DRM and Download FAQ

1. GENERAL QUESTIONS
1.1 What is OMA DRM?
1.2 What is OMA Download?
1.3 What is the relationship between OMA DRM and OMA Download?
1.4 Why is the Nokia DRM implementation different in Series 40 and S60 devices and the Nokia 7710 multimedia smartphone?
1.5 What is the approach for MP3 files? Are they protected? If so, on which devices? When is that particular functionality implemented?

2. OMA DRM-RELATED QUESTIONS
2.1 For whom does DRM add value?
2.2 Why OMA DRM?
2.3 What are OMA forward-lock, combined delivery and separate delivery?
2.4 What are the file types in OMA DRM v1.0 and to which delivery methods do they correspond?
2.5 What are the mechanisms by which OMA DRM v1.0 files can be transferred to a Nokia device?
2.6 What is a DRM Agent?
2.7 What is OMA DRM v2.0?
2.7.1 What are the main differences between OMA DRM v1.0 and OMA DRM v2.0?
2.7.2 What is ROAP?
2.7.3 What are RI and Content Issuer?
2.7.4 What are DCF and PDCF?
2.7.5 What are URI, URL, and URN?
2.7.6 What is Content-ID?
2.7.7 How can OMA DRM packages be created using plain content files?
2.7.8 What is UDT?
2.7.9 How is the DRM Agent different in DRM 2.0?
2.7.10 What is PKI?
2.7.11 What are CEK and REK?
2.7.12 Can backups of rights be made to a PC? If yes, how?
2.5 Content owners
2.8.1 What does OMA DRM offer to content owners (rights owners)?
2.8.2 How can content owners take advantage of OMA DRM?
2.9 Developers, publishers and aggregators
2.9.1 What does OMA DRM offer to developers, publishers and aggregators?
2.9.2 How can developers, publishers, or aggregators take advantage of OMA DRM?
2.10 Operators and service providers
2.10.1 What does OMA DRM offer to operators and service providers?
2.10.2 How can operators or service providers take advantage of OMA DRM?
2.10.3 How does OMA DRM affect billing of content?
2.10.4 What content types and delivery mechanisms does OMA DRM support?
2.11 Technology vendors
2.11.1 What does OMA DRM offer to technology vendors?
2.11.2 How can technology vendors take advantage of OMA DRM?
2.12 Consumers
2.12.1 What does DRM offer to consumers?
2.13 Which Nokia products support OMA DRM?

3. OMA DOWNLOAD RELATED QUESTIONS
3.1 What are the benefits of OMA Download?
3.2 How can operators or service providers implement OMA Download?
3.3 How can OMA Download features be integrated with billing?
3.4 Which Nokia products support OMA Download?
3.5 What is the relationship between OMA Download and COD?

4. ADDITIONAL QUESTIONS ABOUT BOTH OMA DRM AND OMA DOWNLOAD
4.1 Where are the technical specifications of the standards located?
4.2 What is Nokia Delivery Server?

1. GENERAL QUESTIONS

1.1 What is OMA DRM?

DRM stands for Digital Rights Management. It governs how content is used and allows the development of new end-user features and new kinds of mobile content services for content providers, service developers, operators, and service providers. OMA DRM is a Digital Rights Management standard published by the Open Mobile Alliance (OMA).

1.2 What is OMA Download?

OMA Download, or OMA Download OTA, is an open standard and application-level protocol that enables reliable content downloads. It can be integrated with other services, such as billing, allowing premium-priced content to be made available to mobile users.

1.3 What is the relationship between OMA DRM and OMA Download?

OMA DRM and OMA Download are independent technologies for independent tasks. Both promote the mobile content downloading business as well as improve the consumer's experience of mobile content. Content protected by OMA DRM can be delivered using OMA Download as well as Multimedia Messaging Service (MMS), Mobile Information Device Profile (MIDP) OTA, etc. Both OMA DRM and OMA Download have been standardized in parallel within the OMA.

1.4 Why is the Nokia DRM implementation different in Series 40 and S60 devices and the Nokia 7710 multimedia smartphone?

Nokia has harmonized implementations in devices within each platform category, and plans to harmonize implementations between platform categories in future platform releases. In the case of DRM, there is clearly a different challenge between closed and open platforms. In Symbian-based open platforms, Nokia particularly wants to ensure that the implementation is as secure as possible. In DRM systems, security is based not only on high-quality specifications (such as OMA DRM) but also on secure implementations. The DRM features between platforms will be harmonized in future releases of platforms.

What is the approach for MP3 files? Are they protected? If so, on which devices?

Nokia is committed to creating the best possible consumer media experience by enabling services as well as consumer use of personal content. Nokia will not, for instance, prevent the use of consumer legacy MP3 files. If service providers wish to launch MP3-based services, Nokia can also provide protection for these services, but even so, sees no reason to prevent consumers from using their legacy MP3 files. Currently, Nokia does not see MP3-based mobile services emerging because it believes Advanced Audio Coding (AAC) is a much more attractive choice for music services.

2. OMA DRM-RELATED QUESTIONS

2.1 For whom does DRM add value?

DRM adds value for all parties who have an interest in content businesses. For content owners, it allows them to make efficient use of digital distribution channels. In agreement with their distributors, DRM also allows content owners to decide which rights to give to content users and which business models to adopt, including new models of renting and superdistribution. Additionally, DRM can significantly improve the mobile user's experience by providing new content and allowing free previews before buying.

2.2 Why OMA DRM?

Because OMA DRM is an industry-wide standard, no other DRM solution can provide access to so many mobile users. OMA DRM contains a client component, providing a mechanism to control not only piracy via the mobile network but also via local connections, such as BT, IR, and MultiMediaCard (MMC) memory cards. The OMA will continue to develop DRM standards as a joint effort among OMA members. The current standard is called OMA Digital Rights Management v1.0 or simply OMA DRM.

2.3 What are OMA forward-lock, combined delivery and separate delivery?

These are the mechanisms defined in OMA DRM v1.0.

OMA forward-lock is a simple mechanism that prevents content from leaving the mobile device. It provides basic copy protection that protects the rights of content owners.

Combined delivery is similar to OMA forward-lock, but additional usage rights can be added to the content, for example one-time use, or use for a week. This allows the previewing of content, or the adoption of various new business models by applying different usage rights.

Separate delivery is similar to combined delivery but with added security. Content is delivered as encrypted files separately from usage rights, which are delivered via a different channel. Separate delivery also enables the superdistribution business model, in which DRM-protected content can be sent from mobile device to mobile device, for example sending the content as part of an MMS to a friend; the content receiver can then "acquire a license" to get a preview or buy the content. This makes viral marketing a potentially powerful concept.

2.4 What are the file types defined in OMA DRM v1.0 and to which delivery methods do they correspond?

1. Delivery Message (file extension *.dm) is the file containing the content, and it is used in both OMA forward-lock and combined delivery. In the case of an OMA forward-lock delivery message, the file contains only the protected content, whereas in the case of a combined delivery message, the file contains both the rights (defined in ODRL) as well as the content. The MIME type for this is "application/vnd.oma.drm.message".
2. DRM Content Format (file extension *.dcf) contains the encrypted content. This file type is used in separate delivery where the content is encrypted into this message without the rights. The key used to encrypt the content is sent separately with the rights to the device. The MIME type for this is "application/vnd.oma.drm.content".
3. DRM Rights Object (file extension *.drc) is the file containing the rights object, specified in binary, as well as the key used to encrypt the content in the DCF file. The MIME type for this file type is "application/vnd.oma.drm.rights+wbxml".
4. DRM Rights Object (file extension *.dr) contains the rights object, specified in clear text, as well as the key used to encrypt the content in the DCF file. The MIME type for this file type is "application/vnd.oma.drm.rights+xml".

2.5 What are the mechanisms by which OMA DRM v1.0 files can be transferred to a Nokia device?

The supported delivery methods/mechanisms are:

HTTP download
MMS

DCF-files:
-MMS
-HTTP
-Bluetooth
-IrDa
-MMC
-E-mail
or any other connectivity method that supports file transfer.

2.6 What is a DRM Agent?

A DRM Agent embodies a trusted entity in a device. This trusted entity is responsible for enforcing permissions and constraints associated with DRM Content, controlling access to DRM Content.

The DRM Agent is launched when DRM Content is received on the device, at which point it will unpackage the DRM Content and encrypt the content to the device. After the DRM Content is encrypted by the DRM Agent, whenever the DRM Content is being accessed, the DRM Agent will be consulted for permissions and constraints before the content is passed to the media player (for example, Image Viewer or Video Player). If the rights have expired, the media player will be informed and the content will be unusable.

2.7 What is OMA DRM v2.0?

The Open Mobile Alliance (OMA) launched v2.0 of its Digital Rights Management (DRM) specification to provide stronger access and copying protection for digital media content on mobile devices.

The new OMA DRM v2.0 adds protection features as well as improved support for device capabilities, audio and video rendering, streaming content, and access to protected content using multiple devices, according to a statement issued at the OMA Secure Content Delivery for the Mobile World event in Beverly Hills, California.

The DRM system will be built into mobile handsets to allow compliant devices to receive and play encrypted files, and should also work with devices using Wi-Fi networks, based on IEEE 802.13 wireless networking standards. By comparison, OMA DRM v1.0 provided only basic protection for limited value content, while OMA DRM v2.0 is designed to protect high-value content and enable new business models through a broader feature set.

Figure from OMA-DRM-ARH-V2_020040715-C

2.7.1 What are the main differences between OMA DRM v1.0 and OMA DRM v2.0?

	OMA DRM v1.0 in S60 2nd Edition	OMA DRM v2.0 in S60 3rd Edition*
Security level in DRM Content transportation	Content is delivered in unprotected format and is encrypted in the device.	Content is delivered in protected (encrypted) format.
Receiving Rights Objects	Via unconfirmed WAP push.	Via ROAP (see Section 2.7.2).
Constraints	- Count - DateTime - Interval	OMA DRM v1.0 constraints + new ones: - Timed-Count - Accumulated - Individual

* S60 3rd Edition supports OMA DRM v.1.0, and as optional feature (i.e. not be available in every device) OMA DRM v2.0 for music/audio content only.

2.7.2 What is ROAP?

The Rights Object Acquisition Protocol (ROAP) defined in OMA DRM v2.0 is the common name for a suite of DRM security protocols between a Rights Issuer (RI) and a DRM Agent in a device.

The protocol suite contains:

• A 4-pass protocol for registration of a device with an RI and two protocols by which the device requests and acquires Rights Objects (RO).
• A 2-pass RO acquisition protocol that encompasses request and delivery of an RO.
• A 1-pass RO acquisition protocol that is only a delivery of an RO from an RI to a device (for example, messaging/push).

2.7.3 What are RI and Content Issuer?

The Rights Issuer (RI) is an entity of a Content Provider that assigns permissions and constraints to DRM Content and generates Rights Objects.

The Content Issuer is an entity that delivers DRM Content. OMA DRM defines the format of DRM Content delivered to DRM Agents and the way DRM Content can be transported from a content issuer to a DRM Agent using different transport mechanisms (that is, via Multimedia Message Service [MMS], Bluetooth, etc.). The Content Issuer may do the actual packaging of DRM Content itself, or it may receive prepackaged content from some other source, another Content Provider.

A Content Issuer delivers DRM Content, and a Rights Issuer generates a Rights Object. The Content Issuer and Rights Issuer embody roles in the system. Depending on deployment they may be provided by the same or different actors, and implemented by the same or different network nodes. For example, in one deployment, content owners may prepackage DRM Content, which is then distributed by a content distributor acting as both content issuer and rights issuer.

2.7.4 What are DCF and PDCF?

DRM Content Format (DCF) is used to package and protect Discrete Media (that is, ring tones, applications, images, etc.). This Discrete Media profile allows wrapping of any content in an envelope (DCF). That content may or may not be encrypted and then placed as a single content object in the DCF's internal structure and layout.

Packetized DRM Content Format (PDCF) is used to protect Continuous Media (for example, audio and video). Continuous Media is protected in a separate profile because it is packetized and thus the profile is called the Packetized DCF (PDCF). Applications that read and parse Continuous Media are meant to work on the file on a packet-by-packet basis. To facilitate the playback of protected Continuous Media, the storage format needs to be structured in such a way that the packets are individually protected.

This structurally aware packetization is also required in order to stream Continuous Media. An OMA DRM-compliant streaming server must be able to understand the Content Format's structure in order to break the content into headers and packets that can be delivered to a client that understands the Content Format.

2.7.5 What are URI, URL, and URN?

A Universal Resource Identifier (URI) is a member of this universal set of names in registered name spaces and addresses referring to registered protocols or name spaces. A Uniform Resource Locator (URL) is a form of URI that expresses an address that maps onto an access algorithm using network protocols. The Uniform Resource Name (URN) debate attempts to define a name space (and presumably resolution protocols) for persistent object names.

2.7.6 What is Content-ID?

A downloadable media object is located on the Web using a URL and is identified using a URI. The rights object contains exactly one reference, the Content-ID to the media object for which the rights apply. In OMA DRM v1.0 the term Content-ID was used in same context as URI in OMA DRM v2.0.

2.7.7 How can OMA DRM packages be created using plain content files?

Nokia Mobile Internet Toolkit 4.1 (which can be downloaded from Forum Nokia's Tools section) can be used for creating and publishing OMA DRM packages. This toolkit facilitates the creation of different mobile media content via a comprehensive set of editors and wizards. This tool contains fully integrated DRM and DD editors.

2.7.8 What is UDT?

User Data Transfer (UDT) refers to the transfer of user settings and user data from one device to another in case the original device is exchanged for a new terminal. UDT covers transfer of rights in case of warranty replacement or upgrades.

The UDT mechanism consists of three steps:
1. Transferring DRM-protected files from the original device;
2. Transferring the protected files to the target device;
3. Processing DRM-protected files on the target device.

2.7.9 How is the DRM Agent different in DRM v2.0?

The DRM Agent in DRM v2.0 has a unique private/public key pair and a certificate. The certificate includes additional information, such as:

- Maker
- Device
- Type
- Software version
- Serial numbers

This allows the Content and Rights Issuers to securely authenticate a DRM Agent.
Each DRM Agent is provisioned with a unique key pair and an associated certificate identifying the DRM Agent and certifying the binding between the agent and this key pair; this arrangement allows rights issuers to securely authenticate the DRM Agent using the standard Public Key Infrastructure (PKI) procedure (see Section 2.7.10).

2.7.10 What is PKI?

In the Public Key Infrastructure (PKI), secret data is encrypted with the recipient's public key. Only the recipient can open the content with the private key. This private key system is sometimes known as symmetric cryptography and the public key system as asymmetric cryptography. PKI makes sure that both the mobile device and server are authenticated.

PKI is based on two key pairs:
- The key in the phone identifies the mobile device
- The key in the server identifies the server
- The device key is stored by using data caging

When the key is lost, the downloading rights are disabled, but using rights still works.

2.7.11 What are CEK and REK?

DRM Content is packed in a secure content container, DRM Content Format (DCF). (DRM Content Format is a secure content package for encrypted content, with its own MIME content type.) DRM Content is encrypted with a symmetric Content Encryption Key (CEK). Content encryption keys are used to protect content files. They are delivered to the device as part of a Rights Object.

A Rights Object is protected using a Rights Encryption Key (REK). The REK is used to encrypt sensitive parts of the Rights Object such as the CEK. DRM Content cannot be used without an associated Rights Object.

2.7.12 Can backups of rights be made to a PC? If yes, how?

Yes, you can make a backup of the rights by using the version of Nokia PC Suite intended for use with your device. Note that the backup information can be restored only to the same device from which it has been originally copied.
Note: Rights objects with counters or any nonactivated intervals are not restored.

2.8 Content owners

2.8.1 What does OMA DRM offer to content owners (rights owners)?

OMA DRM turns a mobile device into a new controlled distribution channel for branded content, bringing maximum revenue for every item of content. OMA DRM also opens new business models via superdistribution (see Section 2.3), allowing content owners to increase the number of content customers through fan clubs.

2.8.2 How can content owners take advantage of OMA DRM?

Content owners can simply agree with their business partners — that is, developers, publishers, aggregators, operators, or service providers — which content to use OMA DRM for, and define the usage rights. They can start with simple trials to see how it works and gather experience without taking any significant business risks. Nokia provides a free packaging tool that can be used to create the right file types for mobile delivery. Packaging can be performed either by the content owner or a business partner. The owner's role would then simply be to define which content is released for delivery and which usage constraints to apply.

2.9 Developers, publishers and aggregators

2.9.1 What does OMA DRM offer to developers, publishers and aggregators?

Developers, publishers, and aggregators are directly affected by the manner in which content is distributed, such as whether content can be freely copied between devices or not. The introduction of OMA DRM technology changes the way content is distributed and consumed. Understanding and using the OMA DRM standard enables developers, publishers, and aggregators to gain access to high-quality branded content

2.9.2 How can developers, publishers, or aggregators take advantage of OMA DRM?

They can agree with business partners, such as content owners and service providers who provide the content management and delivery platform, which of their content services to apply OMA DRM to, and what kind of usage rights to assign to them. In the simplest case, they can have all of their content files packaged in OMA forward-lock format. Alternatively, they can also apply user rights to promote various business models as part of their content services.

2.10 Operators and service providers

2.10.1 What does OMA DRM offer to operators and service providers?

OMA DRM provides better access to branded content, since use of the content can be controlled, and the industry-wide standard allows operators and service providers to gain a critical mass of users. Hence they can significantly expand their mobile content business as well as increase customer loyalty, and DRM can improve customer experience through free content previews. The concept of superdistribution (see Section 2.3) is also a very powerful way to promote content.

2.10.2 How can operators or service providers take advantage of OMA DRM?

In the case of forward-lock and combined delivery, there is no need to change existing roles—they must simply agree who will package the content. It is therefore very easy and fast to deploy, as operators and service providers simply need to ensure that all the content they deliver is packaged according to the OMA DRM standard.

For separate delivery and superdistribution, they must come to an agreement with their direct business partners about who will be responsible for content and rights management, packaging, content and rights delivery, and billing. In addition to content packaging, they also need a license server to take care of rights delivery and its integration to billing.

2.10.3 How does OMA DRM affect billing of content?

For forward-lock and combined delivery, no changes to billing integration are required. For separate delivery, a license server must be integrated to the billing system, as billing is supposed to occur on the delivery of rights rather than on delivery of content.

2.10.4 What content types and delivery mechanisms does OMA DRM support?

The OMA DRM standard itself defines the mechanisms for any content type or delivery mechanism, keeping in mind the current popular types and mechanisms. New Nokia devices will implement support for content types and delivery mechanisms progressively so that building of first services supporting them can begin immediately. For example, the Nokia 3650 mobile device, a S60 device, supports OMA forward-lock for ringing tones, MIDI, JPEG, GIF, and Java™ technology acquired via WAP download. Newer devices will have better OMA DRM 1.0 support with more complete coverage of content types and delivery mechanisms. OMA DRM v2.0 will provide improved security and mechanisms that are better suited for high value content.

2.11 Technology vendors

2.11.1 What does OMA DRM offer to technology vendors?

For the first companies implementing it, OMA DRM will offer a competitive edge; later, it will become a basic requirement. For device vendors, their products need to have a DRM solution supported over the whole value chain and interoperability with other device vendors. For those with server products, this is an excellent opportunity to improve value to their customers.

2.11.2 How can technology vendors take advantage of OMA DRM?

OMA DRM v1.0 specifications are available at http://www.openmobilealliance.org/tech/publicmaterial.html, and are ready for implementation. Device vendors are advised to test the implementation with existing packaging tools.

Server vendors can also implement the required functions according to OMA DRM v1.0 specifications. For interoperability, they should test their server solution with devices (see Section 2.13 for a listing of Nokia devices that have OMA DRM). They can also test their solution against the packaging tools available on the market.

2.12 Consumers

2.12.1 What does DRM offer to consumers?

By adopting DRM, service providers can offer better services and high-value content to mobile device users. This opens up a world of new content services that were previously unavailable due to a lack of copy protection. OMA DRM can also be used to provide free previews of content prior to actual purchase.

2.13 Which Nokia products support OMA DRM?

Nokia will support OMA DRM in all relevant product lines with an end-to-end offering. OMA DRM will become a standard feature in Nokia devices. The first products to include forward-lock are the Nokia 3650, Nokia 5100, Nokia 6200, and Nokia 6650 mobile devices. The Nokia 6220 mobile device will also include combined and separate delivery. Additionally, Nokia has a server product called Nokia Delivery Server 2.0, which provides the server functionality to fully support OMA DRM.

3. OMA DOWNLOAD RELATED QUESTIONS

3.1 What are the benefits of OMA Download?

OMA Download improves a consumer's experience by informing him or her of the success of the content download. This helps ensure that the content can be used in the mobile device and that the consumer will not be charged for failed downloads. OMA Download is used on top of HTTP or Wireless Session Protocol (WSP).

3.2 How can operators or service providers implement OMA Download?

The effort needed to implement OMA Download is minimal. An operator only needs to create a so-called download descriptor file for each piece of content and make simple changes in the HTTP server to enable the OMA Download protocol. The required server functions are also part of Nokia Delivery Server 2.0, which supports several other features in the content downloading process (OMA DRM).

3.3 How can OMA Download features be integrated with billing?

OMA Download can be adopted without any changes in the billing mechanisms. However, to fully benefit from it, some changes are required in order to recognize if the customer received the ordered content and hence ensure that s/he will not be charged for failed downloads. The "install notification" feature of OMA Download can, for example, be used as an event that triggers billing. Nokia Delivery Server 2.0 supports integration of OMA Download events to billing.

3.4 Which Nokia products support OMA Download?

Nokia will support OMA Download in all relevant product lines with an end-to-end offering. There are already several products on the market that support OMA Download, for example, Nokia 3650, Nokia 6600, Nokia 6630, and the Nokia N90. Nokia Delivery Server 2.0 also provides delivery of content via the OMA Download protocol.

3.5 What is the relationship between OMA Download and COD?

COD predates the OMA Download standard and has been used in Nokia mobile devices to provide the same download features. Nokia recommends the use of OMA Download.

4. ADDITIONAL QUESTIONS ON BOTH OMA DRM AND OMA DOWNLOAD

4.1 Where are the technical specifications of the standards located?

The technical specifications for OMA DRM and OMA Download can be found at http://www.openmobilealliance.org/tech/publicmaterial.html.

4.2 What is Nokia Delivery Server?

Nokia Delivery Server manages business rules for content download, fetches content from a storage server, and delivers it reliably to a device. It allows operators to earn revenue from content download services, such as delivering Java and Symbian applications to mobile devices. Content providers can submit and store content, which is managed in the Delivery Server. Users can choose the applications they want and download them to their mobile devices.

Rate This