Licensing protected content to application sets

• US 8,225,390 B2
• Filed: 06/27/2008
• Issued: 07/17/2012
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ray, Kenneth D., Kamat, Pankaj M., Kaufman, Charles W., Leach, Paul J., Tipton, William R., Herron, Andrew, Karamfilov, Krassimir E., Bryce, Duncan G., Schwartz, Jonathan D., Setzer, Matthew C., McDowell, John
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): Cribbs, Malcolm
• Application Number:
  US12/163,548
• Publication Number:
  US 20090328134A1
• Time in Patent Office: 1,481 Days
• Field of Search: 726 1- 4, 726/16, 726/17, 726/21, 726 26- 29, 705/51, 705/56
• US Class Current: 726/17
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level

Abstract

The present invention extends to methods, systems, and computer program products for licensing protected content to application sets. Embodiments of the invention permit a local machine to increase its participation in authorizing access to protected content. For example, an operating system within an appropriate computing environment is permitted to determine if an application is authorized to access protected content. Thus, the application is relieved from having to store a publishing license. Further, authorization decisions are partially distributed, easing the resource burden on a protection server. Accordingly, embodiments of the invention can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Claims

1. At a computer system, which includes one or more processors, a method for providing access to protected content, the method comprising:

an act of the computer system detecting that a user is attempting to access protected content through an application at the computer system, the protected content protected in accordance with a protection policy, the protection policy managed by a digital rights management system that includes a separate digital rights management server, the protection policy including an application set which identifies a set of applications that are allowed to access the protected content according to the protection policy;

prior to allowing the application to access the protected content;

an act of the computer system exchanging information with the digital rights management server, the information including one or more attributes of the computer system'"'"'s operating environment, the one or more attributes used by the digital rights management server to determine that the computer system is trusted to evaluate whether the application is in the application set;

based at least in part on the computer system exchanging information with the digital rights management server, an act of the computer system obtaining a user key corresponding to the user, the user key being usable for accessing the protected content, the user key issued by the digital rights management server after determining that the user is authorized to access the protected content and after determining that the computer system is trusted to evaluate whether the application is in the application set; and

an act of the computer system determining that the application is in the application set; and

subsequent to the computer system determining that the application is in the application set, an act of the computer system allowing the application to use the user key to access the protected content.

2. The method as recited in claim 1, wherein the act of detecting that a user is attempting to access protected content through an application at the computer system comprises an act of detecting that a user is attempting to access protected content protected in accordance with a protection policy, the protection policy including the application set and one or more computing environments that are appropriate for evaluating application set membership in the application set.

3. The method as recited in claim 1, wherein the application set includes one or more application IDs for applications that are authorized to access the protected content.

4. The method as recited in claim 1, wherein the protected content is protected in accordance with a protection policy of a business owner of the protected content.

5. The method as recited in claim 1, wherein the act of the computer system exchanging information with digital rights management server comprises:

an act of sending user authentication information for the user to the digital rights management server.

6. The method as recited in claim 1, wherein the attributes of the computer system'"'"'s operating environment indicate one or more of a network location, a boot path for the operating system, a code integrity policy for the operating system, boot options for the operating system, information from a system health agent (“

SHA”

), and information from a system health validator (“

SHV”

).

7. The method as recited in claim 3, wherein the act of the computer system determining that the application is in the application set comprises:

an act of an operating system at the computer system generating an application ID for the application; and

an act of the operating system at the computer system determining that the application is in the application set by determining that the generated application ID is one of the application IDs for applications that are authorized to access the protected content.

8. The method as recited in claim 1, wherein the act of the computer system determining that the application is in the application set comprises:

an act of an the computer system comparing an application ID of the application to one or more application IDs included in the application set; and

an act of determining that the application ID of the application is included in the application set.

20. The method as recited in claim 7, wherein the act generating an application ID for the application comprises an act of generating the application ID from one or more of an application version, an application patch history, an application ownership, or an application certification of the application.

9. At a computer system, which includes one or more processors, a method for providing access to protected content, the method comprising:

an act of detecting that a user is attempting to access protected content through an application at the computer system, the protected content protected in accordance with a protection policy, the protection policy specified by a business owner of a business that originated the protected content, the protection policy indicating;

users that are authorized to access the content, operations authorized users are permitted to perform with respect to the protected content, computing environments that are permitted to access the content, and a set of applications that are permitted to access the content;

an act of sending user identity information for the user to a content protection server;

an act of sending one or more attributes of a computing environment of the computer system to the content protection server, including one or more attributes indicating that the computer system is sufficiently trusted to evaluate whether the application is in the set of applications that are permitted to access the content;

an act of receiving a user key from the content protection server, the user key usable by the user to access the protected content, the user key returned from the content protection server to the computer system in response to authenticating the user based on the user identity information and in response to determining that the one or more attributes of the computing environment indicate that the computer system is sufficiently trusted to evaluate whether the application is in the set of applications that are permitted to access the content;

an act of an operating system at the computer system determining if the application is included in the set of applications in the protection policy; and

an act of the operating system appropriately regulating the application'"'"'s access to the protected content based on the determination, including;

an act of permitting the application to access the protected content when the application is included in the set of applications in the protection policy; and

an act of preventing the application form accessing the protected content when the application is not included in the set of applications in the protection policy.

10. The method as recited in claim 9, authorized applications in the set of applications are applications trusted to appropriately enforce the operations users are permitted to perform.

11. The method as recited in claim 9, wherein the act of sending user identity information for the user to a content protection server comprises an act of sending user credentials to the protection server.

12. The method as recited in claim 9, wherein the act of sending one or more attributes of a computing environment of the computer system to the content protection server comprises an act of sending attributes indicating one or more of a network location, a boot path for the operating system, a code integrity policy for the operating system, boot options for the operating system, information from a system health agent (“

SHA”

), and information from a system health validator (“

SHV”

).

13. The method as recited in claim 9, wherein the act of the operating system at the computer system determining if the application is included in the set of applications in the protection policy comprises an act of the operating system:

generating an application ID for the application, and

comparing the generated application ID for the application to application IDs included in the protection policy.

14. The method as recited in claim 9, wherein the act of the operating system at the computer system determining if the application is included in the set of applications in the protection policy comprises an act of the operating system determining that the application is included in the set of applications.

15. The method as recited in claim 9, wherein the act of permitting the application to access the protected content comprises an act of the application enforcing operations authorized users are permitted to perform with respect to the protected content.

16. A computer system, the computer system comprising:

one or more processors;

system memory; and

one or more computer-readable media having stored thereon computer executable instructions that, when executed by one of the processors, cause the computer system to provide access to protected content, including the following;

detect that a user is attempting to access protected content through an application at the computer system, the protected content protected in accordance with a digital rights management (DRM) protection policy, the DRM protection policy specified by a business owner of a business that originated the protected content, the protection policy indicating;

users that are authorized to access the content, operations authorized users are permitted to perform with respect to the protected content, computing environments that are permitted to access the content, and a set of applications that are permitted to access the content;

send user credentials for the user to a DRM server;

send one or more system attributes of the computer system to the DRM server to indicate that the computing environment of the computer system can be trusted by the DRM server to evaluate whether the application at the computer system is in the set of applications that are permitted to access the content;

receive a user key from the DRM server, the user key usable by the user to access the protected content, the user key returned from the DRM server to the computer system in response to authenticating the user with the user credentials and in response to determining that the one or more system attributes indicate a computing environment that can be trusted by the DRM server to evaluate whether the application is in the set of applications that are permitted to access the content according to the protection policy;

an operating system at the computer system determining if the application is included in the set of applications in the protection policy, inclusion in the set of applications indicative of an application that is trusted to enforce operations authorized users are permitted to perform with respect to the protected content; and

the operating system appropriately regulating the application'"'"'s access to the protected content based on the determination, including;

permitting the application to enforce operations authorized users are permitted to perform with respect to the protected content when the application is included in the set of applications in the protection policy; and

preventing the application from accessing the protected content when the application is not included in the set of applications in the protection policy.

17. The system as recited in claim 16, wherein untrusted applications excluded from the set of applications are tagged as unusable by the operating system to enforce operations authorized users are permitted to perform with respect to the protected content.

18. The system as recited in claim 16, wherein computer executable instructions that, when executed by one of the processors, cause the computer system to determine if the application is included in the set of applications in the protection policy comprise computer executable instructions that, when executed by one of the processors, cause the computer system to generate an application ID for the application and to compare the generated application ID for the application to application IDs in the set of the applications.

19. The system as recited in claim 16, wherein computer executable instructions that, when executed by one of the processors, cause the computer system to send one or more system attributes of the computer system to the DRM server, to indicate the computing environment of the computer system to the DRM server comprise computer executable instructions that, when executed by one of the processors, cause the computer system to send one or more of:

a network location, a boot path for the operating system, a code integrity policy for the operating system, boot options for the operating system, information from a system health agent (“

SHA”

), and information from a system health validator (“

SHV”

).