Organization-based content rights management and systems, structures, and methods therefor

• US 7,512,798 B2
• Filed: 06/27/2003
• Issued: 03/31/2009
• Est. Priority Date: 06/27/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Brown, Kevin, Antonoff, Lauren, Graham, Chris, Cahill, Jason, Kouznetsov, Pavel
• Primary Examiner(s): Nalven; Andrew L
• Application Number:
  US10/608,476
• Publication Number:
  US 20050027804A1
• Time in Patent Office: 2,104 Days
• Field of Search: 705/51, 380/284, 713/170
• US Class Current: 713/170
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]

Abstract

A method is employed to propagate rights management (RM) protection to an email and to an attachment thereof comprising an RM-protectable document. The email with the RM-protectable attachment is authored, and a content key (KD) and a bind ID are generated. RM protection is first applied to the RM-protectable attachment of the email based on the generated (KD) and the generated bind ID, and the RM-protected attachment is attached to the email. RM protection is then applied to the email with the attached RM-protected attachment based on the generated (KD) and the generated bind ID. The RM-protected email and the RM-protected attachment thereof thus share the generated (KD) and the generated bind ID such that a license obtained for the RM-protected email and having therein the generated bind ID and the generated (KD) can be applied to render the RM-protected email and also the RM-protected attachment thereof.

Claims

1. A method of propagating rights management protection to an email and to an attachment of the email, the attachment comprising a rights-management-protectable attachment, the method comprising:

generating a content key;

generating a bind identifier;

generating rights data including the generated content key and the generated bind identifier, wherein the rights data sets forth each entity having rights with respect to the email and the rights-management-protectable attachment, and wherein the rights data further sets forth a description of the particular rights associated with each entity;

applying rights management protection to the rights-management-protectable attachment of the email based on the generated content key, the generated bind identifier, and the generated rights data, wherein the generated rights data is attached to the rights-management-protectable attachment;

attaching the rights-management-protectable attachment to the email; and

applying rights management protection to the email based on the generated content key, the generated bind identifier, and the generated rights data, wherein the generated rights data is attached to the email, and

wherein the rights-management-protected email and the rights-management-protectable attachment thereof share the generated content key, the generated bind identifier, and the generated rights data such that a license obtained for the rights-management-protected email and having therein the generated bind identifier and the generated content key can be applied to render the rights-management-protected email and also the rights-management-protectable attachment thereof.

2. The method of claim 1 wherein applying rights management protection comprises:

encrypting at least one of the email or the rights-management-protectable attachment with the content key to form a content-key-encrypted item; and

attaching the generated rights data to the content-key-encrypted item to form a package containing the item in a rights-management-protected form, whereby the rights data from the package may be employed to obtain the license for the rights-management-protected email and the rights-management-protectable attachment thereof, such license thus including the bind identifier of the rights data and being bound to the rights-management-protected email and the rights-management-protectable attachment thereby.

3. The method of claim 2 fun her comprising submitting the generated rights data for signing and receiving signed rights data based thereon, whereby the signed rights data is tamper-resistant in that any changes to the signed rights data will cause the signature to fail to verify, and wherein attaching the generated rights data comprises attaching the signed rights data.

4. The method of claim 3 wherein submitting the generated rights data for signing comprises submitting the generated rights data to the rights management server for signing.

5. The method of claim 2 wherein attaching the generated rights data comprises concatenating the generated rights data with the content-key-encrypted item to form the package containing the item in the rights-management-protected form.

6. The method of claim 1 further comprising providing the generated content key to a rights management server so that all requests for a license corresponding to at least one of the email or the rights-management-protectable attachment are directed to the rights management server.

7. The method of claim 6 further comprising encrypting the content key with a public key of the rights management server to result in a rights-management-public-key-encrypted content key such that only the rights management server with a corresponding rights management private key can decrypt the rights-management-public-key-encrypted content key to reveal the content key.

8. A computer-readable storage medium having stored thereon an email and an associated attachment, the email and the attachment being rights-management-protected, the attachment of the email being rights-management-protected based on a particular content key, a particular bind identifier, and common rights data attached to the attachment, the email with the rights-management-protected attachment itself being rights-management-protected based on the particular content key, the particular bind identifier, and the common rights data attached to the email, wherein the rights-management-protected email with the rights-management-protected attachment therein share the particular content key, the particular bind identifier, and the common rights data such that a license obtained for the rights-management-protected email and having therein the generated bind identifier and the generated content key can be applied to render the rights-management-protected email and also the rights-management-protected attachment therein, wherein the common rights data sets forth each entity having rights with respect to the email and the attachment and a description of the particular rights associated with each entity, and wherein the computer-readable storage medium includes computer-executable instructions for storing the email and the associated attachment on the computer-readable storage medium.

9. The computer-readable storage medium of claim 8 wherein the rights management protection comprises encrypting at least one of the rights-management-protected email or the rights-management-protected attachment with the content key to form a content-key-encrypted item and having attached thereto the common rights data to form a package containing the item in a rights-management-protected form, the common rights data including the particular bind identifier and the particular content key provided to a rights management server so that all requests for a license corresponding to the item are directed to such rights management server, and setting forth each entity that has rights with respect to the rights-management-protected email and the rights-management-protected attachment thereof and for each such entity a description of such rights, whereby the common rights data from the package may be employed to obtain the license for the rights-management-protected email and the rights-management-protected attachment therein, such license thus including the particular bind identifier of the common rights data and being bound to the rights-management-protected email and the rights-management-protected attachment thereby.

10. The computer-readable storage medium of claim 9 wherein the common rights data comprises rights data submitted for signing and received as signed rights data based thereon, whereby the signed rights data is tamper-resistant in that any changes to the signed rights data will cause the signature to fail to verify.

11. The computer-readable storage medium of claim 10 wherein the common rights data is submitted to the rights management server for signing.

12. The computer-readable storage medium of claim 9 wherein the content key is encrypted with a public key of the rights management server to result in a rights-management-public-key-encrypted content key such that only the rights management server with a corresponding rights management private key can decrypt the rights-management-public-key-encrypted content key to reveal the content key.

13. The computer-readable storage medium of claim 9 wherein the common rights data is concatenated with the content-key-encrypted item to form the package containing the item in the rights-management-protected form.

14. A computer-readable storage medium having stored thereon computer-executable instructions for propagating rights management protection to an email and to an attachment of the email, the attachment comprising a rights-management-protectable attachment, the computer-executable instructions comprising instructions for:

generating a content key;

generating a bind identifier;

generating rights data including the generated content key and the generated bind identifier, wherein the rights data sets forth each entity having rights with respect to the email and the rights-management-protectable attachment, and wherein the rights data further sets forth a description of the particular rights associated with each entity;

applying rights management protection to the rights-management-protectable attachment of the email based on the generated content key, the generated bind identifier, and the generated rights data, wherein the generated rights data is attached to the rights-management-protectable attachment;

attaching the rights-management-protectable attachment to the email; and

applying rights management protection to the email based on the generated content key, the generated bind identifier, and the generated rights data, wherein the generated rights data is attached to the email and

wherein the rights-management-protected email and the rights-management-protectable attachment thereof share the generated content key, the generated bindidentifier, and the generated rights data such that a license obtained for the rights-management-protected email and having therein the generated bind identifier and the generated content key can be applied to render the rights-management-protected email and also the rights-management-protectable attachment thereof.

15. The computer-readable storage medium of claim 14 wherein applying rights management protection comprises:

encrypting at least one of the email or the rights-management-protectable attachment with the content key to form a content-key-encrypted item; and

attaching the generated rights data to the content-key-encrypted item to form a package containing the item in a rights-management-protected form, whereby the rights data from the package may be employed to obtain the license for the rights-management-protected email and the rights-management-protectable attachment thereof, such license thus including the bind identifier of the rights data and being bound to the rights-management-protected email and the rights-management-protectable attachment thereby.

16. The computer-readable storage medium of claim 15 wherein the computer-executable instructions further comprise instructions for submitting the generated rights data for signing and receiving signed rights data based thereon, whereby the signed rights data is tamper-resistant in that any changes to the signed rights data will cause the signature to fail to verify, and wherein attaching the generated rights data comprises attaching the signed rights data.

17. The computer-readable storage medium of claim 16 wherein submitting the generated rights data for signing comprises submitting the generated rights data to the rights management server for signing.

18. The computer-readable storage medium of claim 15 wherein attaching the generated rights data comprises concatenating the generated rights data with the content-key-encrypted item to form package containing the item in the rights-management-protected form.

19. The computer-readable storage medium of claim 14 wherein the computer-executable instructions further comprise instructions for providing the generated content key to a rights management server so that all requests for a license corresponding to at least one of the email or the rights-management-protectable attachment are directed to the rights management server.

20. The computer-readable storage medium of claim 19 wherein the computer-executable instructions further comprise instructions for encrypting content key with a public key of the rights management server to result in a rights-management-public-key-encrypted content key such that only the rights management server with a corresponding rights management private key can decrypt the rights-management-public-key-encrypted content key to reveal content key.

21. A computer-readable storage medium having stored thereon a data structure comprising an email having an attachment, the email and the attachment being rights-management-protected, the attachment of the email being rights-management-protected based on a particular content key, a particular bind identifier, and common rights data attached to the attachment, the email with the rights-management-protected attachment itself being rights-management-protected based on the particular content key the particular bind identifier, and the common rights data attached to the email, wherein the rights-management-protected email with the rights-management-protected attachment therein share the particular content key, the particular bind identifier, and the common rights data such that a license obtained for the rights-management-protected email and having therein the generated bind identifier and the generated content key can be applied to render the rights-management-protected email and also the rights-management-protected attachment therein, and wherein the common rights data sets forth each entity having rights with respect to the email and the attachment and a description of the particular rights associated with each entity.

22. The computer-readable storage medium of claim 21 wherein the rights management protection comprises encrypting at least one of the rights-management-protected email or the rights-management-protected attachment with the content key to form a content-key-encrypted item and having attached thereto the common rights data to form a package containing the item in a rights-management-protected form, the common rights data including the particular bind identifier and the particular content key provided to a rights management server so that all requests for a license corresponding to the item are directed to such rights management server, and setting forth each entity that has rights with respect to the rights-management-protected email and the rights-management-protected attachment thereof and for each such entity a description of such rights, whereby the common rights data from the package may be employed to obtain the license for the rights-management-protected email and the rights-management-protected attachment therein, such license thus including the bind identifier of the common rights data and being bound to the rights-management-protected email and the rights-management-protected attachment thereby.

23. The computer-readable storage medium of claim 22 wherein the common rights data comprises rights data submitted for signing and received as signed rights data based thereon, whereby the signed rights data is tamper-resistant in that any 20 changes to the signed rights data will cause the signature to fail to verify.

24. The computer-readable storage medium of claim 23 wherein the common rights data is submitted to the rights management server for signing.

25. The computer-readable storage medium of claim 22 wherein the content key is encrypted with a public key of the rights management server to result in a rights-management-public-key-encrypted content key such that only the rights management server with a corresponding rights management private key can decrypt the rights-management-public-key-encrypted content key to reveal content key.

26. The computer-readable storage medium of claim 22 wherein the common rights data is concatenated with the content-key-encrypted item to form the package containing the item in the rights-management-protected form.