Protection Systems, from CP, CAS to DRM, part A of 2

Sistemi Collaborativi e di
Protezione (SCP)
Corso di Laurea in Ingegneria
Part 1a (2012-2013)– sistemi di protezione

Prof. Paolo Nesi
Department of Systems and Informatics
University of Florence
Via S. Marta 3, 50139, Firenze, Italy
tel: +39-055-4796523, fax: +39-055-4796363
Lab: DISIT, Sistemi Distribuiti e Tecnologie Internet
http://www.disit.dsi.unifi.it/
paolo.nesi@unifi.it http://www.dsi.unifi.it/~nesi

Sistemi Collaborativi e di Protezione, Univ. Firenze, Paolo Nesi 2012-2013 1

Part 1a: sistemi di protezione

Distribution models
Terminologies
Business Models & Value Chain
Copy protection
Conditional Access Systems
Digital Rights Management
Content Modeling and Packaging
Licensing and content distribution
Creative Commons Licensing
Example of Microsoft Windows Media


Content Services Aspects
Scalability:
 From few to millions of transactions per hours
 From few to millions of subscribed users
 From few to millions of different content items
Availability and
 High reliability of the service, no or few interruptions
Accessibility:
 Accessibility of the service, broadcast/cellular coverage
 User accessibility aspects
Other aspects discussed in the course
 Privacy of the customers
 Intellectually property management and protection, IPMP
 Multichannel distribution
 Interoperability of content on devices


Architectures

A. Content/good distribution

B. Content/good production and management

C. Content/good Protection and Security

D. Content/good Modeling and Processing


A) Content distribution models
Download, P2P download, …:
 1:N: one sender N receivers/users
 N copies, propagation of seeding/sources sites
 Network costs from O(N)  O(1)
Broadcast Streaming (e.g., MPEG2-TS):
 1:N: one sender N receivers/users
 N users that play the same content at the same time
 Network costs O(1)
 DVB-T, DVB-S, DVB-H, DVB-SH
VOD, progressive download, P2P streaming/progressive:
 1:1 stream processes, one sender process for each
receiver/user, that play the same content a different time
 Network costs O(N) - may be going to O(1) if ….


B) Content production and management
Content Processing:
 adaptation,
 production,
 formatting,
 packing, etc.

Scalability GRID for content processing:
 UGC management
 Indexing for search,
 production on demand,
 massive production
 transcoding


C) Content Protection and Security, aspects
CP: Copy Protection
CAS: Conditional Access Systems
DRM: Digital Rights Management
Based on technologies such as
 Certification of: content, users, devices, etc.
 Authentication of: users, actors, devices, etc.
 Signature of: content, DLL, EXE, ..
 Identification of: content, users, devices, etc.
 Watermark and fingerprint of: content,
descriptors, ....any....
 Coding and Encryption of: ......everything.....


D) Content Modeling and Processing
The content model impacts on:
 Format: XML, binary
 Content gathering and ingestion
 Production and production-process definition
Workflow Management systems
Cooperative work
 CMS, DMS, Content/Media Management Systems
Database management systems
query support, distributed queries, etc.
 Content description for
Search, classification/indexing, retrieval
 Content protection for enforcing respect of
IPR: CAS, DRM, ....
 programme/guide production
EPG, GuidePlus, ShowView, TVAnytime, etc.


Acronyms and Definitions
IPR: Intellectually Property Right
CA: Certification Authority, chain of certificates
TPM: Technological Protection Model
FTA: Fault Tolerance Architectures
VOD: video on demand
PPP: pay per play
PPV: pay per view
VOIP: voice over ip
TS: Transport Stream
EPG: elecronic program guide
Etc.



Distribution models
Terminologies
Copy protection


Terminology

Work

The artist creates a
Work
The work may be
used to produce
several
manifestations
Manifestations Resources

Some Actors of the value chain, “definitions”
Right/Content Owners, artists, etc.
 who has the rights on the initial work, non digital
Content Producers, Publishers
 Who is producing the manifestations of the work, define its
rights, may produce the digital resources or not, etc.
Content Integrators, aggregators
 Who is Integration/aggregation: resources + metadata ++ ,
added value, etc., may be add other rights, etc.
Content Distributors,
 Who is distributing digital content
Final Users,
 Who is using (or should use) the digital content on behalf of the
rights obtained
Users, in general
 All the above actors that use in some way content on the basis of
the rights obtained

Simplified Traditional value chain
Production Collecting
Authoring

Processing
(adap, fp, etc.)
Control
Supervision
Packaging
(integration, etc.)

Pay
Protection

Distribution
Usage


Traditional value chain Issues
Producers
 Does not protected the content

Protection performed before production
 By the distributor
 By a specialized third party

Since B2B areas are (production, licensing, integration, etc.):
 Considered trusted
 Based on paper contracts
 Contracts are produced on the basis of a limited and not standard
terminology, so that they are not easy interpreted and transported
on other media, or channels, etc.
 Recently in Digital with XML, with DDEX


Traditional value chain Issues
Monitoring about what is done on the content rights on the:
 Authors, integrators and producers cannot verify what has been
sold, they may ask to each single
Distributor (via reports, see DDEX, MPEG-21, etc.)
• managing one or more channel
Collecting Society, e.g.: SIAE, SGAE, ...
• Managing one or more territorial area and rights type
Etc.
The distributors:
 Controls the selling of content depending on the business model:
Pay per play, monthly subscription, etc.
 In some cases do not control/verify the exploitation of each single
right but only the access to the content.
High complexity of keeping under control all the user actions,
user behaviour, action logs, event reporting, etc.


E-Commerce Services Aspects
Business Model (who is going to pay, which is the flow of
money)
 how/who/when to give money for some goods/service ?
 How is created the revenue stream ?
 Subscription, Pay per play, etc..
Transaction Models
 technical aspects of business transaction
Security: certification, smartcards, etc.
Mission Critical Applications
Subproblems: payment solution
 Accounting: for example in phone bill
 Banking: for example on your bank account
 Micropayments: for direct payment, small amounts
 Model: prepaid or post paid
 Cards: Prepaid cards, Credit Card, temp cards, etc.


Business Models
Are business models
 Monthly subscription to get all videos of channel, for example
SKY
 Generic subscription to have in your monthly bill a price for
each item you buy, for example Pay per Play
 Prepaid card: to pay in advance a certain credit that is
consumed every time you buy an item, for example the
prepaid cards of Mediaset on DVB-T/DTT
 Etc.


Classification of Transaction Models
B2B: Business to Business
 Among digital good: producer, publishers, integrator,
resellers, distributors, etc.
 Each of them add a value and thus charge to final prince of
the digital good, …
B2C: Business to Consumer
 From distributors to consumers
 The final part of the value chain
C2C: Consumer to Consumer
 File and good sharing
 UGC (User Generated Content) sharing
 Recently IPR management

B2B2C
 Integrated B2B to B2C


Ex: Broadband VOD value chain

Source EITO2005


Distribution models
Terminologies
Copy protection


Copy Protection solution
Naturally digital items can be freely copied
 The copy is a feature of the operating system, file
system
 The operating system cannot be typically controlled
 Microsoft is going to enforce more control on the
Operating System

CP Solution: prevents the Copy of digital content
 Programs: hardware key
 Holes in FD
 Special formatting in CDs/DVDs
 Etc.


Utilizzo della crittografia
Encryption è il processo che codifica un
messaggio in modo da nasconderne il
contenuto
Si basano sull’uso di parametri segreti
chiamati chiavi
Si dividono in due classi fondamentali
 Chiavi segrete condivise (secret-key)
 Coppie di chiavi pubblica/privata (public-key)
Segretezza e integrità
Autenticazione
Firma digitale


Algortimi di crittografia
Un messaggio si dice criptato quando il mittente applica
alcune regole per trasformare il testo originale (plaintext) in
un altro testo (ciphertext)
E(K1, M) = {M}K

Il ricevente deve conoscere la trasformazione inversa per
ritrasformare il ciphertext nel messaggio originale
D(K2, E(K1, M)) = M

K1 = K2

K1 != K2


Scenario 1: secret communication
Alice vuole inviare alcune informazioni segretamente a Bob
 {M}=E(KAB,M)
Alice e Bob conoscono entrambi la chiave segreta KAB
La comunicazione è segreta finchè KAB non è
compromessa

{M}
Alice E(KAB,M) D(KAB,{M}) Bob

KAB KAB


Scenario 3: authenticated with public-key
Richiesta chiave pubblica
KBpub
Alice Key distributor
KBpriv
Determinazione chiave di sessione KAB

Alice E(KBpub,KAB) {KAB} D(KBpriv,{KAB}) Bob

KBpub
KBpriv
KAB
Cumunicazione sicura
{M}
Alice E(KAB,M) D(KAB,{M}) Bob

KAB KAB


Scenario 4: digital signature

Alice H(M)

KApub

M M, {H(M)} M
Alice Bob
E(KApriv,H(M)) D(KApub,{H(M)})

KApriv M H(M)

Bob H’(M) Confronto


Firma elettronica
Come la firma “del mondo reale”, la firma elettronica
ha valore se posta su un particolare documento

Una firma “di pugno” certifica che:
 Il firmatario ha deliberatamente sottoscritto quel
documento che non è stato alterato da nessun’altro
 Il firmatario è sicuramente la persona incaricata a
firmare tale documento
 Il firmatario non potrà in un secondo momento negare
di aver sottoscritto il contenuto del documento

Un segreto che il principal firmatario possiede è
considerato come la sua “calligrafia”


Firma elettronica e documenti
I documenti informatici sono più facili da generare,
copiare da alterare
Non basta legare al documento un’identità in
qualunque forma (testo, immagine)

È necessario legare indissolubilmente
l’intero documento
con l’identità del firmatario

I documenti elettronici sono più resistenti alla
falsificazione di quelli cartacei, perdono però il
significato del termine originale


Firma elettronica e chavi
Il documento M firmato consiste nella sequenza:
M, E(KA, H(M) )

Se per criptare viene utilizzata una chiave segreta il
ricevente può essere sicuro dell’identità del firmatario A

Nella crittografia asimmetrica (preferibile per questo tipo
di sicurezza) si utilizza la chiave privata (poiché è
segreta) in modo che chi possiede la chiave pubblica
possa autenticare il mittente


Funzione Digest
Digest: funzione H(M) che produce un'impronta del
messaggio e deve possedere le seguenti proprietà:
 accetta un messaggio di dimensione variabile
 produce un digest di lunghezza fissa
 è veloce da calcolare
 è difficilmente invertibile
 è estremamente improbabile che messaggi diversi
generino lo stesso digest

Se M e M’ diversi danno lo stesso digest H(M) è
possibile che avendo firmato M il ricevente dichiari
che è stato firmato M’


Part 1: sistemi di protezione

Distribution models
Terminologies
Copy protection


Systems that controls the access to the content
 Typically used on streaming towards STB/Decoders
 Copy is assumed not possible since the content is not stored
locally and neither accessible to the final user.

For PC:
 Partially suitable for open platforms such as PC
On PC: SSL, HTTPS, etc.
 Temporary storage of smaller content on the disk, may be
encrypted
For STB:
 The most interesting and diffuse solution


Systems that controls the access to the content for STB
 Streaming towards STB/Decoders
DVB-T, DVB-S, DVB standards for CAS
 Copy is assumed not possible since the content is not locally
stored and accessible to the final user. Recently can be
temporary stored, see MySky.

Protection and solution
 Streaming in broadcast
 Adoption of MPEG-2 TS (other models such as RTSP)
 For example: Irdeto, Nagravision, NDS
 Key distributed into the stream, accessible with another key
 Adoption of SmartCard for some business models
 Adoption of the Return Channel for some business models


DVB-T/DVB-S
DVB Server
Millions of STBs

Business model:
Subscription: monthly rate
Pay per View: specific activation
via SMS, return channel and GUI,
web, etc.


La televisione digitale terrestre …

Un po’ di storia
1991 Nasce l’European Launching Group [ELG]
09/1993 Il MoU (Memorandum of Understanding): nascita del
DVB Project (Digital Video Broadcasting)
11/1993 MPEG-2 (ISO/IEC 13818-2) viene approvato
dall’ISO
10/1996 Il MoU viene rivisto e integrato con l’interattività e
l’accesso condizionato.
1/2000 Approvata la piattaforma
5/2001 Parte la fase DVB 2.0


Il sistema DVB terrestre (DVB-T)…

Set Top Box
(STB)


La Multimedia Home Platform (MHP)…

La piattaforma DVB-MHP

MHP 1.0 nel luglio 2000, MPH 1.1 nel giugno 2003
Indipendenza dall’ambiente HW e SW
Approccio a livelli per le API MHP

I Profili Internet Access

Interactive Broadcast

Enhanced Broadcast


Il digitale terrestre e Java…
Le applicazioni MHP
Java Virtual Machine (JVM)
API Java Media Framework (JMF)
API JavaTV
Astrazione dalle specifiche HW
Nessun vincolo con lo standard DVB
Xlet vs Applet
L’interfaccia Xlet
La classe java.tv.XletContext
L’interfaccia grafica
Java.awt.* java.havi.ui.* org.dvb.ui.* org.dvb.event


I meccanismi di trasmissione…

MPEG2-DVB System
 Il Program Stream (PS)
 Il Transport Stream (TS)
 La Program Service Information (PSI)
 Program Association Table (PAT)
 Program Map Table (PMT)
 Conditional Access Table (CAT)
 Newtork Information Table (NIT)


DVB-T Server Side


MPEG2-TS e DVB-T
Il Program Stream, PS, integra nel tempo I vari programmi
producendo uno stream integrato
Il MUX di program integra contenuti di vario tipo nello stesso
Stream producendo un TS
 Program stream, info di CAS, XLET application, EPG
 Questo puo’ essere integrato con quello di altri canali:
 Ogni TS puo’ avere vari PS, cioe’ vari canali al suo interno
Il MUX viene trasmesso su una sola frequenza e puo’ pertanto
essere ricevuto tutto insieme dal tuner.
 MUX Canale satellitare: 34-38 Mb/s ≈ 8 programmi
 MUX Canale terrestre: 20-24 Mb/s ≈ 4 programmi
La selezione del singolo canale avviene tramite una demux
che seleziona I pacchetti del canale dal PS.


Distribuzione


CAS protezione
Cifrare il TS da lato Server per poi abilitare lato client solo
quelli che stipulano un contratto,
 E pertanto solo questi ottengono una licenza

La cifratura avviene tipicamente con algoritmi standard
(scrambling) e vengono cambiate le chiavi molto spesso.

Oltre a questo, nel TS vengono anche inviate alcune info che
possono essere usate per recuperare la chiave di decifratura.

La chiave non viene inviata in chiaro per ovvi motivi.


Sk list

UK


Sistema di Chiavi
CW: Control word, chiave utilizzata per cifrare il flusso digitale
SK: Service Key, serie di chiavi,
 una per ogni servizio/canale contenuto nello stream,
 Per ogni SK viene creato un oggetto cifrato chiamanto ECM
UK, User key, permette all’utente di ottenere la SK, decrypt.
 Ogni utente ha un UK diversa,
 Per esempio nascosta in una SMARTCARD
ECM: Entitlement Control Message, ECM(SK,CW)
 viene inviata in broadcast
 contiene la CW cryptata tramite la SK
EMM, Entitled Management Message, EMM(SK,UK)
 viene inviato in broadcast
 contiene una SK encrypted che puo’ essere decifrata solo con una
UK

Client side:
1. arriva un EMM per un certo servizio i dallo stream che viene
passato al SecProcessor che ha la UK (user key)
2. Il SecProcessor produce la SK(i) (service key) se possibile, cioe’ se
abbonato al servizio
3. Questa SK(i) (ve ne e’ n, una per ogni servizio/canale) viene usata
per estrarre la CW (i) da ECM (i)
4. CW(i) viene usato per decriptare il ProgStream/servizio (i)
Server side:
1. Le CW per ogni servizio i sono generate in modo periodico
2. SK(i) (n elementi) sono generate per ogni servizio degli n
3. SK(i) viene usata per codificare CW(i) into ECM(i) del servizio i
4. La User List viene usata per codificare le n SK(i) into m EMM (j,i),
un EMM per ogni servizio e per ogni utente.


ECMn = { per ogni servizio i si ha SKi, ECM i = Encrip (CWt, SKi) }
Con: i di n; dove: n e’ il numero di oggetti/servizi
CW t cambia nel tempo
 n ECM, uno per ogni SK
 complessita’ O(n)
 Invio ogni 2 secondi, in anticipo
 I servizi possono essere canali diversi, PS diversi

EMMm = { per ogni utente j di m: EMM j,i = Encrip (SKi, UKj) }
Con: j di m; dove: m e’ il numero di utenti
Con: i di n; dove: n e’ il numero di oggetti/servizi
 m EMM, uno per ogni servizio i-esimo SK (Service Key si trova dentro la
EMM e viene decripted tramite la UK)
 complessita’ O(mn)
 Invio ogni 10 secondi, in anticipo


The Decoder


Effectiveness of Protection, and example
The cards have to be very hard to be cloned, but they are
standards. So that additional features are added to make
them different from the standard one.
The keys are periodically changed, period is very short.

Attack:
 Substitute the smartCARD with one capable to extract the key
and make it accessible to other decoders in the same house or
via internet (on internet other users may use this key in their ad
hoc smart card).
Defense:
 Detection of non correct cards measuring several aspects:
patterns, temperature as a function of workload, identification of
the electronic circuit contained, etc.


EPG, Electronic Program Guide
There are several standards
 TvAnyTime adopted by BBC: (limited channels)
accessible via specific private services
 SKY model and service (many channels)
Publically accessible via web in XML
 GuidePlus (many channels)
broadcasted via a terrestrial channel not digital MTV now in
Italy.

Once obtained the program description via EPG
it is possible to know:
 starting time, ending time
 additional metadata and descriptors
 Etc.


AXMEDIS
STB tid CA
users PPV+others STB
STB
CRM Usr Requ. verfication
registration
SMS StbMS
WEB SC

BO-web
CRMs uid Producer
shops SCMng
call cntr
IntPS cid pid

Return channel
Cd Gen KMS PPV+other
PaySys
interactive
EPG EPG srv Billing PPV
subscriptions CDN
Content gathering

TS
PS Play out

TS mux
Applications EPG

protection
Audio
Interactive Play out
regia
mux
Video applications Play out
Content Audio
in non video Play out
compliant users
formats
Content processing
Live
events TS application advertising content
manager manager manag. Syst. DRM ch
DRM ch5
app adv cnt md
CM/CAS/DRM DRM server


Pros and Cons of DVB CAS
Pros: Cons:
Cheap for the distributor, 1 Cost of the decoder
sender N RX, if DVB-T or S Cost of the cards
Final user privacy respected Hardly replicable on PC
depending on the business
High costs for VOD, Video on
model to get the smartcard
demand.
Suitable for S, T and H and SH:
High costs for DVB-H, DVB-SH
see DVB-H
Limited rights on the content
now recording, but with
locked STB!
only one TV!
Even if one has paid cannot
see again the video 10 times
in the rest of its life!


Standard Digital TV


DVB-S


References
http://www.dvb.org
http://www.mhp.org
http://www.interactivetvweb.org/
http://www.etsi.org
http://erg.abdn.ac.uk/research/future-net/digitalvideo/
http://www.dgtvi.it
Memorandum of Understanding
http://www.dvb.org/documents/mou2001.pdf
List of DVB Members,
http://www.dvb.org/index.php?id=27
DVB Worldwide http://www.dvb.org/index.php?id=228



Distribution models
Terminologies
Copy protection


Rights Management
 general term many times abused, confused, ...

Management of Digital Rights
 Limited to the management of rights of
digital content ?  NO!!!
Digital Management of Rights  YES!!!
 More correct and reasonable
 Management of both rights for original works and
related manifestations, digital resources, etc.
 in many solutions DRM is not intended in this way


 A set of technologies and solution to cope with
Digital Management of Rights

1st generation of DRM were covering:
 security and encryption
 prevent non authorized copying, i.e., CP solutions
2nd generation of DRM covers:
 Content: description, identification, trading, protection,
 monitoring, and tracking of all forms of rights usages
over contents, including management of rights holders
relationships


Aim of …… Digital Rights Management
To allow exploiting digital content functionalities (rights) in a
controlled manner
 To who has been authenticated/certified
 To do what (are the rights) is defined in a formal license
 Verifying/Control/Supervise if the above conditions and others
are respected
 By using technologies to protect content (e.g., encryption,
fingerprint, watermark, etc.)

Cons:
 Registration of users (in some case can be relaxed)
 Authentic. of users and/or tools/terminal/devices
 Control of users
It has to be supported by a set of additional technical solutions


Motivations for Digital Rights Management
Prevent the rights exploitation to who has not acquired
the rights
 from some rights owner or authorized reseller
Verifying/Control if the allowed rights are respected:
 In the whole value chain or at least at the end users
Support/adoption of protection solution to
 Enforce the rights control on the players and tools by which the
users are accessing to the content.

Recently, strongly rejected by the final users since most the
DRM solutions also enforce some limitations with respect to
the TRU (traditional rights usages):
 Cracking the DRM solutions
 Redistributing the content violating the IPR via P2P, Social
Network, direct contacts, etc.


Motivations for Digital Rights Management
The collection of money/revenues (creation of revenue
streams) related to the exploitation of rights is
traditionally/partially covered by Collecting Societies
(clearing houses)

Collecting Societies
 Are Focussed on one or more rights types
thus, one or more for each Country/area
 Guarantee/protect the interests of the content/rights owners
 Are territorially distributed, while in Europe some liberalisation has
been performed, permitting in some measure the competitions
among different European CS

They are some common agreement among the majors
Collecting Societies in Europe: SIAE, SGAE, SAGEMA, etc.


Simple protection with Key sending
Selling Server

License
License distribution and Ask for the
Production player/device License

verification and
Content
supervision
deprotection
and rights
Get the content exploitation
Content Distribution
Packaging, content Server
Protection

Production and
distribution Player device


What Should be the DRM
To allow exploiting the (digital) content functionalities
(rights) in a controlled/supervised manner
 To who has been authenticated/certified
 To do what (are the rights) is defined in a formal
license
 By using technologies to protect content (e.g.,
encryption, fingerprint, watermark, etc.)
 Verifying/Control/Supervise if the above conditions
and other issues are respected,
including the possibility of keep trace of the activity
performed by the users and reporting/using them to the
distributors (this part is disputable since for the privacy)


Technical issues behind the DRM
Digital Encryption/decryption
 DRM may use strong encryption (# bits) never been cracked

Digital signatures
 content may be digitally signed to prevent tampering
 license has to be digitally signed, etc.
 event reporting has to be digitally signed, etc.

Unique identification of elements:
 Users, Content Objects, devices/players, ...
 Distributors and rights, ...

Authentication and certification of users and devices
 To prevent compromised players or non trusting users to receive or
distribute other content, ….
 Black list of devices, licenses, users, etc.


Technical issues behind the DRM
Separation of licenses from content
 licenses should be kept separate from content
 The license formalises what can be done by a given user on a given
content
 thus content can be protected once for all and widely distributed via any
kind of channel including P2P
Revocation of User, User ID
 The user that has violated the solution is black listed, banned.
 He cannot exploit any right on content !!, may be too strong..
Revocation of licenses, via License ID
 Revocation of rights authorization, for that content-right
 various ways to prevent players from exploiting content
Revocation of Content, via Content ID
 Content with the listed IDs cannot be played on players.
Revocation of Player, Player ID
 Players with the listed IDs cannot be used to open protected content, lost of
certification.

Single Channel Distribution value chain Issues

The content protection is performed before distribution
The B2B areas are (production, integration, etc.):
 Considered trusted, based on paper contracts
The authors, integrators and producers cannot verify and
keep direct trace of the exploited rights.

The single channel distributor:
 Establishes the business model(s) for the channel:
pay per play, subscription, …………etc….
produce licenses for each person/device, content, etc.
 sale the content and produce the Bill: pay per, subscription,..
 has a limited control on the exploitation of rights
 Direct relationships with content producers and CS
 Etc.


Distribution models
Terminologies
Copy protection


Content Elements
Content Packaging to contain the following
information
 Metadata + semantic descriptors ………
 Digital Resources: items, digital essences, ……
 Protection Information: (how to prot/deprot the content)…..
 License: ……..who can use, when, how, etc...

The Package should allow to be
 Protected
 Streamed (so called real-time) and/or downloaded, ….
 Shared on P2P, etc..
 Ported on physical supports,
 Adapted, etc..
 Coded in binary and/or XML, etc.
 etc.


Content Elements of the package
Metadata: Metadata
 Identification information, unique ID, distributor ID, etc.
 Classification information also for indexing: Dublin core, etc.
 Semantic Descriptors, MPEG-7, for indexing, etc.
 References to Owner, to distributor, etc.
 Etc.
Digital Resources: Resource
 Any digital information: images, doc, txt, video, game, application, file,
audio, etc.
 Hierarchy of digital resources
Protection Information: Prot-Info Model P
 What has to be done to access at a given information/resource
 Tools used, their parameters, etc.
License: License Model
 Which rights are provided, who is the recipient, conditions, etc.


The package
Today is a bad day.
We don’t have the power
and we have to create the
objects manually.


Packing Content vs other aspects
The package may contains several information: metadata, info, several
files, etc. 
 Cross media content
 hierarchical content and structure
The package to be protected has to encoded in some file and format.
For example to be encrypted with some algorithm
 Protection by ignorance (algorithm and key)
 Protection by complexity
The key has to reach the player only via specific protected channels
 If the key is reached and the algorithm is known the protection is
violated
The player has to enforce the protection and has to provide a precise
semantics for the rights
The license is a description of the conditions under which the key can
be taken, passed, used to/by the player



Distribution models
Terminologies
Copy protection


License formal language
XrML 2.0: eXtensible rights Markup Language
 http://www.xrml.org/
 General purpose
 ContentGuard, Nov. 2001, Microsoft
 Derived from DPRL
 Usato come base per MPEG-21
Windows Media DRM
 Derived from XrML
MPEG-21:
 REL: Rights Expression Language
Derived from XrML
 RDD: Rights Data Dictionary
OMA ODRL: Open Digital Rights Management
 Expression language for mobiles
 In some way simpler than MPEG-21 REL
 ..

An example of statement

 Rosy can Play 3 times the Ocean Wilds in November 2003.


MPEG-21 — REL, Rights Expression
Language
REL is a machine-readable language, XML
 to declare rights and permissions
 uses terms defined in the Rights Data Dictionary, RDD
REL allows to define licenses that give specific permissions to
Users to perform certain actions on certain resources, given that
certain conditions are met
 Grants can also allow Users to delegate authority to others
Systems and device have to
 parse and validate the REL formalizations
 check permissions before any further action is done
REL licenses are wrapped into MPEG-21 Digital Items when the
object is governed
MPEG-21 DID parser is responsible for discovering and identifying
where to gather licenses


REL data model
right
issued subject
to to
associated
with
principal resource condition

REL grant formalization consists of
 principal to whom grant is issued
 rights the grant specifies
 resource to which right in grant applies
 condition to be met before grant can be exercised


REL – Principal and Rights
Principal: Party to whom a grant conveys usage rights.
 authentication mechanism by which the principal can prove its identity.
 a principal that must present multiple credentials, all of them must be
simultaneously valid, to be authenticated.
Right:
 Action or activity that a principal may perform using a resource under
some condition.
Resource:
 Object/content to which the principal can be granted a right.
Condition:
 Terms under which rights can be exercised.

MPEG REL provides a right element to encapsulate information about
rights and provides a set of commonly used, specific rights, notably rights
relating to other rights, such as issue, revoke and obtain.
 Extensions to MPEG REL could define rights appropriate to using specific
types of resource.
 For instance, the MPEG REL content extension defines rights appropriate to
using digital works (e.g., play and print)


RDDOnto (Garcia, Delgado, 2007)
Example: Act hierarchy.


Possible values for terms
Principal Examples of Rights
 AllPrincipals and KeyHolder  Adapt
Rights  Delete
 Issue, Obtain, PossesProperty and Revoke  Diminish
 Embed
Resources
 Enhance
 DigitalResource, Revocable and ServiceReference
 Enlarge
Conditions  Execute
 AllConditions, ExerciseMechanism, ExistsRight,  Install
Fullfiler, PrerequisiteRight, RevocationFreshness,  Modify
ValidityInterval  Move
 CallForCondition  Territory  Play
 ExerciseLimit  TrackQuery  Print
 FeeFlat  TrackReport  Reduce
 FeeMetered  TransferControl  Uninstall
 FeePerInterval  ValidityIntervalFloating
 FeePerUse  ValidityIntervalStartsNow
 FeePerUsePrePay  ValidityTimeMetered
 SeekAproval  ValidityTimePeriodic


Esempi di Licenze: creator to distrib
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<r:license xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:mx="urn:mpeg:mpeg21:2003:01-REL-
MX-NS" xmlns:r="urn:mpeg:mpeg21:2003:01-REL-R-NS" xmlns:sx="urn:mpeg:mpeg21:2003:01-REL-
SX-NS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="urn:mpeg:mpeg21:2003:01-REL-R-NS ../schemas/rel-r.xsd
urn:mpeg:mpeg21:2003:01-REL-SX-NS ../schemas/rel-sx.xsd urn:mpeg:mpeg21:2003:01-REL-MX-NS
../schemas/rel-mx.xsd">
<r:grantGroup>
<r:grant> <r:keyHolder> <r:info><dsig:KeyName>AXDID:Distributor</dsig:KeyName> </r:info>
</r:keyHolder>
<mx:adapt/>
<mx:diReference><mx:identifier>AXOID:Identifier</mx:identifier> </mx:diReference>
</r:grant>
</r:grantGroup>

<r:issuer> <r:keyHolder> <r:info> <dsig:KeyName>AXCID:Creator</dsig:KeyName></r:info>
</r:keyHolder>
</r:issuer>
</r:license>

<r:grantGroup>
<r:grant><r:keyHolder><r:info><dsig:KeyName>AXDID:Distributor</dsig:KeyName></r:info>
</r:keyHolder>
<r:issue/>
<r:grantGroup>
<r:grant>
<mx:play/>
<mx:diReference> <mx:identifier>AXOID:Identifier</mx:identifier>
</mx:diReference>
<sx:feePerUse xmlns:iso="urn:mpeg21:2003:01-REL-SX-NS:2003:currency">
<sx:rate> <sx:amount>1.00</sx:amount>
<sx:currency>iso:EUR</sx:currency>
</sx:rate>
</sx:feePerUse>
</r:grant>
</r:grantGroup>
</r:grant>
</r:grantGroup>

<r:issuer><r:keyHolder>
<r:info><dsig:KeyName>AXCID:Creator</dsig:KeyName></r:info></r:keyHolder>
</r:issuer>

Riferimenti
CAS
 Irdeto: http://www.irdeto.com/
 Nagravision: http://www.nagravision.com/
 NDS: http://www.nds.com/
DRM
 MPEG-21: http://www.dsi.unifi.it/~nesi/DISIT-Introduction-to-MPEG-
21-v1-0.pdf
 AXMEDIS DRM for dummies: a full round into the content
protection, production of licenses, etc.
 http://www.axmedis.org
 http://www.axmedis.org/documenti/view_documenti.php?doc_id=39
64


Rights Models: Types of Rights

Derivative Work
Render Rights Transport Rights
Rights

Now is the time for all

Print
good men to come to
the aid of their
country. Why do we
always ue this piece
Copy Extract
of txt for exmaples?

View
Now is the time for all good
men to come to the aid of
their country. Why do we
always ue this piece of txt
for exmaples?
Move Edit

Play Loan Embed


Business Rules, a way to formalize allowed rights
Exploitation Models (contracts from the consumers to the
provider are aligned to the exploitation model):
 Subscription to a collection or service, per months, per year, etc.
All you can eat, per month, etc.
Pay per minute all you can eat
 Pay per
rent, use, play, print, etc.
stream, download, etc…
burning the CD
copy the object
moving the object
passing the object to a different device/friend
building a collection
 Preview without paying preview
 Try and buy, e.g., 30 gg try, …
Etc. Resource


Business Rules, a way to formalize allowed rights
It may be based on limiting
 Number of times you can do an action, and usage
 in a temporal window for the exploitation of any rights
renting
 in a space
regional area or
domain (set of computers, etc.)
 The usage according to the user profile:
impaired,
student,
Archival
etc.


Packaging and Protection, Open Model
Metadata
Metadata
Resource
Resource
Prot-Info Model

License Model Protection
License
License
Production P
License
License Metadata
License
License Prot-Info Resource
Protected
Digital Content

General Architecture of content business
Content P
Protection
Protection
Information
Metadata

Resource Certifier and
Protected Supervisor
Digital Content
Distribution
Server M users, N different source
objects:
Pros: P N Objects protected only
Simple distribution once

P2P supported P N protection info
Cons: M*N licenses maximum
since each of them may be
3 servers interested to have all
Many Licenses objects

Production of Governed Objects
License Metadata
Production Resource
License Model License

Prot-Info Model
Protection

P
License
Metadata
Prot-Info
Resource Protected
Digital Content

Content
Protection
Protection
Information
Metadata License Certifier and
Resource Supervisor
Protected
Digital Content M users, N different source
Distribution objects:
Server
P Max N*M Objects
Pros: protected, that is for all the
N Objects M different
Simple distribution, 2
servers protected-licensed
versions have to be
Cons: produced
P2P non supported
P N*M protection info
Too many different
objects, too much space


Production of Objects and Augmented License
License Model Metadata

Prot-Info Model Resource

Protection and
Lic. Prod.
P License
License
Metadata License
Prot-Info
License
Prot-Info
Resource Prot-Info
Prot-Info Augmented
Protected Licenses
Digital Content

Content
Protection
License
Augmented
Metadata
Prot-Info License
Resource
Protected
Protection
Digital Content
Distribution Information
Server Certifier and
Supervisor
Pros:
Simple distribution, 2 M users, N different source
servers objects:
P2P supported
P N Objects protected
Cons:
Many information
P N protection information
outside N*M protection info
Diff users have the same included into licenses
protection inform

Some Considerations
Open Model:
 Supporting P2P
 The volume of Objects is acceptable
 The elements can be independently manipulated
Licenses can be changed, reissued
 Suitable for B2B and B2C
Governed Object:
 The user may see what can be done on the objects on the
basis of their license
 the same object with different licenses implies
to produce too many objects
Augmented License:
 Supporting P2P
 The license ha to include the same protection information
 The objects can be substituted independently
Licenses can be changed, reissued

Open Model vs Augmented License
Pros of Open Model vs the Augmented License
 If the protected objects are used for producing several different
more complex objects:
They are reused in the B2B area for different productions
Since the Protection Information is stored only once and not in
every license, this implies to
• have a more precise control of the black list, and
• avoid duplications
 Better for hierarchical nested protected and non prot objects
 Thus the Open model is better for the B2B
Pros of Augmented License vs the Open Model
 Simpler management for the servers
 Higher number of licenses
 Suitable for simpler objects, non nesting protected objects
 May be better for B2C

Based model for DRM

CD DVD Doc
Administrative Services

Audio Images video
Content Producers Selling Service
Agreement and
contracts

License Server L
License L
Production player/device Content
verification unprotection
P
Events collection and rights
and Supervision exploitation
P
Content Distribution
Packaging, content
Protection Server/Portal

User’s devices and
Packaging and Distribution players


Different kinds of Packages

Package Protecti Which Distributi Annot Metadata
on Files on ations custom +
models descriptors
MPEG-21 Xml Yes/DRM any Yes/DIS (Yes) Yes
MPEG-4 Yes (xml/bin) Yes/CAS Audio Yes/Stream No No
video
MXF Yes (xml/bin) No Audio Download No Yes/No
video
SCORM/IMS Yes (xml/bin) Yes /CAS any Download No Yes
AXMEDIS Yes (xml/bin) Yes /DRM any Yes all (Yes) Yes
ZIP Bin Yes (pwd, any Download No No
CAS)
NewsML Yes (xml/bin) Yes (Zip, any Download No Yes
Pwd, cas)


Convergence, the Interoperable Content
Internet Distributor
Internet Distributor

Mobile Distributor
Broadcasters, DVB-H

Media Distributor

Broadcasters, DVB-T

Broadcasters, DVB-S

IPTV distribution

Kiosks distribution


Present Needs for Accessing New Markets
Needs of Interoperable Content that may Migrate from
 one terminal/device to another
 one user to another
 one channel to another
 Licenses assigned to users, devices or domains
 etc.
Transcoding/Adaptation problems
 Content is packaged
 Content is protected, adaptation of protected content is needed
 Content contains several types of information: digital resources,
metadata, glue, etc.
 On the servers and/or on the client terminals

DRM Architecture should support Migration and Adaptation
 see in the following


DRM interoperability
iDRM: interoperable DRM means:
 Content that once under DRM can be moved/used from one
device to another ?
But HOW ??
 Content that can be protected with multiple DRM on the same
File? Different DRM enabled players use the same file.
 Content that can be protected with multiple DRM with several
files? Different DRM enabled players use different files.

For DMP: iDRM means that there is only one DRM, and it is a
standard for all. This is almost impossible today.
For DREAM, AXMEDIS, etc.: iDRM means that multiple DRM
can be applied on content and players may be used.


Es: Convergence, the Interoperable
License, DRM
XY Protection Internet Distributor

XY License Server

Transcoding
Transcoding
XY License Processor

ZZ License Processor

ZZ License Server

ZZ Protection Mobile Distributor
When interoperable content in terms of format passes from two
devices supporting different DRM models and licenses
License needs to be transcribed and rights semantics preserved
License chain processing need to be interoperable
Two single channels DRM are typically disjoined


Major Related Organisations
Standardisation Bodies for elements
 MPEG (Motion Picture Expert Group), ISO
 OMA (Open Mobile Alliance)
 MI3P (ID and licensing aspects)
 OASIS (Organisation for advancement in Structured Information
Standards)
 DVB (TV-AnyTime, DVB-T, DVB-H, DVB-S, ..….)
 W3C
Associations/organization:
 OeB (Open eBook Forum)
 CRF (Content Reference Forum)
 WIPO (World Intellectual Property Organization)
 RIAA (Recording Industry Association of America)
 WS-I (Web Services Interoperability Organisation)
 ISMA (Internet Streaming Media Alliance)
 CC (Creative Commons)
Projects on Architecture and Value chain solutions
 AXMEDIS Project, research and development project
 DMP (Digital Media Project), standardisation project
 Etc.

Example of Content Distributors web sites
Apple i-Tune
 Audio, video distribution, Proprietary DRM
FastWeb
 IPTV, Finsiel, NDS
SKY (OpenSky), EUTELSAT
 Video, MPEG4, Smart CARD
TISCALI portali
 Audio tracks and videos, Windows Media DRM
DTT, DVB-T: MHP (MPEG-2 + Java)
 Mediaset, La-7, RAI, ….., Smart Card: IRDETO, NAGRAVISION
BuyMusic.com
 SDMI, Windows Media DRM
Real Networks
ROXIO, Napster
 Windows Media DRM
Warner Music UK is using the Share!
Musicmatch.com


Technologies and standards
Technologies for content protection
 Apple I-Tune
 Media Commerce Suite of Real Network
 EMMS of IBM
 Liquid Audio
 DMD secure
 Sealed Media
 Intertrust
 Adobe, mainly limited to documents

DRM solutions
 Microsoft Windows Media, DRM
XrML, Content Guard, related to MPEG-21
 OMA DRM, Open Mobile Association
 AXMEDIS/MPEG-21
MPEG-21 smaller cases


Considerations

Model privacy Security TRU Suitable Suitable
level satisfaction for Mobile for UGC
CP Yes Low Low High High
CAS/STB Yes/No Medium Low High no
CAS/PC Yes/No Low Low High no
DRM No/yes none High Medium Medium
DRM+TPM No/yes High Medium Medium

TRU: traditional rights usage
UGC: user generated content
TPM: technological protection model



Distribution models
Terminologies
Copy protection


Creative Commons, CC
Nel commercio elettronico e’ necessario includere anche
alcune slide relative alle licenze CC.
Fino ad ora abbiamo visto tecnologia al servizio della
protezione della proprieta’ intellettuale
CC mette a disposizione degli strumenti, dei formalismi legali
che possono essere o meno adottati da chi pubblica i propri
contenuti
Questi sono license formalizzate:
 Struttura della Licenza CC:
Legal Code: testo legale che la descrive
Commons Deed: short description della licenza
Digital Code: metadati da associare
(see S. Aliprandi, 2005, 2006…)
http://www.copyleft-italia.it/cc/brochureCCv2.pdf


Creative Commons, CC
Le licenze CC
 Nate in USA
 Sono state adattate alla legislazione nazionale di diversi stati e
anche a livello europeo
specialmente per contenuti generati dagli utenti e in ambito
culturale
Questo permette in un certo qual modo di avere una
trascodifica fra le questioni legali nazionali e quelle di altre
nazioni, ma solo per certe questioni.
 Licenze CC ipotizzano uno share, copyleft
E’ stato fatta una codifica delle licenze CC in MPEG-21 REL
 Non e’ vero l’opposto, tutte le licenze che si possono
formalizzare in MPEG-21 non hanno una controparte in CC


Ogni Licenza chiede che il Licensiatario
Ottenga il tuo permesso per fare una qualsiasi delle cose che
 hai scelto di limitare con la licenza,
 for example: limitare gli usi commerciali o quelli di opera derivata

Mantenga l’indicazione di diritto di autore intatta su tutte le
copie del tuo lavoro

Faccia un link alla tua licenza dalle copie dell’opera

Non alteri i termini della licenza

Non usi mezzi tecnologici per impedire ad altri licenziatari di
esercitare uno qualsiasi degli usi consentiti dalla legge


Ogni licenza CC permette le
seguenti azioni a patto che:
i licenziatari rispettino le condizioni della
licenza CC assegnata:
Possono
 Copiare l’opera;
 Distribuire l’opera;
 Comunicare al pubblico, rappresentare, esegure,
recitare o esporre l’opera in pubblico, ivi inclusa la
trasmissione audio digitale dell’opera;
 Cambiare il formato dell’opera.


Alcuni marker CC
Liberta’ per l’utente
 Sei libero di distribuire, comunicare, rappresentare, eseguire,
recitare o esporre l’opera in pubblico, ivi inclusa la trasmissione
audio digitale dell’opera;
 Sei libero di modificare questa opera

Condizioni di uso
 Devi riconoscere la paternita’ di questa opera
 Per esempio citando e riportanto un link alla sorgente


Licenze Creative Commons
Offrono 6 diverse articolazioni
 per artisti, giornalisti, docenti, istituzioni e, in genere, creatori che
desiderino condividere in maniera ampia le proprie opere
secondo il modello "alcuni diritti riservati".

Altre condizioni d’uso, il detentore dei diritti puo‘
 non autorizzare a priori usi prevalentemente commerciali
dell'opera (opzione Non commerciale, acronimo inglese: NC)
 non autorizzare la creazione di opere derivate (Non opere
derivate, acronimo: ND); no extract, no aggregate, ..
 Imporre di rilasciarle con la stessa licenza dell'opera originaria
(Condividi allo stesso modo, acronimo: SA, da "Share-Alike").

Le combinazioni di queste scelte generano 6 licenze CC, disponibili
anche in versione italiana, come descritto in seguito!


2 of the 6 CC licenses, 1/3
Attribution Non-commercial No Derivatives (by-nc-nd)
 The most restrictive of our six main licenses, allowing redistribution.
 This license is often called the “free advertising” license
 it allows others to download your works and share them with others
as long as they mention you and link back to you,
 they can’t change them in any way or use them commercially
Attribution Non-commercial Share Alike (by-nc-sa)
 Let others remix, tweak, and build upon your work non-commercially,
as long as they credit you and license their new creations under the
identical terms.
 Others can download and redistribute your work just like the by-nc-
nd license, but they can also translate, make remixes, and produce
new stories based on your work.
 All new work based on yours will carry the same license, so any
derivatives will also be non-commercial in nature.


Attribution Non-commercial (by-nc)
 Let others remix, tweak, and build upon your work non-
commercially, and their new works must also acknowledge you
and be non-commercial,
 they don’t have to license their derivative works on the same
terms.

Attribution No Derivatives (by-nd)
 allows for redistribution, commercial and non-commercial,
 as long as it is passed along unchanged and in whole, with credit
to you


Attribution Share Alike (by-sa)
 lets others remix, tweak, and build upon your work even for
commercial reasons, as long as they credit you and license their
new creations under the identical terms.
 This license is often compared to open source software licenses.
 All new works based on yours will carry the same license, so any
derivatives will also allow commercial use.

Attribution (by)
 lets others distribute, remix, tweak, and build upon your work, even
commercially, as long as they credit you for the original creation.
 This is the most accommodating of licenses offered, in terms of
what others can do with your works licensed under Attribution.



Distribution models
Terminologies
Copy protection


Windows Media DRM
Composto da:
 Player (client), Windows Media Player
 Encoder/packager (content production)
Uso di codec vari, MPEG, etc.
 Server (distribution Server)
 DRM model
 Streaming and Download

Realizzazione di soluzioni varie da 2-tier a n-tier
 Soluzioni basate su cluster di server


Windows Media Ecosystem
Business Consumer
Content Creation License Portable Devices
Clearinghouse

Transfer
Processing

Transaction
Authorization
Home Devices
Content Packaging Web Retailer
 Download
 Streaming

Distribution

Acquisition


Sample Applications For
WM Technology
Consumer Electronics Devices
 Portable audio and video players
 CD and DVD players and burners
 Digital Media Receivers
 Mobile Phones
 Set Top Boxes
IC Manufacturers, Technology Suppliers
 Chips with WM Codec or DRM built in
 Ported versions of WM components for OEM use
PC Applications
 Media Players, Jukeboxes
Media Services Infrastructure
 Streaming media servers, web servers
 License Servers (for Digital Rights Management)
 Content Creation and DRM Encryption Servers


WM Streaming Experience
Benefit
 Eliminates buffering delays
 Optimizes the experience
Features
 Fast Streaming
 Improved packet recovery techniques
 Improved multi-bitrate (MBR) audio/video
 Bandwidth detection improvements
 Support for standards-based protocols
 Requires the 9 Series player to obtain benefits

Sistemi Collaborativi e di Protezione, Univ. Firenze, Paolo Nesi 2012-2013 129 129

Industrial Strength, scalable
WMS 9 Series far more scalable than 4.1
 Greatly improved TCP performance (2x)
 Greatly improved broadband performance (2x)
 Dramatically better disk i/o by caching frequently accessed
content (2x-8x+)
 20,000 streams (using 20 Kbps content) achieved on a single
machine

 900 Mbps of total throughput (using 1 Mbps content) achieved
on a single machine
Updated load simulation tool on Web


Windows Media Ecosystem
Business Consumer
Artists
Content Creation License Hardware Vendors
Portable Devices
Solution Providers
Clearinghouse
Create intellectual Transfer and Play
property, digital media Issue Licenses Protected Media
content Track Transactions “PD DRM”
Windows Media Windows Media Rights WinCE Platform Builder
Encoder Manager SDK
WM DRM for Devices
WM DRM for Networks
Transfer
Processing
Transaction
Authorization Home DevicesDevelopers
Application
Labels, Studios,
Content Packaging Solution Providers
Web Retailer
Publishers, …
 Download
Host & Distribute Render Protected Digital
Protect Compressed Work, Transfer to Devices
Protected Digital Work
Digital Work  Streaming
Distribution
Windows Streaming Windows Media Format
Windows Media
Media Server or Web SDK, Windows Media
Encoder Acquisition Device Manager
Server


How it works
1. Packaging
2. Rights
3. Distribution
4. License Acquisition
5. License Delivery


Packaging
Generate Content Header:
Key ID
A String to identify content and generate the KEY

License Acquisition URL
Location that specifies where to get licenses from

Individualisation Version
Minimum Individualisation a player must have to play the content

Content ID
Uniquely identifies the file

Additional Attributes
Provides additional information for packaging and managing file


Packaging
Sign The Header
Private Signing Key
To prevent the header from tampering (Kept secret)

Generate the KEY
Key ID
Stored in the content header (public)
License Key Seed
Kept secret and not stored in content header (private)
Key ID + License Key Seed = KEY

Encrypt the file using the KEY


Packaging
Input formats
 Any input source that can be converted to Windows
Media Format
 WAV
 AVI

Output formats (Binary):
 WMA
 WMV


Packaging
Supported Codecs

Windows Media Audio 1 Windows Media Video 7
Windows Media Audio 9 Screen
Windows Media Audio 9 Windows Media Video 9 Image
Professional Microsoft MPEG-4 Video 1
Windows Media Audio 9 Microsoft MPEG-4 Video 2
Lossless Microsoft MPEG-4 Video 3
Windows Media Audio 9 Windows Media Screen 7
Voice
ISO-MPEG-4 (version) 1


Windows Media Rights Manager


Packaging
 Windows Media Rights Manager packages the digital
media file.
 The packaged media file has been encrypted and locked
with a "key."
 This key is stored in an encrypted license, which is distributed
separately.
 Other information is added to the media file, such as the
URL where the license can be acquired.
 This packaged digital media file is saved in Windows
Media Audio format (with a .wma file name extension) or
Windows Media Video format (with a .wmv file name
extension).


Establishing a License Server
 The content provider chooses a license clearing
house that stores the specific rights or rules of the
license and implements the Windows Media Rights
Manager license services.
 The role of the clearing house is to authenticate the
consumer's request for a license.
 Digital media files and licenses are distributed and
stored separately, making it easier to manage the
entire system.


License Acquisition
 To play a packaged digital media file, the consumer
must first acquire a license key to unlock the file.
 The process of acquiring a license begins automatically
when the consumer attempts to acquire the protected
content, acquires a predelivered license, or plays the
file for the first time.
 Windows Media Rights Manager either sends the
consumer to a registration page where information is
requested or payment is required, or "silently" retrieves
a license from a clearing house.


License Acquisition
License Server

Process of authenticating
user
Does this user have a right to view the
content?

Depends on business model
Examples include:
 Payment
 Login
 One time access codes
 Free, no authentication

WM Player


License Delivery
Get the content
Verify the content header with the Public Signing Key
Generate the KEY
 Get the Key ID from the content header
 Get the License Key Seed from the system
Specify the rights for the license, ask it
Deliver the license containing the KEY and rights


License Delivery
A license is delivered ONLY if the user is authorised
to view the content

Post Delivery:
1. Content is distributed first
2. License delivered second

Pre delivery:
1. License is delivered first
2. Content is distributed second


Playing the Media File
 To play the digital media file, the consumer needs a media player
that supports Windows Media Rights Manager.
 The consumer can then play the digital media file according to the
rules or rights that are included in the license.
 Licenses can have different rights, such as start times and dates,
duration, and counted operations.
 For instance, default rights may allow the consumer to play the digital
media file on a specific computer and copy the file to a portable device.
 Licenses, however, are not transferable. If a consumer sends a
packaged digital media file to a friend, this friend must acquire his or
her own license to play the file.
 This PC-by-PC licensing scheme ensures that the packaged digital
media file can only be played by the computer that has been granted
the license key for that file.


Microsoft Windows Media Rights
Manager License
license contains the
 key to unlock the Windows Media file.
 rights, or rules, that govern the use of the digital media file.
 (model based on Augmented License)
content owner sets rights to determine which actions are
allowed from minimal control over playback to more
restrictive licenses.
licenses can support different business rules, including:
 How many times can a file be played.
 Which devices a file can be played or transferred on. For example, rights can
specify if consumers can transfer the file to portable devices that are compliant
with the Secure Digital Music Initiative (SDMI).
 When the user can start playing the file and what is the expiration date.
 If the file can be transferred to a CD recorder (burner).
 If the user can back up and restore the license.
 What security level is required on the client to play the Windows Media file.
 And many others.


Windows Media DRM?
 Allow Backup Restore
 Allow Burn To CD
 Allow Play On PC
 Allow Transfer To Non SDMI
 Allow Transfer To SDMI
 Begin Date
 Burn To CD Count
 Delete On Clock Roll back
 Disable On Clock Rollback
 Exclude Application
 Expiration After First Use
 Expiration Date
 Expiration On Store
 Minimum App Security
 Minimum Client SDK Security
 Play Count
 PM App Security
 PM Expiration Date
 PM Rights
 Transfer Count

Windows Media DRM?
Pay per view
 Play count (client side)
Rental
 Expiration after first use
Useful for different time zones

 Expiration on store
Useful for different time zones

 Begin & expiration dates
Subscription
 Begin & expiration dates
Controlled distribution of media assets
 Can include any of the above


Consideration on Counting Rights
How to arrange the rights counting
 Number of play, print, etc.
Server Side
 More secure, and more expensive in terms of server costs,
 Dependent on the number of licenses, objects and users
if we have 1 Million of users and 1 Million of different
content objects, we have 1012 status records to count the
number of plays!! , 1000 Gbyte !!!
Client Side
 Limit number has to be hidden into the client
Thus Less secure
 Quite cheap with respect to the server solution
 Adopted by Windows Media DRM


Case Study: Preview and Purchase
Client
 Online Music store
Client requirements
 Offering users a free preview of selected content upon
registration
 Normal purchase required after preview
Technical requirements
 Use of pre delivery for preview license
 Use of post delivery for normal purchases
Challenges
 Supporting both pre delivery and post delivery for same content
 Preventing users from getting multiple preview licenses
Result
 Preview license pre delivered through browser after registration
 Once preview license expired, purchase is required through post
delivery


Case Study: Pay per View
Client
 Website owner
Client requirements
 Pay per view
 Files should be self contained
 Integration of payment into DRM popup
Challenges
 Integrating with a payment provider that gives instant notification
on payment status
Result
 Content that can only be played once for each payment
 Content that is completely self contained, including the payment
process
 Content that can be securely shared on file sharing networks


Case Study: Rental
Client
 Online video rental
Client requirements
 Payments made using existing payment methods on website
 Rental period of 3 days
 Good user experience
 Integration with client website
 License will use expiration on store (72 hours)
 Identifying users through use of cookies and silently delivering licenses
Challenges
 Sharing authentication information with client website, transparent to the
user
 Identifying user silently through use of cookies
Result
 Client website shares authentication information through background http
requests
 Users pay at website for a rental and later licenses are delivered silently


Case Study: Subscription
Client
 Major Satellite channel
Client requirements
 Live streaming of satellite channel feed
 Live stream only accessible on subscriptions of 1 day, 1 month or 1 year
 Use of DRM profile to encrypt stream in real time
 License will use begin dates and expiration dates
 Integration with client website
Challenges
 To prevent users from rolling their clock back to get round license terms
 Managing 3 different licenses for same content
Result
 Only subscribers allowed access to live stream
 3 different subscription periods available
 Stream becomes disabled if clock rolled back


Case Study: Controlled Access
Client
 Investment bank
Client requirements
 No payment or authentication required for access
 To be able to restrict access to content immediately at an unknown future
date
 Statistics on number of plays per content
 Each play of content will need a license (play count of 1)
 Silent license delivery
 Counting licenses delivered
Challenges
 To be able to restrict access to content at an unknown time when none of
the rights can be preconfigured to do this
Result
 Each time the content is played a license request is needed
 Client can restrict access to content immediately with a click of a button, the
license server stops issuing licenses for content
 Statistics on content access


Online Music Store Example

The steps required are as follows:
Defining the business model
Develop database that will support business
model
Website integration
Encoding of content into Windows Media
Packaging content
License terms
License delivery


Defining the business model
 Subscriptions will
start from the registration date
end 1 calendar month after start date
allow access to all content
 Credits
Monthly subscriptions are credited with 400
credits
Content will cost 5 credits per play
Once credits expire content will not be playable


Develop database that will support business
model
User id
Username
Password
Start date
End date
Credits


Website Integration
Payments made at website
Website maintains subscription database
Website can uniquely identify user
(registration)
Logging on/registration stores cookie on
users computer (user id)


Encoding of content into Windows Media
Encoded into WMA or WMV
Encoding specifications tailored to target
audience



Packaging content
For this example:
Files can be
encrypted with unique
keys

All files can be
encrypted with one
key


License terms
Static rights
Play on PC
Play count = 1
Allow burn to CD = false
Disable on clock rollback
Dynamic rights (pulled from database)
Begin date
Expiration date


License delivery


Issues
 Every clients requirements are unique
 Clients may already have existing website and
membership databases
Need to tailor solution to existing infrastructure
Share only authentication information
• Filename (needed for keys)
• User ID (from cookie to identify users)
• Expiration date
 Content, license and key management can get
complex


Considerazioni
Soluzione Windows Media
 Streaming scalabile, professionale
Basato sulla conoscenza di Streaming Server e
Media Player
 Scalabilità, CDN
Presenza di sottoreti di distribuzione e cache/proxy
 DRM
Licenze
Autenticazione dei client
Uso di varie tecnologie: enc, sign, etc.


Fine Part 1a: sistemi di protezione

Distribution models
Terminologies
Copy protection


Protection Systems, from CP, CAS to DRM, part A of 2

More Related Content

Viewers also liked (13)

Similar to Protection Systems, from CP, CAS to DRM, part A of 2 (20)

Recently uploaded (20)

Protection Systems, from CP, CAS to DRM, part A of 2