D‑Cine Player · 4.2.32 release
DCP Cine Player security
Combine authenticated users, recipient-bound keys, trusted time, validated content, qualified output and signed software with the site's operating controls.
Identity and access
Monitor, operator, manager and administrator roles, authenticated sessions and configurable timeout separate observation, playback, management and administration.
KDM-controlled playback
Certificate identity, composition/key matching and validity windows gate encrypted playback. Keys display readable content titles and complete validity-window lengths to support pre-show checks.
AES‑256 media at rest
EAR‑Tech authenticates and encrypts supported ordinary-media payloads. Playback reads verified chunks in memory without writing a complete decrypted temporary movie.
Display assurance
Authenticated HDCP, approved display fingerprints and hardware-dependent receiver identity checks support content-selected DDL policy. Qualify the exact output path and its permitted use.
Release trust
Pinned signing keys verify release manifests and packages before controlled upgrades. Review the release/beta classification and use APT for manual installation with dependency resolution.
Licence administration
Authority staff can inspect registration details, manage expiry/revocation and transfer single-machine licences by deactivating the previous installation. Separate integration credentials limit issuance and masked reporting permissions.
Remote control safeguards
Extended transport commands retain native media/KDM checks and playing/paused state. Duplicate-request protection and pollable results help controllers recover safely from a lost response.
Operating evidence
Content readiness, system details, logs, source/output telemetry and two-year DDL activity history support site procedures and support investigations.
MPA / MPAA requirements and TPN assessment
The MPA Content Security Best Practices covers organisations, sites, applications and workflows. EAR‑Tech contributes authenticated AES‑256 file encryption; the deployment must also address transport, keys, access, recovery and the host. See the EAR‑Tech production mapping.
TPN provides assessment and reporting, not facility certification. Content owners use that evidence to make their own risk-based decisions; buying or installing a player does not establish an assessment result. Official TPN FAQ.
Keep the delivery protected
Approve storage, backups and transfer paths. EAR payload encryption remains present in a copied package; unencrypted IMF, source masters, credentials and public metadata need their own controls. Place plain FTP compatibility behind a separately protected network path.
Manage keys and hosts
Separate private mastering material from delivery media. Restrict and review access, protect player private keys, document recovery and compromise handling, and secure swap, crash dumps and privileged administration.
Qualify and retain evidence
Record software versions, supported media, KDM manager, display hardware and configuration. Test rejected keys/time windows and altered content, document operational access and retention, and complete the applicable site/application assessment.
Choose the output policy deliberately
EAR's default encrypted-media policy requires authenticated HDCP output. Supported SDI DCP operation follows a separate DDL1 policy; DDL2/DDL3 requests are refused on that path. SDI support alone does not establish EAR output compliance. DDL3 and precision SDI assurance remain dependent on exact hardware/receiver qualification.
Display policy and qualificationRelease channel and installationSeparate discovery, metadata and presentation access
Anonymous discovery is limited to exact read-only identity/public-certificate routes. Detailed operational APIs and screen declarations retain authentication; password changes are administrator-only. Licence-issued serials, installation UUIDs and recipient certificate serials are distinct.
AirPlay Casting binds an explicit network and uses a fresh code on entry. It reserves the output and interlocks competing playback until stopped. Keep the presentation network restricted, and qualify real sender/output behavior.
Written by James Gardiner · Documentation updated 2026-10-31. For more information visit tools.d-cine.net. Check procedures against the installed release and venue policy.
