Hybrid digital rights management system and related document access authorization method

Patent metadata

Field	Value
Publication number	US-9959395-B2
Application number	US-201514788419-A
Country	US
Kind code	B2
Filing date	Jun 30, 2015
Priority date	Jun 30, 2015
Publication date	May 1, 2018
Grant date	May 1, 2018

Abstract

A digital rights management system includes two digital rights management servers (RMS servers) connected to a client computer. The two RMS servers implement different but related digital rights management (DRM) policies, with the first RMS server implementing conventional DRM policies and the second RMS server implementing extended DRM policies. An application program on the client computer interacts with a document on the client computer, and communicates with the first RMS server to obtain access authorization for the document. A plug-in program in the client computer cooperates with the application program, and communicates with the second RMS server to obtain additional access authorization for the document. Access to the document is granted when both RMS servers grant access to the document. This achieves extended digital rights management control which can provide a more flexible access control than that provided by existing DRM systems.

First claim

What is claimed is:

1. A digital rights management method implemented in a system including a first digital rights management server (first RMS server), a second digital rights management server (second RMS server), and a client computer connected to the first RMS server and the second RMS server, the client computer including an application program for interacting with a document which is requested to be accessed by a user and a plug-in program which cooperates with the application program, the method comprising:
(a) the application program communicating with the first RMS server to obtain a first authorization response which indicates whether the first RMS server grants or denies access to the document by the user under a first digital rights management policy (first DRM policy) stored on the first RMS server;
(b) the plug-in program communicating with the second RMS server to obtain a second authorization response which indicates whether the second RMS server grants or denies access to the document by the user under a second digital rights management policy (second DRM policy) stored on the second RMS server, wherein the second RMS server is a separate and different server from the first RMS server, and wherein the second DRM policy contains additional policy terms not contained in the first DRM policy; and
(c) the plug-in program and the application program cooperating with each other to grant or deny access to the document by the user based on the first authorization response which has been obtained from the first RMS server and the second authorization response which has been obtained from the second RMS server, wherein the plug-in program and the application program grant access to the document by the user only if the first authorization response indicates that the first RMS server grants access to the document by the user and the second authorization response indicate that the second RMS server grants access to the document by the user.

2. The method of claim 1 , wherein the second RMS server stores a document authorization table, the document authorization table containing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to a document represented by the document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a user ID of the user requesting the access;
the second RMS server extracting the document ID and the user ID from the authorization request received from the plug-in program;
the second RMS server querying the document authorization table using the document ID to obtain the full policy information associated with the document ID, and based on the full policy information, determining whether the user is to be granted or denied access to the document; and
the second RMS server transmitting the authorization response to indicate whether the user is granted or denied access to the document.

3. The method of claim 1 , wherein the second RMS server stores a document authorization table, the document authorization table storing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to the document, the document authorization table further including a status associated with each document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a user ID of the user requesting access;
the second RMS server extracting the document ID and the user ID from the authorization request received from the plug-in program;
the second RMS server querying the document authorization table using the document ID to first determine whether the associated status is a first value, and if it is, to obtain the associated full policy information, and based on the full policy information, determining whether the user is to be granted or denied access to the document; and
the second RMS server transmitting the authorization response to indicate whether the user is granted or denied access to the document.

4. The method of claim 1 , wherein the second RMS server is a Microsoft Active Directory RMS server and the application program is a Microsoft Office program.

5. The method of claim 1 , wherein step (c) includes:
after step (b), the plug-in program passing the second authorization response to the application program; and
the application program granting or denying access to the document by the user based on the first authorization response received from the first RMS server and the second authorization response received from the plug-in program.

6. A digital rights management method implemented in a system including a first digital rights management server (first RMS server), a second digital rights management server (second RMS server), and a client computer connected to the first RMS server and the second RMS server, the client computer including an application program for interacting with a document which is requested to be accessed by a user and a plug-in program which cooperates with the application program, the method comprising:
(a) the application program communicating with the first RMS server to obtain a first authorization response which indicates whether the first RMS server grants or denies access to the document by the user under a first digital rights management policy (first DRM policy) stored on the first RMS server, wherein when the first authorization response indicates that the first RMS server grants access to the document, the first authorization response further includes a decryption key for decrypting the document, and
(b) the plug-in program communicating with the second RMS server to obtain a second authorization response which indicates whether the second RMS server grants or denies access to the document by the user under a second digital rights management policy (second DRM policy) stored on the second RMS server, wherein the second authorization response includes no decryption key regardless of whether the second RMS server grants or denies access to the document, wherein the second RMS server is a separate and different server from the first RMS server, and wherein the second DRM policy contains additional policy terms not contained in the first DRM policy; and
(c) the plug-in program and the application program cooperating with each other to grant or deny access to the document by the user based on the first authorization response which has been obtained from the first RMS server and the second authorization response which has been obtained from the second RMS server, wherein the plug-in program and the application program grant access to the document by the user only if the first authorization response indicates that the first RMS server grants access to the document by the user and the second authorization response indicate that the second RMS server grants access to the document by the user.

7. The method of claim 6 , wherein the second RMS server stores a document authorization table, the document authorization table containing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to a document represented by the document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a

Assignees

• Konica Minolta Laboratory Usa Inc

Inventors

• Pathak Rabindra
• Shiraishi Kyohei

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/10 Primary

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• G06F2221/0728

  Physics · mapped topic

• G06F21/1063 Primary

  Personalisation · CPC title