What's the difference between DRM and CAS?

Question

As I see it, both are used within the scope of content security, to restrict who has access to what.

So what's the difference between a DRM system and a Conditional Access System? Is CAS a subset of a DRM integration?

Answer 1

The main difference is that Conditional Access Scrambling and Digital Rights Management are that the first is a transport protection mechanism and that the second an asset protection mechanism. With CAS you can offer a stream like with television for example and everyone who has the right key can unscramble the stream within a certain timeframe as most videostreams for television have a time based lock. This is almost all done in hardware and think about the CI+ modules for televisions as a working example of this.

DRM is a way to protect content when it is both in transport as in rest. This allows for the consumer of the content to access it when he has the right key and is not restricted to a certain timeframe as with CI+ for example where the encryption key is rotated every 120 seconds and would make playback and/or timeshifting difficult. Some DRM implementations as for example with Microsoft Office require access to Active Directory to verify the keys to access protected content, but this is mostly due to key management to not have both the protected content and the keys to unlock it on the same device.

Now with modern technologies the lines between CAS and DRM are fading slowly, but in essence you could compare it to SSL versus PGP. Both have their purposes, but CAS will most likely be around as long as we have streaming video and the solutions in hardware to support them. And most DRM implementations have to overcome how protect both the content and keys in rest, but also how to protect the interaction with the protected content.