Microsoft Technology Licensing, LLC

Pankaj Mohan Kamat

Gregory Kostal

Vladimir Yarmolenko

Krassimir Emilov Karamfilov

Yuhui Zhong

Scott C Cottrille

Tejas Patel

Kenneth D Ray

Frank Byrum

Mayank Mehta

Edward Thomas Banti

Chandresh Kumar Jain

Duncan G Bryce

Paul J Leach

Charles W Kaufman

William R Tipton

Andrey Shur

Victor Boctor

Andrew M Herron

Hao Zhang

Jonathan D Schwartz

Amit Fulay

Christopher Barnes

Michael Nelte

Matthew Charles Setzer

Dan Knudson

John Richard McDowell

James R Knibb

Ayse Yesim Koman

Marcio Mello

Sunitha Samuel

Eugene Savchenko

Krassimir E Karamfilov

John Mcdowell

Ducan G Bryce

The present invention extends to methods, systems, and computer program products for deriving express rights in protected content. Embodiments of the invention provide mechanisms to convert implicit rights to express rights for entities, including applications, inside and outside of an organizational (e.g., enterprise) boundary. The conversion can occur dynamically, based on the information protection policies defined by a policy administrator, granting entities express access to perform tasks on protected content.

Deriving express rights in protected content

Business to business secure mail may be provided. Consistent with embodiments of the invention, a protected message may be received. The recipient may request a token from a trust broker, submit the token to an authorization server associated with the sender, receive a user license from the authorization server; and decrypt the protected message using the user license. The protected message may restrict actions that may be taken by the recipient, such as forwarding to other users.

Business to business secure mail

The present invention extends to methods, systems, and computer program products for separating authorization identity from policy enforcement identity. Embodiments of the invention extend the consumption phase for protected information. Two identities, an authorization identity and a policy enforcement identity, are used for acquiring, issuing and enforcing usage license instead of one identity certificate. The authorization identity is used to evaluate against usage policy. The authorization identity is similar to identification information in an identity certificate. The policy enforcement identity is used to ensure the confidentiality of granted permissions and content key. The policy enforcement identity enforces a usage license on an authorization principal's (e.g., recipient's) machine. The policy enforcement identity's enforcement of a usage license is similar use of a cryptographic key in an identity certificate.

Separating authorization identity from policy enforcement identity

A file may contain an unencrypted and an encrypted portion. The unencrypted portion may contain a layout section that may point to a published license, metadata, and a contents section, where the contents section is in the encrypted portion. The encrypted portion may contain the contents section which may act as a directory for one or more included files that may be compressed and stored in the encrypted portion. When the file is opened by a receiver, the receiver may read the published license and communicate with a security server to establish access rights and receive at least one key for decrypting at least a portion of the encrypted portion of the file. The receiver may then gain access to the included files.

Generic file protection format

The present invention extends to methods, systems, and computer program products for licensing protected content to application sets. Embodiments of the invention permit a local machine to increase its participation in authorizing access to protected content. For example, an operating system within an appropriate computing environment is permitted to determine if an application is authorized to access protected content. Thus, the application is relieved from having to store a publishing license. Further, authorization decisions are partially distributed, easing the resource burden on a protection server. Accordingly, embodiments of the invention can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Licensing protected content to application sets

The secure application of content protection policies to content. The secure application of content protection polices is accomplished by having an enforcement mechanism monitor policy application points to detect the transfer of content. The enforcement mechanism accesses the content and a determination is made to protect the content. A usage policy is then identified by the enforcement mechanism to apply to the content and the usage policy is then applied to the content, resulting in a usage policy for the content.

Automatic application of information protection policies

Growing community of inventors

Kirkland, WA, United States of America

Pankaj Mohan Kamat