New_portable.htm
24.7 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
<html xmlns:o="urn:schemas-microsoft-com:office:office"
xmlns:w="urn:schemas-microsoft-com:office:word"
xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=windows-1252">
<meta name=ProgId content=Word.Document>
<meta name=Generator content="Microsoft Word 9">
<meta name=Originator content="Microsoft Word 9">
<link rel=File-List href="./New_portable_files/filelist.xml">
<title>Meeting for analyzing security impact of changing usage model</title>
<!--[if gte mso 9]><xml>
<o:DocumentProperties>
<o:Author>pramila</o:Author>
<o:Template>Normal</o:Template>
<o:LastAuthor>pramila</o:LastAuthor>
<o:Revision>2</o:Revision>
<o:TotalTime>811</o:TotalTime>
<o:LastPrinted>2002-05-21T03:01:00Z</o:LastPrinted>
<o:Created>2002-05-30T23:00:00Z</o:Created>
<o:LastSaved>2002-05-30T23:00:00Z</o:LastSaved>
<o:Pages>4</o:Pages>
<o:Words>1333</o:Words>
<o:Characters>7600</o:Characters>
<o:Company>RouteFree</o:Company>
<o:Lines>63</o:Lines>
<o:Paragraphs>15</o:Paragraphs>
<o:CharactersWithSpaces>9333</o:CharactersWithSpaces>
<o:Version>9.3821</o:Version>
</o:DocumentProperties>
</xml><![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;
mso-font-charset:2;
mso-generic-font-family:auto;
mso-font-pitch:variable;
mso-font-signature:0 268435456 0 0 -2147483648 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-style-parent:"";
margin:0in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"Times New Roman";}
h1
{mso-style-next:Normal;
margin:0in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
page-break-after:avoid;
mso-outline-level:1;
font-size:12.0pt;
font-family:"Times New Roman";
mso-font-kerning:0pt;}
p.MsoBodyTextIndent, li.MsoBodyTextIndent, div.MsoBodyTextIndent
{margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.25in;
margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:12.0pt;
font-family:"Times New Roman";
mso-fareast-font-family:"Times New Roman";
font-weight:bold;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;
mso-header-margin:.5in;
mso-footer-margin:.5in;
mso-paper-source:0;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:31005300;
mso-list-type:hybrid;
mso-list-template-ids:828171864 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l1
{mso-list-id:86538236;
mso-list-type:hybrid;
mso-list-template-ids:-1683428478 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l2
{mso-list-id:403575719;
mso-list-type:hybrid;
mso-list-template-ids:658133446 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l3
{mso-list-id:444469449;
mso-list-type:hybrid;
mso-list-template-ids:1654275524 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l4
{mso-list-id:908198256;
mso-list-type:hybrid;
mso-list-template-ids:-1444274116 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l5
{mso-list-id:1074739482;
mso-list-type:hybrid;
mso-list-template-ids:-673706772 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l5:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l6
{mso-list-id:1127358479;
mso-list-type:hybrid;
mso-list-template-ids:902577200 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l6:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l7
{mso-list-id:1151017732;
mso-list-type:hybrid;
mso-list-template-ids:820946706 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l7:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l8
{mso-list-id:1195533505;
mso-list-type:hybrid;
mso-list-template-ids:141089468 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l8:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l9
{mso-list-id:1629049004;
mso-list-type:hybrid;
mso-list-template-ids:697829360 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l9:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l10
{mso-list-id:1880430999;
mso-list-type:hybrid;
mso-list-template-ids:-769519742 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l10:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l11
{mso-list-id:1925065401;
mso-list-type:hybrid;
mso-list-template-ids:1871338490 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l11:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l12
{mso-list-id:2029863714;
mso-list-type:hybrid;
mso-list-template-ids:1845134276 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l12:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
</head>
<body lang=EN-US style='tab-interval:.5in'>
<div class=Section1>
<h1>Analyzing Security Impact of New Usage Model</h1>
<p class=MsoNormal><b><![if !supportEmptyParas]> <![endif]><o:p></o:p></b></p>
<p class=MsoNormal><b>Current model: <o:p></o:p></b></p>
<p class=MsoNormal>Take the BB player to the depot for the following
transactions:</p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l12 level1 lfo2;tab-stops:list .5in'>Purchase
license for new content</li>
<li class=MsoNormal style='mso-list:l12 level1 lfo2;tab-stops:list .5in'>Download
content corresponding to license already purchased</li>
<li class=MsoNormal style='mso-list:l12 level1 lfo2;tab-stops:list .5in'>Return
license for content (revocation)</li>
<li class=MsoNormal style='mso-list:l12 level1 lfo2;tab-stops:list .5in'>Activate
or de-activate BB</li>
</ul>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>New model:<o:p></o:p></b></p>
<p class=MsoNormal>Take the BB player to the depot for only one operation:</p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l7 level1 lfo3;tab-stops:list .5in'>Activate
or de-activate BB (perhaps)</li>
</ul>
<p class=MsoNormal>For all other transactions, take the smart media card (on a
removable slot on the BB) to the depot and use it to perform the transaction on
behalf of the BB. Bring it home and plug it into the slot to use as before.</p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal>From a security point of view the one major difference is
that the component connected to the depot now does not have a
CPU/micro-controller and does not have the private key corresponding to the BB.
</p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal>Let us analyze the basic security operations and how they
would be performed in the two cases:</p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l7 level1 lfo3;tab-stops:list .5in'><b>Content
authentication</b>:<span style="mso-spacerun: yes"> </span>proving (while
downloading and playing) that the content came from our servers.</li>
<li class=MsoNormal style='mso-list:l7 level1 lfo3;tab-stops:list .5in'><b>Server
authentication</b>: proving (while acquiring licenses) that the
license-server is authorized by us.</li>
<li class=MsoNormal style='mso-list:l7 level1 lfo3;tab-stops:list .5in'><b>Client
authentication</b>: proving to our server that the hardware it is talking
to is an authorized BB. </li>
</ul>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal>Let us assume we have the following resources to achieve the
above:</p>
<p class=MsoNormal><b>Current model: <o:p></o:p></b></p>
<p class=MsoNormal>The chip is capable of performing real time operations in
response to the server. It carries its private, public key pair internally and
is capable of signing and verifying a signature. It is capable of performing
decryption internally.</p>
<p class=MsoNormal><b>New model:<o:p></o:p></b></p>
<p class=MsoNormal>The memory card is capable of carrying information from a BB
player to a depot and vice versa, but it does not have a CPU, hence cannot
perform a real time computation when connected to the server or depot. It does
not contain any keys/identity of its own. </p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal>Let us assume that we can replace the current model with the
following instead and analyze the equivalence.</p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l5 level1 lfo5;tab-stops:list .5in'>The
server can send any signed message to the BB player embedded in the
license. It is encrypted by the BB public key, hence copying does not make
the license work on another player. It could send, in addition,<span
style="mso-spacerun: yes"> </span>a message number for the BB player to
use in a subsequent response to prevent replay.</li>
<li class=MsoNormal style='mso-list:l5 level1 lfo5;tab-stops:list .5in'>The BB
player can send any signed message/response to the server by writing it to
the memory card. It could include the signed message and BB certificate
and the above message number.<span style="mso-spacerun: yes"> </span>It
could be copied, but should be used in online transactions so that the
server can detect a copy by observing the number. It could be encrypted by
server public key. If copies are made of the message, it could cause a
denial of service problem since the server has to decrypt and check the
message number to know the problem.</li>
</ul>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal>Using the above two tools we can try to translate all the
solutions to the new model.</p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>Content authentication</b>: </p>
<p class=MsoNormal>Covers usage: <b>downloading content</b>.</p>
<p class=MsoNormal><b>Current model: </b>The authentication of content is done
as follows: (this is a summary, the details are in the respective document).</p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l0 level1 lfo4;tab-stops:list .5in'>The
content license contains the content encryption key. The content is
delivered to the BB from the depot encrypted by that key</li>
<li class=MsoNormal style='mso-list:l0 level1 lfo4;tab-stops:list .5in'>The
BBs on-chip decryption engine decrypts and does signature verification
simultaneously. It re-encrypts using a second key only known to the chip
and writes out to the flash.</li>
<li class=MsoNormal style='mso-list:l0 level1 lfo4;tab-stops:list .5in'>It
verifies the signature and writes the (content id, re-encryption key) pair
to flash.</li>
<li class=MsoNormal style='mso-list:l0 level1 lfo4;tab-stops:list .5in'>The
decryption engine uses the new key during playback.</li>
</ul>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>New model:<o:p></o:p></b></p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l1 level1 lfo6;tab-stops:list .5in'>The
depot transfers content in its original encrypted form to the smart media
card. <b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l1 level1 lfo6;tab-stops:list .5in'>At
home, when the card is plugged into the player, the above operations work
without change, now the smart media card replaced by the depot. (As
content is loaded from the memory card to the flash it is re-encrypted).<b><o:p></o:p></b></li>
</ul>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>Client authentication: (license purchase or return)<o:p></o:p></b></p>
<p class=MsoNormal><b>Current model:<o:p></o:p></b></p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l6 level1 lfo7;tab-stops:list .5in'>Client
authentication was not required for purchasing licenses since the licenses
would be useless to someone who did not own a BB player anyway. The
licenses are encrypted by player public key so that implicitly
authenticates the player who requested it.<b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l6 level1 lfo7;tab-stops:list .5in'>Client
authentication would be required to return a license since the player
owner is returned some money as a result. Also, he should not have access
to the content after that. After purchase, the idea was that it would be
returned without a chance to make a copy of the content to a smart media
card. (Otherwise it could be reloaded to flash later thus re-creating an
internal key, making it playable).<b><o:p></o:p></b></li>
</ul>
<p class=MsoNormal><b><![if !supportEmptyParas]> <![endif]><o:p></o:p></b></p>
<p class=MsoNormal><b>New model:<o:p></o:p></b></p>
<p class=MsoNormal><b>(license return/refund)<o:p></o:p></b></p>
<p class=MsoNormal>If the license has not been copied to memory card, no
problem.</p>
<p class=MsoNormal>If it has been copied and the retailer wants to revoke it,
it is a problem, we may have to disallow that. (Basically he has to make sure
he issues the license after collecting the money.)</p>
<p class=MsoNormal>If we still want to revoke/return after the person has taken
it home, this may be one way:</p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l8 level1 lfo8;tab-stops:list .5in'>The
license now contains a license id.<b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l8 level1 lfo8;tab-stops:list .5in'>When
the BB player user wants to return the license he has purchased, the BB
should write in internal state, corresponding to the content id, the
revoked license id, and write a signed message to delete that content id,
to memory card.<b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l8 level1 lfo8;tab-stops:list .5in'>When
the user goes to get his money back, the message is read from the card and
the server authorizes the refund.<b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l8 level1 lfo8;tab-stops:list .5in'>The
player will not play any content corresponding to a revoked license id.<b><o:p></o:p></b></li>
</ul>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal>Problem: this could need unlimited storage in the internal
flash eventually.</p>
<p class=MsoNormal><b><![if !supportEmptyParas]> <![endif]><o:p></o:p></b></p>
<p class=MsoNormal><b>License purchase:<o:p></o:p></b></p>
<p class=MsoNormal>If client authentication is required it can be done this
way: </p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l10 level1 lfo10;tab-stops:list .5in'>A
prior embedded message in a license contains a random challenge from the
server to be used for a future license purchase.<b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l10 level1 lfo10;tab-stops:list .5in'>The
BB player takes some user input (that he is going to take the card out to
get content) and generates a request for license message, with the random
challenge signed, and writes out to the memory card. The server requests
this message and verifies before issuing a license.<span
style="mso-spacerun: yes"> </span>The license contains a random challenge
for a future request session, and so on.<b><o:p></o:p></b></li>
</ul>
<p class=MsoNormal><b>Server (license server) authentication:<o:p></o:p></b></p>
<p class=MsoNormal><b>Current model:<o:p></o:p></b></p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l11 level1 lfo9;tab-stops:list .5in'>The
license server certificate revocation list would be used to invalidate a
compromised server issuing certificates. This list could be sent to the BB
when it was connected to the depot. <b><o:p></o:p></b></li>
</ul>
<p class=MsoNormal><b>New model:<o:p></o:p></b></p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l11 level1 lfo9;tab-stops:list .5in'>The
player now does not connect to the depot, so the server sends a CRL
embedded in a license, signed an encrypted as usual. The BB player updates
its revocation list from the license.<b><o:p></o:p></b></li>
</ul>
<p class=MsoNormal><b>(If the rogue server uses the same method to revoke
current server and switch, it could become a race? I think we need an ultimate
protected root server whose certificate cannot be revoked by this scheme, and
use that to override
or something like that).<o:p></o:p></b></p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>Other management operations:<o:p></o:p></b></p>
<p class=MsoNormal><b>Current model:<o:p></o:p></b></p>
<p class=MsoNormal style='margin-left:.25in'>While being connected to the
depot, the BB would be queried for </p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l11 level1 lfo9;tab-stops:list .5in'>Space
available on flash</li>
<li class=MsoNormal style='mso-list:l11 level1 lfo9;tab-stops:list .5in'>Content
on flash etc.</li>
</ul>
<p class=MsoNormal><b>New model:<o:p></o:p></b></p>
<p class=MsoNormal>The BB has to write this in a signed message to memory card
before the card is taken to the depot.</p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>New possibilities:<o:p></o:p></b></p>
<p class=MsoNormal><b>Home content repository: </b>The smart media cards could
be used as content storage for multiple BBs in the home. For example</p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l2 level1 lfo11;tab-stops:list .5in'>Insert
card in first BB, it writes license purchase request message signed by that
BB.</li>
<li class=MsoNormal style='mso-list:l2 level1 lfo11;tab-stops:list .5in'>Insert
card in second BB, it writes similar message signed by second BB.</li>
<li class=MsoNormal style='mso-list:l2 level1 lfo11;tab-stops:list .5in'>Take
card to depot and pay for two licenses</li>
<li class=MsoNormal style='mso-list:l2 level1 lfo11;tab-stops:list .5in'>Acquire
one copy of content and two licenses on same card</li>
<li class=MsoNormal style='mso-list:l2 level1 lfo11;tab-stops:list .5in'>Use
card to transfer content into flash in both BBs.</li>
</ul>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>User friendly BB name</b>: During activation, if the user
picks a user-friendly name for the BB(could be phone number etc.) we could
register the name in the server and make sure it is unique. After that the user
could refer to the name to request license purchase (if we did not require
hardware authentication). This would then work instead of the method above.</p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>Buying gifts or purchasing for others: <o:p></o:p></b></p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l4 level1 lfo12;tab-stops:list .5in'>The
user requests a license for a named content and named BB and pays for it.<b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l4 level1 lfo12;tab-stops:list .5in'>The
server looks up the BBID and issues a license for that BBID<b>.<o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l4 level1 lfo12;tab-stops:list .5in'>The
license (encrypted by the named BB public key) is stored with content in
memory card<b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l4 level1 lfo12;tab-stops:list .5in'>The
user hands over/mails the card to the intended gift recipient.<b><o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l4 level1 lfo12;tab-stops:list .5in'>The
user could take the memory card back.<b><o:p></o:p></b></li>
</ul>
<p class=MsoNormal>In this case if the hardware authentication is required, the
recipient name has to be input to the BB (by keyboard UI on screen or numeric
UI on screen) and the BB writes the request for license message for the named
BB, onto memory card. Rest is as before.</p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><b>Summary:<o:p></o:p></b></p>
<p class=MsoNormal><b>There is no significant impact to using the memory as a
means of downloading content to the BB but for the following minor issues:<o:p></o:p></b></p>
<ul style='margin-top:0in' type=disc>
<li class=MsoNormal style='mso-list:l9 level1 lfo13;tab-stops:list .5in'><b>There
is no easy way to revoke a wrong license purchase initiated by a
retailer.<span style="mso-spacerun: yes"> </span>(That can be fixed with
the exception that the user now has to go to the same retailer to get
content or establish a server connection to get content from another
retailer).<o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l9 level1 lfo13;tab-stops:list .5in'><b>If
you want to return a license after it is written to the memory card, the
user has to take it home and make the player authorize the return.<o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l9 level1 lfo13;tab-stops:list .5in'><b>There
is no way for the user to confirm that the license is good before he
walked out of the store<o:p></o:p></b></li>
<li class=MsoNormal style='mso-list:l9 level1 lfo13;tab-stops:list .5in'><b>We
cannot trivially authenticate the player at the time of license download.
We could do some round trip challenge-response scheme spanning two trips
to the depot.<o:p></o:p></b></li>
</ul>
<p class=MsoNormal><b><![if !supportEmptyParas]> <![endif]><o:p></o:p></b></p>
<p class=MsoNormal><b><![if !supportEmptyParas]> <![endif]><o:p></o:p></b></p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><span style="mso-spacerun: yes"> </span></p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
<p class=MsoNormal><![if !supportEmptyParas]> <![endif]><o:p></o:p></p>
</div>
</body>
</html>