About Adobe Pass Authentication and TV Everywhere about-auth-tve

About TV Everywhere about-tve

Today’s television viewers can go online at any time or place, and they expect their ability to access Pay TV content to be right there with them. In addition, audiences are viewing content using an ever-increasing range of Internet­‐capable devices, including:

TV Everywhere is the industry movement that supports the ability of Pay TV subscribers to access the same content that they are already paying for, across multiple devices, both in and out of their homes. While the bulk of television viewing is still occurring on conventional, linear TV, the growth in consumption is in time-­shifted content, online video, and alternative screens. As a result, the video distribution market today is in a state of disruption, and TV Everywhere has emerged as the solution that aligns the interests of Programmers, Pay TV providers, and Pay TV subscribers.

The technical goal of TV Everywhere is to enable Pay TV customers to access content that they already subscribe to on all of their devices and platforms.

The business goals of TV Everywhere are to:

TV Everywhere Challenges tve-challenges

Along with the opportunities of TV Everywhere come challenges. At the heart of these is entitlement. Before a viewer accesses subscription content, someone has to determine whether they are entitled to that access.

Does the user have a subscription with a Pay TV provider? If so, does that subscription include the content that is being requested? Entitlement is especially difficult for Programmers and content owners to directly determine, because it is the Pay TV operators that have the identifying data for their customers, as well as their customers’ access privileges.

Beyond entitlement are a host of related technical and integration challenges, including:

These challenges make performing and maintaining complex, direct integrations between Programmers and the authentication systems of multiple Pay TV providers highly resource intensive, requiring time and technical sophistication.

The solution? Adobe® Pass Authentication.

Introduction to Adobe Pass Authentication authentication-intro

With Adobe Pass Authentication, Programmers and Pay TV providers only need to do a simple integration, using Adobe Pass Authentication APIs, to get access to the whole ecosystem, including:

In addition, Adobe Pass Authentication provides the framework that makes user authentication and authorization simple and secure.

Figure 1: Just some of the Programmers and Pay TV providers who connect through Adobe Pass Authentication…

Adobe Pass securely mediates entitlement transactions between Programmers and Pay TV providers, facilitating viewer access to subscription content. Or, in other words…

Adobe Pass Authentication makes it easy and quick for the right customers to access the right content.

Who is Adobe Pass Authentication for?

For Programmers, Adobe Pass Authentication provides:

For Pay TV providers/MVPDs, Adobe Pass Authentication provides:

For Pay TV customers, Adobe Pass Authentication provides:

The rest of this paper provides a technical introduction to Adobe Pass Authentication. While much of the following focuses on Programmer integration, there is both general and specific information that applies to Pay TV providers, as well. This document also highlights the security and integrity of how Adobe Pass Authentication functions as a solution for TV Everywhere. For further details beyond this paper, contact your Adobe representative or fill out the Request for Information form here.

Architectural Building Blocks arch-building-blocks

The following discusses the central entitlement transactions of authentication and authorization. Authentication is the process of confirming with a Pay TV provider that a given user is a known customer. Authorization is the process wherein a Pay TV provider confirms that an authenticated user has a valid subscription to a given resource.
Adobe Pass Authentication consists of the following basic components:

At a basic level, Adobe Pass Authentication consists of three components (the Access Enabler, Adobe-hosted backend servers, and the Media Token Verifier) and a central item of exchange (tokens).

Client Components client-components

Access Enabler access-enabler

On fully supported platforms (including the Web, iOS, Android, Windows 8), Programmers interact with Adobe Pass Authentication via the Access Enabler client component. This component facilitates all authentication and authorization interactions with the customer. The Access Enabler runs locally on their system. When a user accesses a Programmer site or application and requests content, the Adobe-hosted/maintained Access Enabler component is silently loaded in the background.

The Access Enabler handles the actual entitlement workflows, while the Programmer maintains responsibility for the higher-level web page or player application that implements the user interface and interacts with the Access Enabler. These interactions are via an asynchronous system of functions and callbacks, defined by the Access Enabler API.

These are the basic entitlement flows, easily implemented using the Access Enabler API:

The Access Enabler also provides the following services:

Depending on your website or player application, the Access Enabler can take the following forms:

Clientless API clientless-api

The Clientless API approach is for “smart devices” (game consoles, set-top boxes, and Smart TVs) that do not support web browsers (required for authentication with MVPDs). In the clientless approach, smart device apps communicate directly with Adobe Pass Authentication through RESTful web services APIs for everything except authentication, which is performed on a second screen (browser) app. In other words, the Access Enabler client-side library is not used. Instead, developers of smart device apps directly consume the Adobe Pass Authentication web services APIs to implement the entitlement flows.

Adobe-hosted Backend Servers adobe-backend-servers

The Adobe Pass Authentication backend servers, hosted by Adobe:

Tokens and the Media Token Verifier tokens-media-token-verifier

The Adobe Pass Authentication entitlement solution centers on the generation of specific pieces of data that are obtained upon the successful completion of authentication/authorization workflows. These pieces of data are called tokens. They have a limited lifespan and are stored securely, either in platform-dependent locations on the client, or on Adobe servers in the case of the Clientless API solution. Upon expiration, tokens must be re-issued through the re-initiation of the authentication and/or authorization workflows.

There are three types of tokens that Adobe Pass Authentication issues during the authentication/authorization workflows. Two are “long-lived,” providing continuity in the user’s viewing experience. The third, a short-lived token, provides support for industry best practices for mitigating fraud (where fraud includes exploits such as stream ripping, for example). The time-to-live (“TTL”) values are set based on agreements between Programmers and Pay TV providers, who agree on a value that best serves everyone involved.

(Long-Lived) Authentication Token long-lived-auth-token

Authentication success occurs once a customer uses Adobe Pass Authentication to successfully log in to their Pay TV account. Adobe Pass Authentication then produces a long-lived authentication (AuthN) token tied to the requesting device and (depending upon the Pay TV provider) a globally unique identifier (“GUID”) that anonymously identifies the user.

(Long-Lived) Authorization Token long-lived-authriz-token

Upon successful authorization, Adobe Pass Authentication creates a long-lived authorization (“AuthZ”) token. This token is not portable, as it is tied to the requesting device and a specific protected resource (for example, a channel, series, or episode).

Short-Lived Media Token short-lived-media-token

Once Adobe Pass Authentication generates the AuthZ token, it uses that token to generate a single-use, short-lived media token that is signed by Adobe and encrypted to avoid tampering during exchange:

Media Token Verifier media-token-verifier

Programmers are responsible for integrating the Media Token Verifier Library into their existing application server, so that the Verifier can perform the final user validations before a video stream is actually started. The Media Token Verifier library defines:

Figure 2: High-level architecture of the Adobe Pass Authentication ecosystem in an Access Enabler integration

Integrate with Adobe Pass Authentication integrate-auth

Whether you are a Pay TV provider or Programmer, the process of integrating with Adobe Pass Authentication requires some amount of your active participation. Each of these processes is described below.

The Pay TV Provider Process

The Pay TV provider’s primary responsibility with Adobe Pass Authentication is to validate that a requesting user is indeed a known subscriber who is entitled to access the Programmer’s content. At a high
level, the Adobe Pass Authentication process for integrating with a new Pay TV provider requires the following steps:

While Adobe Pass Authentication may replace existing integrations for Programmers, this is typically not required for Pay TV providers. Adobe works with the provider’s technical team to configure Adobe Pass Authentication to meet the needs of any existing integrations. Integration is free of charge for Pay TV providers, assuming a “standard” integration and minimal support requirements (documentation and basic email support). If a provider requires significant support or an escalated timeline, a support fee may be charged or the provider may want to work with a third party familiar with our solution such as Synacor.

Adobe Pass Authentication also supports the efficient handling of Pay TV provider business logic, as follows:

Adobe also offers fraud-limiting services. Contact your Adobe representative for details.

The Programmer Process programmer-process

To successfully integrate Adobe Pass Authentication, Programmers must set up their media player application or web page to work with Adobe Pass Authentication in handling the core entitlement processes: authentication, authorization, and logout.

Prior to beginning an integration with Adobe Pass Authentication, Programmers should have:

Programmers should expect to perform some integration tasks as part of providing TV Everywhere services with Adobe Pass Authentication. These tasks include:

This paper provides an overview of the Programmer process, and Adobe provides additional guidance upon formal initiation of the integration.

Requestor (Programmer) Setup requester-prog-setup

Registering with Adobe registering

As a first step, Programmers must register with Adobe or an Adobe-authorized partner and specify the domains that they want to use with Adobe Pass Authentication. Programmers then receive a unique requestor ID, which is supplied to Adobe Pass Authentication for each session in which the Programmer interacts with the Access Enabler.

Setup For Initial Access Enabler Integration access-enabler-int-setup

Prior to any customers requesting access to content, Programmers must integrate the Adobe Pass Authentication client component – the Access Enabler – into their existing media player app or web page. There are various options as to how to do this:

Setup for Initial Clientless API Integration clientless-api-int-setup

Prior to any customers requesting access to content, Programmers must implement the RESTful web services calls using the Clientless API into their media player app, as well as set up a “second-screen” application to handle the user’s log in to their Pay TV Provider over the web.

Handling Authentication and Authorization auth-authr-handling

When a customer requests a protected resource from a Programmer for the first time, the Programmer presents the customer with a list of Pay TV providers from which to choose. When the provider is selected, the user is redirected to that operator for initial user authentication. Once authentication succeeds, Adobe Pass Authentication communicates with the selected Pay TV provider to authorize access to the specified resource. Details on these processes follow.

Figure 3: Example provider-selection UI

Programmer Communication using the Access Enabler

The two-way communication channel between the Access Enabler and the Programmer’s web page or player app follows a fully asynchronous pattern. The Programmer sends messages to the Access Enabler through the methods exposed by the Access Enabler API. The Access Enabler responds via callbacks that are registered with the Access Enabler library.

Programmer Communication Using the Clientless API progr-comm-clientless-api

Communication between the Programmer’s app and Adobe Pass Authentication is via RESTful web services. There are security protocols in place for all API calls to the Adobe Pass Authentication endpoints. Security requirements are described in the Clientless API documentation.

Sample Workflow With SAML Web Browser SSO-based Authentication sample-wf

Figure 4: Authentication and authorization Access Enabler workflow

Providing an Entitlement User Interface entitlement-ui

Programmers must create their own UI for the access workflow into their website or app. Some elements, such as the actual login process, are provided by the Pay TV provider, and some elements are optionally available as part of Adobe Pass Authentication. At minimum, the Programmer does the following:

Supporting Single Logout single-logout-support

In most cases, the Programmer is responsible for handling user logouts via a simple API call. The logout() call directs Adobe Pass Authentication to log out the current user by:

If the user leaves their machine idle for enough time that their tokens expire, they can still return to their session and successfully initiate logout. Adobe Pass Authentication ensures that all tokens are deleted and notifies the Pay TV provider to delete their session, as well.

When the logout is initiated from a site that isn’t integrated with Adobe Pass Authentication, the Pay TV provider can invoke the Adobe Pass Authentication Single Logout service through a browser redirect.

Beyond the Basic Entitlement Flows - Additional Features beyond-basics

The basic entitlement flows are Start-up, Authentication, Authorization, and Logout. As Adobe Pass Authentication matures and develops, a number of additional features have been and are being added to the basic flows. These include:

Security security

This section highlights the security and integrity of the Adobe Pass Authentication infrastructure.

Token Security token-security

One of the primary goals of Adobe Pass Authentication is ensuring that the system can withstand attacks on the content entitlement data by a rogue user or content aggregator. Therefore, data access is secured at different levels in the workflow, with protecting the generation and usage of the authorization token data having the highest importance. The Adobe Pass Authentication architecture is designed to ensure token contents are securely maintained and that the token remains on the device to which it was issued.

Platform-specific Device Security platform-sp-security

The security measures used by Adobe Pass Authentication vary by platform, but all are robust and state-of-the-art.

FAQ faqs

What is TV Everywhere?
The industry movement known as TV Everywhere enables pay TV customers to access the premium content they already subscribe to on a variety of Internet-connected devices, including personal computers, tablets, smartphones, game consoles, set-top boxes, and “Smart” TVs. The challenge of this initiative is to make the authentication process is as simple and painless as possible, allowing customers to smoothly access their subscription content without prohibitive barriers and multiple logins.

What is Adobe Pass Authentication, and how does it relate to TV Everywhere?
Adobe Pass Authentication takes TV Everywhere from concept to reality by smoothly verifying a user’s entitlement to content in a manner that is both simple and secure. Adobe Pass Authentication is a hosted service that allows rapid back-end integration based on the business rules required by both Programmers and Pay TV providers. This means a quick time to market for all parties, a more secure environment to prevent fraud, and a superior customer experience, with more TV content available to more people across more platforms.

How is Adobe Pass Authentication offered/delivered?
Adobe Pass Authentication is offered via the Software as a Service (SaaS) model. This enables more secure communication to take place between end users, Programmers, and Pay TV providers in order to validate entitlement to content. The core components of the service include the client-side Access Enabler (or the Clientless API for some devices) and the hosted Adobe Pass Authentication Server. The Access Enabler is a small file that is loaded into a Programmer’s web page or player application. It communicates with the Adobe Pass Authentication Servers, which in turn have connections built into the authentication systems of various Pay TV providers. Adobe Pass Authentication also offers a Clientless API approach to integration for some “smart devices” that aren’t web-capable (Smart TVs, Set-top Boxes, Game Consoles, etc.). The Clientless approach provides RESTful web services with which developers can implement the Adobe Pass Authentication entitlement flows on these devices.

How is Adobe Pass Authentication different from other TV Everywhere solutions?
Adobe Pass Authentication has distinct benefits over alternative TV Everywhere solutions. Direct integrations with individual providers do not provide the flexibility of a single, persistent login (SSO) as users travel from site to site across the Internet. Adobe Pass Authentication also has remarkable market penetration; once a Programmer integrates with Adobe Pass Authentication, they are immediately connected with Pay TV operators serving over 90% of the households in the United States. Additionally, Adobe Pass Authentication leverages unique security features built into the Flash runtime (where available) to help mitigate fraud, while also providing SDKs so that Programmers can have the same TV Everywhere functionality built into native apps for mobile or in-home devices where Flash is not available. Finally, while Adobe Pass Authentication is available as a standalone service, we also offer the option to have tight integration with other Adobe products and services (including Adobe Pass and Adobe Analytics) related to the delivery, protection, and monetization of TV Everywhere content.

How secure is Adobe Pass Authentication?
The number one priority of the Adobe Pass Authentication architecture is to ensure that only authorized viewers are authenticated and granted access to premium content. Adobe Pass Authentication tightly binds access to viewing device and can help to limit streams, sessions, and/or devices for a given household.

Is Flash Player required?
Adobe Flash Player 11.x or later is required for the strictest device binding security. However, Adobe Pass Authentication for TV Everywhere is player and platform agnostic, integrating with any playback application, including Silverlight and HTML5. Additionally, Adobe Pass Authentication provides native support for devices such as iOS, Android, and Xbox where Flash Player is not available. Finally, Adobe Pass Authentication provides a Clieintless approach for devices that are not capable of rendering web page (game consoles, Smart TVs, Set-top boxes).

Which devices does Adobe Pass Authentication support?
Adobe Pass Authentication is supported by virtually any device with the HTML5 web kit for in-browser viewing experiences. Additionally, Adobe Pass Authentication is continuing to roll out native software development kits (SDKs) for various device-specific platforms, including iOS, Android™, and Windows 8. Adobe Pass Authentication partially supports some non-web-capable devices (Smart TVs, Set-top boxes, game consoles, etc.) through its RESTful web services APIs.

Does Adobe Pass Authentication support the emerging standards for TV Everywhere?
Adobe Pass Authentication is compliant with the CableLabs OLCA (Online Content Access) specification, which provides technical requirements and architecture for the delivery of video to a Pay TV customer from online sources. Adobe participated in the joint CableLabs interopt testing project in June 2011 and passed the testing process for a Service Provider implementation. Adobe Pass Authentication is verified (complete and tested) against the OLCA specifications for authentication. The authorization component is completed, but testing verification awaits the release of the CableLabs testing environment (ETA Nov 2011).

Adobe is also an active member of the OATC (Open Authentication Technical Consortium) and participates in several of the subcommittees’ specification-drafting projects as part of that body.

How does Adobe Pass Authentication handle federated identity management/single sign-on (SSO)?
Adobe Pass Authentication allows you to provide customers with single sign-on (SSO) authentication and authorization, using back-channel (server-to-server) communication between Adobe Pass Authentication and participating Pay TV operators. So, with Adobe Pass Authentication, there’s no need for subscribers to log in again after their first authentication, for as long as that authentication is allowed by the Pay TV operator to persist. Typically this limit is set at 30 days. To accomplish this, Adobe Pass Authentication provides a common domain for authentication tokens for our customers. This authentication state information is available to all participating sites that are integrated with a given Pay TV operator.

Currently, most Adobe Pass Authentication integrations with Pay TV operators use the SAML protocol, one of the primary authentication standards. Adobe Pass Authentication acts as a proxy Service Provider in the SAML architecture and persists the SAML authentication response as a secure token in the Adobe common domain. Adobe Pass Authentication is SAML 2.0 compliant.

While Adobe Pass Authentication is typically used with SAML SSO solutions at this point, the Adobe Pass Authentication architecture abstracts any protocol specifics from the Programmer integration. Therefore, support for new protocols-such as one based on OAuth 2.0 or custom protocols-can be added over time.

How much does Adobe Pass Authentication for TV Everywhere cost for end users?
There is no additional cost to end users for use of Adobe Pass Authentication.