Issuing a digital rights management (DRM) license for content based on cross-forest directory information

• US 20040168077A1
• Filed: 02/26/2003
• Published: 08/26/2004
• Est. Priority Date: 02/26/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Waxman, Peter David, Narin, Attila, Venkatesh, Chandramouli, Rozenfeld, Yevgeniy (Eugene)
• Granted Patent: US 7,827,156 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

An organization maintains a computer network comprising at least a forest A and a forest B, where forest A has a directory A and a querying entity A capable of querying directory A, and forest B has a directory B and a querying entity B capable of querying directory B. Querying entity A receives a request from the user and decides whether to grant the request based at least in part on whether the user is a member of the group. Thus, querying entity A queries directory A to return information on the group, is directed to forest B, contacts querying entity B, requests querying entity B to query directory B whether the user is a member of the group, receives a response, and grants the request from the user based at least in part on whether the user is a member of the group.

Claims

1. A method for determining whether a user from an organization is a member of a group pre-defined within the organization, the organization maintaining a computer network comprising at least a forest A and a forest B, forest A having a directory A and a querying entity A capable of querying directory A, forest B having a directory B and a querying entity B capable of querying directory B, the method comprising:

querying entity A receiving a request from the user, querying entity A deciding whether to grant the request based at least in part on the user being a member of the group;

querying entity A querying directory A of forest A to return information on the group and in response being directed to forest B;

querying entity A contacting querying entity B of forest B and requesting querying entity B to query directory B whether the user is a member of the group;

querying entity A receiving in response from querying entity B whether the user is in fact a member of the group; and

querying entity A granting the request from the user based at least in part on whether the user is a member of the group.

2. The method of claim 1 comprising:

querying entity A querying directory A of forest A to return any object therein for the group, the group being native to forest B such that directory B of forest B has therein a record object corresponding to the group, the record object for the group in directory B including all direct members of the group, directory A of forest A having therein a pointer object corresponding to the group, the pointer object for the group in directory A including an address of forest B;

querying entity A receiving in response from directory A the pointer object for the group, thus signifying that the group is not native to forest A;

querying entity A retrieving the address of forest B from the received pointer object;

querying entity A employing the retrieved address to query directory B of forest B for an address of querying entity B of forest B;

querying entity A receiving in response from directory B the address of querying entity B; and

querying entity A contacting querying entity B at the address thereof and requesting querying entity B to query directory B whether the user is a member of the group.

3. The method of claim 1 further comprising querying entity B querying directory B of forest B to determine whether the user is a member of the group by:

querying entity B querying directory B of forest B to return any object therein for the group, the group being native to forest B such that directory B of forest B has therein a record object corresponding to the group, the record object for the group in directory B including all direct members of the group;

querying entity B receiving in response from directory B the record object for the group, thus signifying that the group is native to forest B; and

querying entity B reviewing the direct members of the group as set forth in the received record object to determine whether the user is a direct member of the group.

4. The method of claim 3 further comprising:

if the user is a direct member of the group, querying entity B reporting to querying entity A that the user is in fact a member of the group;

if the user is not a direct member of the group, querying entity B querying directory B to return any object for the user and thus proceeding to determine whether the user is an indirect member of the group by attempting within directory B to find a membership path from the user to the group, whereby a membership path found from the user to the group establishes that the user is in fact a member of the group; and

querying entity B reporting to querying entity A whether the user is in fact a member of the group based on whether a membership path.

5. The method of claim 3 wherein the querying entity A is a digital rights management (DRM) server, the method comprising querying entity A receiving the request from the user for a digital license to render a corresponding piece of digital content, the request including an identification of the user and an identification of the group.

6. The method of claim 5 wherein the querying entity B is a DRM server, the method further comprising querying entity A sending to querying entity B an identification of querying entity A as being a DRM server and querying entity B satisfying itself based on the sent identification that querying entity A is entitled to be informed whether the user is a member of the group.

7. The method of claim 6 comprising querying entity A sending to querying entity B a digital certificate with a certificate chain leading back to a trusted root of authority as recognized by querying entity, and querying entity B verifying the certificate.

8. The method of claim 1 wherein the querying entity A is a digital rights management (DRM) server, the method comprising querying entity A receiving the request from the user for a digital license to render a corresponding piece of digital content, the request including an identification of the user and an identification of the group.

9. A computer-readable medium having stored thereon computer-executable instructions for performing a method for determining whether a user from an organization is a member of a group pre-defined within the organization, the organization maintaining a computer network comprising at least a forest A and a forest B, forest A having a directory A and a querying entity A capable of querying directory A, forest B having a directory B and a querying entity B capable of querying directory B, the method comprising:

querying entity A receiving a request from the user, querying entity A deciding whether to grant the request based at least in part on the user being a member of the group;

querying entity A querying directory A of forest A to return information on the group and in response being directed to forest B;

querying entity A contacting querying entity B of forest B and requesting querying entity B to query directory B whether the user is a member of the group;

querying entity A receiving in response from querying entity B whether the user is in fact a member of the group; and

querying entity A granting the request from the user based at least in part on whether the user is a member of the group.

10. The medium of claim 9 wherein the method comprises:

querying entity A querying directory A of forest A to return any object therein for the group, the group being native to forest B such that directory B of forest B has therein a record object corresponding to the group, the record object for the group in directory B including all direct members of the group, directory A of forest A having therein a pointer object corresponding to the group, the pointer object for the group in directory A including an address of forest B;

querying entity A receiving in response from directory A the pointer object for the group, thus signifying that the group is not native to forest A;

querying entity A retrieving the address of forest B from the received pointer object;

querying entity A employing the retrieved address to query directory B of forest B for an address of querying entity B of forest B;

querying entity A receiving in response from directory B the address of querying entity B; and

querying entity A contacting querying entity B at the address thereof and requesting querying entity B to query directory B whether the user is a member of the group.

11. The medium of claim 9 in combination with another computer-readable medium having stored thereon computer-executable instructions for performing a method comprising querying entity B querying directory B of forest B to determine whether the user is a member of the group by:

querying entity B querying directory B of forest B to return any object therein for the group, the group being native to forest B such that directory B of forest B has therein a record object corresponding to the group, the record object for the group in directory B including all direct members of the group;

querying entity B receiving in response from directory B the record object for the group, thus signifying that the group is native to forest B; and

querying entity B reviewing the direct members of the group as set forth in the received record object to determine whether the user is a direct member of the group.

12. The another medium of claim 11 wherein the method further comprises:

if the user is a direct member of the group, querying entity B reporting to querying entity A that the user is in fact a member of the group;

if the user is not a direct member of the group, querying entity B querying directory B to return any object for the user and thus proceeding to determine whether the user is an indirect member of the group by attempting within directory B to find a membership path from the user to the group, whereby a membership path found from the user to the group establishes that the user is in fact a member of the group; and

querying entity B reporting to querying entity A whether the user is in fact a member of the group based on whether a membership path.

13. The medium of claim 11 wherein the querying entity A is a digital rights management (DRM) server, the method of the medium comprising querying entity A receiving the request from the user for a digital license to render a corresponding piece of digital content, the request including an identification of the user and an identification of the group.

14. The medium and another medium of claim 13 wherein the querying entity B is a DRM server, the method of the medium further comprising querying entity A sending to querying entity B an identification of querying entity A as being a DRM server, the method of the another medium further comprising querying entity B satisfying itself based on the sent identification that querying entity A is entitled to be informed whether the user is a member of the group.

15. The medium and another medium of claim 14 wherein the method of the medium comprises querying entity A sending to querying entity B a digital certificate with a certificate chain leading back to a trusted root of authority as recognized by querying entity, and the method of the another medium comprising querying entity B verifying the certificate.

16. The medium of claim 9 wherein the querying entity A is a digital rights management (DRM) server, the method comprising querying entity A receiving the request from the user for a digital license to render a corresponding piece of digital content, the request including an identification of the user and an identification of the group.