DPI holds promise as content protector

(Read Part One of this story here.)

Although deep packet inspection (DPI) technology has become controversial as a means for service providers to offer tiered services or base the way they treat Internet traffic on the nature of the application, continued developments in this arena are a strong indication that DPI is likely to become more important to network operators in the coming years.

One reason is that the proliferation of video on the Internet in many different forms has spawned two distinct trends, both of which lead to a need for knowing more about what type of packets are traversing the Internet.

First, the fact that there is more diverse traffic and much more commercial video traffic on the Internet is rapidly driving the need for higher quality Internet video. Watching jerky YouTube videos is one thing; viewing episodic TV on the computer is another. Second, there are growing concerns about video piracy and the ability to ship illegal content, now in digital format, rapidly around the Internet.

There is general agreement that the latest generation of DPI systems offers service providers a means to ensure application-level quality of service. In its recent report, the Yankee Group demonstrated how DPI can be used to introduce tiered subscription models that would both increase their revenue and enable them to offer users a better video or gaming experience.

“The focus will be on the services that have the most demand,” said Azi Ronen, executive vice president of corporate development at Allot Communications, which makes DPI technology. “In Asia, that is gaming. In the U.S., it is TV-related services. This is not only about IPTV as the classical replacement for cable. There are also lots of other sources and sides and services that provide you with video – Joost and others – that are trying to compete with the other TV services on a different method, on a different technology and a different business model.”

As those service proliferate, Ronen reasons, consumers and content providers will be looking for ways to guarantee the quality of their video. “You may find a coalition between the network provider and one of those providers of content like Joost,” he said. “The network provider may say, ‘We will offer Joost as an IPTV-like solution to our customers, and to do that, we will use DPI equipment that will identify Joost and prioritize that traffic so people will get it at a higher quality over our network. Someone has to pay something here for this priority to take place – the infrastructure is expensive, so if you wish to have a higher quality of service than the network’s native service, someone will pay.”

Ronen believes consumers will be willing to pay, if it means their gaming service or their video service is of a guaranteed quality. He and others believe that the current controversy in the U.S. around the notion of tiered services is likely to dissipate as more advanced services are delivered over the Internet.

There is less controversy thus far but also no complete agreement about how DPI can be used to prevent content piracy, although many see the potential for combining the technology with digital watermarking, which imprints content with an invisible signal that identifies the last legal user of the content. AT&T uses DPI as one layer of its IPTV security solution today, but the company doesn’t want to publicly discuss details of that.

As for digital watermarking, Paul Whitehead, executive director of Advanced Access Technology at AT&T, says the company is interested but believes “there is substantial work that needs to be done in a lot of industry forums. This is not something we’ve currently implemented and not that close.”

The technology could be used in this fashion, though it isn’t being done today.

“If you mark your content, which is easy to do, then with DPI you have the capability to look at every packet, figure out what stream that packet is part of, from thousands of streams, then use DPI to look for those watermark signatures and compare them to what the subscriber is watching,” said Mike Coward, chief technology officer at Continuous Computing. “We can do this today, but it is a fairly compute-intensive task.”

Over time, he said, all content is likely to be watermarked, and DPI can be used to protect against casual piracy, but there may be better market-based approaches to handling the problem.

“If you can get all the content you want when you want it for a price you are willing to pay, some of the motivations for piracy really decline,” he said.

There is also technology required beyond DPI in order to do real content protection, said Kurt Dobbins, CEO and founder of Ellacoya, an early player in the DPI space. “Technology-wise, it is possible to interface with payment systems or back office systems or, in the case of IMS, policy-charging and enforcement functions,” he said. “If they have DPI to authorize whether to allow a session to start and enforce that, it is possible. But there is a lot of technology involved beyond DPI.”

Ellacoya customers today are using its DPI systems to do QoS for video on demand delivery over IP, he added. “We could also protect that service to make sure only subscribers in the VoD service plan have access to that, and then we can also count usage.”

Tom Donnelly, executive vice president of marketing and sales for Sandvine, which does IPTV security, agrees that DPI “is part of the answer to pirated content.”

“One part of it is identification of certain conditions and different digital rights management tools like watermarking, which marks something as legitimate versus traffic which may not bear the mark,” he said. “DPI is very good at identifying conditions or applications which have evasive characteristics. It uses quite complex analysis to make an accurate identification of what is happening. It can be married to DRM techniques to trigger action regarding a specific payload. But by and large, it is more orchestrated to classes of traffic – voice, video and gaming, for instance, have different requirements and different relative value to the end user.”

There is also the law enforcement angle to be considered. Although DPI and digital watermarking can be used to identify the last legal user of content that has been pirated, the next step is for someone – likely the content owner – to work with law enforcement to crack down on the specific pirates. There is no standardized mechanism for doing that today, and the IPTV Interoperability Forum, which is part of ATIS, has not yet gotten to that topic, according to its chair, Dan O’Callahan of Verizon.

Because DPI can look for unusual behavior in the network, Coward said, it is the right place at which to detect certain problems, such as spoofing, where a hacker pretends to be a subscriber or pretends to be a content server and forces content onto a set-top box.

“DPI can detect that because it doesn’t expect packets to be going from one subscriber to another, so it will pick up that traffic,” he said. “What if I program my set-top box to send a million channel changes a second – that’s the simplest kind of attack. All of a sudden, no other subscribers can change channels.”

DPI can pick up that unusual behavior, tear apart the packets and see if it conforms to expected packet types. “If not, it can throw that traffic away or raise an alarm,” he said.