OMA DRM
A new GSM/GPRS feature I was tasked with testing was MMS protected by Open Mobile Alliance (OMA) Digital Rights Management (DRM) version 1.0 Forward Lock.
I only had to test Forward Lock because the other methods of content protection set out in OMA DRM V1.0; Combined Delivery, Separate Delivery and Superdistribution were not required to be supported by the phone.
After downloading via HTTP, WAP, or MMS, the phone could view, delete, store and print the image but could not forward (copy) the content to another device, or allow another device to copy the OMA DRM protected content.
The OMA DRM protected content could be stored in the cellphones memory, or on the SIM card but not stored off the SIM/phone.
Some controversy existed about allowing protected content to be copied to a PC but our implementation permitted that. Sony-Ericsson didn't have a seat in the Open Mobile Alliance but our parent company Ericsson did. The Ericsson system engineer in Sweden said to allow a desktop application to copy OMA DRM Forward Lock material from the phone.
In studying the requirements, it quickly became apparent that Forward Lock was intended to help keep the honest people honest. The content provider was required to package content so that it was OMA DRM V1.0 protected. This meant the content to be protected had to be wrapped inside an OMA DRM message.
In the case of download via HTTP request, an OMA DRM message was a text file having extension .dm that contained a short header and footer. Between the two was the binary content being protected. So, if the content being OMA DRM protected was a jpeg, inside the .dm file there would be a header, a length calculation, followed by the binary of the jpeg, followed by a short footer.
All that was required to remove OMA DRM from a file was to remove the wrapper, the header and footer along with any whitespace and save the file with the proper extension.
My task was to verify that from the standpoint of a reasonably honest user, OMA DRM Forward Lock protected content could not be misused.
A server had been setup in Sweden which I was given access to. I could access it via WAP on the phone, or by HTTP request from a desktop PC. Our IT Department needed to grant my account rights to download MIME type application/vnd.oma.drm.message and I had to configure the browser to accept the MIME type. At the time, IE couldn't be configured but FireFox could so, I used FireFox for web download.
When I downloaded from the web to my desktop, I would then copy the file onto the phone via the different methods available of copying the phone onto the phone; system bus, bluetooth, infrared, etc. Once on the phone, I verified the content could be used in the normal manner but not forwarded (copied) outside of the phone.
In every attempt to forward the content, I had to verify the user was either notified forwarding was not allowed, or that the possibility of forwarding was greyed out, or not even displayed in the phones menu system.
For download via WAP and MMS, I had to verify the same requirements as when downloaded via HTTP request.
The OMA DRM Forward Lock wasn't perfect but it was a start.
