Digital Rights Management Ecosystem and its Usage Controls: A Survey
---
paper_title: Hardware assisted watermarking for multimedia

paper_content:

Digital media offer several distinct advantages over analog media, such as high quality, ease of editing, and ease of processing operations such as compression and high fidelity copying. Digital data is commonly available through digital TV broadcast, CD, DVD, and computing devices such as personal computers. The ease by which a digital media object can be duplicated and distributed has led to the need for effective digital rights management tools. Digital watermarking is one such tool. Watermarking is the process of embedding extra data called a watermark into a multimedia object, like image, audio, or video, such that the watermark can later be detected or extracted in order to make an assertion regarding the object. During the last decade, numerous software based watermarking schemes have appeared in the literature and watermarking research has attained a certain degree of maturity. But hardware based watermarking systems have evolved more recently only and they are still at their infancy. The goal of hardware assisted watermarking is to achieve low power usage, real-time performance, reliability, and ease of integration with existing consumer electronic devices. In this paper, we survey the hardware assisted solutions proposed in the literature for watermarking of multimedia objects. The survey is preceded by an introduction to the background issues involved in digital watermarking.
---
paper_title: Usage Control Enforcement: Present and Future

paper_content:

Both personal data and intellectual property must be protected for various reasons. The authors explore the state of the art in usage control, which is about controlling the use of such data after it has been given away, and identify room for improvement.
---
paper_title: Secure video distribution scheme based on partial encryption

paper_content:

In TV program distribution, the receiver's identification information is embedded into video data in order to trace illegal distributors, and video data are encrypted in order to protect the confidentiality against unauthorized users. In traditional method, the TV program is firstly fingerprinted, then encrypted, and finally transmitted. For N receivers, N times of encryption, and N times of fingerprinting operations are required, which makes the sender of high loading. In another method, the media content is decrypted and fingerprinted simultaneously by the joint fingerprint embedding and decryption, which is difficult to obtain reasonable performances. In this article, a commutative encryption and fingerprinting scheme is proposed to reduce the sender's loading. In this scheme, the TV program is firstly encrypted, then fingerprinted, and finally transferred. When compared with the traditional method, in the proposed method, only once encryption and N times of fingerprinting are required, which reduces the sender's loading greatly. Based on MPEG2 videos, a commutative encryption and fingerprinting scheme is presented, whose performances including security, efficiency, robustness, and imperceptibility are evaluated. Experimental results show that the scheme obtains good performances and is suitable for TV program distribution. © 2009 Wiley Periodicals, Inc. Int J Imaging Syst Technol, 19, 227–235, 2009
---
paper_title: Commercial piracy and intellectual property policy

paper_content:

Abstract I discuss the competition between a copyright owner and several commercial pirates who sell copies of the same information good to consumers. I view the increased risk of a punishment that offering a pirate copy to a consumer causes as an advertising cost whose value is chosen by the government. The structure of the market for pirate copies is affected also by fixed costs that are caused by punishments or DRM systems. I present a systematic analysis of the effects of these policy variables and the quality of pirate copies on the market for the considered information good.
---
paper_title: Problem Analyses and Recommendations in DRM Security Policies

paper_content:

We claim that the current digital rights management (DRM) technology and its related policy do not address customers' needs in the perspective of availability, which---along with confidentiality and integrity---is one of the main security properties. Our research has focused on how the current security policy in regards to DRM addresses the availability as a main security property. We study the current policies of DRM in U.S. law, the fair use doctrine, and the Digital Millennium Copyright Act. Additionally, we look at policies at the market, examining how the recording industry has used DRM in both the past and present. We analyze how much the companies and distributors place unnecessary controls on customers by considering customers' online resource usage. Finally, we suggest the market-level policy criteria as our possible solutions for the copyright owners, the distributors, and the general users.
---
paper_title: An artist life cycle model for digital media content: Strategies for the Light Web and the Dark Web

paper_content:

This paper surveys and categorizes emerging digital media business models. We apply the customer activity cycle of Vandermerwe (2000) to the consumption of digital media, taking three phases into account: pre-consumption, consumption and post-consumption. Our analysis of the business models focuses on their social costs and benefits. We derive the parameters as follows: convenience of use, exposure, ease of compliance and administration. We distinguish two polar environments for digital media: the Dark Web with content created by the masses, and the Light Web with content created by big media. We develop an artist life cycle model in which different business models appear to be optimal at different stages of an artist's career. Voluntary payment-based models seem to be ideal for newcomers in the Dark Web, while digital rights management-based and complementary product and service-basedmodels are the likely choice of established artists in the Light Web. Established artists might change their approach again, using voluntary payment-based or complementary product and service-based models when they retire.
---
paper_title: Secure and traceable multimedia distribution for convergent Mobile TV services

paper_content:

Few papers have focused on secure mobile multimedia distribution that protects both the confidentiality and copyright in mobile multimedia services. In this paper, a secure multimedia distribution scheme is presented for a ubiquitous mobile content service, i.e., the Mobile TV based on the converged DVB-H (Digital Video Broadcasting - Handheld) and GPRS/GSM. At the server side, the Joint Compression and Encryption method is proposed to encrypt video contents. At the mobile terminal side, the Joint Decryption and Fingerprinting method is proposed to decrypt video contents and simultaneously embed the mobile terminal's identification information. When the media content is illegally redistributed to public networks, such as Internet or public TV, the proposed Fingerprint Detection and Traitor Tracing method will be used to identify the illegal redistributor. To show the proposed scheme's prior performances, the existing secure media distribution schemes are reviewed, and the comparative evaluations are done. The analysis and experimental results show that the proposed scheme is more suitable for secure mobile multimedia distribution. The work is expected to attract more researchers.
---
paper_title: The combined model of influencing on-line consumer behavior

paper_content:

Combining the views from the Decomposed Theory of Planned Behavior and Technology Acceptance Model, this study proposes an integrated opinion to construct on-line consuming behavior patterns for travel. The nonlinear fuzzy network model were adopted to test and verify the sample data. The method of convenience sampling was employed and the questionnaires were distributed through e-mail sending, or were brought back by selected consumers, or were filled in on-line by access to the designated website. A total of 550 questionnaires were returned, giving a response rate of 35.6%. It concluded from the factor loading that among the three independent variables in this study, product marketing attracts customers most in respect to the ''Marketing Mix''. The possibility of misunderstanding information is higher in respect to the ''Perceived Risk'' of information from customers. The close relationship of the family works more effectively for decision making in respect to the ''Subjective Norms''. The three latent independent variables of ''Marketing Mix'', ''Perceived Risk'' and ''Subjective Norms'' are the three key factors that directly or indirectly influence the ''Attitude'' and the ''Behavioral Intention'' in this study.
---
paper_title: Joint Watermarking Scheme for Multiparty Multilevel DRM Architecture

paper_content:

Multiparty multilevel digital rights management (DRM) architecture involving several levels of distributors in between an owner and a consumer has been suggested as an alternative business model to the traditional two-party (buyer-seller) DRM architecture for digital content delivery. In the two-party DRM architecture, cryptographic techniques are used for secure delivery of the content, and watermarking techniques are used for protecting the rights of the seller and the buyer. The cryptographic protocols used in the two-party case for secure content delivery can be directly applied to the multiparty multilevel case. However, the watermarking protocols used in the two-party case may not directly carry over to the multiparty multilevel case, as it needs to address the simultaneous security concerns of multiple parties such as the owner, multiple levels of distributors, and consumers. Towards this, in this paper, we propose a joint digital watermarking scheme using Chinese remainder theorem for the multiparty multilevel DRM architecture. In the proposed scheme, watermark information is jointly created by all the parties involved; then a watermark signal is generated out of it and embedded into the content. This scheme takes care of the security concerns of all parties involved. Further, in the event of finding an illegal copy of the content, the violator(s) can be traced back.
---
paper_title: An improved watermarking technique for multi-user, multi-right environments

paper_content:

In digital rights management, there are many instances where there is more than one user involved, with each user having different level of rights. In this paper, we develop a novel approach to the multi-user, multi-right problem, where users are tied to various rights in an arbitrary access structure. Our approach is applicable to all kinds of media and can be used with any watermarking algorithm, provided that keys are used to generate the watermarks. This flexibility also enables it to benefit from future progress in the development of watermarking algorithms, in particular that of multiple watermarking. The proposed technique uses the generalized secret sharing scheme of Benaloh and Leichter, and builds on the earlier work of Guo on the joint ownership problem. By noting that the number of rights is likely much smaller than the number of users in most practical situations, and by generating the watermarks independently, the proposed approach achieves greater fidelity and detection capability than Guo's schemes while remaining secure against colluding users.
---
paper_title: Chinese MPEG-21 Rights Expression Language: Enhancing Digital Rights Management Adoption to Digital Libraries in Hong Kong

paper_content:

Rights Expression Language in digital library scenario is described as rights management metadata, which are becoming a significant impetus for the development of digital libraries. However, the research on it just starts and is still immature in China. This paper aims to fill up the gap by discussing the issues of localizing MPEG-21 REL into Chinese language. A well-established and notable model called HowNet is adopted for semantic mapping, and a case example is created to demonstrate the application of the Chinese REL.
---
paper_title: Consumer perception of interface quality, security, and loyalty in electronic commerce

paper_content:

Customer interface quality, perceived security, and customer loyalty are critical factors for success of an e-commerce website; however, the relationships among them are not fully understood. We proposed a model for testing the relationships among them and the important outcomes of the site: switching costs and customer loyalty. Data was collected to test the model using a web-based survey, and empirical analyses were performed using SEM. The analytical results demonstrated that customer interface quality and perceived security positively affected customer satisfaction and switching costs, and thus customer loyalty to an e-commerce website. Specifically, our study showed that switching costs positively moderated the effect of customer satisfaction on customer loyalty; this moderating effect is discussed.
---
paper_title: Design and development challenges for an E2E DRM content business integration platform

paper_content:

Current studies on Digital Rights Management (DRM) have focused on controlling access to and copies of contents, centered exclusively on the end of the value chain (end users). This focus has been oriented towards security and encryption as a means of solving the issue of illegal copying by purchasers. In this paper, we propose End-to-End Digital Rights Management (E2E DRM) that involves the protection of the content throughout the entire value chain. This concept is given form in the new technologies for representing intellectual property (IP) which, in a secure and unequivocal manner, identify the content at each point in the value chain: from the author to the end user, the content is identifiable in any of the transactions and statuses through which it passes. The key concept which E2E DRM must provide is not only the governability of access and copying, but also that of all the processes associated with the content business. We establish an E2E DRM model and architecture, and propose the R&D management of its design and implementation that makes it possible to protect content from content creator to purchaser. Finally, the paper also analyzes their impact from a global perspective.
---
paper_title: A Prototype Design for DRM based Credit Card Transaction in E-Commerce

paper_content:

In E-Commerce credit cards gained popularity as a sophisticated payment mechanism. With the increase in credit card use on web, credit card fraud has gone up dramatically. Which cause customer's inconvenience and for merchant, loss of customers. To combat credit card fraud and to regain the customer's trust an attempt is made here to design a trust based payment system, in which the customer does not need to disclose his/her credit card number during the transaction, and hence they can feel safe. In this newly proposed system on behalf of the customer the bank or the issuer of the credit card is involved to perform the transaction. This is basically done by generating a single use 'token' by the bank which includes information about the customer, merchant, product, payment amount, date of issue and date of expiry etc. and thereafter wrapped as a DRM package. Among various advantages, one is that only the intended user and the specified application software can open the DRM package using special key. The application, thereafter, will take care of the rights imposed on the 'token' and expires itself after the single use. We have tried an attempt to use UML to design the model of such system, which is the recent trend of software engineering practice.
---
paper_title: Metadata-based image watermarking for copyright protection

paper_content:

Abstract In this paper, we propose a practical application for copyright protection of images with watermarking. The EXIF metadata of images and error-control codes are integrated into our algorithm and corresponding applications. Application for robust watermarking is one of the major branches in digital rights management (DRM) systems and digital forensics. Here, we focus on the copyright protection for images taken by ordinary cameras. By use of robust watermarking, it generally alters selected coefficients of the contents to accomplish the embedding process. Should the received image be in question, the watermark embedded beforehand can be extracted to indicate the copyright owner of such an image. We consider not only the image contents itself, but we also employ the EXIF metadata, which serves as the role of watermark, to be integrated into our scheme to make copyright protection possible. Moreover, for enhancing the performance for copyright protection, channel coding is employed and better protection capability can be expected. Taking the manufacturer, camera model, date and time stamp, and other important information in the EXIF metadata into account, conventional watermarking techniques can be applied to ordinary pictures taken by ourselves, and watermarked images with good quality can be produced. Even when the marked image has been intentionally modified, the original EXIF with selected information can mostly be recovered from the channel decoding process. Simulation results present the effectiveness of such an implementation.
---
paper_title: Open process and open-source enterprise systems

paper_content:

Enterprise systems have become pervasive, especially at the high end of the market where SAP and Oracle service large organisations. There is a great deal of value in enterprise systems offered to all organisations, but many small and medium businesses (SMBs) cannot afford the excessive software costs of established ERP systems. There have been a number of alternative forms of enterprise systems developed, to include open-source software. Service-oriented architecture (SOA) allows vendors to efficiently adopt new processes within their products. Organisations (and open-source ERP systems) can use SOA in customising or improving their systems. Web 2.0 helps collaborative development of knowledge which can be invaluable in identifying better business processes. The Web 2.0 era makes innovative access to enterprise systems possible for many SMBs. This paper reviews the role of SOA and Web 2.0 in making ERP systems more open, and classifies open enterprise systems on the dimension of process. We propose that organisations should conduct knowledge development for business processes through Web 2.0 prior to implementing external to enterprise systems. Once better processes are developed, they can be implemented to improve enterprise systems.
---
paper_title: Digital Rights Management and Individualized Pricing

paper_content:

Digital rights management makes it easier for vendors to practice price discrimination online. Public resistance is perhaps the main reason it is not prevalent in online information sales.
---
paper_title: An empirical study of customers' perceptions of security and trust in e-payment systems

paper_content:

Abstract It is commonly believed that good security improves trust, and that the perceptions of good security and trust will ultimately increase the use of electronic commerce. In fact, customers’ perceptions of the security of e-payment systems have become a major factor in the evolution of electronic commerce in markets. In this paper, we examine issues related to e-payment security from the viewpoint of customers. This study proposes a conceptual model that delineates the determinants of consumers’ perceived security and perceived trust, as well as the effects of perceived security and perceived trust on the use of e-payment systems. To test the model, structural equation modeling is employed to analyze data collected from 219 respondents in Korea. This research provides a theoretical foundation for academics and also practical guidelines for service providers in dealing with the security aspects of e-payment systems.
---
paper_title: Pricing schemes for digital content with DRM mechanisms

paper_content:

In this paper, utilizing game-theoretic model, we examine the impact of collaborative structure, content quality, and network environment on the development of pricing scheme and DRM protection policy of digital content. DRM protection level decreases and pirating activities becomes relatively tolerable as the content provider and platform provider operate collaboratively. Depending on the market structure, higher content quality may strengthen or weaken the adoption of DRM. However, it would seem that, as the network environment becomes more decentralized and uncontrolled, weaker DRM protection should be a better strategy.
---
paper_title: Tampering with a watermarking-based image authentication scheme

paper_content:

We analyse a recent image authentication scheme designed by Chang et al. [A watermarking-based image ownership and tampering authentication scheme, Pattern Recognition Lett. 27 (5) (2006) 439-446] whose first step is based on a watermarking scheme of Maniccam and Bourbakis [Lossless compression and information hiding in images, Pattern Recognition 37 (3) (2004) 475-486]. We show how the Chang et al. scheme still allows pixels to be tampered, and furthermore discuss why its ownership cannot be uniquely binding. Our results indicate that the scheme does not achieve its designed objectives of tamper detection and image ownership.
---
paper_title: A Novel Approach to DRM Systems

paper_content:

Modern Digital Rights Management (DRM) systems are often developed as web software platforms designed as service oriented architectures composed of a federation of coordinated web entities that play distinct roles and dynamically interact within a trusted environment. Such a design approach requires that trustu relationships have to be dynamically established across multiple and heterogeneous organizational boundaries so as to facilitate an ``on-the-fly'' resource sharing. This introduces non-trivial security architectural requirements concerning with the mechanisms that allow different security realms of web entities to be federated. This paper presents a DRM system developed as a web software platform designed to give a specific support both to the interaction of the web entities involved in the platform and to the development of the trusted relationships among them, in a much more flexible way than before, dynamically and with minimal overheads and shared infrastructure.
---
paper_title: Multimedia Content Encryption: Techniques and Applications

paper_content:

How to Design a Secure Multimedia Encryption Scheme The widespread use of image, audio, and video data makes media content protection increasingly necessary and urgent. For maximum safety, it is no longer sufficient to merely control access rights. In order to fully protect multimedia data from piracy or unauthorized use, it must be secured through encryption prior to its transmission or distribution. Multimedia Content Encryption: Techniques and Applications presents the latest research results in this dynamic field. Examines the Latest Encryption Techniques The book begins with the history of multimedia encryption and then examines general performance requirements of encryption and fundamental encrypting techniques. It discusses common techniques of complete, partial, and compression-combined encryption; as well as the more specialized forms, including perception, scalable, and commutative encryption. In addition, the author reviews watermarking and joint fingerprint embedding and decryption. Later chapters discuss typical attacks on multimedia encryption, as well as the principles for designing secure algorithms and various applications. An exploration of open issues, up-and-coming topics, and areas for further research rounds out the coverage. Shiguo Lian is the author or co-author of more than fifty peer-reviewed journal and conference articles covering topics of network security and multimedia content protection, including cryptography, secure P2P content sharing, digital rights management (DRM), encryption, watermarking, digital fingerprinting, and authentication. By following the techniques outlined in this book, users will be better able to protect the integrity of their multimedia data and develop greater confidence that their data will not be misappropriated.
---
paper_title: Network-Based Traitor-Tracing Technique Using Traffic Pattern

paper_content:

Today, with the rapid advance in broadband technology, streaming technology is applied to many applications, such as content delivery systems and web conference systems. On the other hand, we must implement digital rights management (DRM) to control content spreading and to avoid unintended content use. Traitor tracing is one of the key technologies that constructs DRM systems, and enables content distributors to observe and control content reception. General methods make use of watermarking to provide users' individual information unique to each user. However, these methods need to produce many individual contents. Especially, this is not realistic for real-time streaming systems. Furthermore, watermarking, which is a key technology adopted by contemporary methods, has known limitations and attacks against it. This is why the authors have proposed a method to monitor the content stream using traffic patterns constructed from only traffic volume information obtained from routers. The proposed method can determine who is watching the streaming content and whether or not a secondary content delivery exists. This information can be also used with general methods to construct a more practical traitor-tracing system. A method to cope with random errors and burst errors has also been investigated. Finally, the results of simulation and practical experiment are provided demonstrating the effectiveness of the proposed approach.
---
paper_title: Is DRM fit for purpose

paper_content:

Ten or so years ago, digital rights management software was widely touted as being about to take over the world. Its ability to prevent the unauthorised use of content such as music and films would mean that media companies no longer had to worry about piracy in a digital world bereft of boundaries. By the same token, the technology would also provide organisations of all stripes with a silver bullet for protecting their sensitive internal documents and files.
---
paper_title: Trust considerations on attitudes towards online purchasing: The moderating effect of privacy and security concerns

paper_content:

The research examines the relationships between three common trust considerations (vendor, Internet and third parties) and attitudes towards online purchasing. The study incorporates privacy and security concerns as a moderating variable and finds that these relationships vary depending on the level of concerns a consumer has when purchasing online. The study suggests that "fears" surrounding the Internet as a place to do business still hinder the use of it for e-commerce purposes, but that the presence of a reputable agent might in some manner mitigate this risk. In the context of business to consumer relationships trust in the vendor is important for the consumer to accept any risk associated with a transaction. Theoretical implications for online customer behavior theory are also discussed.
---
paper_title: Integrating fingerprint with cryptosystem for internet-based live pay-TV system

paper_content:

In the last few years, live pay-TV system via the Internet has come to be established with the development of broadband network. To develop such a system, a mechanism for content protection is required. In this paper, a new architecture integrating fingerprint with cryptosystem is proposed to protect digital contents (image and video) from unauthorized viewing and illegal redistribution. Then, a scheme integrating anti-collusion code and Home Page public-key cryptosystem (PKC) is described. Such a scheme is shown feasible and realistic for implementing with respect to computation/transmission cost. Copyright © 2008 John Wiley & Sons, Ltd.
---
paper_title: Cooperative and Non-Cooperative Game-Theoretic Analyses of Adoptions of Security Policies for DRM

paper_content:

Digital Rights Management ecosystem is composed of various participants, which adopt different security policies to meet their own security requirements, with a goal to achieve individual optimal benefits. However, from the perspective of the whole DRM-enabling contents industry, a simple adoption of several increasingly enhanced security policies does not necessarily implement an optimal benefit balance among participants. A game-theoretic analysis of adoptions of security policies was emphasized based on a proposed General DRM value chain ecosystem without the loss of generality. First, we formalized security policies and fundamental properties that include internal relativity and external one, together with multiparty game on adoptions of security policies. Also, a cooperative game among digital Contents Provider, Rights/Service Provider and digital Devices Provider, as well as a non-cooperative game between Providers and Consumers were presented. Final, a stable core allocation of benefits and Nash Equilibriums were found out, respectively. It is clearly concluded that the cooperative game has important super-addivitity and convexity, thus simultaneous adoptions of security policies with external relativity being helpful to achieve Pareto Optimality by using a pre-established cooperative relation; and that Pareto Optimality also exists between Providers and Consumer with the increase of users' purchase transactions when both have a repeated game.
---
paper_title: Access Controls in the Digital Era and the Fair Use/First Sale Doctrines

paper_content:

Abstract Each sale of an iTunes track means that a copy of music has been distributed that cannot be legally resold, edited, excerpted, or otherwise sampled by that user. This scenario has been repeated over 2.5 billion times since the inception of the iTunes Music Store. Much like software sales, consumers are now purchasing licenses to "access" the work instead of the content, given that access to these works is controlled by Digital Rights Management (DRM) schemes bolstered by the Digital Millennium Copyright Act (DMCA). In enacting [section] 1201(a) of the DMCA, Congress effectively created an additional exclusive right for content providers: controlling access to a work. I. INTRODUCTION "iTunes really competes with piracy, not with the other services. Piracy is the big enemy. Buying music online legally is good karma."--Steve Jobs, CEO of Apple Computer (1) Pirating a copyrighted work is not what it used to be: it is easier. Before xerography and bits-and-bytes, there was handwriting. If you wanted another copy of a book, you handwrote yourself one. Furthermore, distributing that handwritten copy required a physical act of bringing it from one place to another. All in all, this was an extremely laborious process. Unprotected digital works are not subject to such encumbrances. Digitized (unprotected) copyrighted material can now be spread far and wide over the Internet. Copyright owners are understandably concerned by the fact that each copy of a digital work is as good as the last one, and is not subject to the same material degradation as a cassette or record. Finally, digital works are compact and easily archived compared to their traditional physical counterparts. The days of the rogue printing press are gone. We are now in the digital age of piracy. The best starting point for exploring the effects of digital content on copyright law and copyright owners is examining the most successful implementation of digitally protected downloadable content to date: Apple's iTunes Music Store ("iTunes"). iTunes offers a library of over 4 million songs from the 4 major labels as well as hundreds of independent labels. (2) Able to run equally well on both Macs and PC's, the service has boasted over an 84% market share, is available in 22 countries, and has sold more than two and one half billion songs. (3) Individual tracks can be purchased for 99 cents, while complete albums begin at $9.99. (4) The growth rate of iTunes sales has been nothing short of astonishing. As of October 12, 2005, iTunes had surpassed 500 million music downloads since its initial launch in April 2003, and was averaging 1.8 million song downloads per day for its 10 million registered users. (5) On February 23, 2006, Apple reported that iTunes downloads had reached a total of 1 billion songs. (6) Less than a year later, on January 9, 2007, Apple reported that iTunes downloads had reached 2 billion. (7) Apple's downloadable music is encoded in the open standard Advanced Audio Coding (AAC) format at 128 kbps, and it incorporates a proprietary Digital Rights Management System (DRM) called FairPlay. (8) Apple restricts users to downloading one unique copy of a purchased song, but allows them to transfer the song to an unlimited number of iPods. (9) The DRM also prevents more than seven identical burns of a purchased music playlist. (10) Because Apple does not officially license FairPlay, it is a proprietary standard only supported through Apple on the iPod or the iTunes program. (11) Through iTunes, Apple is able to regulate what consumers do with their purchased music by using a technologically implemented combination of copyright law and contractual provisions. The thoroughness of Apple's control, however, derives from the unique contract/copyright interaction in concert with DRM. Copyright Law contains exceptions that allow consumers who purchase copies of works a potentially greater amount of freedom than these contractual license agreements. …
---
paper_title: A secure and traceable E-DRM system based on mobile device

paper_content:

In recent years, intellectual property violation events have caused enterprise to respect digital content protection. Illegal copying digital content abuses become a serious problem. Because the mobile devices are more portable and individualized than personal computers, anyone can access the network resources at anytime from anywhere. However, valuable digital contents without proper protection make the content vulnerable to unauthorized copying, modification and re-distribution, causing revenue losses to service providers. Thus, constructing an effective Digital Right Management (DRM) system has become an important issue. On the basis of the mobile device, we propose an efficient digital rights management protocol. We apply symmetrical cryptosystem, asymmetrical cryptosystem, digital signature and one-way hash function mechanisms in our scheme. To overcome the computing resource weakness problem of mobile devices, we also integrate digital certificate, hardware information and one time password mechanisms such that the security, persistent protection, integrity, authentication, track usage of DRM work, changeable access right, integration and portability issues will be assured. In this way, the mobile user can access the digital content securely in the enterprise via authorization mechanism.
---
paper_title: Adaptive traitor tracing for large anonymous attack

paper_content:

In this paper we focus on traitor tracing technologies for the anonymous re-broadcasting attack where the attackers re-distribute the per-content encrypting key or the decrypted plain content. To defend against an anonymous attack, content is usually built with different variations. For example, content is divided into multiple segments, each segment comes with multiple variations, and each variation is differently encrypted. Each user/player can only play back one variation per segment through the content. A typical traitor tracing scheme for re-broadcasting attack involves two basic steps, assigning the key/variation to devices (the assignment step) and detecting at least one traitor in the coalition when a series of pirated key/content are recovered (the coalition detection step). The traceability of a traitor tracing scheme is defined to be the number of recovered pirate copies of the content/keys needed in order to detect traitors. In [1] we presented a traitor detection scheme that tries to detect the entire coalition all together. This significantly improved the traditional one-by-one detection approaches in the literature. However, the traceability of the traitor detection scheme has a up limit that is constrained by the number of variations q one can build into the content. We are motivated to improve the traceability on a larger collusion attack and lift the up-limit on traceability with a given q. In this paper we will show a new traitor tracing approach that will assign the variations with skewed probabilities. Our approach not only lifts the tracing up-limit but also enables the tracing agency to assign the variations so as to maximize the traceability for a given coalition size. Our traceability results show that it is possible to achieve good traceability when traitor size exceeds q, and continue doing well even after the coalition size reaches q log q.
---
paper_title: DFT-Based SoC/VLSI IP Protection and Digital Rights Management Platform

paper_content:

In this paper, the author proposes a novel testing-based system-on-a-chip (SoC)/very large scale integration (VLSI) intellectual property (IP) identification and protection platform in SoC/VLSI design. The principles are established for the development of a new IP identification, protection procedures, and a digital rights management system that depends on the current IP-based design flow. This platform can successfully survive synthesis, placement, and routing and identify the IP core at various design levels. The proposed method has the potential to solve the digital rights management problem in SoC/VLSI design.
---
paper_title: Fuzzy Risk Assessments on Security Policies for Digital Rights Management

paper_content:

In multimedia consuming, Digital Rights Management (DRM) is the important means to conflrm the beneflts of both digital contents/services providers and consumers. To keep the DRM system running in order, risk management should be adopted, which identifles and assesses the DRM system's security level. Now, the legitimate sharing of copyrighted digital content is still an open issue, which faces severe risks of propertied assets circumvention and copyright infringe- ments. In this paper, we try to highlight a multi-disciplinary method for all-around examinations on risks to digital assets in the contents sharing scenario. The method is a qualitative and quantitative fuzzy risk assessment, which is used for estimating a novel concept called Risk-Controlled Utility (RCU) in DRM. Then, we emphasize on an application case of the emerging trusted computing policy, and analyze the in∞uences of difierent content sharing modes. Finally, we address a business model with some simulation results. The comparison with other methods shows that the fusion of qualitative and quantitative styles can not only evaluate the RCU with uncertain risk events efiectively, but also provide accurate assessment data for the security policies of DRM.
---
paper_title: A best practice model for e-consumer protection

paper_content:

Abstract This article outlines a set of criteria for assessing the value of e-consumer protection schemes. It is intended that it be used as a tool, for policy-makers, industry associations, corporations and consumer organisations in all jurisdictions, seeking to assess the appropriateness of their consumer protection regulation. It can be used to devise new, or improve existing, policies, and it can also be used to compare the usefulness of e-consumer protection in different jurisdictions. It commences with a brief review of existing frameworks for the protection of e-consumers, which demonstrates the need for a model that uncompromisingly presents the needs of consumers. An overview of the model is provided, followed by a presentation of the model's key features. A further section identifies the several ways in which the model can be applied in order to improve the usefulness of e-consumer protection. An earlier version of the model was published in checklist form (Clarke R. ‘A Major Impediment to B2C Success is … the Concept 'B2C' Invited Keynote, Proc. ICEC'06, Fredericton NB, Canada, 14–16 August 2006, at http://www.rogerclarke.com/EC/ICEC06.html#TNT ). The present article revises and expands that checklist, and presents the rationale underlying each item in it.
---
paper_title: Optimal subset-difference broadcast encryption with free riders

paper_content:

Broadcast encryption (BE) deals with secure transmission of a message to a group of receivers such that only an authorized subset of receivers can decrypt the message. The transmission cost of a BE system can be reduced considerably if a limited number of free riders can be tolerated in the system. In this paper, we study the problem of how to optimally place a given number of free riders in a subset-difference (SD)-based BE system, which is currently the most efficient BE scheme in use and has also been incorporated in standards, and we propose a polynomial-time optimal placement algorithm and three more efficient heuristics for this problem. Simulation experiments show that SD-based BE schemes can benefit significantly from the proposed algorithms.
---
paper_title: Robust image watermarking using local Zernike moments

paper_content:

In this work, we propose a robust image watermarking algorithm using local Zernike moments, which are computed over circular patches around feature points. The proposed algorithm locally computes Zernike moments and modifies them to embed watermarks, achieving robustness against cropping and local geometric attacks. Moreover, to deal with scaling attacks, the proposed algorithm extracts salient region parameters, which consist of an invariant centroid and a salient scale, and transmits them to the decoder. The parameters are used at the decoder to normalize a suspect image and detect watermarks. Extensive simulation results show that the proposed algorithm detects watermarks with low error rates, even if watermarked images are distorted by various geometric attacks as well as signal processing attacks.
---
paper_title: Digital rights management for multimedia content over 3G mobile networks

paper_content:

Third generation (3G) mobile systems offer true broadband data transmission and many multimedia services are flourishing on them. Hence, 3G transmission security has become a popular issue. Recently, Dimitriadis and Polemi proposed a lightweight IDM3G protocol for mutual authentication between users and their service providers. However, many multimedia services require safeguards during transmission over 3G networks to protect the digital rights of music and video, for example. Unfortunately, the Dimitriadis and Polemi protocol does not address this requirement in their protocol, which means their protocol can not be directly applied to design a fair and secure digital rights management mechanism. Therefore, in this paper, we try to improve their protocol by integrating the identity management 3G (IDM3G) and then propose a fair and secure digital rights management mechanism for multimedia content or services over 3G networks. Using our proposed scheme enables service providers to provide time-bounded multimedia content or services and guarantees user privacy, data integrity, confidentiality, and non-repudiation, as well as forward secrecy and backward secrecy of transferred digital rights with low computation costs.
---
paper_title: Integrated Digital Rights Management for Mobile IPTV Using Broadcasting and Communications

paper_content:

This paper presents a digital rights management (DRM) scheme for mobile broadcasting that integrates management via broadcasting and communications. The scheme provides access control and rights protection for subscription Mobile IPTV (Internet Protocol TV), enabling transmission of contract information to control broadcasting reception via both broadcasting wave and communications. It has transmission functions that reduce the amount of contract information that has to be transmitted through broadcasting as well as a function for transmitting contract information via communications. A PC simulation indicates that the DRM scheme is effective in terms of the transmission rate required to send contract information via broadcasting wave. We also demonstrated the feasibility of the DRM scheme by using a prototype system implemented on an SIM card. The DRM scheme enables advanced mobile receiver functions such as pay-per-view with an interactivity channel using communications and a subscription TV such as pay-per-month on mobile receivers without an interactivity channel by transmitting contract information via broadcasting wave.
---
paper_title: A security framework for Content-Based Publish-Subscribe system

paper_content:

Content-Based Publish-Subscribe system is an important emerging model in e-commerce applications. The distribution of contents to the Subscribers in a scalable and secured way is a very important requirement of these applications. Security schemes exercising centralized control cannot be applied directly to these applications due to the increased number of Subscribers subscribing to a particular event. This is because of the enormous growth of Internet. The centralized approach increases the burden on the central controller, which is the major entity in security management. To solve this problem, an efficient grouping is done based on the decentralized mechanism and a novel key management scheme is proposed for secured distribution of contents. The proposed method minimizes the overheads. The model is simulated and the results are found to be optimum compared to other methods.
---
paper_title: Privacy Preserving Multiparty Multilevel DRM Architecture

paper_content:

Traditional digital rights management (DRM) systems are only two party systems, involving the owner and consumers. However, for scalability of business it is often necessary to involve additional levels of distributors and sub-distributors, who can promote and distribute the content in regions unknown to the owner. Thus, we propose an architecture for multiparty multilevel DRM system. The term 'multiparty' refers to involvement of many parties such as the owner, distributors, sub-distributors and consumers and the term 'multilevel' refers to multiple levels of distributors/sub-distributors. The architecture also supports the log files based violation detection, in case of violation of DRM system by any party. However, violation detection imposes a problem of preserving privacy of consumers. So, in the architecture, a provision is made to preserve their privacy.
---
paper_title: On the operational semantics of rights expression languages

paper_content:

We propose an operational model for formalising and enforcing rights expression languages based on the concept of a rights expression compiler. Our compiler transforms an XML-based rights expression into a programme for a virtual machine. This approach provides a formal way of defining semantics for rights expression languages that can be directly used in practice to enforce the expressions while ensuring their consistency and correctness. We further argue that our model eliminates a number of limitations in previous attempts to associate rights expression languages with formal semantics. We demonstrate the power and practicality of our model by using it to develop operational semantics for the OMA Rights Expression Language, from which a real interpreter can be derived with relatively little effort.
---
paper_title: A formal conceptual model for rights

paper_content:

Emergence of different digital rights management (DRM) systems and various rights expression languages (RELs) has led to problems with DRM interoperability and smooth flow of content across different content management systems. The complexity, varied scope, undefined boundaries, and lack of formalism in current RELs pose some of the biggest challenges in addressing DRM interoperability. In this paper, we define a formal language neutral conceptual model for rights expression statements that provides a platform upon which rights statements from different RELs can be mapped, reasoned, and manipulated.
---
paper_title: Efficient license validation in MPML DRM architecture

paper_content:

Multiparty multilevel DRM architecture (MPML-DRM-A) involves multiple parties such as owner, multiple levels of distributors and consumers. The owner issues redistribution licenses to its distributors, who in turn generate and issue variations of these redistribution licenses to their sub-distributors. Also the distributors generate and issue usage licenses to the consumers to consume the contents. But, these variations of the redistribution licenses and usage licenses generated and issued by each distributor must be validated by a validation authority against the redistribution licenses that it has received. In MPML-DRM-A, there may exist multiple, different types of redistribution licenses for a content. Validation using multiple redistribution licenses may become difficult in real time. Further, storage of multiple redistribution licenses for validation presents a challenge of reducing storage space requirements. Hence, in this paper we propose a bit-vector transform based license organizing structure, and present a method to do the validation of issued licenses in the bit-vector transform domain efficiently. Experimental results show that our license organization structure helps to achieve low validation time and storage space complexity.
---
paper_title: A formal foundation for XrML

paper_content:

XrML is becoming a popular language in industry for writing software licenses. The semantics for XrML is implicitly given by an algorithm that determines if a permission follows from a set of licenses. We focus on a fragment of the language and use it to highlight some problematic aspects of the algorithm. We then correct the problems, introduce formal semantics, and show that our semantics captures the (corrected) algorithm. Next, we consider the complexity of determining if a permission is implied by a set of XrML licenses. We prove that the general problem is undecidable, but it is polynomial-time computable for an expressive fragment of the language. We extend XrML to capture a wider range of licenses by adding negation to the language. Finally, we discuss the key differences between XrML and MPEG-21, an international standard based on XrML.
---
paper_title: Using first-order logic to reason about policies

paper_content:

A policy describes the conditions under which an action is permitted or forbidden. We show that a fragment of (multi-sorted) first-order logic can be used to represent and reason about policies. Because we use first-order logic, policies have a clear syntax and semantics. We show that further restricting the fragment results in a language that is still quite expressive yet is also tractable. More precisely, questions about entailment, such as 'May Alice access the file?', can be answered in time that is a low-order polynomial (indeed, almost linear in some cases), as can questions about the consistency of policy sets. We also give a brief overview of a prototype that we have built whose reasoning engine is based on the logic and whose interface is designed for nonlogicians, allowing them to enter both policies and background information, such as 'Alice is a student', and to ask questions about the policies.
---
paper_title: A logic for reasoning about digital rights

paper_content:

We present a logic for reasoning about licenses, which are "terms of use" for digital resources. The logic provides a language for writing both properties of licenses and specifications that govern a client's actions. We discuss the complexity of checking properties and specifications written in our logic and propose a technique for verification. A key feature of our approach is that it is essentially parameterized by the language in which the licenses are written, provided that this language can be given a trace-based semantics. We consider two license languages to illustrate this flexibility.
---
paper_title: Content Value Chains Modelling using a Copyright Ontology

paper_content:

Existing digital rights management (DRM) systems, initiatives like Creative Commons or research works as some digital rights ontologies provide limited support for content value chains modelling and management. This is becoming a critical issue as content markets start to profit from the possibilities of digital networks and the World Wide Web. The objective is to support the whole copyrighted content value chain across enterprise or business niches boundaries. Our proposal provides a framework that accommodates copyright law and a rich creation model in order to cope with all the creation life cycle stages. The dynamic aspects of value chains are modelled using a hybrid approach that combines ontology-based and rule-based mechanisms. The ontology implementation is based on Web Ontology Language and Description Logic (OWL-DL) reasoners, are directly used for license checking. On the other hand, for more complex aspects of the dynamics of content value chains, rule languages are the choice.
---
paper_title: DRM as a layered system

paper_content:

The current landscape for digital rights management(DRM) consists of various ad hoc technologies and platforms that largely focus on copy protection. The fragmented nature of the DRM industry in 2004 is somewhat reminiscent of the telecommunications industry in the late 1980's. At that time various networking technologies were available, and what was needed was a technology that could integrate existing networks and provide various services to users. The OSI layered framework and the TCP/IP communications protocol suite provided a solution to this situation. The OSI model divides the process of digital data communications into layers. Likewise, in this paper we divide the process of DRM into layers in which various services are offered to the users of digital content at each layer. Three blocks of layers have been identified. The upper layers deal with the end-to-end functions of the application, the middle layers deal with rights expression and interpretation, and the lower layers ensure rights enforcement. This paper describes how responsibilities might be distributed among the various layers, and considers where in these layers it would be appropriate to define protocols and standards.
---
paper_title: Improvement of MPEG-21 right expression language

paper_content:

Digital Rights Management (DRM) allows controlling the access, the use and the diffusion of digital contents produced by right holders. A rights expression language (REL) is necessary. In order to guarantee these rights, the MPEG-21 REL was proposed which is a standardized language used to express the licenses. In this paper, we propose a new MPEG-21 REL model with a formal description and license interpretation process. By introducing the role concept we improve the MPEG 21 REL expressivity. This will be illustrated by several examples.
---
paper_title: Persistent access control: a formal model for drm

paper_content:

Digital rights management (DRM) can be considered to be a mechanism to enforce access control over a resource without considering its location. There are currently no formal models for DRM, although there has been some work in analysing and formalising the interpretation of access control rules in DRM systems. A formal model for DRM is essential to provide specific access control semantics that are necessary for creating interoperable, unambiguous implementations. In this paper, we discuss how DRM differs as an access control model to the three well known traditional access control models - DAC, MAC and RBAC, and using these existing approaches motivate a set of requirements for a formal model for DRM. Thereafter, we present a formal description of LiREL, a rights expression language that is able to express access control policies and contractual agreement in a single use license. Our motivation with this approach is to identify the different components in a license contract and define how these components interact within themselves and with other components of the license. A formal notation allows for an uniform and unambiguous interpretation and implementation of the access control policies.
---
paper_title: Cardinality Constraint Access Control Model and Implementation

paper_content:

Analysis constraints and its diversity in security access control model. Cardinality is a common constraint in access control model. An extended cardinality constraint access control model is established. According to actual demand, we describe the user-role, user-session, role-session cardinality constraints based on the RBAC model. The differences between static and dynamic cardinality constraints are also represented particularly. Describe the extended model with Schema based XML and extend corresponding model functional specification. In order to support the extended model, we give an implementation structure including access control management and query functions.
---
paper_title: Design principles and issues of rights expression languages for digital rights management

paper_content:

Digital rights management (DRM) provides a unified approach to specifying, interpreting, enforcing and managing ::: digital rights throughout the entire life cycle of digital assets. Using a declarative rights expression language (REL) for ::: specifying rights and conditions in the form of licenses, as opposite to some other approaches (such as data structures ::: and imperative languages), has been considered and adopted as a superior technology for implementing effective, ::: interoperable and scalable DRM systems. This paper discusses some principles and issues for designing RELs, based on ::: the experiences of developing a family of REL's (DPRL, XrML 1.x, XrML 2.0 and MPEG REL). It starts with an ::: overview of a family tree of the past and current REL's, and their development history, followed by an analysis of their ::: data models and a comparison with access-control oriented models. It then presents a number of primary design ::: principles such as syntactic and semantic un-ambiguity, system interoperability, expressiveness in supporting business ::: models and future extensibility, and discusses a number of key design issues such as maintaining stateful information, ::: multi-tier issuance of rights, meta rights, identification of individual and aggregate objects, late-binding of to-be-identified ::: entities, as well as some advanced ones on revocation and delegation of rights. The paper concludes with ::: some remarks on REL profiling and extension for specific application domains.
---
paper_title: A four-layer model for security of digital rights management

paper_content:

Defining Digital Rights Management (DRM) is a complex task. There is no unique universal definition. There are many legal, economic, functional, and technical definitions. This complexity induces also that there is not one unique modeling of DRM. Each model should help to compare different DRM systems and easily highlight the differences and the similarities between them. One of the weaknesses of the current models is that none puts specifically the focus on the most important characteristics of DRM: protection of content and rights management. We propose a four-layer model that complements traditional ones. Using trust layer, rights management layer, rights enforcement layer, and content protection layer, this model is security oriented. It is suitable to describe any content protections such as DRM, conditional access, copy protection or even pre-recorded content protection systems.
---
paper_title: Copyright Licenses Reasoning an OWL-DL Ontology

paper_content:

In order to extract the full potential from Internet-wide content sharing and reuse, the underlying copyright issues must be taken into account. The novel requirements are not satisfied by traditional Digital Rights Management. Open licensing initiatives seem more appropriate, but they lack the required computerised support. Our proposal facilitates interoperation while providing a rich framework that accommodates copyright law and copes with custom licensing schemes. It is based on the Description Logic variant of the Web Ontology Language (OWL-DL) and constitutes an ontology that conceptualizes the copyright domain. The ontology provides the building blocks for flexible machine-understandable licenses and facilitates implementation because DL reasoners can be directly used for license checking. However, some preliminary transformations of the licenses models are required in order to overcome the Open World Assumption inherent in OWL-DL, which limits DL-based license reasoning.
---
paper_title: Digital rights management architectures

paper_content:

Digital rights management (DRM) is increasingly becoming a necessity for content management and distribution in highly networked environments such as the Internet. However, very few DRM models have been able to achieve commercial success and acceptance among users. This paper analyzes the problems with current DRM environments and proposes an open layered framework for development of DRM systems, where different technologies can interoperate within the framework. Furthermore, interoperability is studied in terms of the proposed layered framework, and problems posed by the current rights expression languages (RELs) are identified. We conclude that a refactoring of current RELs based on a set of design principles is necessary to achieve a reasonable level of DRM interoperability. We emphasize the need for middleware services for DRM, along with their responsibilities and places of operation within the proposed framework. Finally, a specific prototype architecture is introduced that makes use of existing infrastructures in order to implement a DRM environment consistent with the design principles described in this paper.
---
paper_title: Role-Based Access Control of Digital Right Management.

paper_content:

The Puppet King website includes a large number of digital video and audio materials of Taiwan's traditional puppet shows. These digital materials include pictures, videos, music and a digital right management system, which protects those materials from been infringed. This system can effectively protect digital contents using the Role-based Access Control mechanism, which controls the users' requests for accessing video and audio data. Keyword: Digital Rights Management, PuppetKing, Taiwan's Traditional Puppet Shows, Role-Based Access Control
---
paper_title: Usage Control Enforcement: Present and Future

paper_content:

Both personal data and intellectual property must be protected for various reasons. The authors explore the state of the art in usage control, which is about controlling the use of such data after it has been given away, and identify room for improvement.
---
paper_title: Towards socially-responsible management of personal information in social networks

paper_content:

Considering the increasing number of Personal Information (PI) used and shared in our now common social networked interactions, privacy issues, retention and how such information are manages have become important. Most approaches rely on one-way disclaimers and policies, often complex, hard to find and lacking ease of understanding for ordinary users of such common networks. Thus leaving little room for users to actually retain any control how the released information is actually used and managed once it has been put online. Additionally, personal information (PI) may include digital artifacts and contributions for which people would legitimately like to retain some rights over their use and their lifetime. Of particular interest in this category is the notion of the "right to forget" we no longer have control over, given the persistent nature of the Internet and its ability to retain information forever. This paper examines this issue from the point of view of the user and social responsibility, arguing for the need to augment information with an additional set of metadata about its usage and management. We discuss the use of DRM technologies in this context as a possible direction.
---
paper_title: Location constraints in digital rights management

paper_content:

Digital rights management allows information owners to control the use and dissemination of electronic documents via a machine-readable licence. This paper describes the design and implementation of a system for creating and enforcing licences containing location constraints that can be used to restrict access to sensitive documents to a defined area. Documents can be loaded onto a portable device and used in the approved areas, but cannot be used if the device moves to another area. Our contribution includes a taxonomy for access control in the presence of requests to perform non-instantaneous controlled actions.
---
paper_title: A Rights Management Approach to Securing Data Distribution in Coalitions

paper_content:

As network capacity has increased over the past decade, individuals and organisations have found it increasingly appealling to make use of remote services in the form of service-oriented architectures and cloud computing services. Data processed by remote services, however, is no longer under the direct control of the individual or organisation that provided the data, leaving data owners at risk of data theft or misuse. This paper describes a model by which data owners can control the distribution and use of their data throughout a dynamic coalition of service providers using digital rights management technology. Our model allows a data owner to establish the trustworthiness of every member of a coalition employed to process data, and to communicate a machine-enforceable usage policy to every such member.
---
paper_title: Replay Attack of Dynamic Rights within an Authorised Domain

paper_content:

Digital Rights Management (DRM), unlike access control techniques, associates content with a rights object specifying content usage rules. The rights object is always bound with content and enforced wherever content is transferred and used. Such a rights object, in many cases, contains dynamic rights, which change with usage and time, e.g. play period, print count, and expire after a specific period. Most existing DRM techniques do not address the replay attack problem for dynamic rights. This problem has the greatest impact when the DRM mechanisms get integrated with authorised domains. In this paper we mainly focus on the replay attack for dynamic rights when it is transferred between member devices in an authorised domain, and when it is restored from an old backup enabling the reuse of an expired license. We also propose a novel mechanism for controlling and managing the consumption of dynamic rights between member devices in a domain. This is to provide a controlled environment for a user to transfer dynamic rights back and forth between domain devices in order to use content on any device member in the domain at a chosen time.
---
paper_title: Design and implementation of a context and role-based access control model for digital content

paper_content:

Due to the popularity of the Internet and the trend in digital information, large amounts of information can be transmitted quickly around the world. Because of this, intellectual property rights have become an issue. Some valuable or confidential information might be obtained by unauthorized users from the Internet and, consequently, providing an effective protection mechanism for digital content management has become an important issue. Therefore, the research adopted a context and role-based access control mechanism, and combined usage rules and protection mechanisms to propose a novel access control model for digital content. The proposed model not only takes into account the digital content provider's copyright but also considers users' flexibility. The proposed model was found to be effective and practical for digital content access control. In the study, a prototype was implemented to verify the effectiveness of the proposed model.
---
paper_title: Threshold Based Group-Oriented Nominative Proxy Signature Scheme for Digital Rights Management

paper_content:

Digital Rights Management (DRM) is a system to protect high-value digital assets and control the distribution and usage of those digital assets. Digital licensing controls the contents to be accessed by the consumers. One of the major issues raised by DRM systems concerns the integrity of this license. In this paper, we propose a threshold based group-oriented nominative proxy signature scheme (TB-GO-NPSS) which supports an original provider to delegate his/her signing ability to the partial members of the proxy group having n members and to designate the partial members of the verifier group having l members to verify his/her digital licenses for the mobile users. The proposed scheme can guarantee that the digital products come from the authorized providers. A formal security analysis demonstrates that our scheme is secure enough to be used in DRM systems.
---
paper_title: An interoperable usage management framework

paper_content:

In this paper, we describe a formal framework for usage management that provides a scaffolding upon which interoperable usage management systems can be built. We apply the principles of system design to standardize certain features of the framework, such as the operational semantics, and leave free of standards areas that necessitate choice and innovation. We demonstrate that such an approach enables us to achieve a balance of flexibility and usability for the purpose of interoperability in usage management systems. We provide a formal model that allows us to define formal semantics for interoperability.
---
paper_title: Enforcing DRM policies across applications

paper_content:

In this paper we present Trishul-UCON (T-UCON), a DRM system based on the UCON_ABC model. T-UCON is designed to be capable of enforcing not only application-specific policies, as any existing software-based DRM solution does, but also DRM policies across applications. This is achieved by binding the DRM policy only to the content it protects with no relations to the application(s) which will use this content. Furthermore, to guarantee that the policy is continuously enforced, we designed T-UCON as a JVM-based middleware that mediates the usage requests of any Java application to the protected content. Each request is granted or denied according to the content policy. We illustrate the unique features of T-UCON by using typical examples of DRM policies such as the pay-per-use and the use only N times scenarios. Preliminary results on the overhead of our solution are also provided.
---
paper_title: A Fine-Grained Digital Rights Transfer Policy and Trusted Distribution and Enforcement

paper_content:

Existing digital rights management (abbr. DRM) approaches lack a flexible fine-grained digital rights transfer policy, also could not guarantee the trustworthy distribution and enforcement of the transferable rights policy by using DRM agent. First, descriptions of extensible ODRL-based rights transfer policy were presented to complete OMA REL. Then, we introduced a remote attestation mechanism among entities, such as RI and DRM agent, based on trusted computing platform in order to implement trusted distribution and enforcement of the policy, also mainly proposed trustworthy distribution protocols of the rights object and transfer, as well as a trusted policy enforcement protocol. Final, the approach is made comparison with existing DRM schemes as to several functionality aspects on transferable rights granularity, restricted sharing, temporal limitation, trust of DRM agent. A conclusion is drawn that the proposed scheme is not restricted within local domain environment, and accomplishes fine-grained rights transfer and contents sharing between users without direct participations of rights issuer or local domain manager.
---
paper_title: Research on Usage Control Model with Delegation Characteristics Based on OM-AM Methodology

paper_content:

UCONABC is a basic framework of next generation access control policy Usage Control that is composed of Authorization-oBlige-Condition components, but so far it lacks of important delegation characteristic. The paper analyses the behaviors of delegation in UCON based on OM-AM engineering principles, presents a formalized usage control model with delegation features using BNF Extensions, called as UCOND, and further articulates its hybrid architecture based on Client & Server Delegation Reference Monitors and relative key protocol functions. UCOND is an extension model of UCONABC in the aspect of delegation authorization, and it resolves the delegation question of Usage Control Model. Moreover, we specify delegation procedure of an application for Digital Medium Resource Distribution System.
---
paper_title: A formal foundation for XrML

paper_content:

XrML is becoming a popular language in industry for writing software licenses. The semantics for XrML is implicitly given by an algorithm that determines if a permission follows from a set of licenses. We focus on a fragment of the language and use it to highlight some problematic aspects of the algorithm. We then correct the problems, introduce formal semantics, and show that our semantics captures the (corrected) algorithm. Next, we consider the complexity of determining if a permission is implied by a set of XrML licenses. We prove that the general problem is undecidable, but it is polynomial-time computable for an expressive fragment of the language. We extend XrML to capture a wider range of licenses by adding negation to the language. Finally, we discuss the key differences between XrML and MPEG-21, an international standard based on XrML.
---
paper_title: DRM applied contents share in digital home

paper_content:

DRM(Digital Rights Management) and CAS(Conditional Access System) techniques have been used to cut off the illegal use of contents. These techniques, however, resulted in much inconvenience as restricting the move or play of the content of even legal users. In this paper, we propose a new content share technique based on domain according to the increment of the demand about the flexible content use and share in digital home. The proposed scheme can prevent content being flowed out and cut off the illegal use as describing domain license in the extent of DRM license.
---
paper_title: Identity-Based DRM: personal entertainment domain

paper_content:

Digital Rights Management (DRM) enforces the rights of copyright holders and enforces their business models. This imposes restrictions on how users can handle content. These restrictions apply specifically in networked environments. Authorized Domain (AD) DRM concepts remove several of these restrictions, while taking into account the content providers' need to limit the proliferation of content. This paper compares a number of alternative DRM concepts based on some criteria including control on content proliferation and user experience. We introduce a new concept called Personal Entertainment Domain (PED) DRM. PED-DRM binds content to a person. This person has a number of permanent domain devices. The person's content can be rendered on these permanent domain devices and temporarily on other devices after user authentication. This concept aims at providing a better user experience than current solutions by making it more person identity based. The concept builds upon the best aspects of device-based and person-based DRM. Furthermore, we present the architecture of a PED-DRM realization. We conclude that PED-DRM meets the criteria and is practical to implement, although it has the prerequisite of having an authentication infrastructure.
---
paper_title: Requirements for enforcing digital rights management in multicast content distribution

paper_content:

In this paper, we have collected the requirements for Digital Rights Management from various sources, and presented them as a set of 11 requirements, associated with five categories. We discuss each requirement, provide the motivation for each entry, and illustrate how each one could be achieved. Four example commercial DRM systems are briefly explained, and the requirements that they meet are presented in tabular format. None of the example systems meet all the requirements that we have listed. The security threats that are faced by DRM systems are briefly discussed. All of the example systems are based on unicast data distribution. The use of multicast data distribution can help the source of the data and the underlying network to reduce their resource requirements when distributing high-quality content at minimum cost and delay. Up to now, there has been little motivation to use standard Internet Protocol multicast because it does not support any protection mechanisms for the delivered data. Given that significant progress has been made by other researchers in providing "secure" multicast data distribution, we explore how the use of secure multicast as a distribution technology can bring significant improvement for some requirements, while making the achievement of others more difficult. We review how the architecture of the distribution must change to permit capturing the advantages of multicast distribution while retaining as much as possible the features of unicast systems. Some open problems are identified.
---
paper_title: Redistributing time-based rights between consumer devices for content sharing in DRM system

paper_content:

Device-based digital rights management (DRM) systems tightly bind rights for content to a device. However, it can decrease the consumers’ convenience because it disturbs consumers who want to use the already purchased content with their other devices freely. Previous research into solving this problem still have burdens such as restricting the number of devices that a consumer can use and requiring a special device that manages content sharing. In this paper, we propose a new rights sharing scheme which does not restrict the number of devices that a consumer can use and does not require a specialized device. In our scheme, the right to use content is represented as the right to use the content for a certain amount of time. Consumers can use the content with any of their devices by redistributing the usage amount of time between devices. The redistribution process only requires local synchronization among participating devices. To prevent illegal content sharing and to detect illegally increased content usage time, the amount of time that a consumer can have is limited and the rights for each unit of time has a unique number to prevent illegal duplications. We present data structures and protocols, analyze security properties of our scheme, compare our scheme with related work, and evaluate our scheme through implementation.
---
paper_title: Introduction of the Domain Issuer in OMA DRM

paper_content:

We present the introduction of the Domain Issuer in the Open Mobile Alliance digital rights management (OMA DRM) standard. Domains enable users to access content on multiple devices. In OMA DRM 2.0 Rights Issuers manage which devices belong to a domain besides issuing licenses. However, this results in a confusing customer experience when users buy content from different providers and must maintain a domain at each of them. Sharing domains over multiple content providers solves this problem, and this paper presents an architecture that introduces the Domain Issuer to manage this shared domain.
---
paper_title: A DRM security architecture for home networks

paper_content:

This paper describes a security architecture allowing digital rights management in home networks consisting of consumer electronic devices. The idea is to allow devices to establish dynamic groups, so called "Authorized Domains", where legally acquired copyrighted content can seamlessly move from device to device. This greatly improves the end-user experience, preserves "fair use" expectations, and enables the development of new business models by content providers. Key to our design is a hybrid compliance checking and group establishment protocol, based on pre-distributed symmetric keys, with minimal reliance on public key cryptographic operations. Our architecture does not require continuous network connectivity between devices, and allows for efficient and flexible key updating and revocation.
---
paper_title: Digital Rights Management with Right Delegation for Home Networks

paper_content:

The purpose of digital rights management (DRM) is to protect the copyrights of content providers and to enable only designated user to access digital contents. For a user to share the contents among all his devices in the home network, several domain-based approaches that group multiple devices into a domain have been proposed. In these approaches, however, each device in a domain has equivalent rights on all contents although certain contents require an access control between the devices. In this paper, a new DRM system for home networks is presented. This system enables access control on the contents by a right delegation strategy with proxy certificates. Moreover, it also provides additional functionalities, including restricted sharing and temporal sharing of contents, which are necessary for ordinary scenarios in home networks.
---
paper_title: A Fine-Grained Digital Rights Transfer Policy and Trusted Distribution and Enforcement

paper_content:

Existing digital rights management (abbr. DRM) approaches lack a flexible fine-grained digital rights transfer policy, also could not guarantee the trustworthy distribution and enforcement of the transferable rights policy by using DRM agent. First, descriptions of extensible ODRL-based rights transfer policy were presented to complete OMA REL. Then, we introduced a remote attestation mechanism among entities, such as RI and DRM agent, based on trusted computing platform in order to implement trusted distribution and enforcement of the policy, also mainly proposed trustworthy distribution protocols of the rights object and transfer, as well as a trusted policy enforcement protocol. Final, the approach is made comparison with existing DRM schemes as to several functionality aspects on transferable rights granularity, restricted sharing, temporal limitation, trust of DRM agent. A conclusion is drawn that the proposed scheme is not restricted within local domain environment, and accomplishes fine-grained rights transfer and contents sharing between users without direct participations of rights issuer or local domain manager.
---
paper_title: OPA: Onion Policy Administration Model- Another approach to manage rights in DRM

paper_content:

Digital Rights Management frameworks (DRM) aim at protecting and controlling information contents widely distributed on client devices. Using a license, the content owner specifies which rights can be rendered to end-users. Basically, only the content owner must be able to define this license, but some DRM models go further. In superdistribution scenario, the content owner does not directly manage enduser’s rights but rather delegate this task to a third-party called a distributor. Nevertheless, this distribution cannot be done without any control. In existing approaches, the content owner restricts the license issued by the distributors. In this paper, we provide a new approach, called the Onion Policy Administration approach (OPA). Rather than restricting licenses issued by the different distributors, OPA aims at controlling which rights are finally rendered to end-users. The main idea of OPA is to have a traceability of the content distribution. The content must keep track of all third-parties it crossed in the distribution chain. In this case, everyone can distribute the content and define a new license without any restriction. In these licenses, the content owner and distributors specify end-user’s rights. Using the content traceability, the DRM controller can gather all licenses involved in the distribution chain and evaluate them. In order to be rendered, a right must be allowed by both the content owner and all distributors involved in the distribution chain.
---
paper_title: Integrated Digital Rights Management for Mobile IPTV Using Broadcasting and Communications

paper_content:

This paper presents a digital rights management (DRM) scheme for mobile broadcasting that integrates management via broadcasting and communications. The scheme provides access control and rights protection for subscription Mobile IPTV (Internet Protocol TV), enabling transmission of contract information to control broadcasting reception via both broadcasting wave and communications. It has transmission functions that reduce the amount of contract information that has to be transmitted through broadcasting as well as a function for transmitting contract information via communications. A PC simulation indicates that the DRM scheme is effective in terms of the transmission rate required to send contract information via broadcasting wave. We also demonstrated the feasibility of the DRM scheme by using a prototype system implemented on an SIM card. The DRM scheme enables advanced mobile receiver functions such as pay-per-view with an interactivity channel using communications and a subscription TV such as pay-per-month on mobile receivers without an interactivity channel by transmitting contract information via broadcasting wave.
---
paper_title: An Efficient Contents Sharing Method for DRM

paper_content:

This paper presents a rights management method for the multiple devices of end-user. In recent years, most existing contents sharing solutions are based on Authorized Domain where legally acquired copyrighted content can seamlessly move from device to device. However, Authorized Domain systems are relatively complex and will usually increase the usage cost. In this paper, we propose an efficient contents sharing method for digital rights management system without authorized domain. In particular, we design a novel license acquisition and sharing mechanism based on ergodic encryption and machine authentication techniques. The mechanism works well in a loosely connected network environment. Our design supports efficient and flexible device alterations without expensive revocation mechanism. In addition, a novel pre-experiencing function is supported conveniently in our approach.
---
paper_title: Trusted mobile platforms

paper_content:

This article addresses two main topics. Firstly, we review the operation of trusted computing technology, which now appears likely to be implemented in future mobile devices (including mobile phones, PDAs, etc.). Secondly, we consider the possible applications of this technology in mobile devices, and how these applications can be supported using trusted computing technology. We focus in particular on three mobile applications, namely OMA DRM, SIMLock, and software download.
---
paper_title: Property-based attestation for computing platforms: caring about properties, not mechanisms

paper_content:

Over the past years, the computing industry has started various initiatives announced to increase computer security by means of new hardware architectures. The most notable effort is the Trusted Computing Group (TCG) and the Next-Generation Secure Computing Base (NGSCB). This technology offers useful new functionalities as the possibility to verify the integrity of a platform (attestation) or binding quantities on a specific platform (sealing).In this paper, we point out the deficiencies of the attestation and sealing functionalities proposed by the existing specification of the TCG: we show that these mechanisms can be misused to discriminate certain platforms, i.e., their operating systems and consequently the corresponding vendors. A particular problem in this context is that of managing the multitude of possible configurations. Moreover, we highlight other shortcomings related to the attestation, namely system updates and backup. Clearly, the consequences caused by these problems lead to an unsatisfactory situation both for the private and business branch, and to an unbalanced market when such platforms are in wide use.To overcome these problems generally, we propose a completely new approach: the attestation of a platform should not depend on the specific software or/and hardware (configuration) as it is today's practice but only on the "properties" that the platform offers. Thus, a property-based attestation should only verify whether these properties are sufficient to fulfill certain (security) requirements of the party who asks for attestation. We propose and discuss a variety of solutions based on the existing Trusted Computing (TC) functionality. We also demonstrate, how a property-based attestation protocol can be realized based on the existing TC hardware such as a Trusted Platform Module (TPM).
---
paper_title: A protocol for property-based attestation

paper_content:

The Trusted Computing Group (TCG) has issued several specifications to enhance the architecture of common computing platforms by means of new functionalities, amongst others the (binary) attestation to verify the integrity of a (remote) computing platform/application. However, as pointed out recently, the binary attestation has some shortcomings, in particular when used for applications: First, it reveals information about the configuration of a platform (hardware and software) or application. This can be misused to discriminate certain configurations (e.g., operating systems) and the corresponding vendors, or be exploited to mount attacks. Second, it requires the verifier to know all possible ``trusted'' configurations of all platforms as well as managing updates and patches that change the configuration. Third, it does not necessarily imply that the platform complies with desired (security) properties. A recent proposal to overcome these problems is to transform the binary attestation into property-based attestation, which requires to only attest whether a platform or an application fulfills the desired (security) requirements without revealing the specific software or/and hardware configuration.Based on previous works, we propose a concrete efficient property-based attestation protocol within an abstract model for the main functionalities provided by TCG-compliant platforms. We prove the security of this protocol under the strong RSA assumption and the discrete logarithm assumption in the random oracle model. Our scheme allows blind verification and revocation of mappings between properties and configurations.
---
paper_title: DRM, Trusted Computing and Operating System Architecture

paper_content:

Robust technological enforcement of DRM licenses assumes that the prevention of direct access to the raw bit representation of decrypted digital content and the license enforcement mechanisms themselves is possible. This is difficult to achieve on an open computing platform such as a PC. Recent trusted computing initiatives namely, the Trusted Computing Group (TCG) specification, and Microsoft's Next Generation Secure Computing Base (NGSCB) aim in part to address this problem. The protection architecture and access control model of mainstream operating systems makes them inappropriate as a platform for a DRM content rendering client because decrypted content cannot be protected against a privileged process. If a DRM client is to be deployed on an open computing platform, the operating system should implement the reference monitor concept, which underpins the mandatory access control model. The TCG model of trusted computing has important limitations when combined with an operating system enforcing discretionary access control. We argue that the TCG services of sealed storage and remote attestation which are important in DRM applications, cannot operate in a secure and efficient manner on such an operating system.
---
paper_title: Semantic remote attestation

paper_content:

Remote attestation is one of the core functionalities provided by trusted computing platforms. It holds the promise of enabling a variety of novel applications. However, current techniques for remote attestation are static, inexpressive and fundamentally incompatible with today's heterogeneous distributed computing environments and commodity open systems. Using language-based virtual machines enables the remote attestation of complex, dynamic, and high-level program properties---in a platform-independent way. We call this semantic remote attestation. This enables a number of novel applications that distribute trust dynamically We have implemented a prototype framework for semantic remote attestation, and a number of example applications built on it.
---
paper_title: Implementing Trustworthy Dissemination of Digital Contents by Using a Third Party Attestation Proxy-Enabling Remote Attestation Model

paper_content:

A secure and trusted distribution of digital contents is a fundamental requirement for Digital Rights Management (DRM) system, so that the integrity of user terminal platform should be verified prior to contents' distribution in order to assure that the platform is free from a malicious modification and attack. Recent years the emerging trusted computing has better enhanced the necessary functionality, though existing remote attestation models and relevant protocols could not solve a critical problem of the privacy protection of the attested platform states, which include basic configurations and security attributes. We proposed an implementation of trustworthy dissemination of digital contents by using a third party attestation proxy-enabling remote attestation model with the privacy protection of the front-end user device environment. Also, a Xen virtualization-based terminal platform architecture, which primarily enforces the domain isolation among the processes or key components, was presented. Finally, an application case manifested the proposed model and platform architecture not only realized the remote integrity verification of user end devices that was carried out on the back-end contents server side, but effectively protected the platform states privacy, further improving the usability of DRM system.
---
paper_title: Secure Data Management in Trusted Computing

paper_content:

In this paper we identify shortcomings of the TCG specification related to the availability of sealed data during software and hardware life cycles, i.e., software update or/and hardware migration. In our view these problems are major obstacles for large-scale use of trusted computing technologies, e.g., in e-commerce, as adopters are concerned that the use of this technology might render their data inaccessible. ::: ::: We propose both software and hardware solutions to resolve these problems. Our proposals could be easily integrated into the TCG specification and preserve the interests of involved parties with regard to security and availability as well as privacy.
---
paper_title: TBDRM: A TPM-Based Secure DRM Architecture

paper_content:

Digital Rights Management (DRM) is the technological solution to control the distribution and usage of digital assets. However, existing solutions are vulnerable to various attacks in the context where the consumer can control the platform totally. To improve the security of DRM solutions the paper proposes a secure DRM architecture based on TPM which is called TBDRM. It ensures that content is always under the control of the license and such license is secure and fresh during its lifecycle. Compared with other DRM solutions, TBDRM can prevent replay attack and improper access enforced through cracked software.
---

Title: Digital Rights Management Ecosystem and its Usage Controls: A Survey

Section 1: Introduction
Description 1: Provide an overview of the rapid developments in ICT, the rise of copyright infringement, and the emergence of DRM as a response to safeguard rights and benefits in the digital content industry.

Section 2: Representative RELs
Description 2: Discuss the various Rights Expression Languages (RELs) used by content/right providers to specify usage policies, the formal specification efforts, and comparison of some representative RELs like XrML, ODRL, and MPEG-21.

Section 3: Logic-Based Rights Formalism
Description 3: Describe the development of REL formalism based on logical approaches, highlighting significant models like Llic, Lithium, and LicenseScript, and their contributions to the robustness and expressiveness of rights management.

Section 4: REL Design and Applications
Description 4: Outline the design principles for RELs, compare available RELs and access control models, and discuss their applications in dynamic modeling, digital content access, and implementing business models.

Section 5: Usage Control Models and Applications
Description 5: Present the fundamental usage control framework, such as UCON ABC, and discuss its applicability in DRM, including temporal-spatial extensions, cross-application policies, and personal privacy protections.

Section 6: Rights Transfer-Supported RELs and Depictions
Description 6: Explore the necessity of legal sharing, rights transfer, and delegation functionalities within RELs, highlighting formal models like UCOND and their implementations for precise rights transfer and content sharing.

Section 7: Rights Sharing Mechanisms and Implementation
Description 7: Investigate mechanisms for distributing usage licenses and content sharing scenarios like 'Authorized Domain', addressing security challenges and offering comparisons of various schemes and their efficiency.

Section 8: Trusted Computing and Its Specifications from the IT Industry
Description 8: Examine the role of trusted computing techniques and industry specifications in establishing trustworthy environments for DRM applications, focusing on secure storage, confidential content handling, and trustworthy behaviors.

Section 9: Trusted Computing Techniques and DRM Applications
Description 9: Discuss existing trusted computing technologies applicable to DRM, including remote attestation, virtualization, and conceptual trusted platform architectures, emphasizing their roles in ensuring the integrity of DRM systems.

Section 10: Conclusions
Description 10: Summarize the significant advancements in DRM technologies, emerging challenges, and the open issues related to security risks, trusted computing requirements, and the establishment of cross-domain platforms.