This document describes how a R2 based app should handle DRMs. It details the Readium LCP support, but other DRM modules should be handled the same way.
A protected publication may be imported in an R2 app in two ways:
- import of a protected EPUB, i.e. an EPUB containing a DRM license;
- import of a DRM licence, e.g. a .lcpl file
These resources may be imported via side loading (Open with ... from a web page on a mobile app, Open file ... in a desktop app), via an OPDS feed or any other supported way to access extenal resources.
To get more details about Reading system behavior in a Readium LCP context, please read the Readium LCP spec, specifically section 7 (Reading System Behavior).
A Readium LCP compliant app must embed a root certificate provided by the DRM administrator.
A Readium LCP compliant app must update the Readium LCP certificate revocation list (CRL) on a regular basis (e.g. on a weekly basis, at the time the app is launched).
A Readium LCP compliant app must generate a unique device id and human readable device name at install time.
A quick note about the device ID: both Android and iOS "test app" open-source implementations use a UUID coupled with a per-app-install persistent storage (i.e. the device "id" is renewed and the persistent storage re-created if the app is removed then reinstalled).