Encrypted At Rest technology
EAR-Tech encrypted media
A D‑Cine feature for wrapping common cinema media in chunk-authenticated AES‑256‑GCM encryption, then controlling access through two-component KDM delivery.
Why it exists
Pre-release trailers, advertisements and alternative content are often delivered as MOV, MP4 or MKV rather than DCP. Leaving those files clear on storage creates an avoidable exposure. EAR‑Tech exists to give that media a strong encrypted-at-rest path without transcoding it.
Its 256-bit encryption design is intended to help operators and service providers implement controls aligned with the MPA Content Security Best Practices maintained by TPN. Those practices are a facility-wide benchmark: technology is only one part of an assessed security posture.
How it protects content
Encrypt
Each asset receives a fresh 256-bit media key assembled from two independently random 128-bit components. AES‑256‑GCM encrypts and authenticates the private manifest and every media chunk.
Bind
The EAR header, DCSM descriptor, composition ID, asset ID, key IDs, asset size and SHA‑256 are cross-checked during ingest and playback.
Authorise
Both key components must be present in a matching, currently valid KDM for the target player. Authentication fails if encrypted bytes or bound metadata are modified.
Playback without a clear temporary copy
The native player authenticates requested chunks and supplies plaintext to FFmpeg through random-access memory reads. Normal playback does not materialise the whole decrypted source as a file on disk.
| EAR‑Tech is | EAR‑Tech is not |
|---|---|
| A private encrypted-at-rest media format implemented by D‑Cine Player | A DCP or a way to make H.264/ProRes essence DCI-compliant |
| AES‑256‑GCM with per-chunk authentication | A claim of FIPS validation or hardware media-block equivalence |
| A cinema-style, two-component KDM compatibility workflow | A guarantee of compatibility with every third-party KDM product |
| A technical control that can support a security programme | By itself, proof of TPN assessment or MPA/TPN conformance |
Operational workflow
EAR‑Tech packages use clearly named ASSETMAP_EAR.xml and VOLINDEX_EAR.xml control files instead of standard DCP discovery markers, reducing false DCP detection by other cinema systems.
Master
Use cine-ear create on a MOV, MP4, M4V or MKV source. Secure the private recovery material separately.
Deliver
Transfer only the public package directory to the player. Do not distribute private mastering keys with media.
Issue KDM
Create a recipient-specific KDM with composition/key IDs and a deliberately limited validity window.
Ingest
The service verifies descriptor binding and encrypted-asset SHA‑256 before indexing the content.
Preflight
The player checks recipient, time window, both key components, content binding and protected output requirements.
Play and audit
Play authenticated chunks in memory and retain delivery, KDM, access and deletion evidence required by local policy.
Documentation edition: 6 September 2026. Check procedures against the installed release and venue policy.
