“...creating knowledge.” Enabling Digital Content Protection on Super-Distribution Models - Carlos Serrão ISCTE – Intituto Superior de Ciências do Trabalho e da Empresa, Ed. ISCTE – Av. Das Forças Armadas Lisboa – Portugal - Joaquim Marques IPCB – Instituto Politécnico de Castelo Branco Av. Pedro Alvares Cabral Nº12 – 6000 Castelo Branco - Portugal Virtual Goods – May 2004

/ DRM Platform – OpenSDRM Global Framework that is flexible and adaptive Inline with recent specification OPIMA Mpeg 4 Mpeg 21 Open - based on open standards - developed with open-source - extensible to allow new components integration Based on MPEG-4 IPMP-X model proposed by MPEG Oriented to user usage regulation Gives some flexibility on content exchange among users. Covers several major aspects of content distribution and trading: content production, preparation and registration, interactive content distribution, content negotiation and acquisition, strong components and user’s authentication and conditional content rendering.

/ Provides an integrated DRM solution, interfacing with several external actors which have their own specific role and requirements: - User wants to use content, - Content Provider (wants secure content trading), - IPMP Tools Provider (wishes to commercialize their own content security tools) - Payment Infrastructure (represents the financial environment) - Certification Authority (responsible for injecting trust on the system) DRM Platform – OpenSDRM

/ Content production and preparation (Content Preparation Server, Registration Server), Content protection ( Registration Server, License Server, Intellectual Property Management and Protection - IPMP tools server and Authentication Server), Content interactive distribution (Media Delivery Server ), Content negotiation and acquisition (Commerce Server, Payment Gateway), Strong components and users authentication (Authentication Server) Conditional visualization/rendering (Media Player, IPMP tools Server, License Server) DRM Platform – OpenSDRM Architecture The implementation followed an LAMP-based (Linux, Apache, MySQL and PHP) approach

/ DRM Platform – OpenSDRM Architecture

/ External actors Interactions DRM Platform – OpenSDRM User - The User wants to enjoy some content (may require the use of protected devices, software and licenses); IPMP Tools Provider - organization that produces tools for encryption, scrambling, watermarking and others that can be applied to content protection; Payment Infrastructure - Facilitates OpenSDRM e-commerce features by providing services for handling electronic payments; Certification Authority - The Certification Authority is responsible for receiving requests and issuing entities credentials to authenticate themselves to each other, (secure and authenticated communication channels can be established)

/ Content Preparation server - receives raw content from a specified source or sources and encodes it on a specified format, adds metadata and protects it. (If further metadata needs to be added, it is stored on the Registration Server). Commerce Server - trades the specific usage conditions to access content (user must be authenticated to this component through the Authentication server and the licenses for the content are also produced online based on this user authentication and the conditions he chose. This operation may also involve a financial transaction) Media Delivery server - Responsible for exchanging pieces of content with the client (used to register the place where the content is located and when it should be delivered to the user). Registration server - assign unique identifiers to content and to register metadata information for that specific content( DII, DOI, Internal Components & Interfaces DRM Platform – OpenSDRM

/ Authentication server - This server component is responsible for authenticating all the entities, internal and external to the DRM system (It validates the access rights of all the entities and components in the system). Cryptographic XML credentials to authenticate both components and users in order to authenticate the transactions exchanged between them. All messages between components are exchanged over a secure and authenticated channel, such as SSL/TLS. messages exchanged between components are signed and authenticated, and share a common structure Internal Components & Interfaces Two security layers DRM Platform – OpenSDRM

/ License Server - The License Server is a server component responsible for house-keeping the rules associating a user, the content and his/her corresponding access rights (accept connections from authenticated client Media Players for downloading of licenses; licenses are XML formatted using Open Digital Rights Language (ODRL) -> REL in the future) IPMP tools server - The IPMP tools server is the server component responsible for registering new IPMP tools and for receiving authenticated client Media Player requests for the downloading of a specific IPMP tool. Media Player - This component represents the software that will be used to render the content (may work with one or several IPMP tools in order to control how the content is accessed by a particular User; ) DRM Platform – OpenSDRM Internal Components & Interfaces

/ OpenSDRM and the SuperDistribution model Usage scenarios 1) User sends content to other user without the respective license UiUi UfUf LIS Player AUS COS Content License download Player Content + license 1 2 Request License production 3 Content + License

/ OpenSDRM and the SuperDistribution model Usage scenarios 2) User sends content and license to other user UiUi UfUf LIS Player AUS COS Content License’ download Player Content + license 1 2 Content + License’

/ OpenSDRM and the SuperDistribution model Conclusions - Is easy to use and convenient (in the sense consumers can share (redistribute) its own content ) ; - Content is portable across different but compatible devices (allowing sufficient level of interoperability and trust), - Provide enough value to convince a significant number of users to choose it over free exchanges ( because a network of clearinghouses providing higher quality content and more efficient distribution can negotiate personalized licenses) ; - Can give to the user a new consumer experience (pricing, sharing,...) ( contributing this way to enhancing its acceptance by encouraging users to exchange content); - Can contribute to the acceptance of new standards (content file format, player, device type, others); - It is secure and flexible enough to traders and consumers;

/ OpenSDRM and the SuperDistribution model Solution for securely distribute, trade and control the access and usage of valuable content Addresses the most fundamental issues associated with digital content distribution (content protection, usage control, usage tracking, flexible business models) Enables the transmission of content independently of direct distributor intervention opening a new usage experience