1. MPEG-21 Part4: IPMP ISO/IEC JTC 1/SC29/WG11 N4269 (Committee Draft)
Multimedia Security

2. Outline Overview of the IPMP framework Standardized processes
Framework architecture
Walkthrough
Standardized processes
Messaging infrastructure

3. ISO/IEC
An MPEG-21 IPMP framework, referred to as “IPMP Extensions”, is specified in this part of MPEG-21
The MPEG IPMP Extensions are designed so that they can be applied to any MPEG multimedia representation
Specific mappings of the MPEG IPMP Extensions should be defined as amendments to the MPEG-n standard

4. Interoperability Two types of interoperability are defined
The major focus of MPEG in general
A consumer centric approach
Content protected by one IPMP vendor will play on any given Terminal
C-interoperability
Consumers’ Point of View
IPMP Tools from different vendors will be able to integrate into the
same Terminal implementation concurrently
An IPMP System is able to comprise IPMP Tools made by one or more
vendors
Goal: to simplify the design of tool and terminal interfaces such that
the integration and interoperation of these tools and terminals may be
more widespread and economical
M-interoperability
Manufacturers’ Point of View
. Allow the same protected content to be consumed on different vendors’ Terminals
. Allow the same content to be protected by different vendors’ IPMP Tools

5. Framework Architecture
Missing IPMP Tools
Content
Obtain missing IPMP Tool(s)
IPMP Tool List
IPMP Tool Manager
Content Request
IPMP Tool ID(s)
Terminal
Alternate IPMP Tool ID(s)
Message Router
Parametric Tool Description(s)
Content Delivery
Terminal-Tool Message
Interchange Interface
IPMP Tool Elementary Stream
IPMP Tool 1
IPMP Tool n …
Terminal-IPMP Tool
Communications
IPMP Information

6. Walkthrough: (1) User Requests Specific Contents
Missing IPMP Tools
Content
IPMP Tool List
Terminal
IPMP Tool Manager
Terminal-Tool Message
Interchange Interface
Content Request
IPMP Tool ID(s)
Alternate IPMP Tool ID(s)
Message Router
Parametric Tool Description(s)
IPMP Tool Elementary Stream
IPMP Information
IPMP Tool 1
IPMP Tool 2 …
The manner in which content is requested is out of scope
Recommendations about the order in which different parts of the content are received and used
IPMP requirements on the Terminal should be placed with or before media requirements on the Terminal
Access information and/or restrictions should precede Content Stream download information

7. Walkthrough: (2) IPMP Tools Description Access
Missing IPMP Tools
Content
IPMP Tool List
Terminal
IPMP Tool Manager
Terminal-Tool Message
Interchange Interface
Access the IPMP Tool List
IPMP Tool ID(s)
Alternate IPMP Tool ID(s)
Receiving
IPMP Tools Description
Message Router
Parametric Tool Description(s)
IPMP Tool Elementary Stream
IPMP Information
IPMP Tool 1 …
IPMP Tool 2
The Terminal access the IPMP Tool List
Using the IPMP Tool List, the Terminal determines the IPMP Tools required to consume the content

8. Walkthrough: (3) IPMP Tools Retrieval
Missing IPMP Tools
IPMP Tool ID(s)
Alternate IPMP Tool ID(s)
Parametric Tool Description(s)
IPMP Tool Elementary Stream
IPMP Information
IPMP Tool List
Content
Obtaining Missing IPMP Tool(s)
Terminal
IPMP Tool Manager
Terminal-Tool Message
Interchange Interface
Obtaining
Missing IPMP Tool(s)
Message Router
IPMP Tool 1
IPMP Tool n …
All Required
IPMP Tools Received
Locally Available IPMP Tools
IPMP Tool 1
IPMP Tool 1 …
IPMP Tool 2 …
Sources of IPMP Tools
Locally available IPMP Tools
Missing IPMP Tools carried in Content itself
Missing IPMP Tools that need to be obtained remotely

9. Walkthrough: (4) Instantiation of IPMP Tools
Missing IPMP Tools
IPMP Tool ID(s)
Alternate IPMP Tool ID(s)
Parametric Tool Description(s)
IPMP Tool Elementary Stream
IPMP Information
IPMP Tool List
Content
Terminal
IPMP Tool Manager
Terminal-Tool Message
Interchange Interface
Accessing
Content
Message Router
Providing Initial IPMP Information
Inter-Tool Communication
IPMP Tool 1
IPMP Tool n …
Instantiations
The Terminal instantiates the IPMP tools
The instantiated Tools are provided with the initial IPMP information from the Content
IPMP Tools may use IPMP information to
Determine security requirements for content access
Monitor and facilitate the establishment and maintenance of the security requirements in inter-Tool communication

10. Walkthrough: (5) IPMP Initialization and Update
Walkthrough: (5) IPMP Initialization and Update - in Parallel with Content Consumption
Missing IPMP Tools
IPMP Tool ID(s)
Alternate IPMP Tool ID(s)
Parametric Tool Description(s)
IPMP Tool Elementary Stream
IPMP Information
IPMP Tool List
Content
Terminal
IPMP Tool Manager
Terminal-Tool Message
Interchange Interface
Content
Consumption
Message Router
IPMP Info. Routing
IPMP Tool 1 …
IPMP Tool n
Content consumption if allowed
IPMP Information routing
The whole walkthrough can be requested again

11. Illustration of Normative Elements
Missing IPMP Tools
Content
Consumption Query
and Permission
Obtain missing IPMP Tool(s)
IPMP Tool List
IPMP Tool List
Terminal
IPMP Tool Manager
Terminal-Tool Message
Interchange Interface
Content Request
IPMP Tool ID(s)
Alternate IPMP Tool ID(s)
IPMP Information Routing
The Parametric Infrastructure
Message Router
Parametric Tool Description(s)
Content Delivery
Tools in the Content
IPMP Tool Elementary Stream
Mutual Authentication
IPMP Information
Terminal-IPMP Tool
Communications
IPMP Information
Instantiation of IPMP Tools
IPMP Tool 1 …
IPMP Tool n

12. Normative Elements IPMP Tool List Tools in the Content
IPMP Tool ID
Parametric Infrastructure
Tools in the Content
Instantiation of IPMP Tools
Mutual Authentication
IPMP Information
IPMP Information Routing
Consumption Query and Permission

13. IPMP Tool List IPMP_Tool IPMP_ToolListDescriptor
The class describing a logical IPMP Tool
required to access the content
IPMP_Tool
bit(1) isAltGroup;
bit(1) isParametric;
bit(6) reserved=0b111111;
bit(128) IPMP_ToolID;
If (isAltGroup) {
bit(8) numAlternates;
bit(128) Alt_IPMP_ToolIDs[numAlternates]; }
else if(isParametric) {
IPMP_ToolParametricDescriptor toolParamDescr;
A vendor-specific IPMP Tool specified by IPMP_ToolID
One of a list of alternate IPMP Tools
An IPMP Tool specified by a parametric description
IPMP_ToolListDescriptor
bit(8) IPMPToolListDescriptorID;
bit(8) numTools;
IPMP_Tool ipmpTool[numTools];
The container for the Tool List
IPMP_ToolParametricDescriptor
Container for a parametric description of an
IPMP Tool required to access the content
ByteArray parametricDesc;
The Terminal shall route the messages specified in the bitstream for IPMP_ToolID to the specific IPMP Tool instantiated (even in alternate or parametric cases)
For the case of a list of alternate IPMP tools, the Terminals shall select an IPMP Tool from the list
For the case of a parametric description of the IPMP Tool, the Terminal shall select an IPMP Tool that meets
the criteria specified in the parametric description

14. IPMP Tool ID (1/2) The IPMP_Tool_ID identifier
128-bits long
Platform-independent
A registration authority for IPMP Tools that use a unique ID is required
An association of the download URLs for various implementations of the given tool for various platforms shall be maintained.

15. IPMP Tool ID (2/2) IPMP_Tool_ID Semantics 0x0000 Forbidden 0x0001
Content
0x0002
Terminal
0x0003-0x2000
Reserved for ISO use
0x2001-0xFFFF
Carry over from RA
0x x100FF
Parametric Tools or Alternate Tools
0x100FF-2^128-2
Open for registration
2^128-1

16. Parametric Infrastructure
Cases in which the tools required may not be unique
Tools are based on popular public algorithms
A wide variety of equivalent implementations are available
Computationally intensive tools leading to platform-specific optimized implementations form a wide variety of venders
A set of parameters and values are to be identified and standardized to support a specific class of functionality
Parametric Representation
Parametric Description
Parametric Aggregation

17. Parametric Description
Definition
Information that enables a Terminal to choose a specific Tool implementation that will support all functionalities required by a presentation
No specific schema for any specific Tool type is attempted to be defined now
It is anticipated that such definitions will be added over time to develop an optimal schema
Only a basic framework is outlined in the current version of the specification

18. Current Parametric Description Framework
Version of parametric description syntax
Class of Tool
e.g. Decryption, Right Language Parser
Sub-class of Tool
E.g. for Decryption: DES, Camellia
E.g. for Rights Language Parser: XrML, ODRL
E.g. for Protocol Parser: Bluetooth, SmartCard
Sub-class-specific information
E.g. for DES: number of bits, block decipher capability
E.g. for Rights language Parser: version

19. Parametric Aggregation
Definitions
Information to aggregate different IPMP Tools in a given configuration under a single entry-point IPMP Tool
Goals
To configure existing IPMP Tools into new combinations, enabling different types of protection schemes

20. Current Parametric Aggregation Framework
Version of parametric aggregation syntax
Entry-point Tool
Input and output pin specification
The ID of the entry-point tool is not required
List of member IPMP Tools (aggregation units)
A 128-bit IPMP Tool ID
One or more Input and output interface codes
No duplication of interface codes to avoid ambiguity
Sequential links can be established
Opaque information, specific to the entry-point tool
Optional signal information

21. Delivery of Tools via Content
One or more Binary Representations of IPMP Tools may be carried directly or by reference in an MPEG presentation
Required information
IPMP_Tool_ID
Tool_Format_ID
The Binary Representation of the Tool
E.g. Platform Dependent Native Code, Java Byte Code
Tool_Package_ID
The details of the packages of the tool
E.g. CAB, Winzip self-install executable
Signature and Certification data
Assigned by a Registration Authority

22. IPMP Tool Instantiation
Upon instantiation of an IPMP Tools, all IPMP Tools already instantiated by the Terminal must be notified such instantiation
The newly instantiated IPMP Tool may request to be informed of other IPMP Tools running on the Terminal
The process of instantiation
Establish a context for the Tool being instantiated
Establish a link between the Message Router and the Tool instance
Establish a link between the Tool instance and the Message Router

23. Events Triggering IPMP Tools Instantiation
Sources and requirements
The Content
The syntax and context that trigger instantiation
The scope of protection
The relationship of one IPMP Tool with another IPMP Tool in the same scope of protection
Another IPMP Tool
Clear method of creation of a context for such instantiation

24. IPMP Information Routing
Addressing
Normative addressing methods are used
Addressee of a specific message is implicit either by bit-stream context or by process context
Message router
Handling the physical routing of information, synchronous/asynchronous delivery issues, and context resolution
Abstract all platform-dependent issues
Both interfaces between the Message Router and the IPMP Tools and the behavior of the Message Router are normative

25. Mutual Authentication
IPMP Tools may be required to communicate with one another or the Terminal.
Execution of mutual authentication
The tool that initiates mutual authentication with another tool determines the conditions of trust to be achieved by such authentication
E.g. integrity protected communication or fully-secured communication
Both tools engaged in message exchange to determine which authentication protocol will be used

26. Credentials
Used by an IPMP Tool or Terminal for identification, verification, mutual authentication, and similar security process.
Information about the identity and implementation of IPMP Tools (see the recommended schema)
A means of identifying the integrity and validity of the credential info
Trust and security metadata
Opaque information

27. A Schema for Platform Presentation (Informative)

28. Permission for Consumption
Permission for an intent on protected media in a presentation should be requested from and explicitly granted by all IPMP Tools protecting that media, prior to processing such intents.
Permission is granted in true-false form by each IPMP Tool.
Permissions are done by related messages

29. IPMP Tool Manager A conceptual entity in a given IPMP Terminal
Parsing IPMP Tool List
Retrieving IPMP Tools
Processing parametric descriptions
Resolving alternative tools
Receive binary Tools that arrive in the content

30. Message Router All IPMP Tool messages are routed through the Terminal
The Message Router (MR) connects and communicates with supported IPMP Tools, and thus abstracts the physical interface of one IPMP Tool from other IPMP Tools that wishes to communicate with it.

31. Message Infrastructure
Normative components of the IPMP Tool Interaction Framework
Interaction (communication) is realized via “messaging”
The generic functional interface is normative
The messages (syntax and semantics) are normative
The process of message routing is normative

32. Message Interchange Interface
IPMP_ToolMsgStatus
IPMP_ReceiveMessage( [in] short Sender, //sender context ID
[in] short Recipient, //recipient context ID
[in] long MsgSize, //size of message in bits
[in] octet Msg[], //payload
[in] IPMP_MsgMode, //sync/async
[in] long MsgID) //message ID, included in response message
IPMP_ToolMsgStatus
An enumerated status returned by the Terminal (MR) to the message originator
IPMP_MSG_STATUS_MSG_POSTED
IPMP_MSG_STATUS_INVALID_SENDER_ID
IPMP_MSG_STATUS_INVALFID_RECIPIENT_ID
IPMP_MSG_STATUS_MSG_MODE_NOT_SUPPORTED
IPMP_MSG_STATUS_GENERIC_ERROR

33. IPMP Tool Messages (I) Instantiation and Notification
IPMP_CreateNewToolInstance/IPMP_ToolInstNotification
IPMP_RequestInstTools/IPMP_ToolInstNotofication
IPMP_AddToolInstNotoficationListener (IPMP_ToolInstNotofication)
IPMP_RemoveToolInstNotoficationListener
IPMP_RequestToolContextID/IPMP_SupplyToolContextID
IPMP Information Delivery
Data Processing Functions (between terminals and tools)
IPMP_ProcessData/IPMP_ProcessDataReturn
Intent and Permission
IPMP_IntentRequest/IPMP_IntentResponse
IPMP_IntentTerminate
IPMP_IntentRevoke

34. IPMP Tool Messages (II)
ToolToUserMessage (defined as a class)
languageCode: three character language code
titleText: Title of dialog display
displayText: Text to be displayed to the user
promptText: Text to be displayed to the user to indicate the purpose of text input field
optionText: text to be displayed indicating purpose of option selection
SMIL: SMIL file to be displayed
UserToToolMessage (defined as a class)
replyText: text entered by user
optionResult

35. IPMP Tool Messages (III)
Mutual Authentication Messages
IPMP_InitAuthentication
Context ID
Authentication Types
No authentication required
No ID verify, do secure channel
No ID verify, no secure channel
Do ID verify, do secure channel

36. IPMP Tool Acquisition Content Terminal IPMP Tool Provider IPMP Tool
Get Tool List
Tool List
IPMP Data
Locate Tool
Establish Channel
Acquire IPMP Tool
Tool
Instantiate
Mutual Authentication
IPMP Data
Allow Consume Content
Get Content
Content

37. Failed IPMP Tool Validation
Content
Terminal
IPMP Tool Provider
IPMP Tool
Get Tool List
Tool List
IPMP Data
Locate Tool
Establish Channel
Acquire IPMP Tool
Tool
Instantiate
Mutual Authentication
Failed Authentication: Consumption Terminates

38. Denied User Permission
Content
Terminal
IPMP Tool Provider
IPMP Tool
Get Tool List
Tool List
IPMP Data
Locate Tool
Establish Channel
Acquire IPMP Tool
Tool
Instantiate
Mutual Authentication
IPMP Data
Disallow Content Consumption