Print this page as document

Recommendation: security backup for (D)KDMs

Affects all Users of easyDCP KDM Generator+

This page contains:

1 Licenses and Certificates

2 Threat of loss of all (D)KDMs caused by hardware change / fault

3 Create a Backup machine using a Complementary License

4 Workflow Description

4.1 Standard (D)KDM Generation Process

4.2 Recommended Workflow utilizing a Backup Unit (BU)

4.3 Using the Backup Unit to recover (D)KDMs

5 How to activate your complementary license for easyDCP KDM Generator+ Backup

1 Licenses and Certificates

In order to run properly, each installation of easyDCP KDM Generator+ needs three different sets of files issued separately for each installation:

1. License – enables all commercial features
2. Signer Certificates – required to digitally sign (D)KDMs issued with the software
3. Server Certificates – An identification of the particular hardware easyDCP KDM Generator+ is installed on. (D)KDMs are issued for certain Server Certificates

During the activation process all of those files are generated using appropriate functions in the easyDCP web shop at http://www.easyDCP.com. Licenses and Server Certificates are bound to the particular hardware easyDCP KDM Generator+ is running on. Signer certificates are not tied to the hardware.

2 Threat of loss of all (D)KDMs caused by hardware change / fault

Important: If some hardware components in the production machine are changed or the machine stops operating at all, the license and server certificates will not work anymore. Using the migration function in the easyDCP web shop, a license can be ported to another machine. However, a server certificate cannot be used on another hardware. Likewise, it is not possible to re-use the certificates if certain hardware components get replaced on the system. And once the server certificates cannot be used anymore.

ALL (D)KDMs ISSUED FOR THESE SERVER CERTIFICATES ARE LOST AND CANNOT BE RECOVERED.

3 Create a Backup machine using a Complementary License

We recommend our easyDCP KDM Generator+ customers to set-up a second computer serving as backup machine for their (D)KDMs. If used properly, existing (D)KDMs can be recovered and ported to a fresh installation, in case the production machine is not working anymore. The set-up is simple and your existing (D)KDM workflow requires only small changes.

1. Every easyDCP KDM Generator+ client gets a complementary license for a second installation of the software (called the Backup Unit - BU)
2. From now on, we recommend to issue a backup DKDM for the Backup Unit once you receive a (D)KDM for your production system. For this, it is important that the Backup Unit must be installed on another physical hardware.
3. Once the production machine stops working for some reason, all (D)KDMs can be recovered using the Backup Unit.

NOTE: You can use your existing easyDCP KDM Generator+ instance to issue backup-(D)KDMs of your existing (D)KDMs for your new backup easyDCP KDM Generator+ instance. This is a one-time-only job and should be performed as soon as possible.

4 Workflow Description

This chapter gives an overview over the recommended workflow when using two instances of easyDCP KDM Generator+ in parallel.

Figure 1 shows a block diagram comprising two activated instances of the software, both identified by their Server Certificate. As mentioned above, the Server Certificate is bound to a specific hardware and installation of the operating system and cannot be used on another installation.

Figure 1: Two activated instances of easyDCP KDM Generator+ running on different hardware

4.1 Standard (D)KDM Generation Process

Figure 2 shows one of the common applications using easyDCP KDM Generator+. Here, the Main Unit (MU) receives certain input data:

1. A (D)KDM or easyDCP Digest from either the previous DCP compiling step or from another facility (step 1). An input (D)KDM can only be processed if it has been issued to the Server Certificate of the MU (compare Figure 1).
2. Certificates from various Cinema Servers that serve to identify the output (D)KDM’s recipients (step 2).
   
   

Figure 2: Standard KDM generation process using one installation of easyDCP KDM Generator+

As result easyDCP KDM Generator+ generates a batch of KDMs for the selected Cinema Servers (step 3).

4.2 Recommended Workflow utilizing a Backup Unit (BU)

Based on the workflow described above, we recommend generating a Backup DKDM for the Backup Unit (BU) shown in Figure 1 whenever a new key is used as input format (step 1). Basically, the processing-steps are identical to the description given in 4.1, but instead of only ingesting certificates from the Cinema Servers we also point our Main Unit of easyDCP KDM Generator+ to the Server Certificate of our Backup Unit (Figure 3, step 2). By doing this, easyDCP KDM Generator+ issues a Backup DKDM that can be read from the Backup Unit later. In case the MU is not available anymore, the Backup KDM can be used to recover the original keys that were used to encrypt the DCP.

Figure 3: KDM Generation Process using the Backup Unit (BU)

4.3 Using the Backup Unit to recover (D)KDMs

In case of a hardware crash or when the system components used to assemble the Main Unit’s system hash change, it is possible that the Server Certificates of the Main Unit cannot be accessed anymore. In this case it is possible to move the main unit onto a new hardware or issue a new set of license and certificates for the new configuration of the main unit. In any case, the previous Main Unit’s Server Certificates must be replaced. Through the easyDCP-web shop it is possible to get new licenses and certificates on the fly. Indeed, none of the old (D)KDMs of the former Main Unit (MU) will work with the new installation, called New Main Unit (NMU) here, since the new Main Unit is identified by a new Server Certificate. In order to get (D)KDMs working on the NMU it is necessary to use the BU as shown in Figure 4. Please note that the BU of KDM Generator+ is used instead of the MU.

Figure 4: Issuing DKDMs for the New Main Unit (NMU) using the Backup Unit (BU)

By ingesting both, all Backup-KDMs (1) as well as the Server Certificate from the New Main Unit (NMU – step 2) new DKDMs for the New Main Unit are generated.

5 How to activate a complementary license of easyDCP KDM Generator+ Backup

Step 1. Download the easyDCP KDM Generator+ Installer for your target OS from your license status again and install it.

Step 2. Request a license and certificate and send it as usual to www.easyDCP.com (see also:How do I activate my easyDCP Product?.) 

Step 3. www.easydcp.com will offer you: "Activate your complementary license". Select it for activation.

Now your license status shows a new entry called: "easyDCP KDM Generator+ Backup"

Step 4: Download the license and certificate data set and import it into your easyDCP KDM Generator+ Backup system. 

NOTE: The complementary license is locked for migration. If you need to migrate your easyDCP KDM Generator+ Backup system please contact us at info@easyDCP.com. 

Quick Installation Guide

Welcome to easyDCP!
Thank you for downloading easyDCP Plus, we are sure that this demo will convince you.

You can also install the program parts of easyDCP Plus individually or on different computers.

Installation instructions Windows

System requirements:

Windows 10 (64-bit)

Hardware requirements:

easyDCP Plus can be operated on any standard PC with at least 4 GB of RAM and 200 MB of free space.

Configuration recommendations:

You can also install the individual programs of the software suite in productive operation on different computers and platforms (Windows and MacOS). You can also install the individual program parts in parallel on several computers in order to use them alternately (license roaming).
For 2K DCP processing under Windows, we recommend a minimum configuration with a CPU with 6 cores or more, 8GB RAM and a fast HDD, RAID or SSD.  Performance improvements can be achieved through powerful CUDA-based GPUs. You can also find more information in the manual.

There is no special hardware recommendation for easyDCP KDM Generator+: All commercially available PCs are suitable for the creation of KDMs. There is no particular requirement for computing power.

Other installation instructions:

Different browsers or operating system security settings can trigger warnings during download or installation.
If you have downloaded the programs from www.easyDCP.com, you can run the installation without worries despite the hints.

 

Installation instructions macOS

System requirements:

macOS 10.14 or higher

Hardware requirements:

easyDCP program can be installed on commercial Apple Mac with a minimum configuration of 4GB and 200 MB HDD.
easyDCP programs on Macs with M1 processor are already compatible with Apple’s own emulation with known restriction in easyDCP Player+. 
Native M1 support is coming soon.

Configuration recommendations:

For 2K DCP processing under macOS, we recommend a minimum configuration with a CPU with 8 cores or more, 8 GB RAM and a fast HDD, Raid or SSD.

There is no special hardware recommendation for easyDCP KDM Generator+: All commercially available PCs are suitable for the creation of KDMs. There is no particular requirement for computing power.

Other installation instructions:

Different browsers or security settings in macOS can trigger warnings during download or installation. If you have downloaded the programs from www.easyDCP.com, you can run the installation without worries despite the hints.
Programs must be released at the first start in System Settings > Security > "Open Anyway".

Start in demo mode

To start the individual program demos please click below on „Demo/Offline Mode“.
Please leave the registration fields blank (these are only required in productive operation for registration for license roaming)

Getting Started

easyDCP Creator+

1. Please enter a title for your project
2. Here you can load existing DCPs
3. Here you can load video/audio and subtitle files for your first project
4. With Ctrl/T you can switch from Reel View to Timeline View and back

* In selection "Help" in main menu you will find a detailed manual for the easyDCP Creator+

Optional Tools and Samples:

• easyDCP JPEG2000 Transcoder
  With the Standalone Transcoder you can create JPEG2000 files from different formats DCI  
• Sample files for subtitles
• Sample files for 3D Lookup Tables
• on macOS: easyDCP Creator+ / FinalCutPro Bridge
  Install "Share" presets in Final Cut Pro for easyDCP Creator+

Find more help with questions about the performance assessment of easyDCP Creator+

Limitations in the demo version:  

• Visibly burned-in easyDCP™ logo in all frames
• No loading of (D)KDMs
  (for test encrypted DCPs, please use the proprietary DCP Digest)
• No Supplementals
• No validation report

---

easyDCP Player+

1. Load your DCP here

• In the top menu or right-click anywhere in the "Canvas" field to display the options

* In selection "Help" in main menu you will find a detailed manual for the easyDCP Player+

Optional Tools

• easyDCP DCP Player+ NE

Find more help with questions about the performance assessment of easyDCP Player+

Limitations in the demo version

• Reduced quality and muted audio after 15 seconds of playback
• No Export
• No loading of (D)KDMs (To test encrypted DCPs, please use the proprietary DCP Digest from Creator+)
• No validation report

---

easyDCP KDM Generator+

1. Here you can download the digest file or DKDM (not available in the demo version)
2. Here you can download the/the certificates of the KDM/DKDM receiver
3. Here you can switch to Advanced mode
 

* Under the selection "Help" in main menu you will find a detailed manual for the easyDCP KDM Generator+

Limitations in the demo version

• Maximum KDM validity of 2 days
• No loading of (D)KDMs (To test KDM generation, please use the proprietary DCP digest from easyDCP Creator+)

 

Licenses of easyDCP software prepared for offline mode can be installed only on one computer system.

Hint: Sometimes this method is required as well to solve license issues when the hashcode doesn't match to the previous license anymore. 

However, if you need to move the easyDCP license to another computer or operating system you can do this easily using Migration function in the web shop:

1. Login in your account at www.easyDCP.com
2. Select license status
3. Select the product you need to migrate
4. Select: "migrate license"
   
   

easyDCP Resolve Plug-In customers can get additional important informations for migration here. 

After the migration is complete you can generate a new license for the new ware system. Please refer to the following FAQ on how to activate your product.

• How to activate my easyDCP product?
• How to activate my easyDCP Resolve Plugin?
• You find a video tutorial easyDCP from V3.6 - Software Activation Tutorial here.

Note:

• There is a limit of one automatic migration in six months. If you require a second migration within the six months period, please inform us via email why it´s necassary.
• Since server certificates are tied to the system hash, they become inaccessible after a migration. New certificates will be automatically created, but all KDMs issued to the old cerificates will no longer be accessible. Please check our FAQ: Server- and Signer- Certificates.

Migration with older Versions: For version easyDCP Creator(+)2.1.X and older, easyDCP Player(+)1.9.X and older, and easyDCP KDM Generator(+)1.47 and older, be prepared to use the new hashcode of your target hardware/software.

Update easyDCP KDM Generator + 1.4.411 to version 4.0

• With the update to the new version 4.0, there is also a major update of the easyDCP KDM Generator+ for the first time.
• The update is available for customers with valid service.

In principle, the new programs can be operated with the new Online Activation or with the Offline Activation:

• With Online Activation, new server certificates must be issued for technical reasons.
• In order to be able to continue using exhibited DKDMs, we recommend to use the new easyDCP KDM Generator + 4.0 in Offline Activation on the same hardware as the previous easyDCP KDM Generator + 1.4.11.

With Offline Activation, please note that the password is required which was set during the creation of the license and certificate request for the previous server certificates.

And this is how you find your new easyDCP KDM Generator+ 4.0:

1. Login to the webshop www.easydcp.com as usual.
   
   
2. Select My Products in the top menu.
   
   
3. You will find a new section: Single Licenses 
   Besides easyDCP licenses up to Version 3.8.9 (without service) and easyDCP plugin licenses, you can also find your new easyDCP KDM Generator+ 4.0 license. 
   
   
   
   
4. When you select a desired easyDCP Plus / IMF Studio application entry, a submenu opens. Here you can select different services like e.g. download, migration and activation.
   Available services depend on the type and the status of the license. 

As part of the conversion to the easyDCP Plus and IMF Studio packages, we have migrated your easyDCP KDM Generator+ 1.4.411 (with valid service) to Version 4.0 as Single License. You can find an overview of your previous licenses in My Products after the section Single Licenses with the button Previous Licenses.

Complementary License

To generate a complementory license of your new easyDCP KDM Generator+ 4.0, please contact us with this form.

If you have already worked with a Complimentory License in Version 1.4.411, please activate the new complimentory license from your new easyDCP KDM Generator+ 4.0 on the same hardware as the previous Complimentory License. 
Then the existing certificates will be adopted.

With the new version easyDCP Creator+ 3.7.3 or higher, a significant increase in performance for Windows systems in GPU mode could be achieved with maximum values of up to 125fps.

System 1:

• Intel Core i9-9900K @ 3.60GHz 8 Cores
• 16 GB RAM
• Samsung SSD 970 EVO 1TB (NVMe M.2 SSD)
• NVIDIA GeForce GTX 1060 6GB 

System 2:

• AMD Ryzen Threadripper 2950X
• 64 GB RAM
• Samsung SSD 860 EVO 1TB
• NVIDIA GeForce RTX 2080 

System 3:

• AMD Ryzen 9 3900X 12-Core
• 32 GB RAM
• Samsung SSD 970 Pro 1TB (NVMe M.2 SSD)
• NVIDIA GeForce RTX 2080 Ti

Test results

The following settings were used in easyDCP Creator+ 3.7.3:

• Color Transform: RGB BT.709 nach XYZ (DCI)
• Maximum Bitrate: 250 Mbit/s

The source image material and the destination folder were in all cases on an SSD, if possible on an NVMe SSD.

Performance measurement easyDCP Player+ CPU/GPU

There are two different options for running easyDCP Player+/IMF Player.

1. Real-time-playback using a fast CPU.

Allows for real-time-playback of 2k/4k DCP and IMF-Packages on a standard PC/Mac. Use this option if you have a sufficiently fast CPU. The software codec will work on macOS 10.14 and Windows 7/10 64-Bit.

Minimum system specification:

• 6-core CPU
• At least 4 GB of RAM
• Graphics device with at least 500 MB memory attached to monitor (primary graphics card)
• Fast hard disk is also recommended

2. Real-time-playback using a Graphics Processing Unit (GPU) as accelerator.

Allows for real-time-playback of 2k/4k DCPs and IMF-Packages *) on a standard PC.
*) limited to lossy with code block size 32x32

This option requires two graphics cards:

1. GPU: Primary device for rendering (OpenGL) to which the display is attached.
2. GPU: Secondary CUDA-enabled device for the JPEG 2000 decompression.

Minimum system specification:

• 4-core CPU
• 1x primary graphics device attached to monitor
  
  • recent NVIDIA GeForce or Quadro series graphics device
  • at least 1 GB VRAM
  • preferably connected with 16 PCIx lanes
• 1x secondary graphics device not attached to monitor
  
  • NVIDIA GeForce with at least 500 CUDA cores
  • least 2 GB of VRAM
  • preferably connected with 16 PCIx lanes
• At least 4 GB RAM
• Fast harddisk/SSD is also recommended

The GPU-accelerated codec is only available for Windows, not for Mac OS X.

3D Video output options:

For best stereo video output, we recommend a NVIDIA Quadro device with at least 2 GB memory (e.g. Quadro K600). When using Nvidia 3D vision, the display needs to have a refresh rate of at least 120 Hz (e.g. Acer GD245QH). Alternatively, a 3D projector can be connected via Dual-DVI. This does not require a professional Nvidia Quadro card, but can also be achieved with a NVIDIA GeForce card.

Furthermore, a 3D LCD can be connected via HDMI or DVI to play out stereo in side-by-side/top-and-bottom/line-by-line or other interleaved modes.

HD-SDI output option:

easyDCP Player supports Blackmagic Design UltraStudio oder DeckLink series output devices.

When Option HD-SDI "enable subtitling, color processing and scaling" is enabled, decoded images will first be processed by the primary graphics card, before they get sent to the SDI-output device.

This works best, when the primary graphics card is a NVIDIA Quadro card. 

View our performance test:

The procedure is different in every country. We can't send you the certificates.

• The best way is to ask the cinema owners directly. They should have current certificates of their projection systems in their screening rooms or tell you the model and serial number.
• Another option is to contact the server manufacturer directly.
• If you have the model and serial number, you can contact the server manufacturer and ask for access to their database.

easyDCP Creator+, easyDCP JPEG 2000 Transcoder are highly optimized for running on multi-processor/multi-core machines. On Windows and from easyDCP Creator(+) 3.3.X can also use one or more CUDA® enabled graphics devices.

We recommend the following minimal system configuration:

• Windows PC (Windows 64 bit, Version 7 or higher) or Intel Mac (Mac OS X 64 bit, Version 10.7 or higher)
• You also need a minimum of 2 GB RAM
• Installation occupies 200 MB free disc space
• Fast hard disk is also recommended

For best performance, opt for the following specifications:

• CPU with 6 cores or more
• 8 GB RAM
• Fast SSD
• A CUDA-enabled graphics device for encoding with the following specifications:
  
  • Compute Capability 2.0 or higher
  • Minimum of 1 GB memory, better 4 GB of memory
  • Preferably connected with 16 PCI Express lanes
  • The more cores, the better
  • E.g. NVIDIA GeForce 980 Ti