Attested content protection

• US 8,387,152 B2
• Filed: 06/27/2008
• Issued: 02/26/2013
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ray, Kenneth D., Lewis, Nathan T., Setzer, Matthew C., Wooten, David R.
• Primary Examiner(s): KOSOWSKI, CAROLYN M
• Application Number:
  US12/163,426
• Publication Number:
  US 20090327705A1
• Time in Patent Office: 1,705 Days
• Field of Search: 726/27, 705/56
• US Class Current: 726/27
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

Computer systems and environments implemented herein permit a local machine increased participation in authorizing access to protected content. An operating system attests to a computing environment at a corresponding computer system. If the computing environment is one permitted to access protected content, the operating system is permitted to regulate further (e.g., application) access to protected content in accordance with a procreation policy. As such, authorization decisions are partially distributed, easing the resource burden on a content protection server. Accordingly, this computing environment can facilitate more robust and efficient authorization decisions when access to protected content is requested.

Claims

1. At a computer system including a processor, an operating system and one or more applications, a method for protecting content, the method comprising:

establishing a protection policy to protect content regardless of where the content is initially or subsequently distributed, the protection policy being manageable by a rights management system that includes a separate rights management server, the protection policy including;

a list of users that are authorized to access the protected content and a list of authorized computing environments that are permitted to access the protected content, wherein the list of authorized computing environments is separately specified for and is specific to each portion of protected content, and wherein each authorized computing environment comprises a specific combination of computer system attributes required for the computing environment to be authorized to access the protected content;

determining by the processor that a user is attempting to access the protected content through an application of the one or more applications at the computer system;

prior to allowing the application to access the protected content;

the computer system exchanging information with the rights management server about the user'"'"'s identity so as to validate that the user is authorized to access the protected content;

the operating system attesting to a specified set of information indicating that the computer system includes the specified combination of computer system attributes required for the computer system to be an authorized computing environment that is permitted to access the protected content according to the established protection policy which includes the list of users and authorized computing environments that are permitted to access the protected content; and

the computer system allowing the application to access the protected content in response to the operating system attesting to an authorized computing environment that is permitted to access the protected content and validating that the user is authorized to access the protected content.

2. The method as recited in claim 1, wherein the computer system exchanging information with the rights management server further comprises:

sending user authentication information for the user to the rights management server; and

obtaining a user key corresponding to the user authentication information for accessing the protected content;

wherein the act of the computer system allowing the application to access the protected content further comprises allowing the application to use the user key to access the protected content.

3. The method as recited in claim 1, wherein the operating system attesting to a set of information indicating an authorized computing environment that is permitted to access the protected content comprises an act of the computer system using a system health agent to collect data about a state of the computer system.

4. The method as recited in claim 3, wherein the operating system attesting to a set of information indicating an authorized computing environment that is permitted to access the protected content comprises an act of the rights management server using a system health validator to validate the collected data.

5. The method as recited in claim 1, wherein the operating system attesting to a set of information indicating an authorized computing environment that is permitted to access the protected content comprises an act of the operating system attesting to one or more of:

a listing of software loaded in a boot path of the computer system, a network location of the computer system, a code integrity policy of the operating system of the computer system, boot options of the operating system, a kernel mode of the computer system, or some combination of the above.

6. The method as recited in claim 1, wherein determining that a user is attempting to access the protected content through an application comprises an act of detecting that a user is attempting to access protected content protected in accordance with the established protection policy.

7. The method as recited in claim 1, wherein establishing a protection policy comprises an act of establishing a protection policy that includes:

a set of use restrictions that restrict what operations an authorized user is permitted to perform with respect to the protected content; and

further comprising the act of the computer system regulating the user'"'"'s access to the protected content such that the user is permitted to perform operations that are permitted by the set of use restrictions and prevented from performing operations that are not permitted by the set of use restrictions.

8. The method as recited in claim 1, wherein the protection policy is specified by a business owner of a business that originated the protected content.

9. At a computer system including a processor, an operating system and one or more applications, a method for protecting content, the method comprising:

establishing a protection policy to protect content regardless of where the content is initially or subsequently distributed, the protection policy including;

a list of users that are authorized to access the protected content, operations that authorized users are permitted to perform with respect to the protected content, and a list of authorized computing environments that are permitted to access the protected content, wherein the list of authorized computing environments is separately specified for and is specific to each portion of protected content, and wherein each authorized computing environment comprises a specific combination of computer system attributes required for the computing environment to be authorized to access the protected content;

determining by the processor that a user is attempting to access the protected content through an application of the one or more applications at the computer system;

sending user identity information for the user to a rights management server;

the operating system attesting to a specified set of information indicating that the computer system includes the specified combination of computer system attributes required for the computer system to be an authorized computing environment that is permitted to access the protected content according to the established protection policy which includes the list of users and authorized computing environments that are permitted to access the protected content;

receiving a user key from the rights management server, the user key usable by the user to access the protected content, the user key being returned to the computer system from the rights management server in response to the rights management server authenticating the user and determining that the attested authorized computing environment is permitted to access the protected content;

the operating system of the computer system permitting the application to use the user key to access the protected content; and

the application controlling the user'"'"'s access to the protected content in accordance with the operations that the users are permitted to perform as indicated in the protection policy.

10. The method as recited in claim 9, wherein attesting to a set of information indicating an authorized computing environment at the computer system comprises an act of using a system health agent to collect state data about a state of the authorized computing environment of the computing system.

11. The method as recited in claim 10, wherein receiving a user key from the rights management server comprises an act of receiving a user key in response to the content protection server using a system health validator to validate the collected state data.

12. The method as recited in claim 9, wherein the operating system attesting to a set of information indicating an authorized computing environment comprises an act of attesting to one or more of:

a listing of software loaded during a boot process, a network location of the computer system, a code integrity policy of the operating system, boot options of the operating system, and kernel mode settings of the computer system.

13. The method as recited in claim 10, wherein establishing a protection policy to protect content comprises an act of a business owner of the protected content establishing the protection policy.

14. A computer system, the computer system comprising:

one or more processors;

system memory; and

one or more physical storage media having stored thereon computer-executable instructions that, when executed by one of the processors, cause the computer system to regulate access to protected content, including the following;

establish a protection policy for protecting content regardless of where the content is initially or subsequently distributed, the protection policy being manageable by a rights management system that includes a separate rights management server, the protection policy including a list of users that are authorized to access the protected content and a list of authorized computing environments that are permitted to access the protected content, wherein the list of authorized computing environments is separately specified for and is specific to each portion of protected content, and wherein each authorized computing environment comprises a specific combination of computer system attributes required for the computing environment to be authorized to access the protected content;

determine that a user is attempting to access the protected content through an application at the computer system;

send user identity information to the rights management server;

attest to a specified set of information indicating that the computer system includes the specified combination of computer system attributes required for the computer system to be an authorized computing environment to the rights management server according to the established protection policy which includes the list of users and authorized computing environments that are permitted to access the protected content;

receive a user key from the rights management server, reception of the user key indicative of;

the rights management server having authenticated the user; and

the rights management server determining that the attested information portrayed an authorized computing environment that is permitted to access the protected content such that the operating system is trusted to regulate the user'"'"'s access to the protected content in accordance with the protection policy.

15. The system as recited in claim 14, wherein computer-executable instructions that, when executed, cause the computer system to attest to information about the authorized computing environment of the computer system comprise computer-executable instructions that, when executed, cause the computer system to

use a system health agent to collect state data about a state of the computer system;

and

attest to the collected state data to the rights management server.

16. The system as recited in claim 15, wherein the rights management server uses a system health validator to validate data collected by the system health agent of the computer system.

17. The system as recited in claim 14, wherein computer-executable instructions that, when executed, cause the computer system to attest to information about the authorized computing environment of the computer system comprise computer-executable instructions that, when executed, cause the computer system to attest to one or more of the following:

a listing of software loaded during a boot process, a network location of the computer system, a code integrity policy of the operating system, boot options of the operating system, and kernel mode settings of the computer system.

18. The system as recited in claim 14, wherein computer-executable instructions that, when executed, cause the computer system to establish a protection policy for protecting content comprise computer-executable instructions that, when executed, cause the computer system to establish a protection policy, including a set of use restrictions that restrict what operations an authorized user is permitted to perform with respect to the protected content.

19. The system as recited in claim 18, further computer-executable instructions that, when executed, cause:

the operating system to permit the application to use the user key to access the protected content; and

the application to control the user'"'"'s access to the protected content in accordance with the operations that the user is permitted to perform as indicated in the protection policy.

20. The system as recited in claim 14, wherein computer-executable instructions that, when executed, cause the computer system to establish a protection policy for protecting content comprise computer-executable instructions that, when executed, cause the computer system to establish a protection policy at the direction of a business owner of the protected content.