1. A Credential Based Approach to Managing Exceptions in Digital Rights Management Systems Jean-Henry Morin morin@cui.unige.ch University of Geneva – CUI CCNC’05, DRM Workshop, 6 Jan, 2005

2. 1/6/2005CCNC'05 DRM Workshop2 Outline Motivation & Background Usage Scenarios Expressing Exceptions as Credentials The proposed approach : Attribute Certificates Resulting Scenario Conclusion & Discussion

3. 1/6/2005CCNC'05 DRM Workshop3 Motivation & Background Problem Statement Managing Exceptions in DRM enabled systems Hard problem, given little attention Exceptions in the context of DRM Particular situation unanticipated by the legitimate content « right holder » where : Rights or policy should be waived or dynamically adapted While maintaining a required persistent protection level and governed usage control Rational for considering Exceptions Conflicting national and international legal frameworks Cannot reasonably anticipate and formalize all situations…

4. 1/6/2005CCNC'05 DRM Workshop4 Motivation & Background (cont.) Unrealistic, impossible nor desirable Limited resource devices Cell phones, PDAs, sensors, etc. 100 kb 1 Mb Content Rules & Policies 

5. 1/6/2005CCNC'05 DRM Workshop5 Usage Scenarios Fair use policies E.g., Academics, scholars, etc. Copyright law and national provisions E.g., Blind and visually impaired (Spain, Portugal, Scandinavia) Communities and affiliations E.g., national and local chapters of professional associations Etc.

6. 1/6/2005CCNC'05 DRM Workshop6 Expressing Exceptions as Credentials Based on « real world » credential patterns Locally managed and held (credential store) Short lived or fixed life time Revocable Late binding (enforcement point)

7. 1/6/2005CCNC'05 DRM Workshop7 The proposed approach : Attribute Certificates X.509 Attribute Certificates (AC): digitally signed (certified) identity and set of attributes PKC bind PK to identity (passport analogy) AC bind attributes to identity (no PK, visa analogy) Short lived Delegation model separating identity from authorization ACA AC Authority (ACA) Holder identity Validity Period Attributes AC Serial # Etc.

8. 1/6/2005CCNC'05 DRM Workshop8 Resulting Scenario AC Credentials delivered by local ACA together with other administrative tokens Requires provisioning DRM systems for checking locally held credentials for applicability and precedence (Enforcement point) prior to rendering / exception license acquisition Exception licenses granted for short time periods Logging and audit trails of granted exceptions for ACA reputation management and reporting purposes

9. 1/6/2005CCNC'05 DRM Workshop9 Conclusion & Discussion Future Work and Leads : Feasibility, formal specification and design, proof of concept prototype Interoperability and Semantics of Exceptions (Exception Data Dictionary) Format and Media independent descriptor for content assets Generic Renewable Space shifting for portability Rights, Policies expressed as attributes (AC)

10. 1/6/2005CCNC'05 DRM Workshop10 Questions… … & Discussion