Beyond Entertainment: Language-Based Standards for Digital Rights Management

It's hard to argue with the notion that those who own content should be able to define the terms and conditions under which others may use it. But translating that principle into a workable Digital Rights Management scheme has proven difficult. One challenge has been to convince enterprises outside of entertainment and media-related fields to make DRM a priority. Another has been to satisfactorily address questions about a range of key practical issues such as implementation costs, ease-of-use, and the ability to interoperate with other elements in a heterogeneous IT context. These latter concerns have led to a shift in emphasis away from proprietary, single-vendor solutions toward open, language-based standards that facilitate maximum flexibility.

"Many early DRM solutions were designed specifically to protect entertainment content," observes Paul Rettig, director of IBM Digital Media Development in Boca Raton, Florida. "However," he says, "with businesses increasingly sharing and transferring confidential and sensitive information, there is a growing need for enterprises to protect business content and maintain its privacy."

Rajan Samtani, director of sales and marketing at ContentGuard in Bethesda, Maryland, says there are many examples of industries that can benefit from DRM deployment. "The Pharmaceutical industry, for instance, could manage the use of content related to product development and patent applications. In Healthcare, DRM can provide usage restrictions that maintain the privacy of patient records as mandated by HIPAA legislation." Samtani also cites the need for protection of enterprise content in areas such as financial services and banking, project management, corporate governance, and human resources.

In sum, says Ji Shen, general manager of media commerce applications at RealNetworks in Seattle, "corporate decision-makers who are looking to securely communicate with employees, customers, and partners, to conduct confidential training, or to monetize elearning materials, should be interested in DRM.

Open Standards
Once the need for content protection is accepted, the next challenge is how to implement DRM in the most cost-efficient and least obtrusive manner. "In the past," Samtani says, "DRM was seen as a monolithic functionality provided by a proprietary end-to-end platform. But to become pervasive, DRM must become componentized, with best-of-breed DRM-enabled components operating within suites of other enterprise applications." Samtani and many others believe that the ideal path to that scenario is through open standards built around an XML-derived language supporting DRM capabilities.

As Rettig points out, a language is only one of several components needed for a complete DRM standard. "Other equally important areas are the format of the content package itself, metadata definitions, content encryption technologies, and a mechanism to exchange decryption keys. But rights expression languages provide the ability to express the rules needed by applications that receive content."

One advantage of a standard, says Renato Iannella, chief scientist at IPR Systems in Sydney, Australia, is that end-users and content-providers won't be locked into proprietary solutions. "The market can compete to offer improved services, and content can easily be moved over to newer systems."

Shen adds that a standard language will also promote interoperability. "A language-based approach allows IT professionals to quickly develop interoperation amongst products from multiple DRM vendors. Existing transaction process, user management, and asset management infrastructures can work with multiple DRM solutions, rather than building new infrastructure for each DRM solution."

Depending on whom you ask, either two or three languages are contenders for incorporation into a DRM standard. Shen says that the eXtensible Media Commerce Language--developed by RealNetworks---best fits the needs of enterprise customers. "XMCL is lightweight, easy to understand, easy to implement, and imposes little overhead in enabling cross-platform interoperability. And XMCL is royalty-free, which eases the cost concerns of enterprise customers."

Shen says that RealNetworks intends to incorporate XMCL into its RealSystem Media Commerce Suite, though it hasn't yet done so. He adds that RealNetworks is "working closely with standards committees who have strong interests in developing a DRM standard." But when MPEG was choosing the Rights Expression Language (REL) component of the MPEG-21 standard last December, RealNetworks itself ended up backing another royalty-free option, IPR's royalty-free Open Digital Rights Language.

"We think that ODRL is the best fit for the enterprise user," Iannella says. "Developed to enable rapid development and low-cost deployment, ODRL is a core expression language covering the majority of needs of the enterprise user. It can also be extended with additional data dictionary terms in cases where the enterprise needs are very specific and constrained." To date, Iannella says, ODRL has been adopted "primarily in the ebook, education/learning, and mobile markets."

Ultimately, however, MPEG-21 went with ContentGuard's XrML, a language that is at once more mature (currently at release 2.1) and more complex. "XrML is mathematically precise," Samtani says, "and therefore machine-readable. The architecture of XrML can comprehend all sorts of content as well as services-based resources, which we believe will be necessary to run DRM functionality in enterprise applications. Also, XrML is the only working language available today, with Microsoft as a customer."

In April, ContentGuard contributed XrML to the Rights Language Technical Committee of the Organization for the Advancement of Structured Information Standards (OASIS), which handles XML-related standards. "The RLTC is presently accepting requirements which will lead to further enhancement of the specification," Samtani says. "An RLTC approved spec is scheduled for the fourth quarter of this year."

As for ODRL, the MPEG-21 setback isn't necessarily terminal. Rettig says that the organizations leading global standards efforts for cell phones and mobile devices--formerly the WAP Forum and now the Open Mobile Alliance--are engaged in "on-going standards activities pertaining to a rights expression language based on ODRL." And according to Iannella, the selection of ODRL by "a global standards body" and the release of version 1.1 were both on track to be announced in July.

Heavy-hitters in the technology and content-distribution sectors have endorsed both ODRL and XrML. And as Rettig points out, the two should not necessarily be seen as mutually exclusive. "The languages are both XML schema-based," he says. "And while they differ on the details, the syntax of each supports the concise, unambiguous expressions needed to operate efficiently in applications. So as long as each standard is published, making interoperability possible, one standard does not preclude another." As these standards develop, Rettig adds, and the technology is incorporated into middleware, "DRM will become pervasive, providing the enterprise with new levels of security and privacy."