HDQMWR18R0018_FINAL.pdf

SOLICITATION, OFFER AND AWARD

1. THIS CONTRACT IS A RATED ORDER

UNDER DPAS (15 CFR 700)

RATING PAGE OF PAGE

1 68

2. CONTRACT NUMBER 3. SOLICITATION NUMBER 4. TYPE OF SOLICITATION

SEALED BID (IFB)

NEGOTIATED (RFP)

5. DATE ISSUED 6. REQUISITION/PURCHASE

NUMBER

HDQMWR-19-R-0037 28 July 2019

7. ISSUED BY CODE 8. ADDRESS OFFER TO (If other than item 7)

COMMANDER, NAVY INSTALLATIONS COMMAND

ACQUISITION BRANCH, N945

5720 INTEGRITY DRIVE, BLDG 457

MILLINGTON, TN 38055-6500

SARAH PARKER

SARAH.K.PARKER1@NAVY.MIL / 901-874-6900

NOTE: In sealed bid solicitations “offer” and “offeror” mean “bid” and “bidder”.

SOLICITATION

9. Sealed offers in original and 3 copies for furnishing the supplies or services in the Schedule will be received at the place specified in Item 8, or if handcarried, in the depository located in until 1400 local time 2 August 2019 (Hour) (Date) CAUTION - LATE Submissions, Modifications, and Withdrawals: See Section L, Provision No. L-6. All offers are subject to all terms and conditions contained in this solicitation.

10. FOR

INFORMATION

CALL:

A. NAME B. TELEPHONE (NO COLLECT CALLS) C. E-MAIL ADDRESS

SARAH PARKER

AREA CODE NUMBER EXT.

Sarah.k.parker1@navy.mil 901 874-6900

11. TABLE OF CONTENTS

(X) SEC. DESCRIPTION PAGE(S) (X) SEC. DESCRIPTION PAGE(S)

PART I - THE SCHEDULE PART II - CONTRACT CLAUSES

X A SOLICITATION/CONTRACT FORM 1 X I CONTRACT CLAUSES 40-49

X B SUPPLIES OR SERVICES AND PRICES/COSTS 2-8 PART III - LIST OF DOCUMENTS, EXHIBITS AND OTHER ATTACH.

X C DESCRIPTION/SPECS./WORK STATEMENT 9-34 X J LIST OF ATTACHMENTS 50

X D PACKAGING AND MARKING 35 PART IV - REPRESENTATIONS AND INSTRUCTIONS

X E INSPECTION AND ACCEPTANCE 35 X K REPRESENTATIONS, CERTIFICATIONS AND OTHER

STATEMENTS OF OFFERORS 51-53 X F DELIVERIES OR PERFORMANCE 35-36

X G CONTRACT ADMINISTRATION DATA 36 X L INSTRS., CONDS., AND NOTICES TO OFFERORS 54-60

X H SPECIAL CONTRACT REQUIREMENTS 36-39 X M EVALUATION FACTORS FOR AWARD 61-67

OFFER (Must be fully completed by offeror)

12. In compliance with the above, the undersigned agrees, if this offer is accepted within calendar days (60 calendar days unless a different period is inserted by the offeror) from the date for receipt of offers specified above, to furnish any or all items upon which prices are offered at the price set opposite each item, delivered at the designated point(s), within the time specified in the schedule.

13. DISCOUNT FOR PROMPT PAYMENT 10 CALENDAR DAYS (%) 20 CALENDAR DAYS (%) 30 CALENDAR DAYS (%) CALENDAR DAYS (%) (See Section I, Clause No. 17)

14. ACKNOWLEDGMENT OF AMEND-

MENTS (The offeror acknowledges receipt of amendments to the SOLICITATION for offerors and related documents numbered and dated):

AMENDMENT NO. DATE AMENDMENT NO. DATE

15A. NAME AND

ADDRESS

OF OFFEROR

CODE FACILITY 16. NAME AND TITLE OF PERSON AUTHORIZED TO SIGN OFFER

(Type or print)

15B. TELEPHONE NUMBER

15C. CHECK IF REMITTANCE ADDRESS

IS DIFFERENT FROM ABOVE - ENTER

SUCH ADDRESS IN SCHEDULE.

17. SIGNATURE 18. OFFER DATE

AREA CODE NUMBER EXT.

AWARD (To be completed by Government)

19. ACCEPTED AS TO ITEMS NUMBERED 20. AMOUNT 21. ACCOUNTING AND APPROPRIATION

22. AUTHORITY FOR USING OTHER THAN FULL AND OPEN COMPETITION: 23. SUBMIT INVOICES TO ADDRESS

SHOWN IN (4 copies unless otherwise specified)

ITEM

10 U.S.C. 2304(c) ( ) 41 U.S.C. 253(c) ( ) SECTION G

24. ADMINISTERED BY (If other than Item 7) CODE 25. PAYMENT WILL BE MADE BY CODE

CNIC NAVY MOTION PICTURE SERVICE N923A

NAVY MOTION PICTURE SERVICE

7736 KITTY HAWK AVE BLDG 457

MILLINGTON, TN 38055

26. NAME OF CONTRACTING OFFICER (Type or print) 27. UNITED STATES OF AMERICA 28. AWARD DATE

SARAH PARKER

(Signature of Contracting Officer)

IMPORTANT - Award will be made on this Form, or on Standard Form 26, or by other authorized official written notice.

AUTHORIZED FOR LOCAL REPRODUCTION

Previous edition is unusable

STANDARD FORM 33 (REV. 9-97)

Prescribed by GSA - FAR (48 CFR) 53.214 (c) mailto:SARAH.K.PARKER1@NAVY.MIL

PART I, SECTION B – SUPPLIES AND PRICE

B.1 GENERAL: This is a procurement of the Commander, Navy Installations Command (CNIC), Fleet and Family Readiness Support Services, a Nonappropriated Fund Instrumentality, hereinafter referred to as NAFI. The requirements stated herein are in support of the mission of Navy Motion Picture Service. The contract is to provide a content delivery and playback method for encrypted movies.

B.2 TYPE OF CONTRACT: It is anticipated as a result of this solicitation an Indefinite Delivery/Indefinite Quantity (ID/IQ) contract will be awarded. The material and prices will be fixed price.

B.3 PERIOD OF PERFORMANCE: A three-year base period to commence on date of award with seven (7) one-year option periods. CNIC approval is pending to award a ten (10) year contract. In the event, only a five (5) year contract is approved for award then only a contract with a three (3) year base period and option periods 1 and 2 will be made pursuant to this solicitation.

B.4. AWARD: Upon award of contract, Sections K, L and M of the solicitation, and the Contractor’s proposal, including any revisions will be incorporated by reference subject to Clause 16, Order of Precedence.

BASE PERIOD (36 Months)

CLIN DESCRIPTION QTY U/I UNIT PRICE TOTAL

PRICE

0001a

Navy Solid State Player (NSSP)

Navy Solid State Player (NSSP)

EA

EA

0002 First Article Test 1 EA 0003 Field Test Unit 10 EA 0004 Option for Rack Mounting Hardware 500 EA 0004a Option for Additional Rack Mounting

Hardware

1 EA

0005 Option for Reset of Master Key for Upcoming Content Release

1 EA

0006 Reserved NA NA

0007a

Encryption Station *If contractor does not provide encryption services, then pricing for an encryption station is required.

Option for Contractor provided encryption services *If contractor provides encryption services, then pricing for an encryption

1 EA

station is not required.

0008a

0008b

Option for Duplication System Capable of Producing up to 1,000 Copies in a Period of Three (3) Working Days

Option for Contractor provided Duplication

Option for Distribution services

1 EA

0009 Technical Data/Manuals 1 LT

TOTAL

OPTION PERIOD 1 (12 Months)

CLIN DESCRIPTION QTY U/I UNIT

PRICE

TOTAL PRICE

1001 Navy Solid State Player (NSSP) 500 EA 1002 Reserved 0 NA 0 0 1003 Reserved 0 NA 0 0 1004 Option for Rack Mounting Hardware 500 EA 1004a Option for Additional Rack Mounting

Hardware

1 EA

1005 Option for Reset of Master Key for Upcoming Content Release

1 EA

1006 Option for Annual/Renewable Warranty for NSSP Hardware/Software Maintenance for Each Unit

1007a

*If contractor does not provide encryption services, then pricing for an encryption station is required.

Option for Contractor provided encryption services *If contractor provides encryption services, then pricing for an encryption station is not required.

1008a

1008b

Option for Duplication System Capable of Producing up to 1,000 Copies in a Period of Three (3) Working Days

Option for Contractor provided Duplication

Option for Distribution services

1 EA

1009 Technical Data/Manuals 1 LT

OPTION PERIOD 2 (12 Months)

CLIN DESCRIPTION QTY U/I UNIT PRICE TOTAL

PRICE

2001 Navy Solid State Player (NSSP) 500 EA 2002 Reserved 0 NA 0 0 2003 Reserved 0 NA 0 0 2004 Option for Rack Mounting Hardware 500 EA 2004a Option for Additional Rack Mounting

Hardware

1 EA

2005 Option for Reset of Master Key for Upcoming Content Release

1 EA

2006 Option for Annual/Renewable Warranty for NSSP Hardware/Software Maintenance for Each Unit

2007a

*If contractor does not provide encryption services, then pricing for an encryption station is required.

Option for Contractor provided encryption services *If contractor provides encryption services, then pricing for an encryption station is not required.

3 EA

2008a

2008b

Producing up to 1,000 Copies in a Period of Three (3) Working Days

Option for Contractor provided Duplication

Option for Distribution services

1 EA

2009 Technical Data/Manuals 1 LT

TOTAL

OPTION PERIOD 3 (12 Months)

CLIN DESCRIPTION QTY U/I UNIT PRICE TOTAL

PRICE

3001 Navy Solid State Player (NSSP) 500 EA 3002 Reserved 0 NA 0 0 3003 Reserved 0 NA 0 0 3004 Option for Rack Mounting Hardware 500 EA 3004a Option for Additional Rack Mounting

Hardware

1 EA

3005 Option for Reset of Master Key for Upcoming Content Release

3006 Option for Annual/Renewable Warranty for NSSP Hardware/Software Maintenance for Each Unit

3007a

*If contractor does not provide encryption services, then pricing for an encryption station is required.

Option for Contractor provided encryption services *If contractor provides encryption services, then pricing for an encryption station is not required.

3008a

3008b

Producing up to 1,000 Copies in a Period of Three (3) Working Days

Option for Contractor provided Duplication

Option for Distribution services

1 EA

3009 Technical Data/Manuals 1 LT

OPTION PERIOD 4 (12 Months)

PRICE

4001 Navy Solid State Player (NSSP) 500 EA 4002 Reserved 0 NA 0 0 4003 Reserved 0 NA 0 0 4004 Option for Rack Mounting Hardware 500 EA 4004a Option for Additional Rack Mounting

Hardware

1 EA

4005 Option for Reset of Master Key for Upcoming Content Release

1 EA

4006 Option for Annual/Renewable Warranty for NSSP Hardware/Software Maintenance for Each Unit

4007a

*If contractor does not provide encryption services, then pricing for an encryption station is required.

Option for Contractor provided encryption services *If contractor provides encryption services, then pricing for an encryption station is not required.

4008a

4008b

Producing up to 1,000 Copies in a Period of Three (3) Working Days

Option for Contractor provided Duplication

Option for Distribution services

1 EA

4009 Technical Data/Manuals 1 LT

OPTION PERIOD 5 (12 Months)

PRICE

5001 Navy Solid State Player (NSSP) 500 EA 5002 Reserved 0 NA 0 0 5003 Reserved 0 NA 0 0 5004 Option for Rack Mounting Hardware 500 EA 5004a Option for Additional Rack Mounting

Hardware

1 EA

5005 Option for Reset of Master Key for Upcoming Content Release

1 EA

5006 Option for Annual/Renewable Warranty for NSSP Hardware/Software Maintenance for Each Unit

5007a

*If contractor does not provide encryption services, then pricing for an encryption station is required.

Option for Contractor provided encryption services *If contractor provides encryption services, then pricing for an encryption station is not required.

5008a

5008b

Producing up to 1,000 Copies in a Period of Three (3) Working Days

Option for Contractor provided Duplication

Option for Distribution services

5009 Technical Data/Manuals 1 LT

OPTION PERIOD 7 (12 Months)

PRICE

7001 Navy Solid State Player (NSSP) 500 EA 7002 Reserved 0 NA 0 0 7003 Reserved 0 NA 0 0 7004 Option for Rack Mounting Hardware 500 EA 7004a Option for Additional Rack Mounting

Hardware

1 EA

OPTION PERIOD 6 (12 Months)

CLIN DESCRIPTION QTY U/I UNIT PRICE TOTAL

PRICE

6001 Navy Solid State Player (NSSP) 500 EA 6002 Reserved 0 NA 0 0 6003 Reserved 0 NA 0 0 6004 Option for Rack Mounting Hardware 500 EA 6004a Option for Additional Rack Mounting

Hardware

1 EA

6005 Option for Reset of Master Key for Upcoming Content Release

1 EA

6006 Option for Annual/Renewable Warranty for NSSP Hardware/Software Maintenance for Each Unit

6007a

*If contractor does not provide encryption services, then pricing for an encryption station is required.

Option for Contractor provided encryption services *If contractor provides encryption services, then pricing for an encryption station is not required.

6008a

6008b

Producing up to 1,000 Copies in a Period of Three (3) Working Days

Option for Contractor provided Duplication

Option for Distribution services

1 EA

6009 Technical Data/Manuals 1 LT

7005 Option for Reset of Master Key for Upcoming Content Release

1 EA

7006 Option for Annual/Renewable Warranty for NSSP Hardware/Software Maintenance for Each Unit

7007a

*If contractor does not provide encryption services, then pricing for an encryption station is required.

Option for Contractor provided encryption services *If contractor provides encryption services, then pricing for an encryption station is not required.

7008a

7008b

Producing up to 1,000 Copies in a Period of Three (3) Working Days

Option for Contractor provided Duplication

Option for Distribution services

1 EA

7010 Technical Data/Manuals 1 LT

*Quantities are estimated figures and are not guaranteed. Exact quantities will be described on the delivery orders.

PART I, SECTION C – DESCRIPTIONS AND SPECIFICATIONS

STATEMENT OF WORK

1. INTRODUCTION

1.1. Background

1.2. Purpose

1.3. Scope

2. APPLICABLE DOCUMENTS

2.1. Specifications and Standards Documents

2.2. Order of Precedence

3. ANTICIPATED WORKFLOW

3.1. Anticipated Workflow Description

3.1.1. Content Workflow

3.1.2. Key Workflow for Content and Device Keys

3.1.3. Key Workflow for Decryption Keys

3.1.4. Integration Workflow

3.1.5. Revocation Workflow

4. REQUIREMENTS

4.1. Contractor Requirements

4.2. Definition of Subsystems

4.2.1. Key Management

4.2.2. Encoding

4.2.3. Minimum Supported Coded Picture Format and Video Encoding Resolution

4.2.4. Encryption

4.2.5. Watermarking

4.2.6. Encryption Protection Rights

4.2.7. Definition of SSPS Master Station and Duplication

4.2.8. Meta Data

4.2.9. Definition of SSPS playback units

4.2.10. Quick Play

4.2.11. Optional Quick Player

4.2.12. Optional Closed Captioning Support

4.2.13. Contractor Peripheral Requirements

4.2.14. Contractor Requirements

4.2.15. Date and Time Function

4.2.16. Security Features

4.2.17. Physical Requirements

4.2.18. Power

4.3. Technical Documentation

4.3.1. Technical Manuals, Operation and Maintenance

4.3.2. System Drawings

4.3.3. Physical Interface Drawings

5. WARRANTY REQUIREMENTS

5.1. Warranty

5.2. Warranty Repairs

6. MISCELLANEOUS REQUIREMENTS

6.1. SITE

6.2. High Definition System

7. FIRST ARTICLE TESTING/DEMONSTRATION

7.1. Demonstration

7.1.1. Key Management and Encryption System Demonstration

7.1.2. SSPS System

8. FIRST ARTICLE TESTING

8.1. First Article Testing Plan

8.2. First Article Testing

1. INTRODUCTION

1.1. Background

The Navy Motion Picture Service (NMPS) provides equipment and motion picture programming for the playback of Early Window Content Motion Pictures on US Navy Ships and shore locations worldwide. Early Window Content means specifically, motion pictures released prior to their home release date. The Navy currently uses a secure encryption process applied to DVD players capable of playing movies. There are an estimated 4,000 of these Navy DVD (NDVD) players deployed. NDVD players are designated as the only authorized equipment to be used for the playback of movies that the Navy licenses from the film companies who are the copyright holders. Navy is now looking for a new method of secure content delivery and content playback as described in the scope. Navy procures and distributes movies to over 850 Fleet, Forward Deployed Forces, afloat, and shore commands worldwide.

Army and Air Force Exchange Service (AAFES) will be an Agency that procures components off any contract awarded under this SOW. AAFES operates a movie program separate from Navy and maintains separate contracts with the Motion Picture content owners. The SSPS-MS process inclusive of duplication and distribution for the two organization shall operate separately due to contract terms with the Content Owners and the additional requirement for AAFES locations to include the ability to add AAFES provided informational content for use at AAFES playback locations.

The purpose of this statement of work (SOW) is to define the NAFI’s requirements for the new content delivery and playback method for encrypted movies.

1.2. Scope

This SOW addresses the requirements for a Solid State Playback System (SSPS) that includes the software and hardware to perform the functions of meta data database, duplication, and playback for encrypted programming in compliance with film studio requirements. This SOW also addresses the delivery of equipment and services for motion picture Encryption and Key Management Authority (KMA) that Navy uses for motion picture duplication. All Ashore and Shipboard locations will initially operate in a disconnected fashion where content, key management, updates, and other required functions will be performed using removable media transfer or another non-IP connection method. In the future various locations may have internet delivery capability.

2. APPLICABLE DOCUMENTS

2.1. Specifications and Standards Documents

The following specifications, standards, and handbooks form a part of this document to the extent specified herein. Unless otherwise specified, the most recent issues of these documents shall be used. In the event of a conflict between this SOW and the cited specification, this SOW shall take precedence.

Cable Television Laboratories, Inc., (CableLabs) Asset Distribution Interface Specification, Version 1.1, 2006. Available from <www.cablelabs.com>.

Cable Television Laboratories, Inc., (CableLabs) Video-On-Demand Content Specification, Version 1.1-C01, 2012. Available from <www.cablelabs.com>.

ISO/IEC 11172-3:1993, “Information Technology – Coding of Moving Pictures and Associated Audio for Digital Storage Media at Up to About 1,5 Mbit/s – Part 3: Audio”, 1993. Available from <www.iso.ch>.

ISO/IEC 13818-1:2000, “Information technology – Generic Coding of Moving Pictures and Associated Audio Information: Systems”, 2000. Available from <www.iso.ch>.

ISO/IEC 14496-1:2004, “Information Technology – Coding of Audio-Visual Objects – Part 1: Systems”, 2004. Available from <www.iso.ch>.

ISO/IEC 14496-3:2009, “Information Technology – Coding of Audio-Visual Objects – Part 3: Audio”, 2006. Available from <www.iso.ch>.

ISO/IEC 14496-8:2004, “Information Technology – Coding of Audio-Visual Objects – Part 8: Carriage of ISO/IEC 14496 Contents Over IP Networks”, 2004. Available from <www.iso.ch>.

ISO/IEC 14496-10:2005, “Information Technology – Coding of Audio-Visual Objects – Part 10: Advanced Video Coding”, 2005. Available from <www.iso.ch>.

ISO/IEC 14496-14:2003, “Information Technology – Coding of Audio-Visual Objects – Part 14: MP4 File Format”, 2003. Available from <www.iso.ch>.

ISO/IEC 15938, Parts 1-11, “Information Technology – Multimedia Content Description Interface”, 2002-2005. Available from <www.iso.ch>.

ISO/IEC 21000, Parts 1-17, “Information Technology – Multimedia Framework (MPEG- 21)”, 2003-2006. Available from <www.iso.ch>.

ITU-R Recommendation BT.601-5, “Studio Encoding Parameters of Digital Television for Standard 4:3 and Wide-screen 16:9 Aspect Ratios”, October 1995. Available from <www.itu.int>.

ITU-R Recommendation BT.709-5, “Parameter values for the HDTV standards for production and international programme exchange”, April 2002. Available from <www.itu.int>.

WAEA Specification 0395, Version 2.0, “Content Delivery for In-Flight Entertainment”, 6 November 2001. Available from <www.apex.aero>.

WAEA Specification 0598, v1.0, “DVD Delivery for In-Flight Entertainment”, 24 January 2001. Available from <www.apex.aero>.

WAEA Specification 1289-2, Revision 3, “Specification for Mastertape Recording, Tape Duplication, Compact Disc Replication, and Digital Encoding for Airborne Audio Entertainment Systems”, 20 January 2005. Available from <www.apex.aero>.

APEX Specification 0403, Revision 2, “MPEG-4 Content Specification and Content Security Requirements for Airline In-Flight Entertainment and Connectivity Systems”, November 11, 2014, Available from <www.apex.aero>.

Worldwide Web Consortium Recommendation: Extensible Markup Language (XML) 1.0, Fourth Edition, 16 August 2006. Available from <www.w3c.org>.

FIPS Publication 197, “Specification for the Advanced Encryption Standard (AES)”, 26 November 2001. Available from <www.csrc.nist.gov>.

R.L. Rivest, A. Shamir, and L. Adleman. “A method for obtaining digital signatures and public-key cryptosystems.” Communications of the ACM, 21(2):120-126, February 1978.

FIPS PUB 140-2, “Security Requirements for Cryptographic Modules”, December 3rd, 2002, Available from <www.csrc.nist.gov>.

MIL-STD-461E – Requirements for the control of Electromagnetic Interference Characteristics of subsystems and equipment

MIL-STD-901 - Shock Tests, (High Impact), Shipboard Machinery, Equipment, and Systems; Requirements for high impact system resilience

MIL-STD-1399 - Interface Standard for Shipboard Systems

MIL-STD-1310 – Shipboard bonding and grounding methods and other techniques for EMC and safety.

2.2. Order of Precedence

In the event of a conflict between the text of this specification and the references cited herein, the text of this specification takes precedence. Nothing in this specification, however, supersedes applicable laws and regulations unless a specific exemption has been obtained.

3. ANTICIPATED WORKFLOW

3.1. Anticipated Workflow Description

While the final workflow will be developed with the Contractor receiving any award of contract resulting from this solicitation Navy/AAFES anticipates the basic work flow for content, KMA information, Integration, and Revocation will follow the flow outlined in this section.

3.1.1. Content Workflow

The Movie Studio contracted content is anticipated to follow this workflow outline.

• Contract for a specific Movie is signed between a Content Owner and Navy/AAFES.

• The contract will stipulate a Lab that will receive the movie file from the Content Owner. There are currently two labs in use on Contracts between Navy and the Studios.

• The Lab will receive Content Keys from the KMA and include at the time of encryption. The Content key at a minimum specifies the time period of the contract for playback. At this point the content is secured for playback only on devices with a matching decryption key during the contract period.

• The Lab will encode and encrypt the movie file using the SSPS encryption and security method.

• The contracted Lab, if not the final Integrator contracted by Navy/AAFES would then transmit the encrypted file to the Integrator.

3.1.1.1. Option for contractor provided KMA, encryption process, duplication and or distribution services.

3.1.2. Key Workflow for Content and Device Keys

The Keys for devices and content is anticipated to follow this workflow outline.

• The contract will stipulate the time period for which the movie is allowed to play on the system. This information will be used by the KMA to generate a Content Key that will allow the content to play on authorized, non-revoked, SSPS playback units during the contracted time period.

• The KMA will deliver the Content Key to the Lab for inclusion during the encode and encryption process.

• The KMA will generate the Device Key or other Keys required for SSPS Playback units to receive authorization to playback a certain piece of content.

• Device Keys for compromised units will not be produced thus Blacklisting the player from playing the content.

• If required in the KMAs security system, the KMA will produce Revocation Keys to remove a player from the universe of authorized devices.

• The Device Keys and Revocation Keys will be delivered to the Integrator for inclusion in the final package delivered to playback locations.

3.1.3. Key Workflow for Decryption Keys

The Keys for decrypting content are anticipated to follow this workflow outline. The Decryption Key is the private key applied directly to a playback device to support decryption of the content file encrypted by the Lab.

• The Decryption Key is generated by the KMA

• The Decryption Key is securely applied by the KMA to a player at the time the player is first registered to operate as part of the system

• The Decryption Key is then activated on a player by the KMA making the unit capable of decrypting Navy/AAFES encrypted content files.

3.1.4. Integration Workflow

The Integrator will perform the function of consolidating content files and keys, preparing the master duplication package, and duplicating the package for all playback locations. The Integrator is to be determined but will be one of the following.

• A Lab also used for encoding and encryption

• KMA

• Navy/AAFES

• 3rd Party Vendor

The Integration effort is anticipated to follow this workflow outline.

• The Integrator will receive the encrypted content files with Content Keys from the various encoding Labs.

• The Integrator will receive the Device Keys or other required Keys from the

KMA

• The Integrator will develop a Master Duplication Folder for each Integration run.

Navy expects there to be 16 movies duplicated and distributed once per month.

• The Master Duplication Folder will contain all the content and keys required for the next scheduled content delivery. Once all Titles and all relevant Keys are in the Master Duplication Folder, the Integrator will begin the duplication process.

• The Integrator will duplicate of the Master Duplication Folder onto the media transfer devices.

• As duplication completes, the Integrator will package the duplicated Media Devices for shipment. Final delivery may be to the end user location or to Navy/AAFES for processing and delivery to the end user. Media Devices will be sent by US Postal Service to APO/FPO addresses.

3.1.4.1 If the contractor elects to provide integration services, all integration requirements from 3.1.4 shall be met.

3.1.5. Revocation Workflow

All Parties involved in the Navy/AAFES system maintain responsibility for the Revocation process. This workflow is the process of revoking a Navy/AAFES capable playback device from playing content.

Watermark Detection

• The Studios will report any discovery of leaked content to Navy/AAFES

• Navy will immediately alert the KMA and the KMA and Studio will work to retrieve the Serial, Date, and Time information from the invisible watermark.

• The Serial number will be used to identify the location and Navy/AAFES and other Investigative agencies would become involved.

• KMA will take the steps necessary to revoke the specific player from the universe of authorized devices unless the device is immediately retrievable by a Trusted party or Law Enforcement.

Compromised Unit

• Parties authorized to procure devices from this contract, that include Navy and

AAFES will track device location by serial number.

• When a device is first delivered to an end user, the end user must verify receipt. If receipt is not verified within an allotted time period, the unit will be reported as missing.

• When a replacement device is sent to a location, both the replacement and faulty devices must be sent by a tracked method. End User must verify receipt of the replacement unit. If receipt is not verified within an allotted time period, the unit will be reported as missing. If a faulty device is not returned within an allotted time period, the unit will be reported as missing.

• When a unit is reported as missing, the Government party will provide the serial number to the KMA and the KMA will take the steps necessary to revoke the specific player from the universe of authorized devices

4. REQUIREMENTS

4.1. Contractor Requirements

The contractor shall provide all hardware; software; table top mounts, technical and operational documentation for all components; and warranties necessary to provide a content encryption and key management system, and SSPS for playback of the encrypted content.

4.2. Definition of Subsystems

Figure 1 represents a high-level block diagram of the system. Each subsystem is described in brief in this section of the SOW. Portions of the description of the encryption, encoding, and key management subsystems are taken directly from the World Airline Entertainment Association’s Specification 0598 - DVD Delivery for In-Flight Entertainment Version 1.0 copyrighted in 1999, 2000 by the World Airline Entertainment Association and APEX Specification 0403, Revision 2, “MPEG-4 Content Specification and Content Security Requirements for Airline In-Flight Entertainment and Connectivity Systems”, November 11, 2014. For a more technical description of the security features required by Navy, please refer to WAEA Specification 0598 unedited in its entirety available from www.waea.org.

For a more technical description of the encoding required by NMPS, please refer to APEX Specification 0403 unedited in its entirety available from www.apex.aero.

Key Manage ment Figure 1 Top Level Reference Model

1 4 2

Encodi ng and

Encryp tion

SSPS

Master Station Duplica tion

Locatio n

Playbac k http://www.waea.org/ http://www.apex.aero/

The Key Management System encompasses the key server hardware and key generation software that is used by a key management authority to produce the Content key that is delivered with the content itself, any other keys required by the Vendor’s security technology, and the Decryption key that is a private key residing on the playback devices.

The Key Management System is the digital rights management (DRM) portion of the SSPS system. The Key Management System and process must be approved by the Content Owners. There are multiple Content Owner approved and commercially available DRM solutions. A short list of the commercial DRM solutions would include Playready, Widevine, and Ultraviolet approved DRMs. Sections of this SOW related to the Key Management System are intentionally left interpretable as a means of not identifying a specific solution. While contractor developed, or DRM solutions currently not approved by the Content Owners may be included in responses to this SOW, be aware that the KMA process and DRM solution will be presented to the Content Owners and must be deemed acceptable before any final award for production units will be awarded.

The Encoding and Encryption System is the hardware and software required to encode or transcode and encrypt the master file that is then sent to the SSPS-MS and duplicated to removal media devices for delivery to locations for playback. Encryption is the process of rendering the Studio Content unplayable on any device that does not have the appropriate matching key structure to unlock the file.

The SSPS Master Station is the interface between Key Management, Encryption, the playback locations. The SSPS Master Station shall include a duplication system for duplicating the SSPS disconnected locations.

The SSPS playback unit is the device that decrypts and provides an HDMI, NTSC video, and stereo analog audio outputs for play back of the material on US Navy Ships and all other locations served by Navy/AAFES. Refer to section 4.2.11 for specific descriptions and requirements of the SSPS playback units. Every response must include support for standard definition NTSC video output. If NTSC video output requires a conversion from HDMI, the conversion should take place internal to the chassis of the SSPS playback unit. The should have the HDMI output internally converted to standard definition NTSC analog video and analog stereo audio with output connections on the rear of the chassis. The unit should be capable of outputting all signal types simultaneously unless the HDMI output is shut down by HDCP. A minimum of HDCP version 1.4 support is required on all HDMI outputs. Full compliance with the HDCP specification licensing requirements for hardware and software implementations is required on all HDMI outputs. The conversion process must not in any way alter the invisible watermark produced by the playback units during the decryption and watermarking process and the watermark must appear on all video outputs.

4.2.1. Key Management

The contractor shall provide a Key Management function. Key Management is an integral segment of the entire system. Key Management includes the installation of the security module in each device requiring the module for processing of encrypted material and watermarking capability. From a historical perspective, it is expected that 16 Navy movies per month will require encryption. The encryption shall occur at facilities mutually agreed upon by the Content Owners and Navy/AAFES. The encryption station must allow for a secure connection to be established with content owners for reception of the motion picture content. These encryption runs will most likely occur at separate times and/or on separate days. Each movie file must be treated as a separate encryption and use a unique Content Key per title. Once per calendar month, all movies encrypted since the last delivery will be consolidated and duplicated onto media transfer devices for delivery to playback locations.

Once encrypted, each piece of content will include the necessary keys to playback on all authorized, non-revoked, SSPS playback units and will also include the data necessary to revoke any SSPS playback unit that has been reported as missing or otherwise compromised. The monthly number of movies identified above is provided for historical information only and should be considered as indicative of the average number for any given month.

4.2.1.1. Key Management Authority

The primary function of the Key Management Authority is to provide assurance that content is enabled only for authorized playback devices and that all Security Modules, Decryption Keys, Content Keys, and any other required Licensing information and Keys used in the system remain confidential. Enforcement of KMA requirements shall be contractual with licensing agreements between Content Providers, the Government, and the KMA. Access control using keys shall be managed by the Contractor’s KMA. The Contractor, through the KMA, shall be responsible for maintaining the secrecy and security of all Security Modules, all Keys and for implementing any new Security Modules and Keys if said devices and keys are compromised. The Contractor’s KMA shall be responsible for:

• Secure creation, storage, assignment and configuration control of the

Security Module, all Keys, and other device unique data (e.g., device id/serial number) for each device.

• Secure Activation of the Security Module.

• Secure updates of Security Modules as may be necessary.

• Secure creation, storage, assignment and configuration control of all

Keys.

• Revocation of the Security Modules and Keys if improper use is discovered. The Government will be responsible for requesting the revocation of a compromised Security Module or Device ID.

4.2.1.2. Revocation Performance

The KMA shall be responsible for performing the actions necessary to revoke a compromised Security Module or Device ID and for activation of a unique Security Module for each device manufactured.

4.2.1.3. Key Management Facility

The Contractor shall provide a secure environment and facility for processing Early Window Content devices and Device Keys. Early

Window Content devices with active Security Modules, Decryption Keys, and Content Keys shall be maintained within Secure Environments and Secure Facilities. Secure Facilities shall have the following characteristics:

• A clear, structurally delineated restricted perimeter.

• Physical access to secured areas is monitored and limited to authorized personnel.

• Security processes and procedures are codified and enforced, compliant with MPAA guidelines.

4.2.1.4. Key Tracking

Inventory and movement of individual Early Window Content devices and keys are tracked and traceable.

4.2.1.5. Key Management Documentation

The contractor shall document and provide its Key Management Authority policies and procedures for:

• Secure authenticated communication of data.

• Playback device activation, authorization and authentication, including handling of loading Security Modules.

• Performing Security Module Key updates.

• Creating, managing and implementing lists of authorized Security

Modules, Decryption Keys, Content Keys, and other Keys and Licenses required.

• Interacting with the Government and Content Providers.

4.2.1.6. Key Management Device Registration

The KMA shall be responsible for the registration of any devices used to decrypt the Navy/AAFES early window content. Registration of devices is the process required to prepare the unit as a secured device for use in the system in this SOW. This includes the installation or updating of any hardware, software, or firmware devices associated with the KMA’s encryption and digital rights management system. Registration also includes adding the device to the list of known units so that keys can be sent to the device for the decryption and playback of newly encrypted material.

4.2.1.7. Key Management Device Activation

The KMA shall provide a means of activating new or replacement devices used to decrypt Navy/AAFES early window content. There shall be a method where the KMA can activate the new or replacement device so that it will play material previously encrypted and delivered to the location where the replacement device will be installed. After activation, the device shall be capable of playing all previous, current, and future encrypted material in the Navy/AAFES early window content library.

4.2.1.8. Key Management Administration

The Navy/AAFES will provide the KMA the locations of every device that supports encryption to enable the KMA to maintain a list of the locations of all registered devices. The Navy/AAFES will advise the KMA of changes to be made to the registration list and provide updated registration lists. The KMA shall ship the units fully activated and the recipient shall communicate with the KMA through phone, email, or other means to confirm delivery. The KMA shall remove the player from the authorize list or send out a revocation 60 days after shipment of a device if there is no confirmation of delivery from the recipient.

4.2.2. Encoding

The contractor shall supply a system capable of taking the Content Owner’s Digital Master file and encoding it for use in the SSPS system.

4.2.2.1. Video Compression

The video codec for video compression should be MPEG-4 Part 10 (ISO/IEC 14496-10:2005). Image data parameters shall be as specified in Table 1.

The majority of content will be provided formatted for 16:9 screens. The video compression system must allow for 4:3 content to be encoded so that the visual picture of the content maintains the 4:3 ratio and shall be framed for 16:9 display presentation. Displays connected to the SSPS playback units will be 16:9 screens.

4.2.2.2. Audio Compression

The encoding system shall support the following audio codecs.

Coded Picture Format Video Encoding Resolution

Full-frame (4:3) SDTV 720 x 480 (NTSC, non-square pixels) ITU-R Recommendation BT.601-5

Widescreen (16:9) SDTV 720 x 480

(NTSC widescreen, non-square pixels) ITU-R Recommendation BT.601-5

Widescreen (16:9) HD 720P

1280 x 720 (square pixels) ITU-R Recommendation BT.709-5

Widescreen (16:9) HD 1080P

1920 x 1080 (square pixels) ITU-R Recommendation BT.709-5

Table 1: Coded Picture Format and Video Encoding Resolution (from APEX Specification 0403_2.0)

MPEG-4, Part 3 – High Efficiency Advanced Audio Coding (HE-ACC)

ISO/IEC 14496-3:2009)

MPEG-4, Part 3 – Low Complexity Advanced Audio Coding (LC-AAC)

ISO/IEC 14496-3:2009)

MPEG-1 Audio, Layer 2 (MP2) (ISO/IEC 11172-3:1993)

Audio Content shall be encoded at the data rates specified in Table 3.

Audio Formats HE-AAC CBR in Kb/s

LC-AAC & MP2

CBR in Kb/s

Joint Stereo 64 128

Dual Channel or Independent Stereo 128 256

Single Channel Monaural 64 128 Table 3: Audio Formats and Data Rates

4.2.3. Minimum Supported Coded Picture Format and Video Encoding Resolution The final system coded picture format and video encoding resolution and bitrates will be determined under contracts between the Content Owners and Navy/AAFES. At a minimum, the system must be capable of supporting Coding of audio-visual objects; MPEG-4, Advanced Video Coding (part 10), High Profile, Widescreen (16:9) HD 1080P, 1920 x 1080 (square pixels) ITU-R Recommendation BT.709-5, with bitrates up to 20Mbps.

4.2.4. Encryption

The contractor shall supply and configure all components within the Navy/AAFES System to ensure that Early Window movie content, supplied and distributed by the Government for use in Navy/AAFES systems, is protected from unauthorized access, including playback on non-authorized devices. The Contractor shall provide an encryption system; inclusive of all hardware, software, cabling, and peripheral devices; capable of encrypting MPEG transport streams for SSPS files, or multiplexed MPEG-2 transport stream data files using AES- 128/256 algorithm, Pro:Idiom, or another encryption method agreed on between the Content Owners, Navy/AAFES, and the Contractor that meets the industry requirements for early window content protection. Navy/AAFES may have contracts with multiple Motion Picture Studios and duplication labs. Contractor may provide encryption service if they meet all industry requirements or they may be required to provide multiple encryption systems. The number of and location of each encryption system may depend on the contract agreements between the Content Providers and Navy/AAFES.

4.2.4.1. Security Module

Security Module refers to hardware, software, and/or firmware-based device that will be required in SSPS playback units where encrypted material will need to be decrypted and watermarked for playback. The security module may include a secure authenticated channel between replaceable secure components. The security module shall provide all

Early Window Content security functions for the device, including decryption, key protection, authentication, and watermarking, in a secure environment. Support for invisible watermarking within the device shall occur in a secure component. The encrypted content stream of Early Window Content shall pass through the security module for decryption.

The unencrypted content stream shall not be retrievable on accessible interfaces without watermarking. Interconnections and interfaces between components of a security module shall be conducted through secure and tamper-resistant means. The contractor shall ensure the security module robustness meets the requirements of FIPS 140–1 or the latest superseding document Security Level 1. For the purpose of this SOW, the definition of operator as defined in FIPS 140–1 or the latest superseding document refers only to those individuals having direct access to the security module.

4.2.4.2. Content, Device, and Decryption Keys

This section describes one type of encryption and key process. Other encryption and key processes that meet the Content Owners security requirements will be considered. AAFES playback devices will operate under the same encryption and key process, but content shall not be cross playable between Navy units and AAFES units as each are operated as separate programs.

The encryption system shall consist of three keys, the Content Key, the Device Key, and Decryption key.

The Content Key is generated at the time of encryption and allows the device to play the encrypted file for a specific period of time. The time period specified shall be the end date of contract between Navy/AAFES and the content owner. All devices shall use the Content Key as a method to validate that the content is still within the contractual time period to allow playback and other purposes required by the Vendor’s system. The Content Key shall be unique for each piece of content. The Content Key shall contain the information to validate the content for playback on an activated, non-revoked, playback device. The Content Keys shall reside on the master encrypted file located on the encryption station server for that specific piece of content. Master encrypted file here refers to the first encrypted file created from the content provided by the Studio. Placing the Content Keys on the Master Encrypted file for each piece of content shall allow the duplication of the Content Keys for SSPS playback locations.

The Device Key is specific to a device. The Device Key is the license granting authority to play the content on a specific playback device. The Device Keys shall be generated for each piece of content. One Device

Key shall be generated for each playback device that is authorized to playback a piece of content. The Device Keys may be added to the master encrypted file or integrated at the integration and duplication level. Either way, all Device Keys shall reside one each media device used to transfer the content to the SSPS playback locations.

The Decryption key shall be unique to SSPS components procured under the SOW. The Decryption key, if properly validated by the playback device, shall allow the device to decrypt and play out the Navy/AAFES encrypted early window content. The Decryption key shall allow the decryption and playback of encrypted content on the contracted devices and shall prevent the decryption and playback of encrypted content on official/approved devices.

It is preferred that the Decryption key be unique to each playback device.

If using a commercial DRM or approved solution with unique keys per playback device, the keys for all authorized, non-revoked, playback devices shall be added either at the master encryption file stage or integrated at the Integration and Duplication level. In either case, all required keys must be included on the final duplicated media devices used for delivery to all SSPS playback locations so that when an end user receives the content all keys required to playback the content on an authorized, non-revoke, playback device will be available on the duplicated media.

The Content Key and Decryption key may be asymmetric or symmetric in design. If the Content Key and/or Decryption key are symmetric the keys shall be contained in an asymmetric package file where the keys can travel on the encrypted movie file through removable media to SSPS locations. The private key for the asymmetric package file shall reside within the security module as defined in paragraph 4.2.6.1. After encryption occurs at the lab the copyrighted content, the Content Key, Device Key, and the Decryption key shall not reside in a non-encrypted state.

On the playback device, the unit must have a valid Decryption Key, verify the Content Key is still within the contractual playback period, and then verify that the playback device is authorized to play the content based on a valid Device Key for the content.

4.2.4.3. Key Revocation

Key Revocation refers to process of removing the ability of a device to playback material after a device is considered compromised. The Key Revocation process must be identified in any response to the SOW. When the Government, Content Owners, or another party identifies a decryption device as compromised, the Government will contact the KMA with the serial number of the compromised unit. The KMA shall update the encryption system to reflect a unit is compromised and shall take actions required to remove the unit from the universe of authorized playback devices.

When a device is reported as compromised in an encryption and key system designed using a unique Device Key to grant authority to playback each piece of content, the KMA will blacklist the compromised Device and Device Keys will no longer be generated and transferred on the media devices thus disabling the compromised device from playing back all future content.

When a device is reported as compromised in an encryption and key system designed that do not use a unique Device Key to grant authority to playback each piece of content, the KMA shall produce a Revocation Key List that will contain a list of one or more Revocation Keys that the Security Module will process when content with a Key Revocation List is delivered. The Key Revocation List will render a unit unusable if it has been reported as compromised. Any new content encrypted after the compromised unit is added to the Key Revocation List shall include a Revocation Key that would disable the unit if the newly encrypted material were inserted in the compromised decryption device. The Key Revocation List shall maintain the stated capability on duplication from the master encrypted files to all media transfer devices so that any Security Module in the system shall recognize and process the Revocation Key.

4.2.4.4. Compromised Device

A lost or non-traceable SSPS playback unit with an active Security Module shall de facto be considered compromised and the contractor shall provide a means to have its Security Module (or information leading to its Security Module) reported to, and de-authorized by, the KMA.

4.2.4.5. Compromised Security Module

If a Security Module is lost, malfunctioning or has evidence of tampering, it shall de facto be considered compromised and the contractor shall provide a means to have the Security Module (or information leading to the Security Module) reported to, and de-authorized by, the KMA.

4.2.4.6. Key Revocation and Optional Renewal

Content, Device, and Decryption keys shall be revocable. Navy prefers units be renewable by contractor if a unit is compromised.

4.2.5. Watermarking

The contractor shall provide Early Window Content Security Protocol Watermarking. The watermark solution must be a Content Owner approved solution. The watermark must be invisible and forensically retrievable. The purpose of Watermarking the Early Window Content is for tracing of pirated content. Watermarking in this context is not for copy control management though copy control management information is not precluded from the Watermark. Watermarking is for the tracking of pirated content to its source, specifically the serial number of the device that was used to playback the pirated content along with the date and time of playback. Watermarking must be capable of providing forensic evidence that a specific SSPS playback unit is the source of pirated content in order to allow the Government to direct the KMA to generate and revoke a playback device. Any cost to the Government associated with extracting and identifying the Watermark must be included in the reply to this scope of work. The contractor shall ensure the Watermark does not compromise the security of the system (e.g., any private portion of the Security Module, Content Key, or Decryption Key shall not be revealed in the Watermark’s hidden value).

4.2.6. Encryption Protection Rights

The contractor shall not allow components and end items supplied under this contract that include features supporting the security of the Navy/AAFES early window content protocol to be sold in the general consumer market. The statement relates to items that are specific to the encryption on Navy/AAFES content including items such as any private keys and any software, hardware, or firmware updates required for the system to operate in a secure environment…