Security Requirements of Digital Rights Management

1
Security Requirements of Digital Rights Management
Mayur Kamat Texas AM University
2
Introduction

• Information runs the Web
• 100 billion market for digital content on the
  Web Meta Group
• Information protection Imperative for viable
  business proposition
• DRM - Digital enabling right holders revenue
  system by secure content marketing rights
  enforcement

3
Digital Rights

• Increasingly, the Internet is being used a source
  of digital content like text, audio, video,
  images, etc
• Ease of copying of digital content makes Internet
  suitable for piracy

4
Digital Rights

• Rights consist of
• Permissions - what you are allowed to do
• Constraints - restrictions on the permissions
• Obligations - what you have to do/provide/accept
• Rights Holders - who is entitled to what
• DRM Digital Management of Content Rights

5
Advantages

• Enables Digital Commerce
• Digital Content Protection
• Secure Content distribution marketing
• Ensures content authenticity

6
Secure Wrapping/ Encryption
Secure Wrapping/Encryption
Secure Wrapping/ Encryption
Publisher
DRM Packaging Software
DRM Packaging Software
Courtesy Content Directions Inc.
7
Content Hosting
Secure Wrapping/ Encryption
Publisher
Publisher
DRM Packaging Software
Meta-data
Courtesy Content Directions Inc.
8
Secure Wrapping/ Encryption
Secure Wrapping/Encryption
Secure Wrapping/ Encryption
Content Hosting
Publisher
Publisher
DRM Packaging Software
DRM Packaging Software
Meta- data
-Visited Publisher website, and been referred to
copy of encrypted content -Linked to encrypted
content from an index or library
catalog -Received the encrypted file from a
friend or colleague (superdistribution)
Customer
Courtesy Content Directions Inc.
9
Secure Wrapping/ Encryption
Secure Wrapping/Encryption
Secure Wrapping/ Encryption
Content Hosting
Publisher
Publisher
DRM Packaging Software
DRM Packaging Software
Meta- data
Rights Clearinghouse

• Checks user ID
• Checks rights assigned (if any) to user by
  Publisher
• Takes payment

• Issues key or Permit

• Reports to Publisher (either aggregate sales
• numbers or individual customer information)

Customer
Courtesy Content Directions Inc.
10
Secure Wrapping/ Encryption
Content Hosting
Publisher
DRM Packaging Software
Meta- data
Rights Clearinghouse
Content Distributors/ Syndicators/ Aggregators

• Checks user ID
• Checks rights assigned (if any) to user by
  Publisher
• Takes payment

• Issues key or Permit

• Reports to Publisher (either aggregate sales
• numbers or individual customer information)

Customer
Courtesy Content Directions Inc.
11
Security Requirements

• Inherent security requirements
• Cater to hostile user over hostile network
• Why not apply existing security solutions?

12
Trusted Software Component

• Enforce interests of content owner
• User has unlimited time and resources to bypass
  content protection mechanisms
• Software component, hence must be able to
  preserve its integrity in hostile environment

13
Trusted Software Component

• Functions of TSC
• Perform integrity checking
• Decrypt content
• Enforce rights
• Provides assurance to content owners
• Requirements of TSC
• Reverse-engineering-proof
• System Portability

14
TSC How to build one?

• Use of tamper-resistant software
• Include entropy along with source code
• Entropy changes, TSC compromised application
  closes down
• Works like checksum error correction
• Creates programs that are difficult to analyze

15
Basic Elements of TRS

• Changing order of instructions
• Inserting Spoof Code
• Source level code encryption
• Using complex TRS generator commercially
  available

16
TRUSTED SOFTWARE COMPONENT Rights
Enforcement
S E R V E R
Content Display
User Authentication Module
Content Decryption Module
Content Storage
Super Distribution
Encrypted Content Key
Authentication
17
Superdistribution

• Simple concept do not restrict replication,
  restrict usage
• Turn customers into distributors
• Reach out to target customers without much
  efforts
• Prevent piracy
• Needs universal ID, secure implementation

18
Conclusion

• Rights enforcement - Means for securing content
  business
• DRM has solutions for information marketing
• Traditional security measures cannot be directly
  implemented for DRM

19
Conclusion

• Concentration of development efforts on the
  client-side software (TSC)
• Use of TRS for coding the TSC
• Superdistribution New mantra for content
  marketing

20
THANK YOU