Web-Based Client for Creating and Accessing Protected Content

• US 20100313276A1
• Filed: 06/05/2009
• Published: 12/09/2010
• Est. Priority Date: 06/05/2009
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hubbell, Steven O., Barnes, Christopher, Yarmolenko, Vladimir, Zhong, Yuhui, Kostal, Gregory, Byrum, Frank D., Malik, Durlabh, Mehta, Mayank, Jain, Chandresh K., Carvalho Neto, Mayerber L., Kamat, Pankaj M., Nelte, Michael A., Fulay, Amit K., Patel, Tejas D., Banti, Edward T.
• Application Number:
  US12/479,235
• Publication Number:
  US 20100313276A1
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A web-based client for creating and accessing protected content may be provided. Consistent with embodiments of the invention, a webmail client may be provided allowing a user to apply a restriction template to a document. The webmail client may be further operative to decrypt and display the document and enforce the restriction against a recipient.

Claims

1. A method for applying persistent document protection, the method comprising:

creating a document;

selecting a template comprising at least one restriction;

applying the template to the document;

sending the document to a recipient; and

enforcing the at least one restriction against the recipient.

2. The method of claim 1, wherein the document comprises at least one of the following:

a text document, an e-mail, a text message, and a voice mail.

3. The method of claim 1, wherein enforcing the at least one restriction against the recipient comprises:

storing the document on a web server;

providing access to the document via a webmail application; and

preventing the recipient from accessing the document without using the webmail application.

4. The method of claim 1, wherein the at least one restriction comprises a restriction requiring the recipient to acquire a decryption key to view the document.

5. The method of claim 4, wherein requiring the recipient to acquire a decryption key comprises requiring the recipient to acquire the decryption key from at least one of the following:

an authorization server associated with a sending organization, an authorization server associated with a receiving organization, a public key server, and a trust broker.

6. The method of claim 1, wherein the at least one restriction comprises at least one of the following:

a restriction preventing the document from being sent to at least one second recipient, a restriction preventing the recipient from printing the document, a restriction preventing the recipient from modifying the document, a restriction preventing the recipient from replying to a sender of the message, a restriction preventing the recipient from replying to all recipients of the message, a restriction preventing the recipient from copying at least a part of the document, and a restriction preventing the document from being viewed by a recipient not affiliated with a specified organization.

7. The method of claim 1, further comprising displaying an indicator to the recipient that the document is restricted.

8. The method of claim 6, wherein the indicator comprises an icon associated with a type of the at least one restriction.

9. The method of claim 1, further comprising:

sending the document, by the recipient, to at least one second recipient; and

enforcing the at least one restriction against the at least one second recipient.

10. The method of claim 1, further comprising:

receiving a request from the recipient to remove the at least one restriction from the document;

determining whether the recipient has permission to remove the at least one restriction; and

in response to determining that the recipient has permission to remove the at least one restriction, removing the restriction.

11. The method of claim 10, wherein determining whether the recipient has permission to remove the at least one restriction comprises:

retrieving a license from an authorization server, wherein the license is associated with the template applied to the document; and

determining whether the template comprises permission for the recipient to remove.

12. The method of claim 11, further comprising sending the document to a plurality of recipients, wherein at least one of the plurality of recipients has permission to remove the restriction and wherein at least one of the plurality of recipients does not have permission to remove the restriction.

13. The method of claim 1, further comprising applying the template to at least one attachment of the document.

14. A computer-readable medium which stores a set of instructions which when executed performs a method for providing persistent document protection, the method executed by the set of instructions comprising:

receiving a protected document;

receiving a request to perform at least one action on the protected document;

determining whether the request comprises an authorized request; and

in response to determining that the request comprises an authorized request, performing the at least one action on the protected document.

15. The computer-readable medium of claim 14, wherein the protected document is received from a first user associated with a sending organization and the request to perform the at least one action is received from a second user associated with a receiving organization.

16. The computer-readable medium of claim 15, wherein determining whether the request comprises an authorized request comprises retrieving a license associated with the second user from an authorization server associated with the first user.

17. The computer-readable medium of claim 14, further comprising receiving the request to perform the at least one action on the protected document by a server computer in response to an input by a user received by an application executing on at least one client computer.

18. The computer-readable medium of claim 17, further comprising:

determining whether the server computer is operative to perform the requested at least one action; and

in response to determining that the server computer is not operative to perform the requested at least one action, providing a message to the at least one client computer comprising an instruction to download at least one second application operative to perform the requested at least one action.

19. The computer-readable medium of claim 18, wherein determining whether the server computer is operative to perform the requested at least one action comprises determining whether the server computer is operative to access at least one remotely located authorization server.

20. A system for providing persistent document protection, the system comprising:

a memory storage; and

a processing unit coupled to the memory storage, wherein the processing unit is operative to;

receive, by a server associated with a receiving organization, a protected message from a first user associated with a sending organization;

execute a message display application operative to display the protected message and at least one visual indication that the message is protected, wherein the visual indication is associated with at least one restricted action associated with the message and wherein the restricted action comprises at least one of the following;

a restriction preventing the document from being sent to at least one second recipient, a restriction preventing the recipient from printing the document, a restriction preventing the recipient from modifying the document, a restriction preventing the recipient from replying to a sender of the message, a restriction preventing the recipient from replying to all recipients of the message, a restriction preventing the recipient from copying at least a part of the document, and a restriction preventing the document from being viewed by a recipient not affiliated with a specified organization;

receive, via the message display application, a request to perform at least one action on the protected message from a client device communicatively connected to the server associated with a second user, wherein the second user is associated with the receiving organization;

determine whether the server comprises a license to process protected messages received from the receiving organization;

in response to determining that the server does not comprises a license to process protected messages received from the receiving organization, retrieve a server certificate from an authorization server associated with the sending organization;

decrypt the message according to the server certificate;

determine whether the second user comprises an authorized recipient of the protected message;

in response to determining that the second user comprises an authorized recipient of the protected message, retrieve a user license associated with the second user from the authorization server associated with the sending organization;

determine whether the requested at least one action comprises the restricted action associated with the message, wherein the restricted message associated with the message is associated with a template applied to the protected message by at least one of the following;

the first user and the sending organization; and

in response to determining that the request comprises a restricted action, enforce the restriction, wherein being operative to enforce the restriction comprises being operative to refuse to perform the requested action.