Security and Business Models for Virtual Goods

1. DigSig Uwe Muster Hamburg Security and Business Models for Virtual Goods ACM Multimedia Security Workshop 6 December 2002 Juan le Pin, France Prof. Dr. Rüdiger Grimm TU Ilmenau Virtual Goods

2. Content Virtual goods Cost of digital goods Busines models for virtual goods IPMP / Lightweight model Alternative „Potato“ model Applications, challenges References Virtual Goods

3. Product value Usage value Cheaper for digital goods Life cycle of goods Creation – Production – Reproduction – Distribution – Consumption – Satisfaction Virtual Goods

4. e.g., Music in the Internet: digital good • Digital: one form of virtuality • Special properties: • Lossless separation from medium • Re-binding to other media • Repeatable by free choice of user Virtual Goods

5. interpretation (enrichment code (reduction) 011101000100101001 111010010000100110 011101000100101001 111010010000100110 transfer/storage (lossless) Production / Communication / Consumption of digital goods Virtual Goods

6. Cost • Production of media is expensive • Sales of products is expensive • Investing into end-user devices is expensive • Infrastructure of end-user devices is available • Infrastructure of communication is available • Consumption of products is cheap • Communication of products is cheap • Reproduction of products is cheap Virtual Goods

7. Degression of cost per-piece for virtual goods Cost per-piece= Product value/Euro Cost for total production 10.000 1000 100 10 1 Final cost of additional piece almost zero 0,1 0,01 Number of pieces sold 1 10 100 1.000 10.000 100.000 1 Mio. 10 Mio. Virtual Goods

8. Busines models for virtual goods • Intellectual Property Management & Protection (IPMP) • Central control of usage by provider • Policy of rights • Restriction of users through policies • Technical basis (full IPMP): IPMP-Tools (control of users) • Technical basis (light-weight): signatures (traces) • Friendly File-Sharing („Potato“) • Decentralizes sales model • Policy of provisions • Users are free to use, but they earn provision only if they pay • Technical basis: sales receipt (TAN in file name) Virtual Goods

9. IPMP: CP-centric model Content Provider Specifies rights Sells content Controls usage User executes rights of usage User executes rights of usage User executes rights of usage User executes rights of usage Virtual Goods

10. Critical comments on IPMP/DRM • Conflict between interest and enforcement • CP-centric view of policies • Burden of enforcement on the user equipment • Enforcement vs. identification of rights • Interoperability • Scalability • Privacy • Negotiation of policies Virtual Goods

11. „LWDRM – light-weight model • Re 4: enforcement vs. identification : • There is no unsigned content in clear in the network • By consuming a file, its origin is verified • By distributing a file, it is signed • Method: signcryption (recoverable signature) Virtual Goods

12. Trans- fer Provider Authors / Creators Authors / Creators Files CDs Authors / Creators Authors / Creators specify / sell / control User / Consumer rights User / Consumer rights User / Consumer rights User / Consumer rights Role of content provider (BMG, Sony, ...) Virtual Goods

13. Authors / Creators Authors / Creators Authors / Creators Authors / Creators Files User / Consumer rights User / Consumer rights User / Consumer rights User / Consumer rights Role of content provider (II) Provider Napster Virtual Goods

14. Authors / Creators Authors / Creators Authors / Creators controls Authors / Creators Gnutella Files User / Consumer rights User / Consumer rights User / Consumer rights User / Consumer rights Role of content provider (III) Provider Napster Virtual Goods

15. Conflict of interests • Users are interested in re-distribution • Users have power to re-distribute • Providers are interested in re-distribution • Providers want money • Solution ???: • Providers prevent users from re-distribution • Pursue of users • Criminalization of users Virtual Goods

16. Cooperation of interests • Users are interested in re-distribution • Users have power to re-distribute • Providers are interested in re-distribution • Providers want money • Solution: • Providers support users to re-distribute • Users earn share of income (provision) Virtual Goods

17. Fred Music Provider Accounting Server Fred offers his music to many users Ginny presents TAN=21 and pays for the music Fred registers MySong TAN=21 TAN=53 Fred receives share as author Fred creates content andGinnie buys content  Ginny likes to listen to Fred‘s music MySong4fo21.mp3 MySong.mp3 MySong4fo53.mp3 MySong4fo21.mp3  Ginny adds TAN=53 to file name Fred adds TAN=21 to file name    Virtual Goods

18. Content files are registered in (distributed) accounting centers • Fred (composer, author) creates content file • Fred registers content file at Accounting Service of Bill und recieves TAN (add to file name) • Fred distributes his file in the Internet • Ginnie receives file from anywhere (e.g., from Fred) Virtual Goods

19. Payment = right to receive a provision • Ginnie receives file from anywhere (e.g., from Fred) • Ginnie pays for the file at Bill‘s and recieves a receipt (her own TAN to be added to file name) • Bill pays Fred • Ginnie distributes the file in the Internet Virtual Goods

20. Ginny loves Fred‘s music Ginny copies Fred‘s music to Harry and to other friends Harry presents TAN=53 and pays for the file Ginny receives provision TAN=71 Accounting Server Ginnie copies content to Harry Harry shares Ginnies enthusiam for Fred‘s music  MySong4fo53.mp3 MySong4fo53.mp3 MySong4fo71.mp3 Harry adds TAN=71 To file name   Fred Music Provider Fred receives share as author  Virtual Goods

21. Payment = right to receive a provision • Ginnie copies file to Harry (Harry is free to pay or not) • In case Harry pays,then he receives his own TAN (to be added to file name, • then Fred receives his share as an author • and then Ginny receives her share as provision • Harry re-distributes his file ... Virtual Goods

22. „Pretty Good Distribution“ • Users can earn more money than they pay • Users who do not pay, are free to consume and re-distribute • Re-distribution without payment supports former payer • Re-distribution supports marketing • Alternative structure of distribution „bottom-up“ • „For friends only“ (name of an Ilmenau spin-off) • Open source in www.4fo.de Virtual Goods

23. Applications • Music marketing • Music of young groups / composers • Radio / TV broadcast • Conference papers (authors want to keep right of distribution) • Levels in games of different authors • Community and re-distribution services (Ginnie has the best pieces, so we look for products at Ginnie‘s server) Virtual Goods

24. Challenges • Accounting protocol • Central names and file register vs. de-central receipts • Electronic payment (e.g., Paybest) • Integrity of origin (Audio-Id, water marks?) • Models of provision • Models of receipts • Roll of a PKI (needed anyway?) • Establishment of accounting services Virtual Goods

25. References [1] Angelo Sotira: Step 1 – What is Gnutella? In: http://www.gnutella.com , 3 Dec 2001.Adam T. Lindsay, Jürgen Herre: MPEG-7 and MPEG-7 Audio – An Overview. Journal of the AES, June/July 2001. [2] Allamanche, E.; Herre, J.; Hellmuth, O.; Fröba, B.; Cremer, M.: AudioID: Towards Content-Based Identification of Audio Material. In 110th AES-Convention, Amsterdam, 2001. Convention Paper 5380 [3] IPMP Ad-hoc Group, ISO/IEC JTC 1/SC 29/WG11: Coding of Moving Pictures and Audio. Study of Text of PDAM ISO/IEC 14496-1:2001, Dec 2001. [4] G. Spenger, C.C. Bürgel: MPEG-21: Der Schlüssel zu Multimedia. DuD 5/2002. [5] Grimm, R.; Nützel, J.: Geschäftsmodelle für virtuelle Waren. DuD 5/2002. [6] 3GPP TS 22.242 V6.0.0 (2002-06). Digital Rights Management (DRM) Stage 1, Release 6, June 2002. [7] Neubauer, Ch.; Pickel, J.; Brandenburg, K.; Siebenhaar, F.: Aspekte des Rechtemanagements für digitale Güter, 22. Tonmeistertagung, Hannover, November 2002, VDT. [8] Nützel J.; Grimm R.; Puchta S.: Musik im Internet – Wie kann man eine Ware verkaufen, die alle schon haben?22. Tonmeistertagung, Hannover, November 2002, VDT. http://www.4fo.de http://www.4friendsonly.com Virtual Goods