Welcome!

Mobile IoT Authors: Elizabeth White, Liz McMillan, Kevin Jackson, Jnan Dash, David H Deans

Related Topics: Mobile IoT

Mobile IoT: Article

Digital Rights Management for Interoperable Mobile Services

How the Open Mobile Alliance enables increased revenues for handset vendors and mobile operators

Managing content in the next few years is only going to get more complicated. Luckily standards are on the way.

The sharing of media and entertainment via mobile devices is becoming an increasingly popular pastime and one of the most widely used mobile services. People download content to their mobile phones or receive information by MMS every day, thereby allowing content to be passed along from one to the other, finding the natural path toward the perfect target audience.

Typically, the media consumed on a mobile device today includes light media content types, with a lower value of around $1.00-$2.00 per item, such as screensavers, wallpapers, or ringtones. Content providers and mobile carriers are facing piracy issues similar to those caused by peer-to-peer networks on the Internet, and they are losing revenues since much of today's lower-value content is forwarded from one user to the next for free. As new smart phones and other devices with color displays and richer audio capabilities penetrate the market, and as network capacities increase thanks to a growing number of WLAN hotspots, consumers are demanding access to higher-value content. Recognizing the revenue potential of these services, mobile carriers and content providers aim to fulfill these consumer demands, while at the same time looking to protect their investments in high-value content.

They are looking for a copy protection solution that is specifically designed for the mobile environment (i.e., mobile digital rights management [DRM]). Addressing the most critical dilemmas in the life cycle of premium content - intellectual property, integrity protection, security, and privacy - successful DRM solutions enable the operation of high-quality mobile services with secured revenues, while also allowing super distribution - the easy, secure forwarding of content from one person to another.

DRM solutions need to work across different devices, geographies, operators, and mobile terminals. They need to escort protected files wherever they go and enforce administrator-defined policies, including who can read what, what content can be duplicated or e-mailed, and how long a user can view a file. Without a secure and interoperable DRM solution, the full potential of mobile media and entertainment delivery cannot be realized.

Defining Open Standards for Interoperable Mobile Services
This is where the Open Mobile Alliance (OMA), or, more specifically, the OMA DRM open standards for the mobile industry, comes in. Created in June 2002, its membership now includes over 400 mobile operators, content, service and applications providers, wireless vendors, and IT companies. OMA aims to stimulate the fast and wide adoption of a variety of new, enhanced mobile information, communication, and entertainment services. Its goal is to deliver high-quality, open technical specifications based upon market requirements that drive modularity, extensibility, and consistency among enablers to reduce industry implementation effort.

OMA identified the market need for various levels of protection depending on the value of the content being protected. The different levels impact the user interfaces and business models. Service providers and mobile vendors wanted a solution that is timely and inexpensive to deploy, can be implemented in mass-market mobile devices, and does not require a costly infrastructure.

In late 2002, OMA released the OMA DRM version 1.0 enabler, its first set of specifications. Based on a subset of the Open Digital Rights Language (ODRL) Rights Expression Language, and entirely royalty-free, the OMA DRM v.1.0 has been adopted by all the major parties in the content value chain. This includes handset vendors such as Motorola, Nokia, and Siemens, and various European and Asian software providers, such as CoreMedia. (CoreMedia is one of the only leading software houses to offer a mobile DRM solution based on the Open Mobile Alliance's (OMA's) DRM specifications.) While handset manufacturers are implementing DRM on their mobile phones, operators are integrating the DRM server components into their content delivery infrastructure.

OMA DRM v.1.0 - Basic Content Protection on Three Levels
Designed to protect light media content such as ringtones, wallpaper, Java games, video and audio clips, and screensavers, OMA's first DRM enabler provides an appropriate level of security for these content types. It includes three levels of protection and functionality: Forward Lock, Combined Delivery, and Separate Delivery, each level adding a layer of protection on top of the previous level.

Forward Lock
The first level, Forward Lock, prevents the unauthorized transfer of content from one device to another. The intention is to prevent peer-to-peer distribution, or super-distribution, of lower value content. Often applied to subscription-based services, such as news or sports, the plaintext content is packaged inside a DRM message that is delivered to the terminal. The device can play, display, or execute the content, but not forward the object.

Combined Delivery
Adding a rights definition to the first level, Combined Delivery equally prevents super-distribution (or forwarding), but also controls the content usage. The DRM message contains two objects: the content and a rights object. The rights object, written into the content using OMA Rights Expression Language (REL), a mobile profile of ODRL, defines usage rules that govern the content. The rules include and support all kinds of business models, including preview and time- and usage-based constraints; for example, a complimentary preview - the permission to play a tune only once, using the content only for a specific number of days, or an annual subscription with non-interfering price models. When applying the Combined Delivery mechanism, neither content nor the rights object can be forwarded from the target device.

Separate Delivery
The third level, called Separate Delivery, is the most sophisticated mechanism because here the content is encrypted, thereby providing better protection for higher value content. Encrypted into DRM Content Format (DCF) using symmetric encryption, the content is useless without a rights object and the symmetric Content Encryption Key (CEK), which is delivered separately from the content. OMA requires that the CEK is delivered securely via WAP push directly to the authorized mobile device, where the DRM User Agent uses it for content decryption.

An OMA DRM-compliant device such as the Nokia 3200 or 6230, or the Siemens SX1 and C62, securely stores the rights objects outside of the consumer's reach. Only the media player on that device has access to both encrypted content and the rights object including the CEK, in order to enable the consumption of the content by displaying or playing it.

People can download media and entertainment content and forward it to friends via MMS, but the recipients will not be able to use the content until they obtain their own CEK for content decryption. A "rights refresh" mechanism enables recipients of super-distributed content to contact the content provider to obtain rights to either preview or purchase the content they have received.

This so-called super-distribution is the key benefit of Separate Delivery. OMA aims to promote super-distribution of content because it maximizes the number of potential customers through peer-to-peer recommendations while retaining control for the content provider through centralized rights acquisition - thereby potentially triggering enormous revenue growth.

Added Protection and Functionality
OMA has taken a different approach to DRM when compared to other standards groups. The alliance aims to enable content delivery in an evolutionary process by implementing basic protection as soon as possible and then taking on more complex issues, thereby avoiding spending years addressing every threat before implementing a definite standard. Hence, the OMA DRM v.1.0 enabler release was developed rapidly in order to reduce time to market and to be immediately available for member companies to implement into their mobile products without requiring massive new infrastructure or changes to handsets.

The DRM v.1.0 enabler is a suitable protection system for lower-value content, appropriate for lower-bandwidth networks and simpler devices. However, as higher bandwidth provided by 2.5G and 3G mobile networks allows for larger content files to be transmitted over the air, and as smart phones and other mobile devices with removable media and larger color screens support downloading and streaming of valuable rich media content, the level of security that OMA DRM v.1.0 provides is no longer satisfying to content providers and mobile carriers who are eager to release high-value rich media content and applications into the mobile marketplace but worry about a "napsterization" of the mobile space.

OMA's Browser and Content (BAC)
The Download and DRM Sub-Working Group began working on its upgraded DRM v.2.0 enabler in early 2003 and announced it to the public in February of this year. The new specifications take advantage of expanded device capabilities and offer improved support for audio/video rendering, streaming content, and access to protected content using multiple devices, thus enabling new business models. They have added security and trust certificates that allow more complex and rich forms of media content (i.e., premium content such as music tracks, video clips, and animated color screensavers and games) as well as improved support to preview and share content.

Security is enhanced by encrypting the rights object and the content encryption key, using the device's public key to bind them to the target device. Integrity protection for both content and the rights object reduces the risk of either being tampered with.

In addition to these enhanced security features, the specifications include additional trust elements. Mutual authentication between the device and the rights issuer (the content provider) will add trust to the downloading or messaging scenario. The rights issuer can accurately identify the device in order to determine the revocation status of the transaction. The new enabler also supports a wide variety of distribution and payment use cases.

Since February, several draft specifications have been announced as part of the OMA DRM 2.0 enabler release. The enhanced version includes countless benefits for content owners as well as end consumers. Content owners will profit from the following features:

  • Enhanced security, enabled by the binding of rights objects to user identity: Individually encrypted rights objects use a device's public key to provide cryptographic binding (to SIM/WIM), integrity protection for content and rights objects.
  • Explicit trust mechanisms, including mutual authentication between a device and the rights issuer as well as device revocation: The rights issuer can identify the device revocation status.
  • Support of secure multicast and unicast streaming: Collaboration with 3GPP and 3GPP2 on a file format for protected streaming and progressive download.
  • Export to other copy protection schemes: For example, the transfer of music to the SD Card (which incorporates its own DRM mechanism) for a mobile music player.
  • Support for a wide variety of business models: These include metered time and usage constraints, subscription rights for content bundles, and gifting.
  • Support for messaging and peer-to-peer (i.e., super-distribution): Viral marketing and a reward mechanism.
The end consumer will also see benefits from the enhanced enabler release, among them the following:
  • Enhanced security: Premium mobile content will be available to users.
  • Advanced content management: Content and rights can, for example, be easily moved between several devices owned by one user or moved to remote or removable storage and later be restored to the device.
  • Sharing of content between multiple users: Within domain (community or family).
  • Unconnected devices: Content can be copied to SD Card for a mobile music player without network connectivity.
  • Complimentary previews: Constraints for super-distributed content before purchase.
  • Export to other copy protection schemes: Transfer of music to a DRM-enabled set-top box or computing device is supported.
OMA DRM v.2.0 implements a DRM (REL v.2.0, defined as a mobile profile of the ODRL). This expression language addresses the principal concerns of content providers - protection of sensitive information and purchased content that is in possession of the customer; prevention of unauthorized use and distribution of content; and avoidance of tampering with content, either during transmission or as a case of unauthorized reuse. Accordingly, numerous content suppliers have announced support for OMA DRM v.2.0, among them Sony and Time Warner. Carriers and handset vendors, who see significant revenue enhancement opportunities by offering pervasive mobile access to premium rich content, are expected to release handsets that have implemented OMA DRM v.2.0 by 2005.

Implementing OMA DRM
The success of premium 3G applications and high-value media and entertainment content delivery lies in security, ease of use, and in the market penetration of suitable handsets. Handsets and other mobile devices that support OMA-defined DRM technology are already on the market. Currently about 80 models are available in all categories. Given that the specifications were released 14 months ago, this can be considered a tremendous success. As OMA DRM has penetrated into the OS and into, for example, Nokia's widely used Series 60, it has become easy for handset manufacturers to implement DRM. Some leading handset vendors have decided to release DRM in all of their phone models. For these devices, the enhanced DRM v.2.0 specifications represent the next step in pervasive mobile access. The new enabler, the specifics of which have just been released, takes advantage of expanded device capabilities - multimedia applications, processing speed, and storage, among others - and offers improved support for the downloading and streaming of content as well as for sophisticated business models.

OMA's DRM solution sets the stage for generating multimedia revenues in a mobile environment. The solution is widely accepted in the content industry and has been embraced by music labels, game providers, and movie studios. But, as Avi Greengart, senior analyst for wireless and personal technology at JupiterResearch states, "It's still early in the wireless content market. Content providers have been encouraged because consumers have shown a willingness to pay $2 for ringtone versions of songs they won't pay $1 to download on their PCs. As such, the lack of open-standards-based DRM hasn't inhibited content providers from releasing ringtones and graphics so far. However, it's pretty clear that as new services evolve for faster wireless networks and more capable handsets, content providers are looking for stronger rights protection and are hopeful that super-distribution will enable new business models."

More Stories By Willms Buhse

Dr. Willms Buhse is head of products and marketing and a member of the executive board of CoreMedia AG, a software company based in Hamburg, Germany, that develops standard solutions for mobile digital rights management, content management systems, and multichannel content delivery. Since early 2003, Willms has also held the position of vice chair of the Open Mobile Alliance's DRM and download group.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
In his session at @ThingsExpo, Eric Lachapelle, CEO of the Professional Evaluation and Certification Board (PECB), will provide an overview of various initiatives to certifiy the security of connected devices and future trends in ensuring public trust of IoT. Eric Lachapelle is the Chief Executive Officer of the Professional Evaluation and Certification Board (PECB), an international certification body. His role is to help companies and individuals to achieve professional, accredited and worldw...
SYS-CON Events announced today that Interoute, owner-operator of one of Europe's largest networks and a global cloud services platform, has been named “Bronze Sponsor” of SYS-CON's 20th Cloud Expo, which will take place on June 6-8, 2017 at the Javits Center in New York, New York. Interoute is the owner-operator of one of Europe's largest networks and a global cloud services platform which encompasses 12 data centers, 14 virtual data centers and 31 colocation centers, with connections to 195 add...
SYS-CON Events announced today that Linux Academy, the foremost online Linux and cloud training platform and community, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Linux Academy was founded on the belief that providing high-quality, in-depth training should be available at an affordable price. Industry leaders in quality training, provided services, and student certification passes, its goal is to c...
What sort of WebRTC based applications can we expect to see over the next year and beyond? One way to predict development trends is to see what sorts of applications startups are building. In his session at @ThingsExpo, Arin Sime, founder of WebRTC.ventures, will discuss the current and likely future trends in WebRTC application development based on real requests for custom applications from real customers, as well as other public sources of information,
SYS-CON Events announced today that Telecom Reseller has been named “Media Sponsor” of SYS-CON's 20th International Cloud Expo, which will take place on June 6–8, 2017, at the Javits Center in New York City, NY. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.
Keeping pace with advancements in software delivery processes and tooling is taxing even for the most proficient organizations. Point tools, platforms, open source and the increasing adoption of private and public cloud services requires strong engineering rigor - all in the face of developer demands to use the tools of choice. As Agile has settled in as a mainstream practice, now DevOps has emerged as the next wave to improve software delivery speed and output. To make DevOps work, organization...
SYS-CON Events announced today that Loom Systems will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Founded in 2015, Loom Systems delivers an advanced AI solution to predict and prevent problems in the digital business. Loom stands alone in the industry as an AI analysis platform requiring no prior math knowledge from operators, leveraging the existing staff to succeed in the digital era. With offices in S...
SYS-CON Events announced today that T-Mobile will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on ...
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloudistics delivers a complete public cloud experience with composable on-premises infrastructures to medium and large enterprises. Its software-defined technology natively converges network, storage, compute, virtualization, and management into a ...
SYS-CON Events announced today that CA Technologies has been named “Platinum Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY, and the 21st International Cloud Expo®, which will take place October 31-November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. CA Technologies helps customers succeed in a future where every business – from apparel to energy – is being rewritten by software. From ...
SYS-CON Events announced today that Infranics will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Since 2000, Infranics has developed SysMaster Suite, which is required for the stable and efficient management of ICT infrastructure. The ICT management solution developed and provided by Infranics continues to add intelligence to the ICT infrastructure through the IMC (Infra Management Cycle) based on mathemat...
Now that the world has connected “things,” we need to build these devices as truly intelligent in order to create instantaneous and precise results. This means you have to do as much of the processing at the point of entry as you can: at the edge. The killer use cases for IoT are becoming manifest through AI engines on edge devices. An autonomous car has this dual edge/cloud analytics model, producing precise, real-time results. In his session at @ThingsExpo, John Crupi, Vice President and Eng...
In the enterprise today, connected IoT devices are everywhere – both inside and outside corporate environments. The need to identify, manage, control and secure a quickly growing web of connections and outside devices is making the already challenging task of security even more important, and onerous. In his session at @ThingsExpo, Rich Boyer, CISO and Chief Architect for Security at NTT i3, will discuss new ways of thinking and the approaches needed to address the emerging challenges of securit...
The taxi industry never saw Uber coming. Startups are a threat to incumbents like never before, and a major enabler for startups is that they are instantly “cloud ready.” If innovation moves at the pace of IT, then your company is in trouble. Why? Because your data center will not keep up with frenetic pace AWS, Microsoft and Google are rolling out new capabilities In his session at 20th Cloud Expo, Don Browning, VP of Cloud Architecture at Turner, will posit that disruption is inevitable for c...
There are 66 million network cameras capturing terabytes of data. How did factories in Japan improve physical security at the facilities and improve employee productivity? Edge Computing reduces possible kilobytes of data collected per second to only a few kilobytes of data transmitted to the public cloud every day. Data is aggregated and analyzed close to sensors so only intelligent results need to be transmitted to the cloud. Non-essential data is recycled to optimize storage.
As businesses adopt functionalities in cloud computing, it’s imperative that IT operations consistently ensure cloud systems work correctly – all of the time, and to their best capabilities. In his session at @BigDataExpo, Bernd Harzog, CEO and founder of OpsDataStore, will present an industry answer to the common question, “Are you running IT operations as efficiently and as cost effectively as you need to?” He will expound on the industry issues he frequently came up against as an analyst, and...
In his General Session at 16th Cloud Expo, David Shacochis, host of The Hybrid IT Files podcast and Vice President at CenturyLink, investigated three key trends of the “gigabit economy" though the story of a Fortune 500 communications company in transformation. Narrating how multi-modal hybrid IT, service automation, and agile delivery all intersect, he will cover the role of storytelling and empathy in achieving strategic alignment between the enterprise and its information technology.
"I think that everyone recognizes that for IoT to really realize its full potential and value that it is about creating ecosystems and marketplaces and that no single vendor is able to support what is required," explained Esmeralda Swartz, VP, Marketing Enterprise and Cloud at Ericsson, in this SYS-CON.tv interview at @ThingsExpo, held June 7-9, 2016, at the Javits Center in New York City, NY.
Microservices are a very exciting architectural approach that many organizations are looking to as a way to accelerate innovation. Microservices promise to allow teams to move away from monolithic "ball of mud" systems, but the reality is that, in the vast majority of organizations, different projects and technologies will continue to be developed at different speeds. How to handle the dependencies between these disparate systems with different iteration cycles? Consider the "canoncial problem" ...
SYS-CON Events announced today that HTBase will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. HTBase (Gartner 2016 Cool Vendor) delivers a Composable IT infrastructure solution architected for agility and increased efficiency. It turns compute, storage, and fabric into fluid pools of resources that are easily composed and re-composed to meet each application’s needs. With HTBase, companies can quickly prov...