Security Aspects of Drm Systems

Acquiring digital media over the Internet has become commonplace in recent years. Companies are looking into ways to sell their content (music, movies, etc.) over the Internet without the buyer being able to further distribute the work. Digital Rights Management (DRM) systems address this; their main goal is to enable authorised users to access a version of digital content on the terms for which they are authorised whilst preventing all other access to digital content. This is of course not always possible, therefore the field of DRM is also interested in practical security, i.e. security that may theoretically be breakable, but in practice will not be (because the costs outweigh the benefits). So DRM systems aim to achieve a security goal. How well they achieve this goal is unclear. Although various security techniques are being used by DRM systems and being researched for use in DRM systems, there seems to be little research into evaluating the security of an entire DRM system. As security of the individual components of a system does not guarantee security of the system as a whole, this means that currently it is hard to understand what level of security is offered by a DRM system. TNO ITSEF performs security evaluations of both hardware and software products. This paper is a preliminary and condensed report of research into evaluating the security of DRM systems. The main goal of this research is to devise a security evaluation method that has consistent, reciprocal comparable results.