Case Study of a DRM Server

Introduction to DRM Solutions in the Industry

This article is a case study to create the various building-blocks of an industry-standard DRM Server. The design and building of this is proposed as an open-source project.



Goals and Non-Goals:

1. Why a DRM Server?

Studying the various security choices available and that are being made in the existing industry-standard DRM solutions is a goal. Opportunity exists to build a DRM framework and to enable various building blocks for a DRM Solution, a Keyset Store, user authorization modules, Key Distribution module.

Some of the privacy and rights debates in the industry will have to eventually sort itself out, as the market-place mechanism for digital content establishes itself. Eventually, a level of DRM that is considered acceptable to both the content providers and the users will emerge.


2. Choice of DRM Standards to include in our case study:

The majority of the deployed DRM solutions and standards have come from a few leading industry players, Adobe, Microsoft and Apple.

There is a second group of companies that is standard-setting called Open Mobile Alliance or OMA. One very good standard that has emerged from this group is known as "SmartCard DRM profile". This is a flavour of DRM standard that supports delivering content via. broadcast/multicast and unicast medium to a mobile platform. This emerges as a leading candidate for our case study.


3. Design and Requirements considerations:

a.) If some of the requirements get too mobile specific, we will always lean towards a more generic solution or a framework to support other design choices.

b.) The early goals are to study and build prototypes for the various building blocks of a DRM server. The driving goal is to arrive at a set of high-level requirements that our DRM server will eventually satisfy.

High-Level Functional blocks of a DRM Server



A brief explanation of each function is in order and is provided here,

1. Key storage

Stores keysets used to encrypt data and even other keys. This is usually a database. Perhaps, this database design may have to consider access, authorization and IT policies. However, this store must be accessible for realtime query. Perhaps, there is a layer of data accessor functionality that manages this database. This is perhaps a vital piece of the DRM server design.

2. User Authorization

Access control policy function. Normal IT policies form the base and perhaps can be made more restrictive to protect the data from prying eyes. Perhaps, this must be supplemented by applying an additional layer for confidentiality.

3. Key Distribution

This function is used to provide keys to the clients and is part of the key management function. This may involve protocols for key exchange and retirement. This function works closely with the user authorization function.

4. Key Generation

This is a function that straddles DRM Server and the Content Server. There is a need to uniquely identify the content and assign keys. The relationship between the two needs to be recorded in a database and the generated keys need to be stored into a database.

5. Content Protection

This is the function that ensures confidentiality of the data and perhaps has policies to encipher the content such as on-the-fly or pre-packaged encrypted data. This function works closely with the Key Generation function. The content can possibly be from parties external to the network.

6. IT Policies

Any network element must be goverened by IT policies. Perhaps the existing ones can be leveraged. But, some careful thought needs to go into the aspects where certificates and keys are generated and delivered over the cloud. This is non-goal for this case study.

7. HeadEnd

Since, binding the content to an eventual transport is a consideration, there are headend equipments and tools. This is a non-goal for this case study.


Our Basic Tasks

1. Analysis of the SmartCard DRM Specification to gather specific requirements for the project.

2. Analysis of basic building blocks such as Cryptographic libraries and frameworks to use for the project.