Re: [security-services] Liberty IPR Issues (was: Liberty ID-FF 1.2 submissionto the SSTC)

["Conor P. Cahill" <concahill@aol.com>]

Hal Lockhart wrote on 11/24/2003, 5:08 PM:

 > I share Tony's concerns that the nature of the IPR applying to the
 > Liberty submission is not clear enough. Five companies are listed
 > on the link provided by Tony on the Liberty Web site. (BTW, I
 > looked in vain for this link, I don't know how Tony managed to
 > find it.)

There is a link for it on the specifications index page 
(http://www.projectliberty.org/specs/index.html).

 > The claims of Time Warner and Fidelity are listed as RF.

Yes.

 > The claims of Citigroup and Catavault are listed as RAND and
 > unfortunately their description of what their patents cover
 > is too broad to be useful.

Both of these are related to patent applications, not issued patents, so 
there is no way to reasonalby discover what will be covered since they 
don't have any issued claims yet (and there's no guarantee that they will).

 > The claim from Sony is most troublesome. It simply says "Please
 > contact Sony Corporation.

I agree that it would be useful for this to be clarified further.

 > I note that Sony (Corporation of America) and Fidelity are OASIS
 > members and therefore have agreed to the OASIS IPR policy. As far
 > as I can tell the other three organizations are not OASIS members.

Two points here:

a) Membership in the Liberty alliance (which requires companies
    to disclose IPR as part of the approval process for Liberty
    specifications) does not mean that the company is a
    "contributor" of the specification to OASIS.  In other words,
    these specifications were contributed by specific members and
    not the entire organization.

b) I do believe that AOl is a member of OASIS (hence my participation).

 > The Liberty submission may comply with the literal wording of the
 > OASIS IPR policy, but it is far from the spirit of "full disclosure."

The problem here is one for lawyers.  Liberty was made aware of some 
real and some potential IPR that the holders claimed applies to some of 
the work done by Liberty.  In some cases, Liberty received nothing more 
than that (a statement that says "hey, we think something you're doing 
is covered by our patent application").  In other cases Liberty recevied 
more detailed analysis by the company as well as a statement as to the 
licensing terms.  Liberty has reported the information that it has received.

Note that Liberty has not done any analysis of the claims for validity, 
nor has there been any legal review, internal or external, of the claims 
  (and neither does OASIS or any other standards body that I am aware of 
-- unless, of course, litigation has been instigated by one of the parties).

So, Liberty has reported on what the potential claims have been. 
Outside of those claims, the Liberty member agreement requires RF/RANDZ 
from all members to all implementors -- something that is much stronger 
than OASIS' IPR policies.

Conor