Microsoft Technology Licensing, LLC

Frank Byrum

Marco A Demello

Vinay Krishnaswamy

Christopher Barnes

Mayank Mehta

Edward Thomas Banti

Pavel Zeman

Yoram Yaacovi

James R Knibb

Attila Narin

Peter David Waxman

Chandresh Kumar Jain

Palash Biswas

Mayerber L Carvalho Neto

Kathryn E Hughes

Leroy B Keely

Scott C Cottrille

Gregory Kostal

Chandramouli Venkatesh

Vladimir Yarmolenko

Michael Nelte

Ladislau Conceicao

Prashant Malik

Ayse Yesim Koman

Jeffrey B Kay

John L Manferdelli

Venkateshaiah Setty

Yuhui Zhong

Brian Kress

Steve Bourne

Mayerber Loureiro De Carvalho Neto

Tejas Patel

Pankaj Mohan Kamat

Victor William Habib Boctor

Thomas K Lindeman

Wilson Li

Chris Barnes

Greg Gourevitch

Attilla Narin

Jonathan LeCroy

Leroy Bertrand Keely, Jr

Matthias Adam Leibmann

Victor Boctor

Hao Zhang

Trevor William Freeman

Amit Fulay

Rushmi U Malaviarachchi

Krassimir Emilov Karamfilov

Jeffrey H Alger

Sara L Manning

Steven Hubbell

Yevgeniy (Eugene) Rozenfeld

Steven Michael Clagg

Jeffrey A Alger

Sunitha Samuel

Architecture that employs encryption and storage of encryption keys to protect trusted client message content from an untrusted third-party hosted service. Each trusted user machine is configured to optionally apply security to messages. Rules determine when automatic protection is applied and the level of protection to apply. The trusted client automatically downloads the rules (or rules policies) from a trusted rules service and caches the rules locally. During composition, the rules analyze the message and automatically apply security template(s) to the message. The security template(s) encrypt the body of the message, but not the headers or subject. The untrusted message service processes the header and delivers the message to the correct recipient. The hosted service cannot view the contents of the message body, and only intended recipients of the protected message can view the message body. Offline protection is supported, and the user can override protection by the rules.

Protecting content from third party using client-side security protection

An email security system is described that allows users within different organizations to securely send email to one another. The email security system provides a federation server on the Internet or other unsecured network accessible by each of the organizations. Each organization provides identity information to the federation server. When a sender in one organization sends a message to a recipient in another organization, the federation server provides the sender's email server with a secure token for encrypting the message to provide secure delivery over the unsecured network.

Secure message delivery using a trust broker

A hosting provider operates a server system that provides a service to one or more tenants. The server system receives configuration data from the tenants. As part of providing the service to a given tenant, the server system attempts to access an external service due to the configuration data received from the given tenant identifying the external service. Service access errors can occur when attempting to access the external service. In response to determining that an error has occurred when attempting to access the external service, the server system sends a service access alert to a recipient associated with the given tenant. The service access alert notifies the recipient that the error has occurred.

Alerting recipients to errors occurring when accessing external services

Certificate remoting and recovery may be provided. A computer may identify required security certificates and determine whether at least one required security certificate is not available. If the certificate is not available, the computer may identify a peer server and request the missing certificate from the peer server. The computer may also be operative to receive certificate management instructions from other computers.

Certificate remoting and recovery

Business to business secure mail may be provided. Consistent with embodiments of the invention, a protected message may be received. The recipient may request a token from a trust broker, submit the token to an authorization server associated with the sender, receive a user license from the authorization server; and decrypt the protected message using the user license. The protected message may restrict actions that may be taken by the recipient, such as forwarding to other users.

Business to business secure mail

The present invention extends to methods, systems, and computer program products for separating authorization identity from policy enforcement identity. Embodiments of the invention extend the consumption phase for protected information. Two identities, an authorization identity and a policy enforcement identity, are used for acquiring, issuing and enforcing usage license instead of one identity certificate. The authorization identity is used to evaluate against usage policy. The authorization identity is similar to identification information in an identity certificate. The policy enforcement identity is used to ensure the confidentiality of granted permissions and content key. The policy enforcement identity enforces a usage license on an authorization principal's (e.g., recipient's) machine. The policy enforcement identity's enforcement of a usage license is similar use of a cryptographic key in an identity certificate.

Separating authorization identity from policy enforcement identity

Email messages are recalled in accordance with restrictions attached to the message. Use of the message is limited per the restrictions. Example restrictions include printing restrictions, forwarding restrictions, exporting restrictions, copying restrictions, reading restrictions, and a expiration time of the message.

Message recall using digital rights management

A method for managing rights in digital content includes generating rights data for a piece of digital content and forming a piece of rights managed digital content by associating the rights data with the piece of digital content. The rights data includes parameters that govern the terms on which the content may be licensed, and may include a list of entities to which the content may be licensed, a respective set of one or more rights that each such entity has in the digital content, and any conditions that may be placed on those rights. A method for licensing rights managed digital content includes receiving a license request for a license to use the piece of rights managed digital content, where the license request includes such a signed rights label. The digital signature on the signed rights label is validated to determine whether a trusted entity issued the signed rights label. If a trusted entity issued the signed rights label, a license to use the piece of rights managed digital content in accordance with the rights data may be issued.

Systems and methods for issuing usage licenses for digital content and services

A server architecture for a digital rights management system that distributes and protects rights in content. The server architecture includes a retail site which sells content items to consumers, a fulfillment site which provides to consumers the content items sold by the retail site, and an activation site which enables consumer reading devices to use content items having an enhanced level of copy protection. Each retail site is equipped with a URL encryption object, which encrypts, according to a secret symmetric key shared between the retail site and the fulfillment site, information that is needed by the fulfillment site to process an order for content sold by the retail site. Upon selling a content item, the retail site transmits to the purchaser a web page having a link to a URL comprising the address of the fulfillment site and a parameter having the encrypted information. Upon following the link, the fulfillment site downloads the ordered content to the consumer, preparing the content if necessary in accordance with the type of security to be carried with the content. The fulfillment site includes an asynchronous fulfillment pipeline which logs information about processed transactions using a store-and-forward messaging service.

Method and system for binding enhanced software features to a persona

Systems and methods for providing digital rights management services are disclosed. Such a system includes a service program that provides a processing framework for performing a digital rights management service, such as publishing or licensing rights managed digital content. A plurality of plug-in components are provided, each of which performs a respective task associated with the digital rights management service. The plug-in components are integrated into the processing framework according to predefined sets of interface rules.

Secure server plug-in architecture for digital rights management systems

Growing community of inventors

Seattle, WA, United States of America

Frank Byrum