1 Jeremy Wyant W3C DRM Workshop 23 January 2001 Establishing Security Requirements For DRM Enabled Systems

2 NTRU provides next generation public key technology with all the same basic security capabilities as RSA or ECC Public key authentication, digital signature and encryption capabilities are critical technologies for complete DRM solutions NTRU provides the fastest and smallest public key technology –Enables the only practical technology for the widest range of wired and wireless content capable devices and client solutions –Meets server side performance requirements for normal and peak security transaction loading –Facilitates establishing trusted devices and enhancing the user experience without sacrificing performance NTRU Background W3C DRM WORKSHOP NTRU delivers the fastest and most efficient security solutions which are especially well suited to complement DRM technologies and provide end-to-end content protection.

3 Content Owner: Strong protection of content and strong authentication of end user End User: Ease of use, portability, transparency Leverage Internet economies and paradigms (e.g. Napster) Support all media types: text, video, audio Support all platform types, PC, PDA, Mobile, CE Support wired and wireless, tethered and untethered players Support streaming and download models Standards: interoperability for broader adoption, competition and economies of scale Business Requirements W3C DRM WORKSHOP

4 Security at the system level Security needs to be designed into the system; only as good as its weakest link Public scrutiny of algorithms Renewability of security Protection of key material in storage and use Management and distribution of key material System Security Practices W3C DRM WORKSHOP

5 Digital Rights Languages Digitals Rights Management Systems and components Public Key based technology Symmetric key cryptographic components Watermarking Fingerprinting Available Technologies W3C DRM WORKSHOP

6 Three fundamental Public Key based services apply in this space: Authentication –Users –Devices –Servers –Trusted components Digital Signature –Data authenticity –Data integrity –Binding of content, metadata and rights –Non-repudiation, e.g. of payment authorization –Proof of purchase, e.g. for the user Key exchange (symmetric key typically used for bulk content encryption) –Content encryption Public Key Technology W3C DRM WORKSHOP

7 What components in the system need to be authenticated? And for what purposes? What is the value of the content being protected and the damage that might result from disclosure? What type of transactions and/or data are being signed? Who relies on the signature? Who are the potential trusted third parties? Who will assume liability if content or other sensitive information is disclosed? Public Key Related Requirements Analysis W3C DRM WORKSHOP

8 End User Example End User System Content Request Distribution Server Content/Rights Description, Payment Options Payment Rights Management Content Packaging Authenticate Server/Client Signed Purchase Authorization Signed Content Protection Public Key Transaction Log ID “Token” Packaged Content w/key(s) and signed receipt Media Client Rights Filters Key Management Content Player Purchase Log Establish Secure Session Green, bold text indicates transactions involving the use of Public Key W3C DRM WORKSHOP

9 End User Example with Trusted Device End User System Content Request Trusted Media Device Distribution Server Content/Rights Description, Payment Options Payment Rights Management Content Packaging Authenticate Server/Client Signed Purchase Authorization Signed Content Protection Public Key Transaction Log ID “Token” Packaged Content w/key(s) and signed receipt Media Locker Rights Filters Purchase Log Establish Secure Session W3C DRM WORKSHOP Green, bold text indicates transactions involving the use of Public Key

10 Learn from other PKI projects - SET, Identrus, US NACHA Pilot End User Experience –Performance – affected by local and server components –Portability of content between devices and users –Trust Scalability –Communications –Operational –Server Performance – e.g. cryptographic operations Key Lessons Learned W3C DRM WORKSHOP

11 Jeremy Wyant For more information, please contact: