Digital Rights Management Systems Research Articles

A randomized encryption algorithm for the MPEG-DASH digital rights management

ABSTRACT This article addresses the pervasive issue of digital piracy in the movie industry. Despite substantial efforts to combat piracy, its impact remains significant, resulting in substantial financial losses for companies. Digital rights management (DRM) has been introduced as a countermeasure to counter this challenge. While the security of video applications, including commercial and military videos, has gained prominence in recent research, this paper focuses on enhancing the encryption algorithm and presenting encryption results. Specifically, it explores the AES 128 encryption algorithm’s vulnerabilities in the MPEG-DASH media file and proposes a randomized algorithm for video file encryption. To bolster security, the randomized approach leverages three robust algorithms: AES 256, Two-Fish, and Serpent. The randomized algorithm demonstrated significantly higher resistance to brute-force attacks than AES 128 CBC, as exemplified by a test scenario with a key length of 32 and 100 media chunks. By utilizing this combination of unbroken algorithms, the paper offers an efficient solution for offline-protected media storage, ultimately strengthening the security and privacy of the MPEG-DASH DRM system and mitigating the risk of media file piracy. The randomized algorithm consistently outperformed AES 128 CBC in terms of execution time across multiple media files, with the randomized algorithm completing the encryption process in 34,610 milliseconds for Media File 1, compared to AES 128 CBC, which required 59,910 milliseconds, showcasing a notable enhancement in speed.

Your DRM Can Watch You Too: Exploring the Privacy Implications of Browsers (mis)Implementations of Widevine EME

Thanks to HTML5, users can now view videos on Web browsers without installing plug-ins or relying on specific devices. In 2017, W3C published Encrypted Media Extensions (EME) as the first official Web standard for Digital Rights Management (DRM), with the overarching goal of allowing seamless integration of DRM systems on browsers. EME has prompted numerous voices of dissent with respect to the inadequate protection of users. Of particular interest, privacy concerns were articulated, especially that DRM systems inherently require uniquely identifying information on users' devices to control content distribution better. Despite this anecdotal evidence, we lack a comprehensive overview of how browsers have supported EME in practice and what privacy implications are caused by their implementations. In this paper, we fill this gap by investigating privacy leakage caused by EME relying on proprietary and closed-source DRM systems. We focus on Google Widevine because of its versatility and wide adoption. We conduct empirical experiments to show that browsers diverge when complying EME privacy guidelines, which might undermine users' privacy. For instance, we find that many browsers gladly give away the identifying Widevine Client ID with no or little explicit consent from users. Moreover, we characterize the privacy risks of users tracking when browsers miss applying EME guidelines regarding privacy. Because of being closed-source, our work involves reverse engineering to dissect the contents of EME messages as instantiated by Widevine. Finally, we implement EME Track, a tool that automatically exploits bad Widevine-based implementations to break privacy.

Construction of a secure and efficient content key distribution framework for DRM systems

SummaryRecent advances in networks and digital technology have provided many user‐friendly environments such as telemedicine, e‐banking, e‐content, and e‐commerce. It has revolutionized the multimedia industry and made it accessible anytime and anywhere. However, its limitation also appeared in digital content piracy, which is more prevalent nowadays. Digital rights management (DRM) systems were developed to control the illegal spreading of digital content. Protocols are being developed to enable effective and secure communication in DRM systems. As security and efficiency are essential parameters, the approach should be two birds with one stone; i.e., the protocol should achieve efficiency and security together. Our investigation identified that secure mechanisms either have increased computation/communication overhead or fail to meet specified security criteria when discussing efficient content key delivery mechanisms. So, an efficient protocol design with the right security attributes is required. We have worked on designing a content delivery mechanism keeping in mind the desirable attribute of security and without decreasing overhead. The suggested solution targets “two birds with one stone.” We proved the security of the scheme in the random oracle model. We verify the security against active attacks using the formal simulation tool AVISPA. Detailed analysis is performed for the evaluation of computational and communication overhead. The comparative study is also presented to understand the gains in efficiency and security.

Digital Rights Management System of Media Convergence Center Based on Ethereum and IPFS

Digital Rights Management System of Media Convergence Center Based on Ethereum and IPFS

Privacy preserving content distribution framework for multidistributor DRM systems

AbstractGrowing network technology and computing facilities present greater opportunities for the e‐commerce industry to sell digital content on an easily assessable platform. However, digital content creators need help due to digital content easily copying and redistributing without quality degradation. Digital rights management (DRM) systems are built up to deal with content piracy and effective distribution. However, traditional two‐party DRM systems are client–server architecture, which may create a bottleneck situation for large networks. At the same time, a multidistributor DRM (MD‐DRM) system can offer content distribution more effectively. However, as the number of distributors increases, chances of security and privacy vulnerability may increase. Thus, a MD‐DRM system requires with an effective mechanism of privacy‐preserving and secure content distribution. We proposed a privacy‐preserving and authorized content distribution framework that remains compatible with multiple distributors and single‐distributor architecture to achieve basic security attributes. Besides, the proposed scheme does not breach the key parameters of accountability. This mechanism makes traitor identification possible without violating the privacy rights of authorized consumers in multidistributor architecture.

Blockchain-based digital rights management systems: Design principles for the music industry

Initially designed to protect intellectual property (IP) of digitalized information goods such as music, games, or books, existing centralized digital rights management (DRM) systems mostly serve the interests of major publishers, with scant inclusion of rights owners, creators, and consumers. Although various blockchain-based DRM systems have been proposed, most of them mirror existing counterproductive IP restrictions. Analyzing the music industry as a case in point, this paper proposes design principles for blockchain-based DRM systems that provide an integrated and flexible solution by enabling transparent music licensing structures, consistent and complete rights metadata, and efficient and transparent royalty payout. The solution can be achieved by storing rights metadata on a public distributed ledger, by validating metadata through a consensus mechanism on a permissioned blockchain, and by algorithmically enforcing royalty payout via stablecoin through a smart contract. The design principles were evaluated by industry experts, validating their benefit for the music industry by increasing surplus value that is currently destroyed through previous suboptimal designs.

Protection in DRM and pricing strategies for digital products considering quality degradation

<p><big>In this paper, we develop a model in which a monopolistic firm manufactures and sells a digital product, by incorporating digital rights management (DRM), quality degradation of pirated products, and government copyright enforcement into the consumer’s utility function. We determine the monopolist’s optimal pricing strategies and the appropriate DRM protection level through mathematical deduction. Our results show that when the government copyright enforcement is moderate and the quality of pirated products is relatively high, implementing a DRM system is optimal for the monopolist. However, in most other cases, DRM-free is better for the monopolist. This result may explain why DRM is not very popular in some industries. Our results suggest that choosing the right price, focusing on content innovation, and weakening DRM protection may be a better strategy for firms now. The results also indicate that DRM-free may be more prominent in the digital music industry than in the software and video games industries.</big></p>

A construction of post quantum secure authenticated key agreement design for mobile digital rights management system

A construction of post quantum secure authenticated key agreement design for mobile digital rights management system

Do I Need to Ask Permission? Applying Fair Use to Educational Activities.

Do I Need to Ask Permission? Applying Fair Use to Educational Activities.

Improved integral cryptanalysis of SPNbox in digital rights management systems

As an access control technology of digital material, digital rights management systems have a profound effect on the copyright protection of digital content. To address the threat of key exposure, applying white-box ciphers is effective to provide a security guarantee for digital rights management systems. SPNbox, proposed at Asiacrypt’16 is such a white-box cipher that fulfils comprehensive resistance against key exposure for digital rights management systems, including black-box security on the server-side and white-box security on the client-side. So far, the previous integral cryptanalysis of SPNbox employs a general 2-round distinguisher without considering the details of SPNbox. The properties of SPNbox are carefully explored and a novel 2-round integral distinguisher is introduced. On this basis, we propose new competitive 3-round key recovery attacks with lower complexities. Particularly, the improved attack on 3-round SPNbox-32 only requires 232 chosen plaintexts, whereas the current best attack necessitates 262 chosen plaintexts. In addition, integral attacks on 4- and 5-round SPNbox-8 are presented for the first time. Thus, the security margin of SPNbox-8 is narrowed by two rounds. These results indicate that the capability of SPNbox resisting integral cryptanalysis is inferior to the designers' claim.

Understanding employee's emotional reactions to ISSP compliance: focus on frustration from security requirements

ABSTRACT As the importance of information assets increases, employees are increasingly required to comply with organisational policies for information security (InfoSec). Since security-related demands lead to stressful situations, employees are likely to bypass security policies to perform their tasks. Extant literature does not sufficiently address the detrimental factors of information system security policies (ISSP). This study investigates employees’ emotional reactions to ISSP compliance from the perspectives of technostress and coping. The aim of this study is to identify behaviour antecedents of frustration in the context of InfoSec and provide factors for mitigating the negative effects of frustration on ISSP compliance intentions. This study followed a survey approach and conducted structural equation modelling using the WarpPLS program to examine its research model and hypotheses. The survey respondents comprised employees who used an enterprise digital rights management system. The results demonstrated that frustration negatively affected employees’ intentions to comply with ISSP, but these negative effects of frustration decreased when autonomy was granted. Further, this study provides critical new insights on ISSP compliance from an emotional perspective.

Digital Copyright Protection: Focus on Some Relevant Solutions

Copyright protection of digital content is considered a relevant problem of the current Internet since content digitalization and high performance interconnection networks have greatly increased the possibilities to reproduce and distribute digital content. Digital Rights Management (DRM) systems try to prevent the inappropriate or illegal use of copyrighted digital content. They are promoted by the major global media players, but they are also perceived as proprietary solutions that give rise to classic problems of privacy and fair use. On the other hand, watermarking protocols have become a possible solution to the problem of copyright protection. They have evolved during the last decade, and interesting proposals have been designed. This paper first presents current trends concerning the most significant solutions to the problem of copyright protection based on DRM systems and then focuses on the most promising approaches in the field of watermarking protocols. In this regard, the examined protocols are discussed in order to individuate which of them can better represent the right trade-off between opposite goals, such as, for example, security and easy of use, so as to prove that it is possible to implement open solutions compatible with the current web context without resorting to proprietary architectures or impairing the protection of copyrighted digital content.

Eland: An Efficient Lightweight Anonymous Authentication Protocol Applied to Digital Rights Management System

<p>A digital rights management (DRM) system provides the function of packaging raw content into an appropriate distribution form, protection for content temper-proof transmission and circumvention of unauthorized use. The digital rights contents in DRM system improve people’s spiritual quality and create huge market value. However, in the sharing of digital contents, malicious adversaries could bring security and privacy issues even cause infringement of copyright. To solve these problems, valid user identity authentication and secret key distribution to legal users is an efficient method. Nevertheless, the existing authentication schemes for DRM system have problems of security weakness or efficiency to be enhanced. Thereby, we cryptanalyze these protocols’ vulnerabilities and propose a new lightweight anonymous authentication protocol called Eland that can be efficiently applied to DRM system. We compare our protocol with six DRM-related authentication protocols from the aspects of security properties, computation expense and communication cost. Comparisons results indicate that our protocol achieves a well trade-off between security and performance. Specifically, our protocol reduces 37.5% communication cost and satisfies more security requirements than Yu et al.’s scheme.</p> <p> </p>

An Improved Authentication Scheme for Digital Rights Management System

With the increasing number and popularity of digital content, the management of digital access rights has become an utmost important field. Through digital rights management systems (DRM-S), access to digital contents can be defined and for this, an efficient and secure authentication scheme is required. The DRM authentication schemes can be used to give access or restrict access to digital content. Very recently in 2020, Yu et al. proposed a symmetric hash and xor-based DRM and termed their system to achieve both security and performance efficiency. Contrarily, in this study, we argue that their scheme has several issues including nonresistance to privileged insider and impersonation attacks. Moreover, it is also to show in this study that their scheme has an incorrect authentication phase and due to this incorrectness, the scheme of Yu et al. lacks user scalability. An improved scheme is then proposed to counter the insecurities and incorrectness of the scheme of Yu et al. We prove the security of the proposed scheme using BAN logic. For a clear picture of the security properties, we also provide a textual discussion on the robustness of the proposed scheme. Moreover, due to the usage of symmetric key-based hash functions, the proposed scheme has a comparable performance efficiency.

Blockchain-Enabled Digital Rights Management for Museum-Digital Property Rights

With the rapid development of digitization technology, digital copyright of museum has become more and more valuable. Its collections can be opened to and shared with the people through the Internet. However, centralized authorization, untransparent transaction information and risk of tampering data in traditional digital rights management have a strong impact on system normal operation. In this paper, we proposed a blockchain-based digital rights management scheme (BMDRM) that realizes a distributed digital rights management and authorization system by introducing non-fungible tokens (NFTs) and smart contracts. To ensure the security and efficiency of transactions and authorization, we store all processing data in a high-security distributed ledger based on cryptographic signatures. We test our scheme on Ethereum private network and the experimental results show that BMDRM is feasible and secure for digital rights management in museums.

Digital access rights management in the information systems of e-libraries and digital archives

The author reviews the basic types of digital document content protection from unauthorized access and dissemination applied by publishers and book trading companies. The principles of digital rights management (DRM) while accessing digital documents. The author suggests that DRM systems are efficient to be applied to certain types and formats of digital documents in libraries and archives. He also reviews several commercial solutions for DRM-systems plied to the most popular PDF-format and substantiates the importance of DRM-systems standardization for digital document friendliness both for the users and rights holders disseminating digital publications. Existing and newly introduced international standards for DRM-systems are discussed. The typology of digital rights protection software as provided for by the standards is presented along with regulated DRM-system features based on data coding. Readium project by international non-profit Readium Foundation exemplifies standard approach to DRM-system design. The project goal is to develop software modules to integrate standard DRM-technology into computer information systems including ALIS.

Blockchain and Cloud to Overcome the Problems of Buyer and Seller Watermarking Protocols

Copyright protection of digital content has become a problem not only for web content providers but also for ordinary web users who like to publish their digital contents on social or user generated content platforms. Among the possible solutions to such a problem, digital watermarking, in conjunction with watermarking protocols, appears to be a valid alternative to current DRM (digital rights management) systems. In fact, watermarking based solutions insert perceptually invisible copyright information into the copies of contents published or distributed on the web in order to track them. Such insertions are carried out according to the watermarking protocols, which have evolved over the years from the classic “buyer and seller” paradigm into a simpler and versatile “buyer friendly” and “mediated” approach. However, such an approach cannot exploit the new technologies that characterize the current Internet. This paper presents a new watermarking protocol able to adapt the “buyer friendly” and “mediated” approach to the use of innovative technologies such as cloud platforms and blockchain. In this way, (1) content providers and common web users can take advantage of the computing and storage resources made available by cloud platforms; (2) the involvement of trusted third parties in the protocols can be reduced by using blockchain without complicating the protection scheme. In fact, these two goals make the protocol particularly suited for the current Internet.

A provably secure content distribution framework for portable DRM systems

The growing demand for digital content using smart devices has taken the attenuation towards the enforcement of rights in digital content distribution. Digital rights management (DRM) systems support copyrights and try to control the access of digital content in a user-friendly way. However, user-friendly systems should also support user’s rights along with system requirements. The portable DRM architecture has the potential to support user’s rights. One of the critical challenges in portable DRM systems is the anonymous and secure delivery of digital content. To address this issue, a smart card-based content distribution framework is presented, which supports mutual authentication and secure session establishment. The security proof of the proposed scheme is presented in a random oracle model with rigorous informal security analysis, which signals that the proposed scheme has desirable attributes of security. Moreover, the security analysis is also performed using a widely adopted simulation tool, namely, “Automated Validation of Internet Security Protocol and Application (AVISPA)”. The study of performance has been conducted, which signals that the proposed scheme is also addressing the requirements of efficiency.

An authenticated access control framework for digital right management system

With the growing development in digital content distribution, researchers focus on the construction of an access right enabled digital content distribution framework for the legal user. Digital rights management (DRM) is the system which tries to ensure authorized content distribution. Current, DRM systems either provide authentication or constrain access right, but access control with legal authentication in the digital content distribution has remained a challenging issue for public-key cryptography (PKC) or identity-based public-key cryptography (ID-PKC). PKC associates certificate management, which includes revocation, storage, distribution and verification of certificates. As a result, certificate authority becomes the bottleneck in a large network. On the other hand, ID-PKC has the drawback of key escrow. For secure and authorized content distribution, evacuation from these problems is needed. In this paper, we present an authenticated access control protocol, which maintains user’s right with authorized content distribution for the digital right management system. Its security has been proved in the random oracle model. An analysis of performance shows enhancement in efficiency, which indicates that the proposed scheme presents a secure and authorized access control mechanisms for resource-constrained devices.

Correction to: A digital rights management system based on a scalable blockchain

A Correction to this paper has been published: https://doi.org/10.1007/s12083-021-01098-2