Article about digital rights management by David Geer

Page 1

Computer

T E C H N O L O G Y N E W S

Published by the IEEE Computer Society

igital media is a killer appli-

cation for the Internet. How-

ever, concerns about the tech-

nology have limited the

commercial distribution of

digital video, audio, and images. Most

notably, content producers worry that

purchasers will copy and give away or

resell their products in ways that the

providers don’t want and that violate

their licenses.

In light of this, companies have

developed digital rights management

(DRM) technology for products and

media players to let content producers

enforce licensing restrictions by limit-

ing the use of their materials.

However, this has led to a critical

problem for the digital-media industry:

Most DRM technologies are not inter-

operable. Most vendors have created

proprietary technologies not available

for license or use by third-party ven-

dors, thereby making interoperability

difficult.

Because they may not have a com-

patible DRM system, consumers can-

not always play digital media they buy

from one source, such as an online

store, on their own player or on multi-

ple players. In fact, media players fre-

quently can play only content down-

loaded from specific online stores. This

has upset many consumers, who want

to play purchased media anywhere.

With digital content becoming a big

business, the industry is concerned

about interoperability. And industry

members fear that still more incompat-

ibility will occur unless hardware, soft-

ware, and content owners and distribu-

tors begin working together to make

sure DRM products interoperate.

A series of initiatives are under way

to address DRM interoperability.

However, it has been difficult to get

some major players, who are making

money from their own proprietary

technologies, to participate.

DRM TECHNOLOGY

The success of Apple’s iTunes online

music store and iPod MP3 audio player,

which uses the FairPlay software-based

DRM system, has increased interest in

digital media. A number of companies,

including Microsoft (which has the

Windows Media and Janus software-

based DRM systems), have created their

own outlets for downloadable music.

Digital-media vendor RealNetworks’

popular Helix Player, shown in Figure

1, has its own software-based DRM

approach.

Hardware-based approaches include

HASP products from security vendor

Aladdin Knowledge Systems.

How it works

Record labels, film companies, and

other content providers set strict rules

in their licenses about how consumers

can use online content. Rules include

license start and stop dates, how many

times and for how long buyers can play

the content, and whether content can

be played only on the device to which

it was downloaded or can be trans-

ferred to other devices.

Content owners use DRM technol-

ogy to encrypt both their online offer-

ings and the software describing their

usage rules. The owners then make this

package available on Web servers for

access by consumers.

“When a consumer buys content,

the provider delivers a license and a de-

cryption key to the media player to

play the material based on the owner’s

rules,” said Brad Hunt, chief technical

officer of the Motion Picture Associ-

ation of America. Purchasers’ media

players, if compatible with the seller’s

DRM system, include software that

understands the rules.

Interoperability issues

Each DRM vendor supports differ-

ent combinations of file formats (such

as Microsoft’s Advanced Systems For-

mat, RealNetworks’ Real Media, and

MPEG-4), codecs (such as MP3, Win-

dows Media Audio, and Apple’s

Advanced Audio Coding), and pro-

prietary content-protection methods.

Only media players that understand

the file formats, codecs, and content-

protection methods used by a particu-

lar piece of digital content can play it,

explained Jeff Ayars, RealNetworks’

general manager for embedded players.

Digital Rights

Technology Sparks

Interoperability

Concerns

David Geer

Page 2

December 2004

Contecs:DD Consortium of content

providers.

The MPEG RDD defines a standard

set of terms that digital-rights systems

use with MPEG-based content and

provides a methodology for creating

new terms. These terms will be man-

aged by a registration authority that

ISO is appointing, Barlas explained.

The MPEG Rights Expression

Language (REL) is an XML-based

declarative language for the comput-

ing process to enable unambiguous

expression of 14 types of content-

access and -usage permissions—such

as execute, modify, play, and print—as

defined by the MPEG RDD.

“In brief, the RDD describes a way

of transforming a term from one meta-

data schema to another. This will make

it possible to relate terms from differ-

Because of security concerns, ven-

dors are reluctant to share their DRM

code, which hampers interoperability.

For example, they worry about hack-

ers getting copies of the code, said ana-

lyst Michael McGuire with Gartner

Inc., a market research firm.

To deal with this, the industry is tak-

ing several approaches to providing

interoperability.

For example, RealNetworks has

provided some interoperability with its

Helix cross-platform, media-format-

independent DRM system, which han-

dles content packaging, license serving,

and rights enforcement, Ayars noted.

Helix provides these services in its

Harmony system via file-format parsers,

an application server for license serving,

and a client that handles cross-platform

media playback, he explained.

TRANSLATING DRM RULES

To make DRM systems interact,

vendors must develop ways to pass

content providers’ rules from one sys-

tem to another and ensure that devices

and content services that use different

DRM technologies enforce the rules

the same way.

Technology that translates rules and

other requirements into various for-

mats so that they work with multiple

DRM products is one approach.

Researchers have developed rights

data dictionaries (RDDs) that try to

define DRM in neutral, unambiguous

ways that multiple systems can under-

stand.

“For DRM to be interoperable,

computers must be able to interpret

rights expressions unambiguously.

Rights expressions must use terms that

are known to a system or whose inter-

pretation is available through a lookup

procedure,” said Chris Barlas, a senior

consultant with Rightscom.

MPEG RDD and REL

Rightscom is a digital-media-man-

agement consultancy that developed the

MPEG RDD, since standardized by the

International Organization for Stan-

dardization (ISO), on behalf of the

ent schemas and establish their seman-

tic content,” Barlas explained.

In-device and Web-based

translation services

Consumer products could contain

software that translates DRM instruc-

tions from one content-protection sys-

tem to instructions understood by the

devices.

“[Device] manufacturers would then

have to agree to embed this technology

into their products,” said Gartner ana-

lyst Ray Wagner.

Rather than rely on internal soft-

ware, devices could contact a Web-

based translation service for DRM

rules. “Each participating technology

would register with the service, which

would maintain a mapping from any

registered [DRM] technology to any

Microsoft

DRM

Windows

Media Player

Apple

FairPlay

Harmony

system

iPod

Real

Network’s

Helix

DRM

Content

Media

file

Helix

DRM

packager

Key and rule

database

Key

Key and

rights

grant

Helix

DRM

license

server

Rights and key

Source: RealNetworks

Figure 1. The Helix DRM Packager wraps a commercial media file in the Helix DRM

secure container. Helix stores the file and the key to unlock the container in a content

management system. When someone wants to purchase the file, this system matches the

content’s file-usage rights with the key and requests an appropriate license for delivery to

the consumer’s Helix client. When buyers use the key to unlock the file and download it to

a PC (and then perhaps to a portable device), the client identifies the rights granted by the

content owner and limits the way the consumer can use the material. The Harmony system

provides interoperability with some other DRM systems.

Page 3

Computer

T e c h n o l o g y N e w s

promotes the use of digital media for

the benefit of providers, distributors,

and users.

A TRU is a statement of a con-

sumer’s real, assumed, or desired right

to use a piece of content in a certain

way, such as by copying, modifying, or

selling it.

The DMP wants to create a set of

TRUs to look at the way users typically

work and want to work with content

and then compare this with the way

digital-media protection and manage-

ment technologies operate, explained

Thomas Curran, a member of the

organization’s board of directors and

a project leader for Enterprise of the

Future, a market research firm.

The DMP then wants to use this

information to create a set of conven-

tions that would let the technologies

interoperate while addressing all con-

cerned parties’ interests, he said.

o enable a measure of DRM inter-

operability, content providers will

probably start by cross-licensing

DRM technology used by other com-

panies, said Gartner’s Wagner. How-

ever, McGuire added, “Cross-licensing

requires that you get Microsoft, IBM,

or other companies, involved, which is

not an insignificant task.”

Meanwhile, Wagner said, there isn’t

likely to be technical DRM interoper-

ability at least for another few years.

As for Coral, Wagner said, “[Con-

sortia have] not worked because there

are so many stakeholders and so much

power involved. The alternative is for

industry players to set their own stan-

dards and have them fight it out. That

seems to be the current way that they

are trying to do it.”

For these reasons, the future is

uncertain. Said Wagner, “We were

talking about the same issues with the

same problems and the same group of

participants five years ago.” I

David Geer is a freelance technology

journalist based in Ashtabula, Ohio. Con-

tact him at geercom@alltel.net.

other. Devices would present content

to this service and receive a translated

version,” Wagner explained.

Translation pros and cons

With translation technology, com-

panies could continue using their pro-

prietary DRM software, eliminating

the need to convince vendors to share

code or adopt a common architecture.

However, said Wagner, translation is

a complex process. He added that it

becomes even more complicated, re-

source intensive, and difficult to make

transparent to users as the number of

DRM applications, file formats, and

systems grows. Standardization could

help with this, he noted.

CORAL CONSORTIUM

Hewlett-Packard, InterTrust Tech-

nologies, Matsushita Electric Indus-

trial, Philips Electronics, Samsung

Electronics, Sony, and Twentieth

Century Fox Film comprise the Coral

consortium. Coral plans to develop

specifications making it easier for pro-

tected digital material to work with

multiple devices, software media play-

ers, and online content stores.

NEMO

Coral is considering a proposal by

InterTrust to use the company’s

NEMO (networked environment for

media orchestration) content-protec-

tion technology. NEMO provides a

way for different DRM systems used

by content providers and consumers to

communicate with one another.

NEMO works via a software-based,

service-oriented architecture, in which

participants have trusted, protocol-

independent interfaces that enable the

easy delivery of content-protection ser-

vices.

With the system, content vendors

use X.509 digital certificates, which

authenticate participants and help

NEMO determine which DRM

approaches providers and consumers

are using. DRM systems are then able

to provide the necessary services.

Coral says it wants its technology to

work with current and future DRM

systems. NEMO could provide this

capability because it is programmable,

said Jack Lacy, InterTrust’s senior vice

president of standards and community

initiatives.

The company has built a NEMO test-

bed that has achieved interoperability

among various DRM-related devices,

formats, networks, and services.

Participation

Coral’s members represent a large

pool of digital content and related

technology, including Hollywood

movies, recorded music, and con-

sumer-electronics devices. However,

Coral is also significant because of the

companies that aren’t participating.

Apple, Microsoft, and RealNet-

works have not joined. Gartner’s

McGuire explained, “Experts say the

companies’ DRM solutions are tightly

coupled with their existing online busi-

ness models and, in Apple’s case, with

the extremely successful iPod. All of

these players want to establish their

technologies as de facto industry stan-

dards. The question they are asking is,

‘What’s the business imperative to

work toward interoperability?’ ”

A lack of participation by most

record companies and movie studios

may also decrease Coral’s chances of

widespread adoption.

However, he added, Coral hasn’t

asked these companies to join because

the consortium is trying to stabilize its

standard first.

TRADITIONAL RIGHTS AND USAGES

The Digital Media Project’s Tra-

ditional Rights and Usages (TRUs) ini-

tiative has begun addressing digital

rights management, including interop-

erability issues. The DMP (www.dmpf.

org) is a nonprofit organization that

A series of initiatives

are addressing DRM

interoperability.