The sharing of media and entertainment via mobile devices is becoming an increasingly popular pastime and one of the most widely used mobile services. Typically, the media consumed on a mobile device today includes light media content types, with a lower value of around $1.00 – $2.00 per item, such as screensavers, wallpapers, or ring tones. As new smart phones and other devices with colour displays and richer audio capabilities penetrate the market, and as network capacities increase thanks to a growing number of W-LAN hotspots, to Bluetooth and IR (infrared), consumers are demanding access to higher value content. Mobile carriers and content providers aim to fulfil those consumer demands, while at the same time looking to protect their investments in high-value content. What they are looking for is a copy protection solution that is specifically designed for the needs in a mobile environment, i.e. mobile digital rights management (DRM).

The OMA approach of defining open standards for interoperable mobile services
This is where the Open Mobile Alliance (OMA), or, more specifically, the OMA DRM open standards for the mobile industry, comes in. Created in June 2002, its membership now includes about 400 mobile operators, content, service and applications providers, wireless vendors and IT companies. Its goal is to deliver high quality, open technical specifications based upon market requirements and to reduce industry implementation effort.

OMA has taken a different approach to DRM when compared to other standards groups. The alliance aims to enable content delivery in an evolutionary process by implementing basic protection as soon as possible and then taking on more complex issues, thereby avoiding spending years addressing every threat before implementing a definite standard. In line with this, OMA and its members identified the market need for various levels of protection depending on the value of the content being protected.

Hence, the OMA DRM v.1.0 enabler release was developed rapidly in order to reduce time to market and to be immediately available for member companies to implement into their mobile products without requiring massive new infrastructure or changes to handsets. The first set of specifications was released in late 2002. Based on a subset of the Open Digital Rights Language (ODRL) rights expression language and entirely royalty-free, the OMA DRM v.1.0 has been adopted by all the major parties in the content value chain. This includes handset vendors, such as Motorola, Nokia and Siemens, and various European and Asian software providers among them the German content technology expert CoreMedia. While handset manufacturers are implementing DRM on their mobile phones, operators are integrating the DRM server components into their service delivery platforms.

The DRM v.1.0 enabler is a suitable protection system for lower value content, appropriate for lower bandwidth networks and simpler devices. Higher bandwidth provided by 2,5G and 3G mobile networks allows for larger content files to be transmitted over the air and smart phones and other mobile devices with removable media and larger colour screens support downloading and streaming of valuable rich media content. Hence, the level of security OMA DRM v.1.0 is no longer satisfying to content providers and mobile carriers who are eager to release high value rich media content such as exclusive music tracks and applications into the mobile marketplace but worry about a „napsterization“ of the mobile space. Nevertheless, in the lack of stronger protection, music labels today already use OMA DRM v.1.0 for full track music delivery.

The above factors contribute to the need for a continuously enhanced OMA DRM solution. OMA‚s Browser and Content (BAC) Download and DRM Sub-Working Group began working on its upgraded DRM v.2.0 enabler in early 2003 and announced it to the public in February 2004. The new specifications take advantage of expanded device capabilities and offer improved support for audio/video rendering, streaming content, and access to protected content using multiple devices, thus enabling new business models. They have added security and trust certificates that allow more complex and rich forms of media content, i.e. premium content, such as music tracks, video clips, animated colour screensavers and games, as well as improved support to preview and share content.

In the following we will go into more detail with respect to the business models enabled by OMA DRM v. 1.0 and 2.0.

OMA DRM v.1.0 – Basic content protection on three levels
Designed to protect light media content such as ring tones, wallpapers, java games, video and audio clips and screen savers, OMA‚s first DRM enabler provides an appropriate level of security for these content types. It includes three levels of protection and functionality: Forward Lock, Combined Delivery and Separate Delivery, each level adding a layer of protection on top of the previous level.

  • Forward Lock: The first level, Forward Lock, prevents the unauthorized transfer of content from one device to another. The intention is to prevent peer-to-peer distribution, or super-distribution, of lower value content. Often applied to subscription-based services, such as news or sports, the plaintext content is packaged inside a DRM message that is delivered to the terminal. The device can play, display or execute the content, but not forward the object.

  • Combined Delivery: Adding a rights definition to the first level, Combined Delivery equally prevents superdistribution (or forwarding), but also controls the content usage. The DRM message contains two objects, the content and a rights object. The rights object, written into the content using OMA Rights Expression Language (REL), a mobile profile of ODRL, defines usage rules that govern the content. The rules include and support all kinds of business models, including preview, time- and usage-based constraints. For example a complimentary preview, the permission to play a tune only once, using the content only for a specific number of days, or an annual subscription with non-interfering price models. When applying the Combined Delivery mechanism, neither content nor the rights object can be forwarded from the target device.

  • Separate Delivery: The third level, called Separate Delivery, is the most sophisticated mechanism because here, the content is encrypted, thereby providing better protection for higher value content. Encrypted into DRM Content Format (DCF) using symmetric encryption, the content is useless without a rights object and the symmetric Content Encryption Key (CEK), which is delivered separately from the content. OMA requires that the CEK is delivered securely via WAP push directly to the authorized mobile device, where the DRM User Agent uses it for content decryption. An OMA DRM compliant device such as the Nokia 3200 and 6230 or the Siemens SX1 and C62 securely stores the rights objects outside of the consumer‚s reach. Only the media player on that device has access to both encrypted content and the rights object including the CEK, in order to enable the consumption of the content by displaying or playing it.

People can download media and entertainment content and forward it to friends via MMS, but the recipient will not be able to use the content until they obtain their own CEK for content decryption. A "rights refresh" mechanism enables recipients of super-distributed content to contact the content provider to obtain rights to either preview or to purchase the content they have received. This so called superdistribution is the key benefit of Separate Delivery. OMA aims to promote superdistribution of content because it maximizes the number of potential customers through peer-to-peer recommendations while retaining control for the content provider through centralized rights acquisition.

Added protection and functionality by OMA DRM v.2.0
Version 2 of the OMA DRM standard, which CoreMedia has already integrated in its latest DRM solution, integrates additional security and trust elements. Security is enhanced by encrypting the rights object and the content encryption key, using the device‚s public key to bind them to the target device. Integrity protection for both content and the rights object reduces the risk of either being tampered with. In addition to these enhanced security features, the specifications include additional trust elements. Mutual authentication between the device and the rights issuer, i.e. the content provider, will add trust to the downloading or messaging scenario. The rights issuer can accurately identify the device in order to determine the revocation status of the transaction. The new enabler also supports a wide variety of distribution and payment use cases.

Since February, several draft specifications have been announced as part of the OMA DRM 2.0 enabler release, which hint to the new capabilities in terms of security, trust, and support for business models:
  • Enhanced security, enabled by the binding of rights objects to user identity: individually encrypted rights objects use a device's public key to provide cryptographic binding (to SIM/WIM); integrity protection for content and rights objects.
  • Explicit trust mechanisms, including mutual authentication between a device and the rights issuer as well as device revocation, i.e. the rights issuer can identify the device revocation status.
  • Support of secure multicast and unicast streaming: collaboration with 3GPP and 3GPP2 on a file format for protected streaming and progressive download
  • Export to other copy protection schemes, for example the transfer of music to the SD card for a mobile music player.
  • Support for a wide variety of business models, including metered time and usage constraints, subscription rights for content bundles and gifting.
  • Support for messaging and peer-to-peer (i.e. super-distribution): viral marketing and a reward mechanism.

What are the benefits for consumers?
In general terms enhanced security means that premium mobile content will be available to users. More specifically, the advanced content management allows for example to easily move content and rights between several devices owned by one user, or moved to remote or removable storage and later be restored to the device. OMA 2.0 also provides for sharing of content between multiple users within a domain (i.e. community or family). Furthermore, content can be copied to SD card for a mobile music player thus allowing content use at unconnected devices. OMA also supports the export of protected content to other copy protection schemes, e.g. transfer of music to a DRM-enabled set-top box or computing device. Last not least, OMA provides for complimentary previews, i.e. super-distributed content can be previewed before purchase.

Bottom line
All in all, the standardization effort of OMA strives for a balance between suitable business models for content owners and the demand of consumers. The incremental evolution of OMA has led from OMA v 1.0 to v. .2.0. Handsets and other mobile devices that support OMA-defined DRM technology are already on the market. Currently about 80 models are available in all categories – given that the specifications were released 14 months ago this can be considered a tremendous success. The evolution of OMA enables the step from appropriate protection of „light media content“ to the protection of premium content. The success of premium 3G applications and high value media and entertainment content delivery lies in security, ease of use, and in the market penetration of suitable handsets. Numerous content suppliers have announced support for OMA DRM v.2.0, among them Sony and Time Warner. Carriers and handset vendors, who see significant revenue enhancement opportunities by offering pervasive mobile access to premium rich content, are expected to release handsets that have implemented OMA DRM v.2.0 by 2005.


About the author:
Dr. Willms Buhse became Head of Products & Marketing of CoreMedia and member of the executive board in November 2003. Prior to that he was over five years at Bertelsmann AG in Gütersloh, Hamburg and New York where he co-founded Digital World Services. In various positions, including head of marketing, head of consulting and product management, he has worked with customers such as AOL, AT&T, BMG, HP, Lycos, Matsushita, Napster, Orange and Universal. Before, Mr. Buhse was a consultant in technology and strategy projects at the German top-management consultancy group, Roland Berger & Partner and advised companies like Volkswagen and Deutsche Bahn. Mr. Buhse is author and editor of two books and has been speaking at about 80 conferences on the subject digital distribution in the media industry. Mr. Buhse holds degrees in industrial engineering (Dipl.-Ing.) and in management sciences (Dipl.-Oec.) from the University of Hannover (Germany) and Madrid (Spain) and a Ph.D. in economics from the Technical University of Munich. His research thesis is titled: Digital Rights Management vs. the DarkNet – Competitive Strategies and Business Models for the Music Industry (ISBN 3-8244-8078-6). He is Vice Chair of the Open Mobile Alliance (OMA) und member of the Recording Academy (Grammy). Contact:

Status: first published in INDICARE Monitor Vol. 1, No 3, 27 August 2004; licensed under Creative Commons