Enabling DRM-preserving Digital Content Redistribution

Srijith K. Nair, Bogdan C. Popescu, Chandana Gamage, Bruno Crispo, Andrew S. Tanenbaum

Vrije Universiteit, Amsterdam

Outline

Introduction

System Model

Compliance - Devices & Testing

Proposed Protocol

Secure Storage

Threat Model

Payment & Privacy

Introduction

Rapid spread of personal digital devices.

Providers want to exploit new technologies.

They want to remain in control though.

Currently very few distribution points of digital content.

Allow consumers to act as distributors!

System Model

Compliant Devices

Designed to enforce content policies.

Made, certified by licensed manufacturers

Requirements

SHA-1, RSA, AES

Limited secure storage,

Limited secure scratchpad memory

Compliance Testing

Device embedded with asymmetric key pair.

Private key stored in secure tamper resistant hardware.

Public key certified by manufacturer.

Public key of licensing organisation forms root of trust.

Compliance Testing

‘A’ sends its public key, associated certificate and manufacturer’s credentials to B.

Using common root of trust, B verifies A’s manufacture’s credentials and A’s public key.

Content Distribution

Mutual Authentication

[M]K, [K]yC1, R, σ, Λ

M= Content, R= Rights,σ= Metadata

Λ= [h(yP,yC1,M,σ,R)]XP

Request content

Content Redistribution

Request content

Mutual Authentication

[M]K’, [K’]yC2,R,R’,σ,Λ,Λ’

Ψ

Λ’ = [h(yC1,yC2,M,σ,R’)]XC1

Ψ = [h(yC1,yP,[M]K’,σ,R’)]XC2

check M, [payment]

Secure Storage

Content stored in encrypted format with encryption key further encrypted with device public key.

License file susceptible to tamper.

Use a Content License File to list license and hash of (encrypted) content.

Each CLF’s hash is stored in secure memory.

Secure Storage

CLF

compute hash

Hash ...

Hash ...

Hash ...

= ??

- update rights

- calculate hash of new CLF

- store new hash securely

Yes

Threat Model - Old Threats

Extraction of copyrighted content from circumvented devices

Extraction of cryptographic keys from circumvented devices

Schemes already exists (watermarking, traitor tracing etc.) to handle these threat.

Can be incorporated into our protocol.

Threat Model - New Threats

Content masquerading

Countered by securely associating metadata σ with content item.

Untrusted storage backup

Associate a version number in form of CLF to dynamic licenses.

Circumvented devices

Identify (using Λ) and revoke such devices.

Payment

Various payment models possible

One off payment, commission based etc.

Several payment schemes easily incorporated into protocol.

Specific payment protocol outside scope of this paper.

Privacy

Λ used to identify circumvented devices can be a privacy ‘threat’.

Individual devices identifiable from Λ.

Remains an open problem.

Mitigation possible by requiring content providers to use privacy preserving software stacks.

Issues

Identified a trivial replay attack in the protocol

Fix identified

Need for ‘fair’ exchange between consumers

Modification in protocol + use of offline TTP

Demo system currently infeasible

Questions?

Mutual Authentication

ISO/IEC 9798-3

C1 →P: NC

P →C1: NP,NC,[NP,NC,C]XP

C1→P: NC,NP,[NC,NP,P]XC

Content Redistribution

Provider to Consumer

C1 → P: request content

C1 ↔ P: mutual authentication

P → C1: [M]K, [K]yC1, R, σ, Λ

Λ= [h(yP,yC1,M,σ,R)]XP

σ= Metadata

M= Content

R= Rights

C1 →P: NC ISO/IEC 9798-3

P →C1: NP,NC,[NP,NC,C]XP

C1→P: NC,NP,[NC,NP,P]XC

Content Redistribution

Consumer to Consumer

C2 → C1: request content

C1 ↔ C2: mutual authentication

C1 → C2: [M]K’, [K’]yC2,R,R’,σ,Λ,Λ’

C2 → C1: Ψ

Λ’ = [h(yC1,yC2,M,σ,R’)]XC1

Ψ = [h(yC1,yP,[M]K’,σ,R’)]XC2

PowerPoint Presentation

1601-01-01T02:00:00