Microsoft Technology Licensing, LLC

Vladimir Yarmolenko

Gregory Kostal

Scott C Cottrille

Yuhui Zhong

Krassimir Emilov Karamfilov

Pankaj Mohan Kamat

Vinay Krishnaswamy

Frank Byrum

Tejas Patel

Kenneth D Ray

Attila Narin

Peter David Waxman

Mayank Mehta

Charles F Rose

Ravindra Pandya

Edward Thomas Banti

Amit Fulay

Rushmi U Malaviarachchi

Muthukrishnan Paramasivam

Chandresh Kumar Jain

Vasantha K Ravula

Victor Boctor

Hao Zhang

Chandramouli Venkatesh

Christopher Barnes

Michael Nelte

Duncan G Bryce

Keith S Brintzenhofe

Prashant Malik

Thomas K Lindeman

Yevgeniy Eugene Rozenfeld

Dean A Wells

James R Knibb

Abhijat A Kanade

Ayse Yesim Koman

Satheesh S Dabbiru

Ikrima Elhassan

Elisa W Zhang

Attilla Narin

Matthew F Steele

Jody A Hendrix

Umesh R Dhond

Jeffrey M Brown

Sunitha Samuel

Ryan A Sizemore

Veneta I Tashev

Charles F Iii Rose

Ravindra Nath Pandya

Embodiments are directed to dynamically transforming user interface actions into executable script commands and to storing groups of executable script commands related to specific tasks. In an embodiment, a computer system tracks user interface actions at a software program user interface. The computer system transforms the user interface actions into an executable script command. The script command is configured to perform the tracked user interface action when executed. The computer system also dynamically displays the resulting executable script commands in a script command window as the user interface actions are entered by the computer user. The computer system may further determine that multiple user interface actions correspond to a specified task and store the resulting executable script commands related to the specified task as a combined group of executable script commands.

Transforming user interface actions to script commands

The present invention extends to methods, systems, and computer program products for deriving express rights in protected content. Embodiments of the invention provide mechanisms to convert implicit rights to express rights for entities, including applications, inside and outside of an organizational (e.g., enterprise) boundary. The conversion can occur dynamically, based on the information protection policies defined by a policy administrator, granting entities express access to perform tasks on protected content.

Deriving express rights in protected content

Business to business secure mail may be provided. Consistent with embodiments of the invention, a protected message may be received. The recipient may request a token from a trust broker, submit the token to an authorization server associated with the sender, receive a user license from the authorization server; and decrypt the protected message using the user license. The protected message may restrict actions that may be taken by the recipient, such as forwarding to other users.

Business to business secure mail

The present invention extends to methods, systems, and computer program products for separating authorization identity from policy enforcement identity. Embodiments of the invention extend the consumption phase for protected information. Two identities, an authorization identity and a policy enforcement identity, are used for acquiring, issuing and enforcing usage license instead of one identity certificate. The authorization identity is used to evaluate against usage policy. The authorization identity is similar to identification information in an identity certificate. The policy enforcement identity is used to ensure the confidentiality of granted permissions and content key. The policy enforcement identity enforces a usage license on an authorization principal's (e.g., recipient's) machine. The policy enforcement identity's enforcement of a usage license is similar use of a cryptographic key in an identity certificate.

Separating authorization identity from policy enforcement identity

A server receives a request and identifies a corresponding task with core and peripheral components. The server performs the core components and collects relevant context data. The server returns a result to the requester based on having performed the core components, and constructs a message including the collected context data and sends same to an asynchronous message collector. An asynchronous message processor takes up and processes the message from the collector to perform the peripheral components. Thus, the message processor performs less-time-sensitive peripheral work independent of the server and allows the server to attend to more-time-sensitive core work.

Asynchronous processing of task components in connection with rights management system and the like

The present invention extends to methods, systems, and computer program products for a centrally accessible policy repository. Protection policies for protecting resources within an organization are stored at a central policy repository. Thus, an administrator can centrally create, maintain, and manage resource protection polices for all of the organizational units within an organization. Accordingly, resources consumed when performing these protection policy related operations is significantly reduced. Additionally, since protection policies are centrally located, there is increased likelihood of being able to consistently apply an organization's protection policies within different organizational units, even when protection policies change.

Centrally accessible policy repository

The secure application of content protection policies to content. The secure application of content protection polices is accomplished by having an enforcement mechanism monitor policy application points to detect the transfer of content. The enforcement mechanism accesses the content and a determination is made to protect the content. A usage policy is then identified by the enforcement mechanism to apply to the content and the usage policy is then applied to the content, resulting in a usage policy for the content.

Automatic application of information protection policies

The present invention extends to methods, systems, and computer program products for pre-performing operations for accessing protected content. Cryptographic user key pairs can be pre-generated and distributed in response to a variety of different events prior to provisioning client machine for accessing protected content. Usage licenses can be pre-generated and allocated prior to requests for usage licenses. Usage licenses can be pre-obtained for client machines prior to client machines access protected content. Pre-performed operations can be performed in response to detected events, such as, for example, reduced resource consumption in a Digital Rights Management system.

Pre-performing operations for accessing protected content

Systems and methods for providing digital rights management services are disclosed. Such a system includes a service program that provides a processing framework for performing a digital rights management service, such as publishing or licensing rights managed digital content. A plurality of plug-in components are provided, each of which performs a respective task associated with the digital rights management service. The plug-in components are integrated into the processing framework according to predefined sets of interface rules.

Secure server plug-in architecture for digital rights management systems

An improved certificate issuing system may comprise a certificate translation engine for translating incoming certificates and certificate requests from a first format into a second format. A certificate issuing engine may then operate on incoming requests in the common format. The issuing engine can issue certificates to clients according to its certificate issuing policy. The policy may be expressed as data in a policy expression language that can be consumed at runtime, which provides for flexible and efficient changing of issuing policy. Issued certificates can be translated back into a format that is consumed by the requesting client. Such translation can be performed by the translation engine prior to delivery of certificates to requesting clients.

Format-agnostic system and method for issuing certificates

An improved certificate issuing system may comprise a novel arrangement for expressing certificate issuing policy. The policy may be expressed in a human-readable policy expression language and stored for example in a file that is consumed by a certificate issuing system at runtime. The policy may thus be easily changed by altering the digital file. Certain techniques are also provided for extending the capabilities of the certificate issuing system so it may apply and enforce new policies.

Extendable data-driven system and method for issuing certificates

A key management interface that allows for different key protection schemes to be plugged into a digital rights management system is disclosed. The interface exposes the functionality of signing data, decrypting data encrypted using a public key, and re-encrypting data encrypted using the public key exported by the interface to a different authenticated principal (i.e., a different public key). Thus, a secure interface can be provided such that the data does not enter or leave the interface in the clear. Such an interface exports private key operations of signing and decryption, and provides security and authentication for the digital asset server in licensing and publishing. During publishing, a client can encrypt asset keys such that only a specified entity can decrypt it, using a plug-in, for example, that implements the aforementioned interface. During licensing, the license issuing entity can use the interface to decrypt keys for assets and to sign licenses and rights labels such that the asset is protected and consumable by a host digital rights management platform. The interface thus provides an abstraction for key operations.

Systems and methods for providing secure server key operations

Growing community of inventors

Duvall, WA, United States of America

Vladimir Yarmolenko