Nonius: Implementing a Drm System

The paper describes experiences, ideas, and problems that were discovered while developing a DRM extension to X-Smiles XML browser as a part of Helsinki Institute for Information Technology’s MobileIPR research project. The project succeeded in implementing a piece of software capable of demonstrating the most important DRM features. The most significant implemented features are restrictions related to an individual, time, and usage-counts. The implementation is not perfect. Some of the interesting features that were intentionally left out are aspect and target constraints. The most obvious shortcomings are related to security: certificates and user data are stored in a user’s hard disk in a human readable and modifiable format. Deliberately, there is no support for a secure encryption algorithm for protecting the content when it is transmitted over the network. The most difficult tasks in implementing a DRM system are related to security and parsers. A secure DRM system requires the support of hardware devices. A DRM document parser depends profoundly on a flexible software architecture. Merging certificates and implementing an interface for creating certificates are also challenging. The ODRL specification, too, produces some challenges for implementation. The three most challenging features in ODRL specification are logical operators, documents’ internal links to its elements, and the requirement that child elements may depend on ancestor elements’ children. Some general technical problems are discussed though largely left unanswered. How can we make secure software when the source code is available to anyone? In what layer should DRM be supported: application software, operating system, audio devices or even further? And how secure should the system be? Many non-technical issues are also discussed. Creating a common, global DRM standard is a very hard political problem. If the immaterial products are sold in a global Internet shop, new questions will arise. Guarantees must be implemented somehow, and some solution must be found for the payment. Probably the biggest non-technical problem with DRM is how to sell it to the consumers. A DRM-featured version of a product is worse and maybe more expensive for a consumer. DRM will make technically impossible some actions that are allowed by copyright laws, like copying a product for personal use or reproducing a part of a product for educational purposes. The publishers must have an answer to the people who find out that they have lost rights they used to have. But DRM is a radical change for publishers too. There is also a big question about the future role of the publishers since the main work is no longer producing and delivering physical products.