1) The document proposes a policy-based service-oriented digital rights management (DRM) system to improve interoperability and security. 2) It streamlines the DRM system architecture to be service-oriented and implements security policies using the eXtensible Access Control Markup Language (XACML) to decouple authorization decisions. 3) The proposed system allows participants in the DRM system to autonomously manage their own systems through centralized security policies that control authorization and access across systems.

1. Design and Implementation of a Policy-based
Service-oriented DRM System
Yung-Hsin Wang, Yu-Hong Lin Shing-Han Li
Tatung University Nat’l Taipei Univ. of Business
Taipei, Taiwan Taipei, Taiwan
1
WDSI 2015 - Maui, Hawaii

2. Outline2
4. Conclusion & Future Work Direction
3. Design and Implementation
2. Background and Technology
1. Introduction

3. Motivations3
DRM permits smooth, secure, trusted movement of digital
contents from Content Providers and Distributors to
Clearing House and Consumers
Based on access, use, tracking, payment & reporting system
Business functions automated to deliver creators’ win-distributors’
win-clearing house’s win-consumers’ win
Access control and authorization implemented in proprietary
manner results in extreme tight coupling of authorization decisions
within applications

4. Motivations (cont.)4
SOA solution
Not only a framework but a key mechanism for cost effectiveness
Promoting organizational agility to adapt the most frequent
changing environment
Implementing SOA to improve DRM System
Service interoperability, Loosing coupling, Reusing or composing
shared service components during service orchestration
Challenges in security issue!

5. To re-model DRM System based on SOA
All participants well collaborate and equitably share sales benefits
Adopt policy-based security mechanism
Introduce the eXtensible Access Control Markup Language
(XACML) technology to decouple authorization decisions from
DRM system
Fulfill autonomous management on authorization and access
control for all resources via flexible policy-based SOA solution
5 Research Objective

6. 2. Background and Technology
6 Outline
4. Conclusions & Future Works Direction
3. Design and Implementation
1. Introduction

7. Emphasizing on protection
and management for
digital contents
The essential is to
control publication,
billing/payment and
copyright for digital
contents
7 DRM System

8. Usually
combined with
certain business
models for the
sales of digital
contents
8 DRM System
The integrated DRM solution

9. Service Contract
Service Loose Coupling
Service Abstraction
Service Reusability
Service Autonomy
Service Statelessness
Service Discoverability
Service Composability
9 Service Oriented Design Principle

10. Interoperability problems arise within different DRM
solutions
DRM with SOA can increase interoperability for the system
management and facilitate efficient collaboration
Security is a major imperative for SOA
Figueira Filho et al. (2006) in their proposed framework adopted
SOA and a high-level policy modeling approach to promote
interoperability among DRM systems; however, the policy model
only focused on the copyright protection
10 DRM System Moves to SOA

11. eXtensible Access Control Markup Language
Based on XML standards
Define the general policy syntax for resources protection and
access
OASIS has regulated XACML as security standards to support
security technology for access control
11 XACML frameworks for services security

12. 12
TheimplementationprocessofXACML
andaccesscontrolarchitecture

13. SOA-based DRM System’s security, privacy, resource
authorizing and access control must be well managed.
Help participants in SOA-based DRM System
autonomously manage their own systems
Security Policy applies to resource authorization and access
control among systems
Facilitate the abstraction of security jobs from the logic
loop of business system to become public services
achieve centralization of operation and management
13 Security Policy in SOA-based DRM System

14. 2. Background and Technology
14 Outline
4. Conclusions & Future Works Direction
3. Design and Implementation
1. Introduction

15. 15
Step 1. Streamline DRM system architecture
to be service choreography
The fundamental architecture
of DRM system
The streamlined architecture of DRM

16. 16
Step 2. Achieve the service-oriented DRM
system
Relations between functions and/or
systems among the DRM system
TheDRMsystemwithlayeredSOA
The SOMA layered
mechanism

17. 17
Step 3. Implement security policy with
XACML

18. 18
The example of XACML Policy converted from CMS
Content Provider authorizes
contents to Distributor

19. 19
The inquiry example of XACML Request for Consumer or Distributor

20. 20
The Example of XACML Response from PDP
when Distributor inquires the authorized content

21. 21
2. Background and Technology
Outline
4. Conclusion & Future Work Direction
3. Design and Implementation
1. Introduction

22. This study has designed and implemented a policy-based
service-oriented DRM system
Transform a proprietary/tight-coupling DRM system into a
loose-coupling/on-demand business processes
Help participants' operation among DRM system be flexible and
react agilely in data transmission, exchange or integration
Not only to meet the security needs of web services, but also to
achieve a loose coupling in resources perspective
22 Conclusion

23. 23 Future Work Direction
Apply to cloud computing via service-oriented features
Parties who need to build up their systems can take advantages
of Infrastructure as a Service (IaaS) to save hardware costs and
maintenance expenses
Functions of Multi-layered and remodeled DRM system can
leverage Software as a Services (SaaS)
Adopt XACML to fulfill the security and safety needs of
inter–service in cloud computing
.

24. Thanks for your attention!
24