DRM Domain Authentication using Electronic Payment Systems

This paper focuses on the problem of how to allow sharing of copyrighted content between a set of authorised devices and preventing unauthoried copying of content to other devices. Our main objective is to achieve controlled secure distribution of content, taking into account user requirements for sharing of content and rights. We mainly focused on creating a domain managed by a single owner, where all devices joining the domain are bound to the domain owner. The novel contribution in this paper is proposing a mechanism for strongly binding a domain to a single owner, which enables the binding of content licences to the domain owner. Devices can use a domain content only after joining the domain, which requires the physical involvement of the domain owner, i.e. the licence content holder. Other devices in the domain that are authorised to access the domain content cannot re-transfer the means for accessing content to others, which limits illicit content proliferation. Our novel idea is the way in which we use consumer payment cards to authenticate a domain owner before adding/removing a device from the domain. In addition, the proposed scheme helps to protect consumers' privacy; unlike the existing electronic payment system, payment card details are not passed to third parties. Also, domain owner authentication using a payment card is only required for managing domain membership, and is not required for creating, downloading or exchanging content.