Microsoft Technology Licensing, LLC

Hewlett-packard Development Company, L.p.

Scott C Cottrille

Gregory Kostal

Vladimir Yarmolenko

Yuhui Zhong

Antony Halim

Peter David Waxman

Vinay Krishnaswamy

Yoram Yaacovi

Rushmi U Malaviarachchi

Kenneth D Ray

Attila Narin

Frank Byrum

Craig Allen Harry

Brian R Daugherty

Pankaj Mohan Kamat

Patrick Pei Cai

Ade A Olubummo

Marco A Demello

Charles F Rose

Ravindra Pandya

Krassimir Emilov Karamfilov

Muthukrishnan Paramasivam

Chandramouli Venkatesh

Abhijat A Kanade

Vasantha K Ravula

Jason Matthew Cahill

Andrey Shur

Mayank Mehta

Kevin Lane Brown

Lauren Nicole Antonoff

Edward Thomas Banti

Amit Fulay

Chandresh Kumar Jain

Brian S Christian

Duncan G Bryce

Keith S Brintzenhofe

Steve Bourne

Prashant Malik

Dan Knudson

Pavel Kouznetsov

Tejas Patel

Thomas K Lindeman

Alok Sinha

Yevgeniy Eugene Rozenfeld

Kumar B Parambir

Marco M DeMello

Marcio Mello

Ashesh P Bakshi

Attilla Narin

Sunitha Samuel

Eugene Savchenko

Syed A Mehdi

Patricia Priest

Li Ren

Jeffrey M Brown

Umesh R Dhond

Jody A Hendrix

Frederic Delombaerde

Michael Selhorn

Conrad G Bayer

Bruce A MacNaughton

Charles F Iii Rose

Ravindra Nath Pandya

The present invention extends to methods, systems, and computer program products for workflow based authorization for content access. A workflow can be triggered when a protection policy does not fully express an intended recipient's rights in protected content. A workflow processes relevant inputs to more fully express the intended recipient's rights in protected content. Workflows can provide policy item updates and authorizations decisions with respect to protected content. Through the use of workflows to make an authorization decision, access to information can become more flexible, allowing it to follow the desired flow of information throughout its lifecycle. This flexibility allows organizations to protect their information without worrying about the protection stopping the natural flow of business.

Workflow based authorization for content access

The present invention extends to methods, systems, and computer program products for separating authorization identity from policy enforcement identity. Embodiments of the invention extend the consumption phase for protected information. Two identities, an authorization identity and a policy enforcement identity, are used for acquiring, issuing and enforcing usage license instead of one identity certificate. The authorization identity is used to evaluate against usage policy. The authorization identity is similar to identification information in an identity certificate. The policy enforcement identity is used to ensure the confidentiality of granted permissions and content key. The policy enforcement identity enforces a usage license on an authorization principal's (e.g., recipient's) machine. The policy enforcement identity's enforcement of a usage license is similar use of a cryptographic key in an identity certificate.

Separating authorization identity from policy enforcement identity

A file may contain an unencrypted and an encrypted portion. The unencrypted portion may contain a layout section that may point to a published license, metadata, and a contents section, where the contents section is in the encrypted portion. The encrypted portion may contain the contents section which may act as a directory for one or more included files that may be compressed and stored in the encrypted portion. When the file is opened by a receiver, the receiver may read the published license and communicate with a security server to establish access rights and receive at least one key for decrypting at least a portion of the encrypted portion of the file. The receiver may then gain access to the included files.

Generic file protection format

A server receives a request and identifies a corresponding task with core and peripheral components. The server performs the core components and collects relevant context data. The server returns a result to the requester based on having performed the core components, and constructs a message including the collected context data and sends same to an asynchronous message collector. An asynchronous message processor takes up and processes the message from the collector to perform the peripheral components. Thus, the message processor performs less-time-sensitive peripheral work independent of the server and allows the server to attend to more-time-sensitive core work.

Asynchronous processing of task components in connection with rights management system and the like

One embodiment includes a method which may be practiced in a computing environment where resources are distributed. The method includes acts for obtaining policy information defining restrictions on resources distributed in the computing environment. The method includes sending a request to a server for metadata about one or more resource protection policies at the server. In response to the request, metadata about one or more resource protection polices at the server is received from the server. The metadata from the server is analyzed. Based on analyzing the metadata, one or more resource protection policies stored at the client are updated.

Distribution of information protection policies to client machines

The present invention extends to methods, systems, and computer program products for a centrally accessible policy repository. Protection policies for protecting resources within an organization are stored at a central policy repository. Thus, an administrator can centrally create, maintain, and manage resource protection polices for all of the organizational units within an organization. Accordingly, resources consumed when performing these protection policy related operations is significantly reduced. Additionally, since protection policies are centrally located, there is increased likelihood of being able to consistently apply an organization's protection policies within different organizational units, even when protection policies change.

Centrally accessible policy repository

A scalable computing system for managing annotations is capable of handling requests for annotations to millions of documents a day. The computing system consists of multiple tiers of servers. A tier I server indicates whether there are annotations associated with a content source. A tier II server indexes the annotations. A tier III server stores the body of the annotation.

Scalable computing system for managing annotations

The secure application of content protection policies to content. The secure application of content protection polices is accomplished by having an enforcement mechanism monitor policy application points to detect the transfer of content. The enforcement mechanism accesses the content and a determination is made to protect the content. A usage policy is then identified by the enforcement mechanism to apply to the content and the usage policy is then applied to the content, resulting in a usage policy for the content.

Automatic application of information protection policies

A method, apparatus, and software are disclosed for delivering customized content to clients with diverse content needs, such as clients from diverse geographical areas an language backgrounds. Customizable content is separated from the underlying code, which is used as a template for inserting localized content into a basic document framework as represented by the template. Both electronic mail and Web community customization techniques are disclosed.

Creation and delivery of customized content

Embodiments described herein are directed to selectively redacting and unredacting display information in accordance with a redaction policy. In one embodiment, a computer system receives user input indicating a user's intention to selectively redact portions of accessed documents. The computer system accesses at least one document, such that the document is capable of being displayed to the user. The computer system determines that the accessed document comprises one or more tags indicating which portions of the document are to be redacted. The computer system dynamically redacts those portions of the document identified by the tags without otherwise altering the structure of the document, in accordance with the user's intention. The computer system also displays the document according to the document's original structure, omitting the dynamically redacted portions.

Selective document redaction

A method for managing rights in digital content includes generating rights data for a piece of digital content and forming a piece of rights managed digital content by associating the rights data with the piece of digital content. The rights data includes parameters that govern the terms on which the content may be licensed, and may include a list of entities to which the content may be licensed, a respective set of one or more rights that each such entity has in the digital content, and any conditions that may be placed on those rights. A method for licensing rights managed digital content includes receiving a license request for a license to use the piece of rights managed digital content, where the license request includes such a signed rights label. The digital signature on the signed rights label is validated to determine whether a trusted entity issued the signed rights label. If a trusted entity issued the signed rights label, a license to use the piece of rights managed digital content in accordance with the rights data may be issued.

Systems and methods for issuing usage licenses for digital content and services

The present invention extends to methods, systems, and computer program products for pre-performing operations for accessing protected content. Cryptographic user key pairs can be pre-generated and distributed in response to a variety of different events prior to provisioning client machine for accessing protected content. Usage licenses can be pre-generated and allocated prior to requests for usage licenses. Usage licenses can be pre-obtained for client machines prior to client machines access protected content. Pre-performed operations can be performed in response to detected events, such as, for example, reduced resource consumption in a Digital Rights Management system.

Pre-performing operations for accessing protected content

Systems and methods for providing digital rights management services are disclosed. Such a system includes a service program that provides a processing framework for performing a digital rights management service, such as publishing or licensing rights managed digital content. A plurality of plug-in components are provided, each of which performs a respective task associated with the digital rights management service. The plug-in components are integrated into the processing framework according to predefined sets of interface rules.

Secure server plug-in architecture for digital rights management systems

A method is disclosed for rendering content encrypted according to a cryptographic key, where the content has corresponding rights data including a decryption key (KD) for decrypting the encrypted content, and where (KD) in the rights data is encrypted according to a public key of a rights management (RM) server (PU-RM) to result in (PU-RM(KD)). The RM server normally delivers (KD) within a license, but upon being decommissioned can no longer issue such license. In the method, a notification is received that the RM server has been decommissioned, and thereafter an attempt is made to render a piece of content. Such content is determined to be protected to the decommissioned RM server, and a request is sent to the decommissioned RM server for the content key (KD) for the content rather than any license. Thereafter (KD) is received from the decommissioned RM server.

Systems, structures, and methods for decrypting encrypted digital content when a rights management server has been decommissioned

Growing community of inventors

Sammamish, WA, United States of America

Scott C Cottrille