Spencer Cheng spencer.cheng@cloakware

1. Trusting DRM Software Presentation to W3C Workshop on DRM January 22-23, 2001 Sophia-Antipolis, France Spencer Cheng spencer.cheng@cloakware.com Cloakware Corporation, 260 Hearst Way, Suite 311, Kanata, Ontario, Canada K2L 3H1

2. Outline • The DRM security model • Cryptography’s role • The need for trusted agents • Hardware Solutions • Trusted Software Agents • Tamper-resistant software • Summary Cloakware Corporation

3. DRM Security ModelTrusting the Untrustworthy • Past and present R&D focused on hostile S/W • Anti-virus S/W & Java sandbox protects users against dangerous S/W and hostile hosts • Trust only occurs with S/W from well known sources • DRM users are assumed to be hostile • All you need is one untrusted user/attacker • Attacker have legitimate access to protected content • Attacker have infinite time and resources • Attacker has complete access to S/W and H/W Cloakware Corporation

4. Cryptography is part of the solution • Store/stream data in encrypted form to prevent direct access • Use a “key” to access content • Where do you store the key? • What if Alice can’t trust Bob with the key? • Who/what checks the integrity checker? • How do you protect the executable? • DeCSS and Steven King’s ebook crack were made possible by cryptographic solutions implemented in unprotected software • Tamper-resistant S/W complements cryptography in hostile environment • Provides a “Trusted Agent” on client/player to protect decryption key and enforce access control Cloakware Corporation

5. Hardware Solutions • Hardware solutions are used for key hiding & tamper resistance • Hardware has several drawbacks • Incompatible with installed base of PCs, players • Time and expense to build installed base • Long lifecycle means devices must remain secure for years • Field Upgrades – difficult & costly to replace hardware when it is compromised Cloakware Corporation

6. Trusted Software Agents • Reduced manufacturing and distribution costs • Compatible with installed base • Faster time-to-market • Renewable and flexible • Attacks continue to improve/evolve • Replaceable tamper resistant components are essential • Easy to manufacture unique agents • Prevents a single crack from compromising a DRM system • The Chain of Trust • Content providers may want trusted components on distributors’ servers • Distributors may want trusted components on commerce service providers servers Cloakware Corporation

7. Tamper Resistant Software • Tamper resistant libraries & current code obfuscators are inadequate • Offer weak obfuscation and little protection against tampering • Portability is key for trusted software agents • Heterogeneous environments are here to stay • Binary-based tamper-resistant software solutions are not portable • Source level tamper resistant solutions are desirable to support multiple platforms and O/S’s Cloakware Corporation

8. Summary • DRM Trust model very different • Broad distribution means some users will be malicious • Cryptography is part of the solution • Trusted Software Agents are required fo • Key hiding • Protecting the rights enforcement engine against tampering • Should be renewable and flexible • Cloakware’s TRS technology • Portable source level technology • Protects against tampering and reverse engineering • Enables the manufacture of unique trusted software agents Cloakware Corporation