Digital Rights Management with XML Eamonn Neylon Technology Director The YRM Group

Information Commerce "In the digital world all transactions are rights transactions" Sally Morris, ALPSP

DRM Definitions Trusted exchange of digital content The management of digital rights and the digital management of rights Protection of content to ensure that only allowed operation will be performed The latest investment craze of venture capitalists with money to burn in the States A Pandora’s Box with fundamental consequences for the future of mankind

Types of rights Statutory – those rights provided by legislation such as fair use and moral rights Contractual – ensure that content is used within the limits established by the licensor Permissions – extending usage beyond that conferred by right of sale or license for a one time use such as copying Subrights – a portion of a copyright that is sold outright and transferred such as a translation or territorial exploitation

Negotiating Permissions Need to express both bibliographic metadata and available rights metadata Context of use is usually a factor in determining price and rights determined by the rightsholder A particular type of license is constructed as the result of a permissions transaction Distribution of monies collected makes transactions expensive to process (this role is often assumed by RROs using mandates)

Expressing granted rights Vocabulary for specifying what is being bought or licensed Selling confers statutory rights whereas licensing allows the explicit specification of what a user can do with content exchanged It is necessary to uniquely identify the parties involved in a transaction and the content that is being licensed

Rights languages ContentGuard’s XrML available licensable specification for XML based on work conducted at Xerox PARC Assumes that all rights are unified under publisher – only occurs at point of creation Can a vocabulary be protected by license – implications for all XML applications Open Digital Rights Language (ODRL) proposed by IPR Systems to W3C - workshop in January 2001 with an aim for recommendation

Consumer Protected content Rights & Conditions Prices & Business models Author / Artist Original content Create Package & ProtectSell View / Play Digital Rights Management using eTailer / Clearinghouse Protected content Rights & Conditions Publisher Protected content Rights & Conditions Prices & Business models Clear Rights & Permissions DistributeAggregate

Comparing XrML and ODRL Both are concerned with usage rights rather than access rights They have very different governance models – XrML is licensed intellectual property; ODRL seeks to be an open development They have different levels of maturity – XrML is the result of many years development by Mark Steffik and now Xin Wang; ODRL is a proposal to W3C to be considered

XrML Example – EBX Voucher T8: T8: T8: ABCD-EFGH Usage Rights from Publisher XYZ " ABCD-1234 XYZ DSA 512 6eP+IDQFwjIz5XSFBV+NBF0eN... uuBciQnJ4xGaqRZ5AYoWRQ==... NdxoJ6mcIIAQVe6Droj2fxA= AA John Doe

ODRL Example – EBX Voucher <ebx:voucher xmlns:ebx=“ xmlns=“ xmlns:xlink=“ xmlns:onix=“ Info about the Voucher The product ID info XML: A Managers Guide The Rights Holders info Addison-Wesley Publisher Usage Rights for the Distributor The Distributor has Sell rights only ABDC-1234 XYZ Usage Rights for a typical End User

Metadata approach Metadata is information about things – in the case of rights the metadata describes the resource being considered Metadata provides a consistent view to serve a particular purpose requiring multiple representations of intuitive models There is much research into good metadata formulation such as the indecs framework project Standards groups developing metadata schema include MPEG, SDMI and Dublin Core

Need to identify components Unique identifiers required to track and authenticate resources, parties and transactions Identifying personas is needed to establish contexts and allow non-repudiation Identifiers can operate at different levels of abstraction such as the work, the expression, the format or the instance Digital Object Identifier accommodates other identification standards and is consistently actionable

Technical implementations Digital watermarking allows open distribution but requires legal measures to enforce copyright Access controls achieved through user authentication requiring trust which can be established using digital certificates Usage control through content wrappers – outside-in and inside-out protection solutions Superdistribution, the packaging of content for sharing, requires the dynamic negotiation of rights

Is there a forum for describing consumer de facto rights ? Legislation and common practice determines what statuatory rights consumers have Digital Millennium Copyright Act outlaws circumventing copy protection mechanisms Exceptions include access for fair use, and research into cryptography Access controls and first sale doctrine – is this applicable to digital works

Conclusions The detailed management of rights are currently not a priority for publishers A substantial industry is growing around the protection and transaction of media assets The traditional publishing industry will embrace digital rights management when the publishers business models are supported Eventually rights management will become part of the operating system as with television broadcast systems

The YRM Group John Eccles House, Oxford Science Park, Oxford OX4 4GP