Compliance and Robustness Rules for Windows Media DRM Implementations Microsoft Corporation

Copyright 2004 by Microsoft Corporation 2 Definitions Compliance Rules specify the required behaviors of the Windows Media DRM implementation and any applications accessing the implementation Compliance Rules include definitions of specific WMDRM license rights Compliance Rules include WMDRM device requirements Robustness Rules specify the Windows Media DRM assets and different levels of robustness required to protect each asset type

Copyright 2004 by Microsoft Corporation 3 Compliance Rules Scope Outputs DRM Stores Keys, Certificates Final Product Platform Application Platform implements Windows Media DRM Application accesses and/or passes Windows Media DRM- protected content Decrypted Content Decoded Content

Copyright 2004 by Microsoft Corporation 4 Anatomy of Robustness Rules Section 1: Construction Section 2: Accessibility of Content Section 3: Methods to Make a Robust Implementation Section 3.1: SoftwareSection 3.2: HardwareSection 3.3: Hybrids Section 4: Robustness Levels Section 3.x.1 Secure by ConstructionSection 3.x.2 Robust to Tampering

Copyright 2004 by Microsoft Corporation 5 Assets and Security Levels Immune to Widely Available Tools Immune to Widely Available Tools Resistant to Specialized Tools Resistant to Specialized Tools Level 1 Assets Level 2 Assets Level 3 Assets Widely Available Tools general purpose, easy to use: screwdrivers, clips, file editors, etc. general purpose, easy to use: screwdrivers, clips, file editors, etc. Specialized Tools reasonable price; some skill required: debuggers, reasonable price; some skill required: debuggers, memory scanners, etc. Professional Tools high price; high price; professional use ICE, logic analyzers professional use ICE, logic analyzers Immune to Widely Available & Specialized Tools Immune to Widely Available & Specialized Tools Resistant to Widely Available & Specialized Tools Resistant to Widely Available & Specialized Tools Device Key Content Key Profiling data

Copyright 2004 by Microsoft Corporation 6 HARD DRIVE Bus Monitor Device Asset Threat Surface And Robustness Rules CPU FLASH ROM SDRAM Obfuscated Device Key Obfuscation Components Crash File Paged Memory ICE, JTAG, ETM, OCD Memory Scanner, Debugger File Editor Professional Tools Widely Available Tools Specialized Tools Device Key

Copyright 2004 by Microsoft Corporation 7 Producing a Robust Solution Understand the Robustness Rules Secured assets on your device Protected content and user accessible bus Widely available, specialized & professional tools Threat model your design For each asset-tool pair, define attack path Evaluate how easily this attack would be done Compare Results to Robustness Rules Does your design meet the minimum standard?

Appendix

Copyright 2004 by Microsoft Corporation 9 WM DRM Content Distribution WM DRM for Portable Devices WM Format SDK WM DRM for Network Devices Distribution Authorization Protected Content WM Rights Manager Content Server