A Content Protection Scheme Using MPEG-21 Concepts and Tools Chia-Hsien Lu Feng-Cheng Chang Hsueh-Ming Hang Dept. Electronics Engineering National Chiao Tung University Hsinchu, Taiwan, R.O.C.

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 2 Outline Goals Goals Overview Overview Design and Implementation Design and Implementation Application Example Application Example Conclusions Conclusions Demonstration Demonstration

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 3 Goals A DRM System A DRM System Integrate concepts of Integrate concepts of MPEG-21 IPMP MPEG-21 IPMP MPEG-21 REL MPEG-21 REL Implement using Implement using MPEG-4 IPMPX MPEG-4 IPMPX MPEG-21 Test Bed MPEG-21 Test Bed

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 4 Fundamental Concepts MPEG-21 MPEG-21 Digital Item (DI) Digital Item (DI) Part 2 Part 2 Digital Item Declaration (DID) Digital Item Declaration (DID) Digital Item Declaration Language (DIDL) Digital Item Declaration Language (DIDL) Part 4 Part 4 Intellectual Property Management and Protection (IPMP) Intellectual Property Management and Protection (IPMP) IPMP DIDL IPMP DIDL Part 5 Part 5 Rights Expression Language (REL) Rights Expression Language (REL)

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 5 MPEG-21 Part-4 IPMP Goals of MPEG-21 IPMP: Goals of MPEG-21 IPMP: Effective protection and management on DIs Effective protection and management on DIs Protect a specific part of the DI by encapsulating it in IPMP DIDL Protect a specific part of the DI by encapsulating it in IPMP DIDL Element interchangeability: Element interchangeability: DIDL IPMP DIDL … …

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 6 MPEG-21 Part-5 REL An XML-based rights expression language An XML-based rights expression language Declare an authorized distribution for the use of any resource owned by specific users Declare an authorized distribution for the use of any resource owned by specific users Characteristics: Characteristics: Comprehensive Data Model Comprehensive Data Model Precise Authorization Model Precise Authorization Model Extensible Extension and flexible Profiling Extensible Extension and flexible Profiling

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 7 REL License General semantics of a license: General semantics of a license: An identified principal has specific rights for exercising those resources under the terms and conditions. An identified principal has specific rights for exercising those resources under the terms and conditions. license grant John play wifi_audio.aac during June 2006 issuer Music Station

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 8 MPEG-4 IPMPX Tool Manager Terminal IPMP Tool IPMP Filter (Control Point)

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 9 MPEG-21 Test Bed Control Channel Data Channel Control Point Control Point

Design and Implementation

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 11 IPMP_Info_Engine An IPMPX Tool An IPMPX Tool Perform functionalities of MPEG-21 IPMP and REL Perform functionalities of MPEG-21 IPMP and REL Parse_IPMPDIDL() Parse_IPMPDIDL() Parse an IPMP DIDL element Parse an IPMP DIDL element REL_authorize() REL_authorize() Extend REL reference software (ContentGuard) Extend REL reference software (ContentGuard) Perform rights authorization and generate an authorization proof Perform rights authorization and generate an authorization proof

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 12 Example Scenario Each IPMP Tool can send requests to the IPMP_Info_Engine Tool for the right to process data through IPMP Message Each IPMP Tool can send requests to the IPMP_Info_Engine Tool for the right to process data through IPMP Message DES Tool IPMP_Info_Engine Tool 1. Send an message for request the right to decrypt. 2. Perform REL verification 3. Send an message with the result of verification

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 13 Content Protection Mechanism Layer 1: Content is protected with symmetric encryption algorithm. Layer 1: Content is protected with symmetric encryption algorithm. Layer 2: Content encryption keys are protected with asymmetric encryption algorithm. Layer 2: Content encryption keys are protected with asymmetric encryption algorithm. (Encryption) DES Tool (Decryption) DES Tool Key Server Layer 1 Layer 2 RequestSetup Ask for keys Verify Encrypted Content Server Client

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 14 Key Server Function of a Key server Function of a Key server Manage keys Manage keys Client authentication and authorization Client authentication and authorization Encrypt keys with client ’ s public keys Encrypt keys with client ’ s public keys Implementation of a Key server Implementation of a Key server A local web server A local web server

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 15 Example: Super-distribution Manage the user ’ s right in a distributed mobile environment. Manage the user ’ s right in a distributed mobile environment. Example of OMA DRM v2.0 Example of OMA DRM v2.0

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 16 License Verification Online verification Online verification Remote server verifies the client. Remote server verifies the client. Offline verification Offline verification Online verification is more secure than offline verification. Online verification is more secure than offline verification. Use an online certificate to represent if a successful online verification already exists. Use an online certificate to represent if a successful online verification already exists.

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 17 License structure License Grant 1 (online) 3 Grant 2 (offline)

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 18 Authorization Flow False Online? True Interval valid? True Count valid? False True Grant 1 (Online) Grant 2 (Offline) Offline? False TrueFalse Interval valid? False True

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 19 Conclusions We construct a DRM system implemented using MPEG-21 IPMP and REL We construct a DRM system implemented using MPEG-21 IPMP and REL Two specifications are included: Two specifications are included: Content protection Content protection Rights Management Rights Management A two-layer content protection scheme is proposed for delivering both content and key securely A two-layer content protection scheme is proposed for delivering both content and key securely Develop one application example Develop one application example

C.-H. Lu, F.-C. Chang, H.-M. HangCommLab EE NCTU 20 Demonstration Offline play without a certificate  Failure Offline play without a certificate  Failure Online play  Success Online play  Success Offline playback three times  Success Offline playback three times  Success Fail to continue offline playback (counts are limited to three times)  Failure Fail to continue offline playback (counts are limited to three times)  Failure