Symantec Corporation

Denis Serenyi

Brian T Witten

Zulfikar Ramzan

Michael Spertus

A method for using virtualization to implement information rights management. The method may include: 1) intercepting, at a virtualization module, a request from an application to access data; 2) querying an information-rights-management database for a virtualization policy associated with the access request; 3) receiving, at the virtualization module, the virtualization policy from the information-rights-management database; and 4) controlling access to the data by applying the virtualization policy to the access request in a manner that is transparent to the application. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for using virtualization to implement information rights management

A computer-implemented client-side method for protecting enterprise rights management keys from being compromised by untrusted client devices may comprise: 1) detecting a request on a client device to access protected data, 2) dynamically instantiating a processor-based secure virtual machine on the client device, 3) establishing a secure communication channel between the secure virtual machine and a policy server, 4) receiving, via the secure communication channel, a content key from the policy server, and then 5) decrypting, using the content key, the protected data using the secure virtual machine. Server-side methods, along with corresponding systems and computer-readable media, are also disclosed.

Systems and methods for protecting enterprise rights management keys

An authentication token management system securely manages an authentication token. Hardware based security extensions on a client are used to dynamically instantiate two dynamic secure virtual machines, a registration initiation module (RIM) and a registration completion module (RCM). A public key and a corresponding private key are generated, and the RIM seals the private key to the RCM. A request for an authentication token is signed by the hardware based security extensions and transmitted to the server. This request comprises at least the public key. In response, an authentication token encrypted with the public key is received. The RCM unseals the private key, and uses it to decrypt the received authentication token. The RCM then seals the authentication token to at least one additional dynamic secure virtual machine, which can use it to perform additional functionalities, such as data signing, encryption, generation and/or verification.

Secure authentication token management

A computer-implemented method for securely managing access to data may comprise identifying a request to access data that is encrypted, the request being made within an insecure platform. The method may: determine that a requestor has a right to access the data, decrypt the data to provide decrypted data, and permit a secure platform to access the decrypted data. A computer-implemented method for securely managing access to data may comprise identifying a request to access data that is encrypted, the request being made within an insecure platform. They method may: submit the request to a policy server, receive permission from the policy server to access the data, decrypt the data to provide decrypted data, and permit a secure platform to access the decrypted data. A system for securely managing access to data may comprise: an authorization platform, an authentication module, a policy-enforcement module, and a cryptography module.

Growing community of inventors

Arlington, VA, United States of America

Denis Serenyi