Print this page as document

Recommendation: security backup for (D)KDMs

Affects all Users of easyDCP KDM Generator+

This page contains:

1 Licenses and Certificates

2 Threat of loss of all (D)KDMs caused by hardware change / fault

3 Create a Backup machine using a Complimentary License

4 Workflow Description

4.1 Standard (D)KDM Generation Process

4.2 Recommended Workflow utilizing a Backup Unit (BU)

4.3 Using the Backup Unit to recover (D)KDMs

5 How to activate your complementary license for easyDCP KDM Generator+ Backup

1 Licenses and Certificates

In order to run properly, each installation of easyDCP KDM Generator+ needs three different sets of files issued separately for each installation:

1. License – enables all commercial features
2. Signer Certificates – required to digitally sign (D)KDMs issued with the software
3. Server Certificates – An identification of the particular hardware easyDCP KDM Generator+ is installed on. (D)KDMs are issued for certain Server Certificates

During the activation process all of those files are generated using appropriate functions in the easyDCP web shop at http://www.easyDCP.com. Licenses and Server Certificates are bound to the particular hardware easyDCP KDM Generator+ is running on. Signer certificates are not tied to the hardware.

2 Threat of loss of all (D)KDMs caused by hardware change / fault

Important: If some hardware components in the production machine are changed or the machine stops operating at all, the license and server certificates will not work anymore. Using the migration function in the easyDCP web shop, a license can be ported to another machine. However, a server certificate cannot be used on another hardware. Likewise, it is not possible to re-use the certificates if certain hardware components get replaced on the system. And once the server certificates cannot be used anymore.

ALL (D)KDMs ISSUED FOR THESE SERVER CERTIFICATES ARE LOST AND CANNOT BE RECOVERED.

3 Create a Backup machine using a Complimentary License

We recommend our easyDCP KDM Generator+ customers to set-up a second computer serving as backup machine for their (D)KDMs. If used properly, existing (D)KDMs can be recovered and ported to a fresh installation, in case the production machine is not working anymore. The set-up is simple and your existing (D)KDM workflow requires only small changes.

1. Every easyDCP KDM Generator+ client gets a complimentary license for a second installation of the software (called the Backup Unit - BU)
2. From now on, we recommend to issue a backup DKDM for the Backup Unit once you receive a (D)KDM for your production system. For this, it is important that the Backup Unit must be installed on another physical hardware.
3. Once the production machine stops working for some reason, all (D)KDMs can be recovered using the Backup Unit.

NOTE: You can use your existing easyDCP KDM Generator+ instance to issue backup-(D)KDMs of your existing (D)KDMs for your new backup easyDCP KDM Generator+ instance. This is a one-time-only job and should be performed as soon as possible.

4 Workflow Description

This chapter gives an overview over the recommended workflow when using two instances of easyDCP KDM Generator+ in parallel.

Figure 1 shows a block diagram comprising two activated instances of the software, both identified by their Server Certificate. As mentioned above, the Server Certificate is bound to a specific hardware and installation of the operating system and cannot be used on another installation.

Figure 1: Two activated instances of easyDCP KDM Generator+ running on different hardware

4.1 Standard (D)KDM Generation Process

Figure 2 shows one of the common applications using easyDCP KDM Generator+. Here, the Main Unit (MU) receives certain input data:

1. A (D)KDM or easyDCP Digest from either the previous DCP compiling step or from another facility (step 1). An input (D)KDM can only be processed if it has been issued to the Server Certificate of the MU (compare Figure 1).
2. Certificates from various Cinema Servers that serve to identify the output (D)KDM’s recipients (step 2).
   
   

Figure 2: Standard KDM generation process using one installation of easyDCP KDM Generator+

As result easyDCP KDM Generator+ generates a batch of KDMs for the selected Cinema Servers (step 3).

4.2 Recommended Workflow utilizing a Backup Unit (BU)

Based on the workflow described above, we recommend generating a Backup DKDM for the Backup Unit (BU) shown in Figure 1 whenever a new key is used as input format (step 1). Basically, the processing-steps are identical to the description given in 4.1, but instead of only ingesting certificates from the Cinema Servers we also point our Main Unit of easyDCP KDM Generator+ to the Server Certificate of our Backup Unit (Figure 3, step 2). By doing this, easyDCP KDM Generator+ issues a Backup DKDM that can be read from the Backup Unit later. In case the MU is not available anymore, the Backup KDM can be used to recover the original keys that were used to encrypt the DCP.

Figure 3: KDM Generation Process using the Backup Unit (BU)

4.3 Using the Backup Unit to recover (D)KDMs

In case of a hardware crash or when the system components used to assemble the Main Unit’s system hash change, it is possible that the Server Certificates of the Main Unit cannot be accessed anymore. In this case it is possible to move the main unit onto a new hardware or issue a new set of license and certificates for the new configuration of the main unit. In any case, the previous Main Unit’s Server Certificates must be replaced. Through the easyDCP-web shop it is possible to get new licenses and certificates on the fly. Indeed, none of the old (D)KDMs of the former Main Unit (MU) will work with the new installation, called New Main Unit (NMU) here, since the new Main Unit is identified by a new Server Certificate. In order to get (D)KDMs working on the NMU it is necessary to use the BU as shown in Figure 4. Please note that the BU of KDM Generator+ is used instead of the MU.

Figure 4: Issuing DKDMs for the New Main Unit (NMU) using the Backup Unit (BU)

By ingesting both, all Backup-KDMs (1) as well as the Server Certificate from the New Main Unit (NMU – step 2) new DKDMs for the New Main Unit are generated.

5 How to activate a complementary license of easyDCP KDM Generator+ Backup

Step 1. Download the easyDCP KDM Generator+ Installer for your target OS from your license status again and install it.

Step 2. Request a license and certificate and send it as usual to www.easyDCP.com (see also:How do I activate my easyDCP Product?.) 

Step 3. www.easydcp.com will offer you: "Activate your complementary license". Select it for activation.

Now your license status shows a new entry called: "easyDCP KDM Generator+ Backup"

Step 4: Download the license and certificate data set and import it into your easyDCP KDM Generator+ Backup system. 

NOTE: The complementary license is locked for migration. If you need to migrate your easyDCP KDM Generator+ Backup system please contact us at info@easyDCP.com. 

One easyDCP software license can be installed only on one computer system.

However, if you need to move the easyDCP license to another computer or operating system you can do this easily using Migration function in the web shop:

1. Login in your account at www.easyDCP.com
2. Select license status
3. Select the product you need to migrate
4. Select: "migrate license"
   
   

easyDCP Resolve Plug-In customers can get additional important informations for migration here. 

After the migration is complete you can generate a new license for the new ware system. Please refer to the following FAQ on how to activate your product.

• How to activate my easyDCP product?
• How to activate my easyDCP Resolve Plugin?
• You find a video tutorial easyDCP from V3.6 - Software Activation Tutorial here.

Note:

• There is a limit of one automatic migration in six months. If you require a second migration within the six months period, please inform us via email why it´s necassary.
• Since server certificates are tied to the system hash, they become inaccessible after a migration. New certificates will be automatically created, but all KDMs issued to the old cerificates will no longer be accessible. Please check our FAQ: Server- and Signer- Certificates.

Migration with older Versions: For version easyDCP Creator(+)2.1.X and older, easyDCP Player(+)1.9.X and older, and easyDCP KDM Generator(+)1.47 and older, be prepared to use the new hashcode of your target hardware/software.

Update easyDCP KDM Generator + 1.4.411 to version 4.0

• With the update to the new version 4.0, there is also a major update of the easyDCP KDM Generator+ for the first time.
• The update is available for customers with valid service.

In principle, the new programs can be operated with the new Online Activation or with the Offline Activation:

• With Online Activation, new server certificates must be issued for technical reasons.
• In order to be able to continue using exhibited DKDMs, we recommend to use the new easyDCP KDM Generator + 4.0 in Offline Activation on the same hardware as the previous easyDCP KDM Generator + 1.4.11.

With Offline Activation, please note that the password is required which was set during the creation of the license and certificate request for the previous server certificates.

And this is how you find your new easyDCP KDM Generator+ 4.0:

1. Login to the webshop www.easydcp.com as usual.
   
   
2. Select My Products in the top menu.
   
   
3. You will find a new section: Single Licenses 
   Besides easyDCP licenses up to Version 3.8.9 (without service) and easyDCP plugin licenses, you can also find your new easyDCP KDM Generator+ 4.0 license. 
   
   
   
   
4. When you select a desired easyDCP Plus / IMF Studio application entry, a submenu opens. Here you can select different services like e.g. download, migration and activation.
   Available services depend on the type and the status of the license. 

As part of the conversion to the easyDCP Plus and IMF Studio packages, we have migrated your easyDCP KDM Generator+ 1.4.411 (with valid service) to Version 4.0 as Single License. You can find an overview of your previous licenses in My Products after the section Single Licenses with the button Previous Licenses.

Complementary License

To generate a complementory license of your new easyDCP KDM Generator+ 4.0, please activate it with Offline Activation as described here and follow the steps described in How to activate a Complementary License.

If you have already worked with a Complimentory License in Version 1.4.411, please activate the new complimentory license from your new easyDCP KDM Generator+ 4.0 with Offline Activation on the same hardware as the previous Complimentory License. 
Then the existing certificates will be adopted.

With the new version easyDCP Creator+ 3.7.3 or higher, a significant increase in performance for Windows systems in GPU mode could be achieved with maximum values of up to 125fps.

System 1:

• Intel Core i9-9900K @ 3.60GHz 8 Cores
• 16 GB RAM
• Samsung SSD 970 EVO 1TB (NVMe M.2 SSD)
• NVIDIA GeForce GTX 1060 6GB 

System 2:

• AMD Ryzen Threadripper 2950X
• 64 GB RAM
• Samsung SSD 860 EVO 1TB
• NVIDIA GeForce RTX 2080 

System 3:

• AMD Ryzen 9 3900X 12-Core
• 32 GB RAM
• Samsung SSD 970 Pro 1TB (NVMe M.2 SSD)
• NVIDIA GeForce RTX 2080 Ti

Test results

The following settings were used in easyDCP Creator+ 3.7.3:

• Color Transform: RGB BT.709 nach XYZ (DCI)
• Maximum Bitrate: 250 Mbit/s

The source image material and the destination folder were in all cases on an SSD, if possible on an NVMe SSD.

Basically there are two different options for running easyDCP Player.

1. Real-time-playback using a fast CPU.

Allows for real-time-playback of 2k/4k DCP and IMF-Packages on a standard PC/Mac. Use this option if you have a sufficiently fast CPU. The software codec will work on Mac OS X and Windows 7 and higher.

Minimum system specification:

• 6-core CPU
• At least 4 GB of RAM
• Graphics device with at least 500 MB memory attached to monitor (primary graphics card)
• Fast hard disk is also recommended

2. Real-time-playback using a Graphics Processing Unit (GPU) as accelerator.

Allows for real-time-playback of 2k/4k DCPs and IMF-Packages *) on a standard PC.
*) limited to lossy with code block size 32x32

This option requires two graphics cards:

1. GPU: Primary device for rendering (OpenGL) to which the display is attached.
2. GPU: Secondary CUDA-enabled device for the JPEG 2000 decompression.

Minimum system specification:

• 4-core CPU
• 1x primary graphics device attached to monitor
  
  • recent NVIDIA GeForce or Quadro series graphics device
  • at least 1 GB VRAM
  • preferably connected with 16 PCIx lanes
• 1x secondary graphics device not attached to monitor
  
  • NVIDIA GeForce with at least 500 CUDA cores
  • least 2 GB of VRAM
  • preferably connected with 16 PCIx lanes
• At least 4 GB RAM
• Fast harddisk/SSD is also recommended

The GPU-accelerated codec is only available for Windows, not for Mac OS X.

3D Video output options:

For best stereo video output, we recommend a NVIDIA Quadro device with at least 2 GB memory (e.g. Quadro K600). When using Nvidia 3D vision, the display needs to have a refresh rate of at least 120 Hz (e.g. Acer GD245QH). Alternatively, a 3D projector can be connected via Dual-DVI. This does not require a professional Nvidia Quadro card, but can also be achieved with a NVIDIA GeForce card.

Furthermore, a 3D LCD can be connected via HDMI or DVI to play out stereo in side-by-side/top-and-bottom/line-by-line or other interleaved modes.

HD-SDI output option:

easyDCP Player supports Blackmagic Design UltraStudio oder DeckLink series output devices.

When Option HD-SDI "enable subtitling, color processing and scaling" is enabled, decoded images will first be processed by the primary graphics card, before they get sent to the SDI-output device.

This works best, when the primary graphics card is a NVIDIA Quadro card. 

View our performance test:

The procedure is different in every country. We can't send you the certificates.

• The best way is to ask the cinema owners directly. They should have current certificates of their projection systems in their screening rooms or tell you the model and serial number.
• Another option is to contact the server manufacturer directly.
• If you have the model and serial number, you can contact the server manufacturer and ask for access to their database.

easyDCP Creator+, easyDCP JPEG 2000 Transcoder are highly optimized for running on multi-processor/multi-core machines. On Windows and from easyDCP Creator(+) 3.3.X can also use one or more CUDA® enabled graphics devices.

We recommend the following minimal system configuration:

• Windows PC (Windows 64 bit, Version 7 or higher) or Intel Mac (Mac OS X 64 bit, Version 10.7 or higher)
• You also need a minimum of 2 GB RAM
• Installation occupies 200 MB free disc space
• Fast hard disk is also recommended

For best performance, opt for the following specifications:

• CPU with 6 cores or more
• 8 GB RAM
• Fast SSD
• A CUDA-enabled graphics device for encoding with the following specifications:
  
  • Compute Capability 2.0 or higher
  • Minimum of 1 GB memory, better 4 GB of memory
  • Preferably connected with 16 PCI Express lanes
  • The more cores, the better
  • E.g. NVIDIA GeForce 980 Ti