The primary goal of security and authentication systems is to keep intruders out, but this militates against granting access to legitimate users without putting obstacles in their way. Essence and metadata need to be reliable and determining the provenance of these is challenging at times.

It means that security, authentication, validation and verification are closely related, and while they each exist in different domains they depend on each other for their implementation:

• Authentication is all about allowing access without compromising the protection that denies access to intruders. Authentication is an intellectual function using ‘secrets’ or biometrics that are owned by an individual.
• Validation is relevant when using content from outside sources. It indicates whether the content is legitimate and has not been tampered with. Validation is a technical function using tools such as C2PA.
• Verification comes into play after content has been validated. Fake information needs to be eliminated by checking it against multiple sources. Content could have come from a reliable source but still not be accurate. Verification is an editorial function.
• Security aims to prevent access whilst at the same time relaxing it in a very controlled way that allows authenticated access. Security is a physical function based on IP technology solutions.

Let’s address each of these as separate topics.

About Authentication

AI generated content is reaching epidemic proportions. The high-profile incidence of misreported fake news amplified by prominent social media users is swamping the real news agenda. The ability to establish authenticity in contributed content is a critical challenge for broadcasters.

Apply these authentication tests to content:

• Is the provenance of the asset as stated?
• Has the asset been tampered with?
• Apply these authentication tests to interactive tasks involving users:
• Is the user who they say they are?re they attempting to connect or access from a permitted location?
• Is the asset they are trying to access available to them at this time?
• Is the operation they are attempting allowed?

The means of authentication might differ in each case. These solutions are routinely used:

ST 2138 - The Catena Control Plane

ST 2138 is relevant here because it has a sophisticated authentication and validation mechanism to prevent unauthorized use of the systems it is managing.

Catena was originally developed by Ross Video based on its earlier openGear platform. It has become SMPTE standard (ST 2138) and is currently under review.

ST 2138 implements a control-plane between microservices and larger applications. It complements the already existing ST 2110 and NMOS architectures to provide a means to devices and services using JSON formatted messages transmitted via gRPC.

ST 2138-50 deals with security. It describes access tokens and web signatures carried in the messages and how they are checked. Each incoming message is validated against the permissions for the sending device to ascertain that it is allowed to request a particular action. Validation and authentication are performed by a separate policy engine running in the security-control-plane. ST 2138-50 describes all of this in detail.

Devices are collected into zones which are granted various levels of trust. Interactions from untrusted zones are managed according to the NIST Zero Trust Architecture (specified in the standards document NIST 800-207).

Some open-source Catena resources are available in the SMPTE and Ross Video GitHub repositories here:

We will look at ST 2138 in more detail later on as it matures.

About Validation

Validation checks the provenance of incoming media assets. They may have come from a reliable third-party source or end-users. Protective security seals or tags need to be tamper-proof.

Coalition For Content Provenance & Authenticity (C2PA)

The Coalition for Content Provenance and Authenticity (C2PA) is a very robust solution using cryptographic techniques to create a secure credentials package to accompany a media asset.

C2PA was founded in 2021 and provides an open and licence free standard for publishers, creators and consumers to establish the provenance of digital content. An asset is granted a set of Content Credentials that validates it during its entire lifecycle within the digital ecosystem.

The standard has been developed over several years by a community of over 500 large and small content creation companies, which includes AI developers as well as broadcasters and social media platforms.

According to the C2PA web site, the statistics are astonishing.

• 400 quintillion bytes of content is created every day.
• 90% of that content has been created within the last two years.
• Future growth rates are expected to accelerate.

This all means that the amount of content being delivered is already well beyond the available human resource to check it. We need to know where it originated and what has been done with it in a way that can be automated.

How C2PA Works

Content credentials can be embedded inside the asset file similar to how EXIF and other camera data is added to photographs – EXIF was never extended to support video although there are proprietary solutions. Audio files can use ID3 tags for similar identification purposes. EXIF and ID3 can easily be altered without exhibiting any evidence of tampering.

C2PA content credentials are securely signed, can be added to any kind of media file and cannot be tampered with. This is core functionality.

An optional invisible watermark can be imprinted onto an image. This uses steganography techniques to hide digital data in a way that is not visible to the human eye. It is robust and withstands manipulation of an image. The watermark can be extracted to discover the content credentials.

The credentials and essence can be stored in other locations, aiding discovery of an asset when it is not present. C2PA can generate a digital fingerprint from an asset as a key to locate the stored credentials to determine its provenance.

When assets are manipulated, each stage of that process can be recorded in the credentials to provide a historical transcript of the changes, including where they were done, when and by whom.

At the moment, credentials can be embedded into these file types. Others are being added:

• ISO Base Media File Format (BMFF) including all the MPEG video and audio file formats.
• PDF 1.7.
• PDF 2.0.
• JPEG 1.
• JPEG XT, ISO/IEC 18477-3.
• JPEG XL, ISO/IEC 18181-2:2024.
• PNG.
• SVG.
• GIF.
• ID3.
• Digital Negative or DNG.
• TIFF/EP.
• TIFF (v6).
• RIFF.
• Multi-Picture Format (MPF).
• Open Font Format.
• OpenType.

Deploying C2PA

C2PA credentials support is being built-in to new hardware such as mobile phones and cameras. Devices can tag images and video footage right away. Content editing tools are adding support for C2PA so authors can tag their image, audio and video creations as they are saved. If the credentials are present and a viewer supports C2PA, a small ‘Pin’ is placed in the corner of the image when you roll a cursor over it. Clicking on the pin will reveal the Content Credentials manifest.

It looks like this:

Validating C2PA Tagged Content

To validate the authenticity of an asset:

1 - Go to the C2PA site where there is an authenticity checker:

2 - Drag your asset over the input bin.

3 - Your web browser will upload the asset.

4 - C2PA validates the asset and displays the Content Credentials if there are any present in the file.

Checking that content has not been tampered with does not detect fake content on its own. It only proves that the content has not been modified by unauthorized means. It might still be genuine, but faked from the outset.

About Verification

Having validated content with C2PA, the editorial team must verify that it is not fake. This involves checking against multiple independent sources.

Image locations can be checked against maps, satellite imagery, Google Street-View and historical photographs.

Facial and voice recognition are becoming more reliable. Whilst AI might simulate both of these, AI detection is keeping up with the progress and may spot the fakes.

The BBC verify team are adept at this and their techniques are described in various articles that are worth studying.