Managing access to on-line information is a broad problem, which occurs in a wide range of different applications. Managers of on-line information wish to implement policies about who can access the information, under what terms and conditions. This paper describes a general approach to this problem and experience in applying it in digital libraries.

Examples of areas where access management is needed include the following:

Digital libraries

Libraries often need to restrict access to parts of their collections for various reasons, including restrictions imposed by donors, concerns about privacy or obscenity, licensing arrangements, and other agreements with copyright owners.

Electronic publications

The most common reason that publishers and other copyright owners wish to manage access is because they require payment for use of materials, but there are other reasons, such as preventing the spread of unapproved derivatives.

Security, classification, and trade secrets

Governments sometimes classify information in order to control access for security reasons. Commercial organizations use similar methods to protect confidential information and trade secrets.

Medical records

Medical information is usually kept confidential, except to people who can demonstrate that they have a need to know.

The approach that is described in this paper is equally relevant to these and other applications areas, though implementation details differ. The various application areas use different terminology to describe the questions of controlling access to on-line information. In publishing, the term "rights management" is often used, but this term is very narrow in scope. The phrase "terms and conditions" is also widely used. The term "access management", which this paper uses, is a broad term that applies in all areas.

Independent of terminology, it is important to view access management from the perspective of the manager of the information. In a digital library, information is obtained from a variety of sources, for example by license from a publisher, or by a donation with restrictions on use. In drawing up its access management policies, the library will reflect agreements with publishers and other third parties. There may also be relevant laws that must be embodied in the policies. However, with digital materials as with physical items, the library is responsible for managing access to its collections.

An illustration

To illustrate the model, here is a simple example. A university library has the following loan policies:

• The collections are divided into three categories: the general collection, a reserve collection, and reference materials.
• Reference materials are for use in the library only.
• The faculty loan periods are: general collection - 12 weeks, reserve - 2 weeks.
• Student loan periods are: general collection - 2 weeks, reserve - use in library only.

These policies can be formalized as follows. A user can have one of two roles:

The material in the library is divided into the following categories, which are marked with the corresponding attributes:

The operations that are allowed on the collections are:

The library's policies can now be expressed as a policy table:

Suppose, now, that the library decides to be egalitarian, by treating faculty and students equally. The loan period for the general collection becomes 12 weeks for everybody. Materials in the reserve and reference collections can be used only in the library.

A prototype example

The access model is currently being evaluated with a collection of historical materials from the Library of Congress. The collection, Prosperity and Thrift: The Coolidge Era and the Consumer Economy, 1920-1929, known as the Coolidge-Consumerism Collection, includes materials digitized from the library's general and special collections: digitized books and magazines, folders of documents from various manuscript collections, still photographs, motion pictures, and sound recordings. Some, but not all, are no longer protected by copyright. Some are published, some unpublished. The Library of Congress wishes to make its collections available as widely as possible, but only when this does not violate the wishes of copyright holders or donors, and the privacy of people mentioned in the materials.

An important attribute of this kind of library material is that the library may be unable to identify all the rights and restrictions that might apply to some items. Carrying out a full search for access restrictions that might possibly apply to every item is expensive and time consuming. Even after a thorough search, vital information may still be missing or undiscoverable. For example, there was no copyright time limit for unpublished items, like manuscripts or archival photographs, created during the period covered by the Coolidge-Consumerism Collection. Difficulties arise even for older published materials: Was the work registered for copyright? Who is the owner? Were rights transferred? Additionally, there may be other considerations that might lead to a need to restrict access: privacy rights, publicity rights, and restrictions placed on material at the time of gift or sale to the library.

To deal with this uncertainty, the Library of Congress has applied the concept of risk assessment. A set of materials is reviewed for general characteristics, such as date, content, and terms under which the material was acquired by the library. After this broad review some materials can be assigned to a "low risk" category, material that can be made openly available with little risk of copyright infringement or other legal concerns. Other materials are placed in more restrictive categories with procedures for appropriate use of each category.

In the access management system, the category is encoded as an attribute of the material, and the procedures for access to that category as entries in the policy table. The access management system has to provide for flexibility. From time to time, materials will be moved from one category to another, such as when copyrighted works enter the public domain; this is achieved by changing the attribute. On occasion the library may change its policies for access to a specific category of material; this requires changes to the policy table.

The next four sections expand the general access model introduced in Figure 1 and describe how the access management model has been used for the Coolidge-Consumerism Collection. First, however, here are a few comments about user interfaces for access management.

All methods of access management tend to be intrusive and interfere with the user's interaction with the library collections. The worst situation occurs when every interaction requires some sort of authentication or authorization for payment. Almost as bad are those situations where the user has different passwords and procedures for many services. User interface design is particularly tricky if payment is involved. There are two extremes, both undesirable: providing the user with no feedback about the rate of expenditure, or continually prompting for the expenditure of tiny sums of money. The least intrusive situation is when authentication is keyed to some hidden information, such as the IP address of the user's computer, or where the user logs in once and an authentication token is passed on to other computers, as in the campus-wide Kerberos systems that some universities have implemented.

These user interface problems are critical, although there is no single solution. Awkward user interfaces have been a significant reason why the field of access management has moved more slowly than might be hoped.

A user is a person using a computer system who wishes to access the digital material, or the computer system itself. Characteristics of users are encoded as roles, for example:

• The user is a subscriber to all ACM publications.
• The user is a high school student.
• The user is physically located within the Library of Congress.

Authentication and payment are methods by which a user's role can be established. A user who has been formally authenticated has a different role from a user who has not been authenticated. In a similar way, if a user makes a payment, it establishes a role. This is shown in Figure 2.

Figure 2. Authentication and payment

One of the annoying problems in access management is the paucity of effective technology to authenticate users. An ideal system of authentication would be easy to administer, unobtrusive to the user, and robust against tampering. Most commonly used methods fail on several of these criteria. Two widely used methods are: (a) to authenticate using an ID and password, and (b) to use the IP address of the user's computer for identification. Beyond these two simple methods of authentication there are few generally available methods of authentication that are easy to administer and convenient for the user. This is a major gap that inhibits the development of good access management systems.

Roles for the Coolidge-Consumerism Collection

Policies that apply to the Coolidge-Consumerism Collection use the following roles, with the corresponding methods of authentication.

This table contains one entry which is still tentative. For some materials, donors or other rights-holders are unwilling to grant universal access, but happy to allow use for educational purposes. The Library of Congress is considering the use of an educational site-license. There would be no cost associated with the license, but the licensee would agree that certain materials would be used for educational purposes only.

Digital material is information that users may wish to access subject to policies. Properties of the digital material that are important for access are called attributes, e.g.:

• Unpublished work.
• Published work, registered for copyright on 1/1/1996.
• French government publication.
• Letter from donor, dated 1/1/1893, states "I give my papers to the Library of Congress and hereby dedicate to the public all rights in my writings."

In general, roles and attributes can be provided in a variety of ways. Many attributes are encoded as metadata, but others can be computed when required. For example, a policy might apply only to digital objects that occupy less than 10 megabytes. The size could be stored as metadata or measured when required. Some attributes depend upon a date or range of dates. For example, in the United States, the copyright status of unpublished materials that existed in 1978 will change in 2003.

Attributes can be associated with individual digital objects or with sets of objects. Sometimes, within a digital object, different attributes may be associated with different elements of the object. A common example is that text and pictures may have different attributes, as shown in Figure 3.

Figure 3. Granularity

Attributes for the Coolidge-Consumerism Collection

For the Coolidge-Consumerism Collection, attribute metadata is being encoded for all digital objects, based on the following list of attributes:

One question that frequently arises in access management is whether it is possible to agree on a standard set of attributes that will serve many different applications. This is a highly desirable objective for interoperability among different digital libraries, but this example shows that it is a difficult challenge. The choice of attributes works well for the Library of Congress's special collections, but it is not certain whether other libraries will manage their collections in the same manner. The general problem of encoding and parsing sets of attributes is complex and beyond the scope of this paper.

Operations are actions that a user may take to access digital material, e.g.:

• Replicate from one computer to another.
• Render an image on a screen.
• Extract 2 minutes from a video program.
• Create a derivative work.
• Perform in public for profit.

Some operations can be precisely described technically, such as the operation of executing a specific computer program with the digital material as input. However, it is a characteristic of access management that many operations are difficult to define precisely, particularly those that specify the purpose for which an operation is carried out, such as "for profit".

Technical methods of enforcement

The term "enforcement" describes methods to ensure that the specified operations are the only actions carried out on digital material. As shown in Figure 4, some methods of enforcement are based on technical methods, such as encryption.

Figure 4. Enforcement by encryption

It is important to recognize that policies need not be enforced by technical means. Enforcement may be:

• technical (e.g., encryption)
• legal (e.g., damages for violation)
• contractual (e.g., revocation of license)
• institutional (e.g., loss of library privileges)

In the long term, perhaps the most effective form of enforcement is wide-spread user education, supported by institutional policies and the development of a set of well understood norms for reasonable behavior. For this reason, one useful operation is to display an access statement. As shown in Figure 5, an access statement is a statement of policies associated with specific digital material which is displayed prominently when the material is presented to a user. By itself an access statement does nothing to enforce any policies, but it educates users so that they know what is expected of them. It may also have some legal significance.

Figure 5. An access statement

Subsequent use

Access management policies frequently restrict the subsequent use that a user may make of digital material, e.g.:

• No redistribution without attribution.
• Display on screen, but do not print.
• Use on a specified computer only.

Strict control of subsequent use by technical methods is rarely possible without great inconvenience. It is necessary to rely on education of users, which may be backed by threats of sanctions.

Operations for the Coolidge-Consumerism Collection

The prototype Coolidge-Consumerism Collection has a very simple set of operations. Several access statements have been specified, for example, "Warning. For copyright reasons, this material is available only for access by Library of Congress staff." The following table lists all the operations.

Policies are at the heart of this architecture for access management. A policy permits users, with certain roles, to carry out operations on digital material. The verbal statement of a policy may be quite informal, e.g.:

• Access to subscribers only.
• May be used for any non-commercial purposes.
• Prints may be made at $1 per print.
• For use only within the Library of Congress.

To formalize policies, they can be represented as logical expressions of the form:

If (role) and (attribute) then (operation)

This simple expression hides a great deal of complexity. In general, the role and attribute can be the result of executing a computer program. They can both be arbitrarily complex Boolean expressions, including the special cases "all" or "none". The operation can be a set of operations, which may form logical expressions.

In general, a single item of digital material may be subject to several policies. These policies may intersect in complex ways. For example, a user might have the choice of a restricted set of operations with no payment or a broader set with payment. Care must be taken to ensure that policies do not contradict each other. Reconciling such complexities creates a need for negotiation among policies. This leads to interesting questions of user interface design, since the user should be kept informed of decisions but should not be subject to a continuous barrage of messages and questions when the responses are trivial.

In simple cases, policies can be described as rows in a policy table. This is reasonably simple to implement and yet provides sufficient flexibility for many situations.

Policy table for the Coolidge-Consumerism Collection

The policy table for the Coolidge-Consumerism Collection is:

This is a comparatively straightforward table, but has been simplified in one aspect. The attribute DR, for material with donor restrictions, actually has variants depending on the specific restrictions. The table above shows how a restriction to holders of educational licenses might be coded.

Many of the ideas in this paper were developed through joint work with members of the Library of Congress, especially Carl Fleischhauer and Melissa Levine of the National Digital Library Program, and Mary Levering of the U.S. Copyright Office, all of whom provided extensive comments on an earlier draft of this paper. The design and implementation of the repository has been carried out by Christophe Blanchi and Ed Overly of CNRI.

This work has been supported in part by the Library of Congress and the Defense Research Programs Agency (DARPA), under DARPA grant MDA972- 92-J-1029.

Copyright © 1998 Corporation for National Research Initiatives