Protecting Privacy with the MPEG-21 IPMP Framework

Abstract

A number of authors have observed a duality between privacy protection and copyright protection, and, in particular, observed how digital rights management technology may be used as the basis of a privacy protection system. In this paper, we describe our experiences in implementing a privacy protection system based on the Intellectual Property Management and Protection ("IPMP") components of the MPEG-21 Multimedia Framework. Our approach allows individuals to express their privacy preferences in a way enabling automatic enforcement by data users' computers. This required the design of an extension to the MPEG Rights Expression Language to cater for privacy applications, and the development of software that allowed individuals' information and privacy preferences to be securely collected, stored and interpreted. Nicholas Paul Sheppard Reihaneh Safavi-Naini Abstract A number of authors have observed a duality between privacy protection and copyright protection, and, in particular, observed how digital rights management technology may be used as the basis of a privacy protection system. In this paper, we describe our experiences in implementing a privacy protection system based on the Intellectual Property Management and Protection ("IPMP") components of the MPEG-21 Multimedia Framework. Our approach allows individuals to express their privacy preferences in a way enabling automatic enforcement by data users' computers. This required the design of an extension to the MPEG Rights Expression Language to cater for privacy applications, and the development of software that allowed individuals' information and privacy preferences to be securely collected, stored and interpreted.

Location constraints in digital rights management

“…The IPLocDRM prototype is based on the Smart Internet Technology Digital Rights Management system ("SITDRM") [42], a DRM framework based on the MPEG-21 Multimedia Framework [43] developed by the Co-operative Research Centre for Smart Internet Technology, Australia.…”

Enforcing P3P Policies Using a Digital Rights Management System

“…DRM technology is widely used in copyright protection applications, but can also be applied to privacy protection [11,15] by developing licenses that represent individual's preferences for use of their personal information.…”

“…In addition, the authors in [15] introduced a privacy extention schema with prefix px for use in the proposed privacy protection system (SITDRM). Figure 3 shows an example of an MPEG REL grant allowing a principal (r:keyHolder) identified by his/her public key to print a resource (mx:diReference) identified by a digital item identifier (smartinternet:doc1).…”

“…In other words, publishing a P3P policy does not provide any technical guarantee that enterprises act according to their policies once they have obtained user's personal data. To address this problem, privacy protection systems such as E-P3P [10], Tivoli [3] and SITDRM 3 [15] are emerging. Tivoli, being the commercial version of E-P3P, is a privacy protection framework that extends traditional access control systems by adapting a privacy oriented language known as EPAL [12].…”

“…It adopts the extended Digital Rights Management (DRM) model that was proposed by Korba et al [11] and implemented by Sheppard et al [15]. The core concept in SITDRM is the use of licenses that are formulated by consumers and enforced by a digital rights management system.…”