Pre-licensing of rights management protected content

• US 7,210,165 B2
• Filed: 10/29/2003
• Issued: 04/24/2007
• Est. Priority Date: 10/29/2003
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Cahill, Jason M., DeMello, Marco A., Davis, Malcolm H., Waxman, Peter D., Graham, Christopher F., Speare, John Gerard
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): COLIN, CARL G
• Application Number:
  US10/697,916
• Publication Number:
  US 20050097359A1
• Time in Patent Office: 1,273 Days
• Field of Search: 713/171, 713/200, 713/201, 709/225, 705/54, 380/4, 380/11, 717/11
• US Class Current: 726/4
• CPC Class Codes: G06F 21/107 License processing; Key processing
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06Q 30/018 Certifying business or products

Abstract

The present invention allows for a pre-licensing process for content that is subject to rights management in order to allow a principal access to the content when the principal does not have access to the rights management server. Rather than requiring the principal to submit a rights account certificate and request for a use license to the rights management server, the present invention allows the message server to obtain a use license on behalf of the principal. Accordingly, the principal can access the use license from the message server and decrypt protected content without having to request the use license from the rights management server.

Claims

1. In a messaging system comprising a rights management server that controls the type of operations principals can perform on protected content and a message server that receives messages and makes them available to principals or their agents, a method of pre-licensing content subject to rights management in order to allow a principal access to the content when the principal does not have access to the rights management server, the method comprising acts of:

receiving, by the message server, which is distinct from a rights management server, a message from a sending computing system, the message being subject to rights management in that access to at least a part of the message is controlled through a rights management server, the message server recognizing that the message is subject to rights management,

receiving, by the message server, a publishing license from the sending computing system, the publishing license containing a rights expression identifying the at least part of the message subject to rights management, specifying one or more intended recipients for the at least part of the message subject to rights management, and specifying one or more rights for each of the one or more intended recipients, and wherein the rights expression limits the one or more principals'"'"' operation in at least one of re-licensing, printing, forwarding and sharing of the message, the publishing license being previously acquired by the sending computing system from the rights management server;

upon the message server recognizing that the message is subject to rights management, requesting from the rights management server, by the message server on behalf of one or more principals, at least one use license for allowing the one or more principals access to the message, wherein the request includes the publishing license to identify the at least part of the message subject to rights management to the rights management server;

the rights management server issuing to the message server one or more use licenses that allow one or more principals to access the at least part of the message subject to rights management without subsequent access to a rights management server;

receiving, by the message server on behalf of the one or more principals, the at least one use license so that the one or more principals may obtain the at least one use license from the message server and access the at least part of the message subject to rights management without the one or more principals having to request the at least one use license from a rights management server;

providing, by the message server, to at least one of the one or more principals, one or more of the at least one use license; and

receiving, by the principal, from the message server, the content and the use license such that the principal is enabled to access the content in accordance with the use license at a time when the principal does not have access to a rights management server.

2. The method of claim 1, wherein the at least a part of the message controlled through the rights management server is encrypted, and wherein the use license comprises a content key used in decrypting the part of the message that is encrypted.

3. The method of claim 2, wherein the part of the message that is encrypted is at least one of a protected contact, protected document, protected calendar item or protected meeting request.

4. The method of claim 1, wherein the act of requesting at least one use license further includes sending an authentication to the rights management server to verify that the message server has the authority to obtain the at least one use license on behalf of the one or more principals.

5. The method of claim 1, wherein the message server requests multiple use licenses on behalf of the one or more principals so that the one or more principals may access the message on multiple machines.

6. The method of claim 1, wherein the at least one use license is stored by the message server separate from the message.

7. The method of claim 1, wherein the publishing license includes a reference to the one or more principals such that when the message server requests the at least one use license, the rights management server may validate that the one or more principals are intended to have access to the message.

8. The method of claim 7, wherein the publishing license further includes at least one rights expression that limits the types of operations the one or more principals are allowed to perform with regard to copying of the message.

9. The method of claim 8, wherein the rights expression is a default value of read only.

10. The method of claim 7, wherein the at least one rights expression in the publishing license limits the one or more principals'"'"' operation of printing the message.

11. The method of claim 10, wherein the rights expression includes an expiration feature, which limits at least one of the number of times or a time period the at least one rights expression is available.

12. The method of claim 1, wherein the at least one principal is a process, user, machine, server or client.

13. The method of claim 1, wherein the publishing license further comprises one or more of a hash used to verify the message has not changed and a signing by the rights management server used to verify that the publishing license is valid.

14. The method of claim 1, wherein the publishing license references multiple principals for which the message is intended, and wherein the message server retrieves use licenses on behalf of the multiple principals by a batch request process for balancing the load on the rights management server.

15. In a messaging system comprising a rights management server that controls the type of operations principals can perform on protected content and a message server that receives messages and makes them available to principals or their agents, a method of pre-licensing content subject to rights management in order to allow a principal access to the content when the principal does not have access to the rights management server, the method comprising steps for:

receiving by a message server a message and a publishing license from a sending computing system, the message containing protected content;

determining by the message server that the message received from a sending computing system contains protected content which is subject to rights management in that access to at least a part of the message is controlled through a rights management server, the rights management server issuing one or more user licenses that allow one or more principals to access the at least part of the message subject to rights management;

upon determining by the message server that the message received from a sending computing system contains protected content, requesting by the message server from a rights management server at least one use license, the publishing license being previously acquired by the sending computing system from the rights management server,

wherein the rights management server issues, to the message server, one or more use licenses that allow one or more principals to access the at least part of the message subject to rights management without subsequent access to a rights management server; and

obtaining, from the rights management server, by the message server, which is distinct from the rights management server, on behalf of one or more principals, said at least one use license, and such that the use license provides the principal access to the content in accordance with the use license at a time when the principal does not have access to the rights management server.

16. The method of claim 15, wherein the at least a part of the message controlled though the rights management server is encrypted, and wherein the use license comprises a content key used in decrypting the part of the message that is encrypted.

17. The method of claim 16, wherein the part of the message that is encrypted is at least one of a protected contact, protected document, protected calendar item or protected meeting request.

18. The method of claim 15, wherein step for obtaining at least one use license includes the act of requesting, by the message server on behalf of the one or more principals, the at least one use license, wherein the request includes the received publishing license for identifying the message to the rights management server, and wherein the request includes an authentication certificate for the rights management server for verifying that the message server has the authority to obtain the at least one use license on behalf of the one or more principals.

19. The method of claim 18, wherein the received publishing license includes a reference to the one or more principals such that when the message server requests the at least one use license, the rights management server may validate that the one or more principals are intended to have access to the message.

20. The method of claim 19, wherein the publishing license further includes at least one rights expression that limits forwarding of the message by the one or more principals of the message.

21. The method of claim 19, wherein the at least one fights expression in the publishing license limits the one or more principals'"'"' operation of re-licensing.

22. The method of claim 21, wherein the rights expression includes an expiration feature, which limits a number of times the at least one rights expression is available.

23. The method of claim 19, wherein the fights expression is a default value of read only.

24. The method of claim 15, wherein the message server requests multiple use licenses on behalf of the one or more principals so that the one or more principals may access the message on multiple machines.

25. The method of claim 15, wherein the at least one use license is stored by the message server separate from the message.

26. The method of claim 15, wherein the at least one principal is a process, user, machine, server or client.

27. The method of claim 15, wherein the received publishing license further comprises one or more of a hash used to verify the message has not changed and a signing by the rights management server used to verify that the publishing license is valid.

28. The method of claim 15, wherein the received publishing license references multiple principals for which the message is intended, and wherein the message server retrieves use licenses on behalf of the multiple principals by a batch requests process for balancing the load on the fights management server.

29. In a messaging system comprising a rights management server that controls the type of operations principals can perform on protected content and a message server that receives messages and makes them available to principals or their agents, a computer program product comprising one or more computer readable media carrying computer executable instructions that implement a method of pre-licensing content subject to rights management in order to allow a principal access to the content when the principal does not have access to the rights management server, the method comprising:

receiving, by the message server, which is distinct from a rights management server, a message from a sending computing system, the message being subject to rights management in that access to at least a part of the message is controlled through a rights management server, the message server recognizing that the message is subject to rights management,

receiving, by the message server, a publishing license from the sending computing system, the publishing license containing a rights expression identifying the at least part of the message subject to rights management, specifying one or more intended recipients for the at least part of the message subject to rights management, and specifying one or more rights for each of the one or more intended recipients, and wherein the rights expression limits the one or more principals'"'"' operation in at least one of re-licensing, printing, forwarding and sharing of the message, the publishing license being previously acquired by the sending computing system from the rights management server;

upon the message server recognizing that the message is subject to rights management, requesting from the rights management server, by the message server on behalf of one or more principals, at least one use license for allowing the one or more principals access to the message, wherein the request includes the publishing license to identify the at least part of the message subject to rights management to the rights management server;

the rights management server issuing to the message server one or more use licenses that allow one or more principals to access the at least part of the message subject to rights management without subsequent access to a rights management server;

receiving, by the message server on behalf of the one or more principals, the at least one use license so that the one or more principals may obtain the at least one use license from the message server and access the at least part of the message subject to rights management without the one or more principals having to request the at least one use license from a rights management server;

providing, by the message server, to at least one of the one or more principals, one or more of the at least one use license; and

receiving, by the principal, from the message server, the content and the use license such that the principal is enabled to access the content in accordance with the use license at a time when the principal does not have access to a rights management server.

30. The computer program product of claim 29, wherein the publishing license includes a reference to the one or more principals such that when the message server requests the at least one use license, the rights management server may validate that the one or more principals are intended to have access to the message.

31. The computer program product of claim 30, wherein the publishing license further includes at least one rights expression that limits at least one of coping and delegating.

32. The computer program product of claim 30, wherein the at least one rights expression in the publishing license limits the one or more principals'"'"' operation in saving.

33. The computer program product of claim 32, wherein the rights expression includes an expiration feature, which limits at least one of the number of times or a time period the at least one rights expression is available.

34. The computer program product of claim 30, wherein the rights expression is a default value of read only.

35. The computer program product of claim 29, wherein the at least one principal is a process, user, machine, server or client.

36. The computer program product of claim 29, wherein the publishing license references multiple principals for which the message is intended, and wherein the message server retrieves use licenses on behalf of the multiple principals by a batch request process for balancing the load on the rights management server.

37. In a messaging system comprising a rights management server that controls the type of operations principals can perform on protected content and a message server that receives messages and makes them available to principals or their agents, a computer program product comprising one or more computer readable media carrying computer executable instructions that implement a method of pre-licensing content subject to rights management in order to allow a principal access to the content when the principal does not have access to the rights management server, the method comprising steps for:

receiving by a message server a message and a publishing license from a sending computing system, the message containing protected content;

determining by the message server that the message received from a sending computing system contains protected content which is subject to rights management in that access to at least a part of the message is controlled through a rights management server, the rights management server issuing one or more user licenses that allow one or more principals to access the at least bart of the message subject to rights management;

upon determining by the message server that the message received from a sending computing system contains protected content, requesting by the message server from a rights management server at least one use license, the publishing license being previously acquired by the sending computing system from the rights management server,

wherein the rights management server issues, to the message server, one or more use licenses that allow one or more principals to access the at least part of the message subject to rights management without subsequent access to a rights management server; and

obtaining, from the rights management server, by the message server, which is distinct from the rights management server, on behalf of one or more principals, said at least one use license, and such that the use license provides the principal access to the content in accordance with the use license at a time when the principal does not have access to the rights management server.

38. The computer program product of claim 37, wherein the at least a part of the message controlled through the rights management server is encrypted, and wherein the use license comprises a content key used in decrypting the part of the message that is encrypted, and wherein the part of the message that is encrypted is at least one of a protected contact, protected document, protected calendar item or protected meeting request.

39. The computer program product of claim 37, wherein step for obtaining at least one use license includes the act of requesting, by the message server on behalf of the one or more principals, the at least one use license, wherein the request includes the received publishing license for identifying the message to the rights management server, and wherein the request includes an authentication for the rights management server for verifying that the message server has the authority to obtain the at least one use license on behalf of the one or more principals.

40. The computer program product of claim 37, wherein the message server requests multiple use licenses on behalf of the one or more principals so that the one or more principals may access the message on multiple machines.

41. The computer program product of claim 37, wherein the at least one use license is stored by the message server separate from the message.

42. The computer program product of claim 37, wherein the received publishing license further includes at least one rights expression that includes an expiration feature, which limits a number of times the at least one rights expression is available.

43. The computer program product of claim 37, wherein the at least one principal is a process, user, machine, server or client.

44. The computer program product of claim 37, wherein the received publishing license references multiple principals for which the message is intended, and wherein the message server retrieves use licenses on behalf of the multiple principals by a batch request process for balancing the load on the rights management server.