Is DRM considered Confidentiality, Integrity, Availability, or some combination of the three?

Question

I was discussing software trial time limit enforcement with a colleague and the idea of CIA came up. Do stricter enforcement techniques increase confidentiality at the expense of availability? (for example when an application MUST phone home to authenticate and therefore cannot be used offline) Or is this integrity? Maybe some combination?

How would you frame software trial time limit enforcement in terms of CIA? What about DRM in general?

Answer 1

It's a matter of point of view. DRM technology is sold by security vendors to content vendors (distributors, not necessarily producers). The interest of content vendors is to limit the distribution of the content, hence what they buy is confidentiality of the content. Availability is not important to content providers, except as a minor point (too little availability may anger customers).

Availability is in the interest of the consumer, who often has no relationship with the DRM provider. Even if the DRM provider is providing a DRM-aware reader to a consumer, availability is a central functionality of the reader, but it is not generally a security matter: unavailable content is just an application bug. For availability to matter, there would have to be a critical concern that DRM-protected content remain available in some circumstances. An airplane entertainment system is the one case I can think of where content availability is mission-critical (but to the lowest degree, only inasmuch bored passengers get cranky and are harder to handle).

DRM today is not directly concerned with integrity. If the consumer wants to view external content that has not been vetted by the content vendor, this is usually allowed (e.g. to allow people to view their home-made content). There are several ways in which integrity can get involved, however. If a device is restricted to only displaying approved content, then integrity does matter. Furthermore, under the hood, DRM content relies on the storage of access rights. If the consumer can modify those access rights, or influence them (e.g. by resetting the clock at the end of a rental period), this affects the security of the DRM implementation. Thus, even though DRM itself is about confidentiality, the implementation (usually) relies on confidentiality. (This is somewhat similar to the way authenticity often relies on a secret key, so even when the data itself is not confidential, confidentiality is involved with respect to the key.)

Answer 2

No. DRM doesn't really guarantee anything.

Confidentiality is the guarantee that an unauthorized user cannot access the protected information. DRM doesn't guarantee this because decryption keys are necessarily distributed to the very person you're trying to prevent access to.

Integrity is the guarantee that the data hasn't been tampered with. DRM doesn't give this either, for the same reason as above. While DRM usually employes encryption, it invalidates any of the guarantees that encryption would otherwise provide by disclosing the secret key to the attacker.

Availability is the guarantee that an attacker cannot prevent access to critical data. In the case of DRM, if protected data is available it is despite the DRM, not because of it. There have been several well-known cases of attackers being able to deny access to protected content by attacking the key distribution points, an attack that wouldn't have been possible without DRM.

Answer 3

DRM is really (meant) to protect the copyright of something. This isn't really one of the CIA principles. Copyright/IP protection isn't one of the CIA principles and is usually discussed separately.

You could argue that it modifies the availability of software, in that to access the software you first have to deal with the DRM. If for whatever reason you cannot get past the locks(for either legitimate or not reasons), you won't have access to the application. However this isn't what people typically mean when they talk about Availability in the context of security, since only you lose availability to the software (as opposed to you disabling the software for other, legitimate users). If you are legitimate user who cannot deal with the DRM protection (say, because it is buggy or complicated), then your availability to the software suffers, so the DRM is actually acting against you from a security point of view.

Answer 4

It's a tricky situation, in part because media-based DRM is so fundamentally broken. It is designed to eventually prevent you from accessing something you initially had access to. The problem with that idea is that, since at some point you had access to the media, you can always extract the raw output and store it.

I'd argue that DRM is about confidentiality more than anything else. The data remains confidential unless you have the right to view it. If the DRM relies on a "rental period", the data becomes confidential after the expiration date.

Availability is about preserving the intended quality of service, which DRM doesn't really do. The intended quality of service is that you can use some software or watch a movie. DRM almost goes entirely counter to this - reducing (ease of) availability to maintain security.

You could argue that DRM attempts to preserve its own integrity, but other than that it doesn't really fit under the integrity label.

Answer 5

DRM often reduces availability, adds complexity and decreases ease-of-use. There is basic rule in security that says: "Client side security is doomed". Client has full control over the product that he owns. So you can just make some trouble for him. This often pays off as decrease in availability.