Click here to close now.



Welcome!

Mobile IoT Authors: Tim Mullahy, Pat Romanski, Scott Allen, Teridion Blog, Sanjay Uppal

Related Topics: Mobile IoT

Mobile IoT: Article

Digital Rights Management for Interoperable Mobile Services

How the Open Mobile Alliance enables increased revenues for handset vendors and mobile operators

Managing content in the next few years is only going to get more complicated. Luckily standards are on the way.

The sharing of media and entertainment via mobile devices is becoming an increasingly popular pastime and one of the most widely used mobile services. People download content to their mobile phones or receive information by MMS every day, thereby allowing content to be passed along from one to the other, finding the natural path toward the perfect target audience.

Typically, the media consumed on a mobile device today includes light media content types, with a lower value of around $1.00-$2.00 per item, such as screensavers, wallpapers, or ringtones. Content providers and mobile carriers are facing piracy issues similar to those caused by peer-to-peer networks on the Internet, and they are losing revenues since much of today's lower-value content is forwarded from one user to the next for free. As new smart phones and other devices with color displays and richer audio capabilities penetrate the market, and as network capacities increase thanks to a growing number of WLAN hotspots, consumers are demanding access to higher-value content. Recognizing the revenue potential of these services, mobile carriers and content providers aim to fulfill these consumer demands, while at the same time looking to protect their investments in high-value content.

They are looking for a copy protection solution that is specifically designed for the mobile environment (i.e., mobile digital rights management [DRM]). Addressing the most critical dilemmas in the life cycle of premium content - intellectual property, integrity protection, security, and privacy - successful DRM solutions enable the operation of high-quality mobile services with secured revenues, while also allowing super distribution - the easy, secure forwarding of content from one person to another.

DRM solutions need to work across different devices, geographies, operators, and mobile terminals. They need to escort protected files wherever they go and enforce administrator-defined policies, including who can read what, what content can be duplicated or e-mailed, and how long a user can view a file. Without a secure and interoperable DRM solution, the full potential of mobile media and entertainment delivery cannot be realized.

Defining Open Standards for Interoperable Mobile Services
This is where the Open Mobile Alliance (OMA), or, more specifically, the OMA DRM open standards for the mobile industry, comes in. Created in June 2002, its membership now includes over 400 mobile operators, content, service and applications providers, wireless vendors, and IT companies. OMA aims to stimulate the fast and wide adoption of a variety of new, enhanced mobile information, communication, and entertainment services. Its goal is to deliver high-quality, open technical specifications based upon market requirements that drive modularity, extensibility, and consistency among enablers to reduce industry implementation effort.

OMA identified the market need for various levels of protection depending on the value of the content being protected. The different levels impact the user interfaces and business models. Service providers and mobile vendors wanted a solution that is timely and inexpensive to deploy, can be implemented in mass-market mobile devices, and does not require a costly infrastructure.

In late 2002, OMA released the OMA DRM version 1.0 enabler, its first set of specifications. Based on a subset of the Open Digital Rights Language (ODRL) Rights Expression Language, and entirely royalty-free, the OMA DRM v.1.0 has been adopted by all the major parties in the content value chain. This includes handset vendors such as Motorola, Nokia, and Siemens, and various European and Asian software providers, such as CoreMedia. (CoreMedia is one of the only leading software houses to offer a mobile DRM solution based on the Open Mobile Alliance's (OMA's) DRM specifications.) While handset manufacturers are implementing DRM on their mobile phones, operators are integrating the DRM server components into their content delivery infrastructure.

OMA DRM v.1.0 - Basic Content Protection on Three Levels
Designed to protect light media content such as ringtones, wallpaper, Java games, video and audio clips, and screensavers, OMA's first DRM enabler provides an appropriate level of security for these content types. It includes three levels of protection and functionality: Forward Lock, Combined Delivery, and Separate Delivery, each level adding a layer of protection on top of the previous level.

Forward Lock
The first level, Forward Lock, prevents the unauthorized transfer of content from one device to another. The intention is to prevent peer-to-peer distribution, or super-distribution, of lower value content. Often applied to subscription-based services, such as news or sports, the plaintext content is packaged inside a DRM message that is delivered to the terminal. The device can play, display, or execute the content, but not forward the object.

Combined Delivery
Adding a rights definition to the first level, Combined Delivery equally prevents super-distribution (or forwarding), but also controls the content usage. The DRM message contains two objects: the content and a rights object. The rights object, written into the content using OMA Rights Expression Language (REL), a mobile profile of ODRL, defines usage rules that govern the content. The rules include and support all kinds of business models, including preview and time- and usage-based constraints; for example, a complimentary preview - the permission to play a tune only once, using the content only for a specific number of days, or an annual subscription with non-interfering price models. When applying the Combined Delivery mechanism, neither content nor the rights object can be forwarded from the target device.

Separate Delivery
The third level, called Separate Delivery, is the most sophisticated mechanism because here the content is encrypted, thereby providing better protection for higher value content. Encrypted into DRM Content Format (DCF) using symmetric encryption, the content is useless without a rights object and the symmetric Content Encryption Key (CEK), which is delivered separately from the content. OMA requires that the CEK is delivered securely via WAP push directly to the authorized mobile device, where the DRM User Agent uses it for content decryption.

An OMA DRM-compliant device such as the Nokia 3200 or 6230, or the Siemens SX1 and C62, securely stores the rights objects outside of the consumer's reach. Only the media player on that device has access to both encrypted content and the rights object including the CEK, in order to enable the consumption of the content by displaying or playing it.

People can download media and entertainment content and forward it to friends via MMS, but the recipients will not be able to use the content until they obtain their own CEK for content decryption. A "rights refresh" mechanism enables recipients of super-distributed content to contact the content provider to obtain rights to either preview or purchase the content they have received.

This so-called super-distribution is the key benefit of Separate Delivery. OMA aims to promote super-distribution of content because it maximizes the number of potential customers through peer-to-peer recommendations while retaining control for the content provider through centralized rights acquisition - thereby potentially triggering enormous revenue growth.

Added Protection and Functionality
OMA has taken a different approach to DRM when compared to other standards groups. The alliance aims to enable content delivery in an evolutionary process by implementing basic protection as soon as possible and then taking on more complex issues, thereby avoiding spending years addressing every threat before implementing a definite standard. Hence, the OMA DRM v.1.0 enabler release was developed rapidly in order to reduce time to market and to be immediately available for member companies to implement into their mobile products without requiring massive new infrastructure or changes to handsets.

The DRM v.1.0 enabler is a suitable protection system for lower-value content, appropriate for lower-bandwidth networks and simpler devices. However, as higher bandwidth provided by 2.5G and 3G mobile networks allows for larger content files to be transmitted over the air, and as smart phones and other mobile devices with removable media and larger color screens support downloading and streaming of valuable rich media content, the level of security that OMA DRM v.1.0 provides is no longer satisfying to content providers and mobile carriers who are eager to release high-value rich media content and applications into the mobile marketplace but worry about a "napsterization" of the mobile space.

OMA's Browser and Content (BAC)
The Download and DRM Sub-Working Group began working on its upgraded DRM v.2.0 enabler in early 2003 and announced it to the public in February of this year. The new specifications take advantage of expanded device capabilities and offer improved support for audio/video rendering, streaming content, and access to protected content using multiple devices, thus enabling new business models. They have added security and trust certificates that allow more complex and rich forms of media content (i.e., premium content such as music tracks, video clips, and animated color screensavers and games) as well as improved support to preview and share content.

Security is enhanced by encrypting the rights object and the content encryption key, using the device's public key to bind them to the target device. Integrity protection for both content and the rights object reduces the risk of either being tampered with.

In addition to these enhanced security features, the specifications include additional trust elements. Mutual authentication between the device and the rights issuer (the content provider) will add trust to the downloading or messaging scenario. The rights issuer can accurately identify the device in order to determine the revocation status of the transaction. The new enabler also supports a wide variety of distribution and payment use cases.

Since February, several draft specifications have been announced as part of the OMA DRM 2.0 enabler release. The enhanced version includes countless benefits for content owners as well as end consumers. Content owners will profit from the following features:

  • Enhanced security, enabled by the binding of rights objects to user identity: Individually encrypted rights objects use a device's public key to provide cryptographic binding (to SIM/WIM), integrity protection for content and rights objects.
  • Explicit trust mechanisms, including mutual authentication between a device and the rights issuer as well as device revocation: The rights issuer can identify the device revocation status.
  • Support of secure multicast and unicast streaming: Collaboration with 3GPP and 3GPP2 on a file format for protected streaming and progressive download.
  • Export to other copy protection schemes: For example, the transfer of music to the SD Card (which incorporates its own DRM mechanism) for a mobile music player.
  • Support for a wide variety of business models: These include metered time and usage constraints, subscription rights for content bundles, and gifting.
  • Support for messaging and peer-to-peer (i.e., super-distribution): Viral marketing and a reward mechanism.
The end consumer will also see benefits from the enhanced enabler release, among them the following:
  • Enhanced security: Premium mobile content will be available to users.
  • Advanced content management: Content and rights can, for example, be easily moved between several devices owned by one user or moved to remote or removable storage and later be restored to the device.
  • Sharing of content between multiple users: Within domain (community or family).
  • Unconnected devices: Content can be copied to SD Card for a mobile music player without network connectivity.
  • Complimentary previews: Constraints for super-distributed content before purchase.
  • Export to other copy protection schemes: Transfer of music to a DRM-enabled set-top box or computing device is supported.
OMA DRM v.2.0 implements a DRM (REL v.2.0, defined as a mobile profile of the ODRL). This expression language addresses the principal concerns of content providers - protection of sensitive information and purchased content that is in possession of the customer; prevention of unauthorized use and distribution of content; and avoidance of tampering with content, either during transmission or as a case of unauthorized reuse. Accordingly, numerous content suppliers have announced support for OMA DRM v.2.0, among them Sony and Time Warner. Carriers and handset vendors, who see significant revenue enhancement opportunities by offering pervasive mobile access to premium rich content, are expected to release handsets that have implemented OMA DRM v.2.0 by 2005.

Implementing OMA DRM
The success of premium 3G applications and high-value media and entertainment content delivery lies in security, ease of use, and in the market penetration of suitable handsets. Handsets and other mobile devices that support OMA-defined DRM technology are already on the market. Currently about 80 models are available in all categories. Given that the specifications were released 14 months ago, this can be considered a tremendous success. As OMA DRM has penetrated into the OS and into, for example, Nokia's widely used Series 60, it has become easy for handset manufacturers to implement DRM. Some leading handset vendors have decided to release DRM in all of their phone models. For these devices, the enhanced DRM v.2.0 specifications represent the next step in pervasive mobile access. The new enabler, the specifics of which have just been released, takes advantage of expanded device capabilities - multimedia applications, processing speed, and storage, among others - and offers improved support for the downloading and streaming of content as well as for sophisticated business models.

OMA's DRM solution sets the stage for generating multimedia revenues in a mobile environment. The solution is widely accepted in the content industry and has been embraced by music labels, game providers, and movie studios. But, as Avi Greengart, senior analyst for wireless and personal technology at JupiterResearch states, "It's still early in the wireless content market. Content providers have been encouraged because consumers have shown a willingness to pay $2 for ringtone versions of songs they won't pay $1 to download on their PCs. As such, the lack of open-standards-based DRM hasn't inhibited content providers from releasing ringtones and graphics so far. However, it's pretty clear that as new services evolve for faster wireless networks and more capable handsets, content providers are looking for stronger rights protection and are hopeful that super-distribution will enable new business models."

More Stories By Willms Buhse

Dr. Willms Buhse is head of products and marketing and a member of the executive board of CoreMedia AG, a software company based in Hamburg, Germany, that develops standard solutions for mobile digital rights management, content management systems, and multichannel content delivery. Since early 2003, Willms has also held the position of vice chair of the Open Mobile Alliance's DRM and download group.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
As enterprises work to take advantage of Big Data technologies, they frequently become distracted by product-level decisions. In most new Big Data builds this approach is completely counter-productive: it presupposes tools that may not be a fit for development teams, forces IT to take on the burden of evaluating and maintaining unfamiliar technology, and represents a major up-front expense. In his session at @BigDataExpo at @ThingsExpo, Andrew Warfield, CTO and Co-Founder of Coho Data, will dis...
SYS-CON Events announced today that Fusion, a leading provider of cloud services, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Fusion, a leading provider of integrated cloud solutions to small, medium and large businesses, is the industry's single source for the cloud. Fusion's advanced, proprietary cloud service platform enables the integration of leading edge solutions in the cloud, including clou...
With the Apple Watch making its way onto wrists all over the world, it’s only a matter of time before it becomes a staple in the workplace. In fact, Forrester reported that 68 percent of technology and business decision-makers characterize wearables as a top priority for 2015. Recognizing their business value early on, FinancialForce.com was the first to bring ERP to wearables, helping streamline communication across front and back office functions. In his session at @ThingsExpo, Kevin Roberts...
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management...
SYS-CON Events announced today that Alert Logic, Inc., the leading provider of Security-as-a-Service solutions for the cloud, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Alert Logic, Inc., provides Security-as-a-Service for on-premises, cloud, and hybrid infrastructures, delivering deep security insight and continuous protection for customers at a lower cost than traditional security solutions. Ful...
SYS-CON Events announced today that VAI, a leading ERP software provider, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. VAI (Vormittag Associates, Inc.) is a leading independent mid-market ERP software developer renowned for its flexible solutions and ability to automate critical business functions for the distribution, manufacturing, specialty retail and service sectors. An IBM Premier Business Part...
With an estimated 50 billion devices connected to the Internet by 2020, several industries will begin to expand their capabilities for retaining end point data at the edge to better utilize the range of data types and sheer volume of M2M data generated by the Internet of Things. In his session at @ThingsExpo, Don DeLoach, CEO and President of Infobright, will discuss the infrastructures businesses will need to implement to handle this explosion of data by providing specific use cases for filte...
The cloud promises new levels of agility and cost-savings for Big Data, data warehousing and analytics. But it’s challenging to understand all the options – from IaaS and PaaS to newer services like HaaS (Hadoop as a Service) and BDaaS (Big Data as a Service). In her session at @BigDataExpo at @ThingsExpo, Hannah Smalltree, a director at Cazena, will provide an educational overview of emerging “as-a-service” options for Big Data in the cloud. This is critical background for IT and data profes...
Fortunately, meaningful and tangible business cases for IoT are plentiful in a broad array of industries and vertical markets. These range from simple warranty cost reduction for capital intensive assets, to minimizing downtime for vital business tools, to creating feedback loops improving product design, to improving and enhancing enterprise customer experiences. All of these business cases, which will be briefly explored in this session, hinge on cost effectively extracting relevant data from ...
SYS-CON Events announced today that Interoute, owner-operator of one of Europe's largest networks and a global cloud services platform, has been named “Bronze Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2015 at the Javits Center in New York, New York. Interoute is the owner-operator of one of Europe's largest networks and a global cloud services platform which encompasses 12 data centers, 14 virtual data centers and 31 colocation centers, with connections to 195 ad...
Most people haven’t heard the word, “gamification,” even though they probably, and perhaps unwittingly, participate in it every day. Gamification is “the process of adding games or game-like elements to something (as a task) so as to encourage participation.” Further, gamification is about bringing game mechanics – rules, constructs, processes, and methods – into the real world in an effort to engage people. In his session at @ThingsExpo, Robert Endo, owner and engagement manager of Intrepid D...
Eighty percent of a data scientist’s time is spent gathering and cleaning up data, and 80% of all data is unstructured and almost never analyzed. Cognitive computing, in combination with Big Data, is changing the equation by creating data reservoirs and using natural language processing to enable analysis of unstructured data sources. This is impacting every aspect of the analytics profession from how data is mined (and by whom) to how it is delivered. This is not some futuristic vision: it's ha...
WebRTC has had a real tough three or four years, and so have those working with it. Only a few short years ago, the development world were excited about WebRTC and proclaiming how awesome it was. You might have played with the technology a couple of years ago, only to find the extra infrastructure requirements were painful to implement and poorly documented. This probably left a bitter taste in your mouth, especially when things went wrong.
Learn how IoT, cloud, social networks and last but not least, humans, can be integrated into a seamless integration of cooperative organisms both cybernetic and biological. This has been enabled by recent advances in IoT device capabilities, messaging frameworks, presence and collaboration services, where devices can share information and make independent and human assisted decisions based upon social status from other entities. In his session at @ThingsExpo, Michael Heydt, founder of Seamless...
The IoT's basic concept of collecting data from as many sources possible to drive better decision making, create process innovation and realize additional revenue has been in use at large enterprises with deep pockets for decades. So what has changed? In his session at @ThingsExpo, Prasanna Sivaramakrishnan, Solutions Architect at Red Hat, discussed the impact commodity hardware, ubiquitous connectivity, and innovations in open source software are having on the connected universe of people, thi...
WebRTC: together these advances have created a perfect storm of technologies that are disrupting and transforming classic communications models and ecosystems. In his session at WebRTC Summit, Cary Bran, VP of Innovation and New Ventures at Plantronics and PLT Labs, provided an overview of this technological shift, including associated business and consumer communications impacts, and opportunities it may enable, complement or entirely transform.
There are so many tools and techniques for data analytics that even for a data scientist the choices, possible systems, and even the types of data can be daunting. In his session at @ThingsExpo, Chris Harrold, Global CTO for Big Data Solutions for EMC Corporation, showed how to perform a simple, but meaningful analysis of social sentiment data using freely available tools that take only minutes to download and install. Participants received the download information, scripts, and complete end-t...
For manufacturers, the Internet of Things (IoT) represents a jumping-off point for innovation, jobs, and revenue creation. But to adequately seize the opportunity, manufacturers must design devices that are interconnected, can continually sense their environment and process huge amounts of data. As a first step, manufacturers must embrace a new product development ecosystem in order to support these products.
Manufacturing connected IoT versions of traditional products requires more than multiple deep technology skills. It also requires a shift in mindset, to realize that connected, sensor-enabled “things” act more like services than what we usually think of as products. In his session at @ThingsExpo, David Friedman, CEO and co-founder of Ayla Networks, discussed how when sensors start generating detailed real-world data about products and how they’re being used, smart manufacturers can use the dat...
When it comes to IoT in the enterprise, namely the commercial building and hospitality markets, a benefit not getting the attention it deserves is energy efficiency, and IoT’s direct impact on a cleaner, greener environment when installed in smart buildings. Until now clean technology was offered piecemeal and led with point solutions that require significant systems integration to orchestrate and deploy. There didn't exist a 'top down' approach that can manage and monitor the way a Smart Buildi...