the API it is interacting with is owned by a trusted party. Integrity - It must be clear if data travelling to or from the API been tampered with. Authentication - The client can check if packets actually came from the API it is interacting with, and vice versa. AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 14 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 NMOS Cipher Suite •TLS ECDHE ECDSA WITH AES 128 GCM SHA256 •TLS ECDHE ECDSA WITH AES 256 GCM SHA384 •TLS ECDHE ECDSA WITH AES 128 CBC SHA256 •TLS ECDHE ECDSA WITH AES 256 CBC SHA384 •TLS ECDHE RSA WITH AES 128 GCM SHA256 •TLS ECDHE RSA WITH AES 256 GCM SHA384 •TLS DHE RSA WITH AES 128 GCM SHA256 •TLS DHE RSA WITH AES 256 GCM SHA384 •TLS ECDHE RSA WITH AES 128 CBC SHA256 •TLS ECDHE RSA WITH AES 256 CBC SHA384 •TLS DHE RSA WITH AES 128 CBC SHA256 •TLS DHE RSA WITH AES 256 CBC SHA256 •TLS ECDHE ECDSA WITH AES 128 CCM 8 ======= Minimum Requirement Johnny Quest Decoder Ring: TLS = Transport Layer Security ECDHE = Elliptic Curve Diffie -Hellman Ephemeral KE ECDSA = Elliptic Curve Digital Signature Algorithm AES = Advanced Encryption Standard (#bits) GCM = Galois/Counter Mode CBC = Cipher Block Chaining (XOR) SHA = Secure Hash Algorithm (#bits) CCM = Counter with CBC -MAC (Cyber Block Chaining Message Authentication Code) 27 Optionally Encrypted Video/Audio/ USB Secure Control User Authentication Customer Case Study – Secure KVM 28 SYSTEM MANAGER 1 Gb/s Switch Fabric RX GW RX GW RX GW RX GW RX GW TX GW TX GW TX GW TX GW Remote Monitor RX GW TX GW TX GW SERVERS/Workstations SDI Sources AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 15 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Summary 29 NMOS IS -04 & IS -05 are solid, stable, and mature They are employed in most all new SMTE 2110 products New features like IS -08 (Audio Mapping), IS -09 (System Discovery), and BCP -002 (Grouping) take NMOS to a new level, surpassing the level of control provided in SDI BCP -003 (Security) adds a layer of security that has been sorely needed in control systems for quite some time NMOS is the glue that holds an ST -2110 environment together and enables extraction of new business value I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Thank you Thank you to our Media Partners Jed Deame , Nextera Video sales@nexteravideo.com , 650 -600 -9686 30