Content Distribution, Rights Management and Trusted PlatformsWhat is Content Distribution?Enterprise challengesEnterprise challengesEnterprise challengesEnterprise challengesHave you ever encountered this?What is the Content Distribution Problem?Rights ManagementAgendaMotivationPolicy Enforcement Systems are ProlificPolicy Enforcement Mechanisms in Microsoft Products TodayPolicy-related Tasks in RM NetworksKey Technical ChallengesGeneral description of RELsAn example REL: XrML 2.XXrML 2.XSemantic of a GrantSample XrML 2.X LicenseXrML authorization modelXrML Key Language FeaturesXrML 2.X and Multiple AuthoritiesXrML 2.X and Multiple Authorities (cont’d)Evaluating Policy ExpressionsAttestable TCBsTrust is Central to Attestable TCBsBuilding Attestable TCBsNGSCB – How It WorksAttestation in NGSCBAttestation and RM SystemsSummaryQuestions?Content Distribution, Rights Content Distribution, Rights Management and Trusted PlatformsManagement and Trusted PlatformsBrian A. LaMacchiaBrian A. LaMacchiaSoftware ArchitectSoftware [email protected]@microsoft.comWindows Trusted Platform TechnologiesWindows Trusted Platform TechnologiesMicrosoft CorporationMicrosoft CorporationCPSC 155bCPSC 155bEE--Commerce: Doing Business on the InternetCommerce: Doing Business on the InternetMarch 25, 2003March 25, 200322What is Content Distribution?What is Content Distribution?zzThe movement of content (any digital The movement of content (any digital information) across a network from the information) across a network from the content creator’s machine to a content content creator’s machine to a content user’s machineuser’s machine{{Usual example: electronic distribution of massUsual example: electronic distribution of mass--market media (books, music, movies) from the market media (books, music, movies) from the content creator (or licensee) to the consumer.content creator (or licensee) to the consumer.{{But enterprises have similar situationsBut enterprises have similar situations{{Consumers also distribute content Consumers also distribute content {{PersonallyPersonally--identifiable informationidentifiable information33Enterprise challengesEnterprise challenges“the fastestthe fastest--growing type of growing type of cybercrimecybercrimeinvolves the theft of involves the theft of intellectual intellectual property,theproperty,thepilfering of a company’s plans pilfering of a company’s plans for major projects . . . stolen for major projects . . . stolen by an employee and sold to a by an employee and sold to a competitorcompetitor.”——TheTheNew York TimesNew York Times, January 27, 2003, January 27, 200344Enterprise challengesEnterprise challenges“ But most corporations do lose intellectual property through employees. Whether intentionally or inadvertently, electronic files containing corporate intellectual property can eventually show up on an outsider's Web site or, worse, in a competitor's hands.”—— Gartner G2 News Analysis,February 25, 200355Enterprise challengesEnterprise challenges“A public-relations firm is dealing with a public-relations nightmare after unintentionally e-mailing journalists and others documents about one of its clients, Seattle-based Cell Therapeutics.”——The Seattle Times,February 1, 200366Enterprise challengesEnterprise challengeszz32% of the worst security incidents were 32% of the worst security incidents were caused by caused by insidersinsiders; 48% in large ; 48% in large companiescompanieszzIntellectual property theftIntellectual property theftcaused the caused the greatest financial damage of all security greatest financial damage of all security failuresfailureszzCostsCosts::{{Consultant fees (fix damage), Down Consultant fees (fix damage), Down time, Brand damage, Legal liability, time, Brand damage, Legal liability, Customer confidence, etc.Customer confidence, etc.77Have you ever encountered this?Have you ever encountered this?88What is the Content Distribution What is the Content Distribution Problem?Problem?zzThe content distribution problem is one of The content distribution problem is one of control.control.{{Content creators want (some) control over Content creators want (some) control over how their content is consumed after it leaves how their content is consumed after it leaves their machines.their machines.zzThe Internet does a great job moving bits The Internet does a great job moving bits around, but it cannot enforce policies on around, but it cannot enforce policies on those bits once they’ve moved.those bits once they’ve moved.99Rights ManagementRights ManagementzzEnter rights management (RM) systems, Enter rights management (RM) systems, which aim to associate policy with content which aim to associate policy with content as that content flows across networks and as that content flows across networks and enforce that policy at remote nodes.enforce that policy at remote nodes.{{The term “digital rights management” (DRM) The term “digital rights management” (DRM) tends to be used today to refer to RM systems tends to be used today to refer to RM systems specifically designed for massspecifically designed for mass--market media.market media.{{We’re going to talk about the general RM case We’re going to talk about the general RM case today, not specifically RM for mediatoday, not specifically RM for media1010AgendaAgendazzMotivation: RM as a policy management problemMotivation: RM as a policy management problemzzRights expression languages Rights expression languages ––XrMLXrML2.X2.X{{Authoring & evaluating policies for use of content.Authoring & evaluating policies for use of content.{{For DRM: representing grants of copyrightFor DRM: representing grants of copyright--related rights and related rights and modeling physicalmodeling physical--world transfers of rights.world transfers of rights.zzTrusted Computing Platform Alliance (TCPA) and NextTrusted Computing Platform Alliance (TCPA) and Next--generation Secure Computing Base (NGSCB)generation Secure Computing Base (NGSCB){{Approaches to adding “attestation” capabilities to the PC. Approaches to adding “attestation” capabilities to the PC. {{Attestation allows the PC to make a digitallyAttestation allows the PC to make a digitally--signed statement about signed statement about its state (e.g. that some set of software is currently running).its state (e.g. that some set of software is currently running).{{Projecting policy