INTERNATIONAL ORGANISATION FOR STANDARDISATION
ORGANISATION INTERNATIONALE DE NORMALISATION
ISO/IEC JTC 1/SC 29/WG 11
CODING OF MOVING PICTURES AND AUDIO
ISO/IEC JTC 1/SC 29/WG 11
MXXXXX
Drested, DE – April 2010
Source:
Title:
Status
Source
1
Systems
Proposal for Protocol to Authenticate Device
Proposal
Jianping Chen, Tiejun Huang (Peking University)
Terms and definitions
Authentication: make sure that a content is used in an intended device in the
specified system.
2
Symbols and abbreviated terms
3
Namespace conventions
Table 1 — Namespaces and prefixes
4
Prefix
Corresponding namespace
mxmadp
urn:mpeg:mpegB:schema:authenticateDeviceProtocol:2010
System overview
Figure 1- Sequence diagram of Authentication Messages exchange
The protocol listed above composes two step: Negotiation step and Authentication
step. The negotiation step has message InitAuthentication and MutualAuthentication,
and the authentication step has the message MutualAuthentication. If negotiation
successes, the authentication step will be going.
This protocol is related to Device Identification Device, for each device will has a
device identification before authentication. In this protocol, the identification is a
certificate.
5
Authenticate and Authorize Device Protocols
The Authenticate Device Protocols is used to authenticate a device to make sure it is
intended.
5.1.1
Protocol specification
This protocol specifies how to authenticate a device to check whether this device can
use the governed content in this system. The protocol is as follows:
1. Negotiation Step.
1) The originator device send an InitAuthentication message to challenged
device
2) The challenged device then send a MutualAuthentication to request
negotiation with the originator device which is executed by specifying the
authentication protocol.
3) Originator device will send the challenged device the negotiation result.
2. Authentication Step.
1) If negotiation successes, the challenged device will send
MutualAuthentication message to the
originator
device
to
begin
authentication. The MutualAuthentication message contains the device’s
certificate.
2) The originator device will authenticate the received message and then send a
MutualAuthentication message(the originator device’s certificate) response to
the challenged device.
3) The last process is that the challenged device authenticate the received
message and response the authentication result.
4) Authentication end.
5.1.2
Protocol data format
The subclasses specify the messages exchanged between two devices when they
execute authentication process.
5.1.2.1
InitAuthentication
<element name="InitAuthentication" type=" mxmadp:InitAuthenticationType"
substitutionGroup=" mxmadp:Data_BaseClass"/>
<complexType name="InitAuthenticationType">
<complexContent>
<extension base=" mxmadp:Data_BaseClassType">
<sequence>
<element name="ContextID" type="anyURI" minOccurs="0"/>
<element name="AuthType" type=" mxmadp:AUTType"/>
<!--Context ID of the logical instance of the Tool with which mutual
authentication is to be performed-->
</sequence>
</extension>
</complexContent>
</complexType>
Figure 2: The mxmadp:InitAuthentication Message
The mxmadp:InitAuthentication Message shall be employed by an entity to initialise
the mutual authentication process with another.
5.1.2.2
MutualAuthentication
<element name="MutualAuthentication" type=" mxmadp:MutualAuthenticationType"
substitutionGroup=" mxmadp:Data_BaseClass"/>
<complexType name="MutualAuthenticationType">
<complexContent>
<extension base=" mxmadp:Data_BaseClassType">
<sequence>
<choice>
<element name="requestNegotiation" type="
mxmadp:requestNegotiationType"/>
<element name="successNegotiation" type="
mxmadp:successNegotiationType"/>
<element name="failedNegotiation" type="boolean"
fixed="true"/>
</choice>
<element name="authenticationData" type="hexBinary"
minOccurs="0"/>
<element name="authCodes" type=" mxmadp:AuthCodesType"
minOccurs="0"/>
</sequence>
</extension>
</complexContent>
</complexType>
Figure 3: The mxmadp:MutualAuthentication element
The mxmadp:MutualAuthentication is employed by two entities (e.g. the DRM
Processor and a DRM Tool) for the purpose of:
1.
2.
3.
5.1.2.3
negotiating the Authentication protocol
carrying out the agreed upon protocol
negotiating how the secured communication channel has to be used.
requestNegotiationType
<complexType name="requestNegotiationType">
<sequence>
<element name="candidateAlgorithms" type="
mxmadp:AlgorithmDescriptorType"/>
</sequence>
</complexType>
Figure 4: The mxmadp:requestNegotiationType complex type
The mxmadp:requestNegotiationType complex type conveys the list of Authentication
algorithms supported by means of the mxmadp:candidateAlgorithms element.
5.1.2.4 AlgorithmDescriptorType
<complexType name="AlgorithmDescriptorType">
<sequence>
<element name="algoID" type="anyURI" maxOccurs="unbounded"/>
<element ref=" mxmadp:opaqueData" minOccurs="0"/>
</sequence>
</complexType>
Figure 5: The mxmadp:AlgorithmDescriptorType complex type
Each of the supported Algorithms are characterised by an Identifier of type
xsd:anyURI. Optionally, mxmadp:opaqueData containing related data to the algorithm
can be conveyed.
5.1.2.5 successNegotiationType
<complexType name="successNegotiationType">
<sequence>
<element name="agreedAlgorithms" type="
mxmadp:AlgorithmDescriptorType" maxOccurs="unbounded"/>
</sequence>
</complexType>
Figure 6: The mxmadp:successsNegotiationType complex type
The mxmadp:successNegotiation element is sent by the entity initiating the mutual
Authentication process in reply to a mxmadp:MutualAuthentication message
proposing a list of candidate algorithms. The mxmadp:agreedAlgorithms element
conveys the list of the Authentication algorithms supported, among the ones proposed
by the entity that was challenged.
5.1.2.6
AuthCodesType
<complexType name="AuthCodesType">
<sequence>
<element name="certificates" type="dsig:KeyInfoType"
maxOccurs="unbounded"/>
<element name="trustData" type="hexBinary" minOccurs="0"/>
</sequence>
</complexType>
Figure 1: The mxmadp:AuthCodesType complex type
The mxmadp:authCodes element conveys`
 a number of certificates and/or trust data belonging to the entity involved in the
Authentication process
 (optional) trust and security data, mostly used when Mutual Authentication
involves DRM Tools.
Annex A
(informative)
Protocol Description Schemas
<?xml version="1.0" encoding="UTF-8"?>
<schema
targetNamespace="urn:mpeg:mpegB:schema:authenticateDeviceProtocol:2010"
xmlns="http://www.w3.org/2001/XMLSchema"
xmlns: mxmadp ="urn:mpeg:mpegB:schema:
authenticateDeviceProtocol:2010"
xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"
elementFormDefault="qualified" attributeFormDefault="unqualified">
<import namespace="http://www.w3.org/2000/09/xmldsig#"
schemaLocation="http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsi
g-core-schema.xsd"/>
<!-- Abstract Base Type from which both DRM Message Containers and DRM
Messages inherit -->
<complexType name="IPMPBaseType" abstract="true"/>
<!--Data_BaseClass-->
<element name="Data_BaseClass" type=" mxmadp:Data_BaseClassType"
abstract="true"/>
<complexType name="Data_BaseClassType" abstract="true">
<complexContent>
<extension base=" mxmadp:IPMPBaseType">
<sequence>
<element name="dataID" type="unsignedInt"/>
</sequence>
</extension>
</complexContent>
</complexType>
<!-- AUTHENTICATION MESSAGES -->
<!--InitAuthentication-->
<element name="InitAuthentication" type=" mxmadp:InitAuthenticationType"
substitutionGroup=" mxmadp:Data_BaseClass"/>
<complexType name="InitAuthenticationType">
<complexContent>
<extension base=" mxmadp:Data_BaseClassType">
<sequence>
<element name="ContextID" type="anyURI" minOccurs="0"/>
<element name="AuthType" type=" mxmadp:AUTType"/>
<!--Context ID of the logical instance of the Tool with which
mutual authentication is to be performed-->
</sequence>
</extension>
</complexContent>
</complexType>
<simpleType name="AUTType">
<annotation>
<documentation>
"01" - No Authentication Required
"02" - No ID verify, Do secure channel
"03" - Do ID verify, No secure channel
"04" - Do ID verify, Do secure channel
</documentation>
</annotation>
<restriction base="integer">
<enumeration value="01"/>
<enumeration value="02"/>
<enumeration value="03"/>
<enumeration value="04"/>
</restriction>
</simpleType>
<!--MutualAuthentication-->
<element name="MutualAuthentication" type="
mxmadp:MutualAuthenticationType" substitutionGroup="
mxmadp:Data_BaseClass"/>
<complexType name="MutualAuthenticationType">
<complexContent>
<extension base=" mxmadp:Data_BaseClassType">
<sequence>
<choice minOccurs="0">
<element name="requestNegotiation" type="
mxmadp:requestNegotiationType"/>
<element name="successNegotiation" type="
mxmadp:successNegotiationType"/>
<element name="failedNegotiation" type="boolean"
fixed="true"/>
</choice>
<element name="authenticationData" type="hexBinary"
minOccurs="0"/>
<element name="authCodes" type=" mxmadp:AuthCodesType"
minOccurs="0"/>
</sequence>
</extension>
</complexContent>
</complexType>
<complexType name="requestNegotiationType">
<sequence>
<element name="candidateAlgorithms" type="
mxmadp:AlgorithmDescriptorType"/>
</sequence>
</complexType>
<complexType name="AlgorithmDescriptorType">
<sequence>
<element name="algoID" type="anyURI" maxOccurs="unbounded"/>
<element name="opaqueData" type="base64Binary" minOccurs="0"/>
</sequence>
</complexType>
<complexType name="successNegotiationType">
<sequence>
<element name="agreedAlgorithms" type="
mxmadp:AlgorithmDescriptorType" maxOccurs="unbounded"/>
</sequence>
</complexType>
<complexType name="AuthCodesType">
<sequence>
<element name="certificates" type="dsig:KeyInfoType"
maxOccurs="unbounded"/>
<element name="trustData" type="hexBinary" minOccurs="0"/>
</sequence>
</complexType>
</schema>
Figure A.1 — The mxmadp schema