Nuovo DRM Paradiso Towards a verified, fair DRM protocol Hugo - PowerPoint PPT Presentation

Nuovo DRM Paradiso Towards a verified, fair DRM protocol Hugo Jonker h.l.jonker@tue.nl Srijith Krishnan Nair srijith@few.vu.nl Mohammad Torabi Dashti dashti@cwi.nl Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 1/12

Digital Rights Management ■ Goal: Introduction ◆ restrict access to digital contents ● Digital Rights Management ◆ access granted only when complying with license NPGCT Scheme Nuovo DRM Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 2/12

Digital Rights Management ■ Goal: Introduction ◆ restrict access to digital contents ● Digital Rights Management ◆ access granted only when complying with license NPGCT Scheme ■ Method: Nuovo DRM Assessment enforce link by bundling license with content Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 2/12

Digital Rights Management ■ Goal: Introduction ◆ restrict access to digital contents ● Digital Rights Management ◆ access granted only when complying with license NPGCT Scheme ■ Method: Nuovo DRM Assessment enforce link by bundling license with content Conclusions ■ Environment: ◆ trusted devices (well...) ◆ trusted content providers Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 2/12

Digital Rights Management ■ Goal: Introduction ◆ restrict access to digital contents ● Digital Rights Management ◆ access granted only when complying with license NPGCT Scheme ■ Method: Nuovo DRM Assessment enforce link by bundling license with content Conclusions ■ Environment: ◆ trusted devices (well...) ◆ trusted content providers ■ Enemy: ◆ untrusted device owners ◆ Untrusted network Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 2/12

Enabling C2C exchange ■ bottleneck in provider-to-client exchanges: bandwidth Introduction NPGCT Scheme ● Enabling C2C exchange ● Protocols ● Weaknesses Nuovo DRM Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 3/12

Enabling C2C exchange ■ bottleneck in provider-to-client exchanges: bandwidth Introduction ■ solution: enable client-to-client exchanges... NPGCT Scheme ● Enabling C2C exchange ● Protocols ● Weaknesses Nuovo DRM Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 3/12

Enabling C2C exchange ■ bottleneck in provider-to-client exchanges: bandwidth Introduction ■ solution: enable client-to-client exchanges... NPGCT Scheme ● Enabling C2C exchange ■ ... whilst preserving DRM ● Protocols ● Weaknesses Nuovo DRM Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 3/12

Enabling C2C exchange ■ bottleneck in provider-to-client exchanges: bandwidth Introduction ■ solution: enable client-to-client exchanges... NPGCT Scheme ● Enabling C2C exchange ■ ... whilst preserving DRM ● Protocols ● Weaknesses Nuovo DRM Adapt intruder model: Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 3/12

Enabling C2C exchange ■ bottleneck in provider-to-client exchanges: bandwidth Introduction ■ solution: enable client-to-client exchanges... NPGCT Scheme ● Enabling C2C exchange ■ ... whilst preserving DRM ● Protocols ● Weaknesses Nuovo DRM Adapt intruder model: Assessment ■ complete, lasting protection unrealistic... Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 3/12

Enabling C2C exchange ■ bottleneck in provider-to-client exchanges: bandwidth Introduction ■ solution: enable client-to-client exchanges... NPGCT Scheme ● Enabling C2C exchange ■ ... whilst preserving DRM ● Protocols ● Weaknesses Nuovo DRM Adapt intruder model: Assessment ■ complete, lasting protection unrealistic... Conclusions ■ thus: migitation procedures: ◆ detection ◆ revocation list Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 3/12

Protocols Provider-client: Introduction NPGCT Scheme 1 . C → P : Request content ● Enabling C2C exchange ● Protocols 2 . C ↔ P : Mutual authentication, [payment] ● Weaknesses Nuovo DRM 3 . P → C : { M } K , { K } pk ( C ) , R, metadata ( M ) , Λ Assessment Conclusions Client-client: 1 . D → C : Request content 2 . C ↔ D : Mutual authentication { M } K ′ , { K ′ } pk ( D ) , R C ( M ) , R ′ , metadata ( M ) , Λ , Λ ′ 3 . C → D : 4 . D : Verification 5 . D → C : ψ, [ payment ] Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 4/12

Weaknesses 1. P2C: no link request — rights Introduction attack: insert rights NPGCT Scheme ● Enabling C2C exchange ● Protocols ● Weaknesses Nuovo DRM Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 5/12

Weaknesses 1. P2C: no link request — rights Introduction attack: insert rights NPGCT Scheme ● Enabling C2C exchange ● Protocols 2. C2C: No link delivery — payment ● Weaknesses attack: abort before payment Nuovo DRM Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 5/12

Weaknesses 1. P2C: no link request — rights Introduction attack: insert rights NPGCT Scheme ● Enabling C2C exchange ● Protocols 2. C2C: No link delivery — payment ● Weaknesses attack: abort before payment Nuovo DRM Assessment Fairness (violated in C2C): Conclusions “Either both parties terminate successfully, or none does” Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 5/12

Weaknesses 1. P2C: no link request — rights Introduction attack: insert rights NPGCT Scheme ● Enabling C2C exchange ● Protocols 2. C2C: No link delivery — payment ● Weaknesses attack: abort before payment Nuovo DRM Assessment Fairness (violated in C2C): Conclusions “Either both parties terminate successfully, or none does” ■ Not possible without TTP ■ Optimistic fair exchange: only use TTP if fairness violated otherwise ■ Two protocols: optimistic exchange and recovery Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 5/12

Design Motivation: Introduction NPGCT Scheme Nuovo DRM ● Design ● P2C protocol ● C2C protocols Goals of Nuovo: Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 6/12

Design Motivation: Introduction NPGCT Scheme ■ address weaknesses Nuovo DRM ■ increase assurance of security ● Design ● P2C protocol ● C2C protocols Goals of Nuovo: Assessment Conclusions Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 6/12

Design Motivation: Introduction NPGCT Scheme ■ address weaknesses Nuovo DRM ■ increase assurance of security ● Design ● P2C protocol ● C2C protocols Goals of Nuovo: Assessment Conclusions ■ effectiveness ■ secrecy ■ resist content masquerading ■ fairness Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 6/12

P2C protocol Provider — client exchange: Introduction NPGCT Scheme 1 . owner ( C ) → C : P, h ( M ) , R Nuovo DRM ● Design 2 . C → P : C, n C ● P2C protocol ● C2C protocols 3 . P → C : { n P , n C , C } sk ( P ) Assessment 4 . C → P : { n C , n P , h ( M ) , R, P } sk ( C ) Conclusions 5 . P → C : { M } K , { K } pk ( C ) , { R, n C } SK ( P ) ■ concrete protocol ■ first weakness addressed (validity of R ) Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 7/12

C2C protocols Client — client optimistic exchange: Introduction NPGCT Scheme C, h ( M ) , R ′ 1 . owner ( D ) → D : Nuovo DRM ● Design 2 . D → C : D, n D ● P2C protocol ● C2C protocols 3 . C → D : { n C , n D , D } sk ( C ) Assessment { n D , n C , h ( M ) , R ′ , C } sk ( D ) 4 . D → C : Conclusions { M } K , { K } pk ( D ) , { R ′ , n D } sk ( C ) 5 . C → D : Client — client, recovery: 5 r . D : resolves ( D ) 6 r . D, n ′ D → P : D 7 r . { n P , n ′ P → D : D , D } sk ( P ) 8 r . { n ′ D , n P , � n D , n C , h ( M ) , R ′ , C � , P } sk ( D ) D → P : 9 r . { M } K , { K } pk ( D ) , { R ′ , n ′ P → D : D } SK ( P ) Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 8/12

Formal analysis Modelling in µ CRL: Introduction NPGCT Scheme ■ Nuovo DRM Nuovo DRM ■ communication model Assessment ● Formal analysis ■ intruder model – Dolev-Yao, with restrictions ● Analysis results ● Device revocation Conclusions Analysed scenario’s: 1. no intruder, synchronous communication (effectiveness) 2. intruder, asynchronous communication (secrecy, masquerading, fairness) Hugo Jonker, WISSEC2006, November 8, 2006, Antwerpen Formalising Receipt-freeness - p. 9/12