We describe the problem of unknown-compromised devices communicating with compliant devices in the context of rights transfer mechanisms within a DRM system. An unknown-compromised device can be used to acquire content rights in the usual manner (from either a backend rights issuer or a peer device), but it is not constrained by rules of legitimate processing other than to remain undetected. The compromise must remain undiscovered in order to avoid revocation which would result in rejection by compliant devices aware of this. Techniques to minimize the damage that can be caused by such rogue devices are introduced and contrasted.

The problem addressed in this paper is that of DRM interoperability. The term DRM interoperability, as used here, refers to approaches that provide for the transfer, from one "upstream" DRM system to another "downstream" DRM system, of DRM protected content and an associated license. We introduce the concept of a Rights Issuer Module (RIM) that is functionally situated in the home network between the upstream device (which includes an upstream-DRM agent) and downstream devices (which each include a downstream-DRM agent). The novelty of our approach lies in the way the RIM handles significant aspects of the translation operations, potentially leaving the upstream and downstream DRM agents intact. Security and implementation advantages of the RIM are discussed. The tradeoffs involved with different RIM implementations are examined.

In this paper we examine how copyright protection of digital items can be securely managed in a 3G mobile phone and other devices. First, the basic concepts, strategies, and requirements for digital rights management are reviewed. Next, a framework for protecting digital content in the embedded environment of a mobile phone is proposed and the elements in this system are defined. The means to enforce security in this system are described and a novel "Family Domain" approach to content management is introduced. Our new approach uses key sharing to help alleviate bad user experiences that are associated with some rights management systems. Examples outlining the enrollment of devices and the acquisition, rendering, and superdistribution of content are shown. Our proposed system is not only applicable to a mobile phone system, but may also be extended to other embedded systems, such as personal digital assistants, set-top boxes, or personal computers.

This paper examines how monitoring power consumption signals might breach smart-card security. Both simple power analysis and differential power analysis attacks are investigated. The theory behind these attacks is reviewed. Then, we concentrate on showing how power analysis theory can be applied to attack an actual smart card. We examine the noise characteristics of the power signals and develop an approach to model the signal-to-noise ratio (SNR). We show how this SNR can be significantly improved using a multiple-bit attack. Experimental results against a smart-card implementation of the Data Encryption Standard demonstrate the effectiveness of our multiple-bit attack. Potential countermeasures to these attacks are also discussed.