DALICC stands for Data Licenses Clearance Center. It is a software framework that utilizes semantic web standards and linked data principles for the purpose of cost eficient clearing of rights issues in the creation of derivative data and software works. The paper describes the service architecture of and usage scenarios for the DALICC framework, exemplifying a scaleable architecture of semantic web enabled compliance services.
Most of the work on automated processing of licensing information is situated in the context
of Rights Expression Languages and contracting [
... R
R search for a license, compose a license, check compatibility of licenses (optionally with a goal license)
R
R R R
DALICC Services
has since then sparked a rich body of research [6]. One of the first foundational papers on reasoning over licenses was published in 2002 by [7] and extended by [8, 9] towards rule-based resolution of licensing conflicts based on OWL constructs. A proof of applicability was provided by [10] and [11], who describe formalisations of a license clearance tool for derivative works based on the processing of deontic clauses [12, 13]. [10] also provide a demo called Licentia (http://licentia.inria.fr/) that exemplifies the practical value of such a service. More recent work on rule-based conflict detection in license compatibility has been provided by [ 14]. Our paper contributes to this research by describing a user-centric and scalable architecture that can be understood as a blueprint for semantic web-enabled compliance services.
The components of the DALICC service framework are shown in Figure 1. An API User’s request is first redirected to an available DALICC instance where the web framework delivers the request to the relevant micro-service. To handle multiple API requests, we rely on container-based load balancing in front of the services. The license library is a repository that contains machinereadable and human-readable representations of the licenses, the former as ODRL policies (set of statements) and the latter as plain text. The dependency graph encodes the expert knowledge about the implicit and explicit semantic dependencies between actions [15, 16]. Additionally, we store user specific data such as licenses provided by individual users and executed compatibility reports. The following APIs are available: The License Search API queries the license library given specific text or facets. /get/licenses/{license_identifier}: It returns the license definition in a RDF serialization format (e.g., Turtle and JSON-LD) for a given license identifier. /post/licenses/search/text: Given a string, it returns a JSON object where license identifiers and descriptions are listed w.r.t. their relatedness to the string. /post/licenses/search/faceted: Given the asset type (i.e., creative work, dataset, or software) and a list of permissions, duties and prohibitions in an RDF serialization format, it returns a JSON object where license identifiers and descriptions are listed.
The License Composer API allows customized licenses to be created from a set of ODRL policy-permission-action-duty statements expressed in an RDF serialization format. /get/licenses/composer/vocabulary: Returns a JSON object where ODRL, ccREL and DALICC vocabularies for defining license statements are listed. /post/licenses/composer/check: Returns a JSON object that states if the sent license is formally correct, logically coherent and thus legally valid, and an error message if the license is badly formed. /post/licenses/composer/upload: Uploads the license in the license library and returns the new license identifier.
The Compatibility Check API provides information on equivalence, similarity and compatibility within a set of licenses. It supports two modes: a) reporting all the conflicting pairs of statements in the given set of licenses and b) further checking if a defined goal license subsumes the input set of licenses, e.g., a software developer wants to find out if his/her project can be published under a specific license. In both modes, the reasoner supports conflict resolution by suggesting the minimum removal of statements/licenses for achieving a coherent state. /post/licenses/compatibility: Given a list of license identifiers and optionally a goal license identifier, it returns the compatibility report.
In the following section, we provide example application scenarios for the proposed DALICC APIs. Large scale software projects potentially have dozens – or even hundreds – of dependencies to other projects, e.g., to third-party software packages, libraries and modules. Example repositories that list libraries and modules together with their licenses are the Python Package Index (“pip”)1 and the Node Package Manager (“‘npm”)2 for the JavaScript programming language. For instance, the popular Python module “pandas” itself already depends on over 80 other modules listed in the respective requirements file. 3
The goal of the DALICC service is to support programmers and data engineers in the process of creating and publishing new applications that depend on third-party sources. Figure 2 displays how this is envisioned: software projects typically specify a list of dependencies (e.g., a requirements.txt file in Python); initially, the respective licenses get extracted from the listed dependencies and mapped to the DALICC license identifiers. Regarding the identification of licenses, the Software Package Data Exchange4 (SPDX) provides standardised, short identifiers for a number of standard licenses that potentially serve as canonical permanent URLs. Having 1https://pypi.org/ 2https://www.npmjs.com/ 3https://github.com/pandas-dev/pandas/blob/master/requirements-dev.txt, last accessed 2021-06-08 4https://spdx.org/licenses/, last accessed 2021-06-08 extraction of license identifiers compatibility check of extracted licenses +
goal license check against extracted licenses DALICC Services
the licenses extracted, a programmer can check for compatibility of the dependencies via the DALICC API. If the project gets published under a new license (that exists in the DALICC license library), the API allows to check for compatibility with the specified “goal license” (cf. Figure 2).
We are currently working on a FAIR documentation and will make the DALICC framework available under a dual license by the end of 2021, thus allowing various forms of collaborative exploitation. The framework closes the existing gap between the technological capabilities to create and publish digital assets and the legal infrastructure necessary to provide them on a legally secure basis for reuse. Hence, DALICC is a tool that puts policies into practice and thus facilitates data governance at various levels. Thus, the DALICC framework should be understood as an enabling service for the emerging data economy.