Digital rights management (DRM) solutions aim to prevent the copying or distribution of copyrighted material. On mobile devices, a variety of DRM technologies have become widely deployed. However, a detailed security study comparing their internal workings, and their strengths and weaknesses, remains missing in the existing literature. In this paper, we present the first detailed security analysis of mobile DRM systems, addressing the modern paradigm of cloud-based content delivery followed by major platforms, such as Netflix, Disney+, and Amazon Prime. We extensively analyse the security of three widely used DRM solutions -- Google Widevine, Apple FairPlay, and Microsoft PlayReady -- deployed on billions of devices worldwide. We then consolidate their features and capabilities, deriving common features and security properties for their evaluation. Furthermore, we identify some design-level shortcomings that render them vulnerable to emerging attacks within the state of the art, including micro-architectural side-channel vulnerabilities and an absence of post-quantum security. Lastly, we propose mitigations and suggest future directions of research.

翻译：数字版权管理（DRM）解决方案旨在防止对受版权保护材料的复制或分发。在移动设备上，多种DRM技术已广泛部署。然而，现有文献仍缺乏对其内部工作原理、优点和缺点进行详细安全对比的研究。本文首次对移动DRM系统进行了详细的安全分析，针对Netflix、Disney+和Amazon Prime等主流平台采用的基于云的内容交付现代范式展开研究。我们广泛分析了全球数十亿设备上部署的三种广泛使用的DRM解决方案——Google Widevine、Apple FairPlay和Microsoft PlayReady的安全性。随后，我们整合了它们的特征与能力，推导出共有的特征和安全属性用于评估。此外，我们识别了一些设计层面的缺陷，这些缺陷使它们在现有技术水平下易受新兴攻击的威胁，包括微架构侧信道漏洞以及缺乏后量子安全性。最后，我们提出了缓解措施并建议了未来的研究方向。