Hybrid digital rights management system and related document access authorization method
A digital rights management system includes two digital rights management servers (RMS servers) connected to a client computer. The two RMS servers implement different but related digital rights management (DRM) policies, with the first RMS server implementing conventional DRM policies and the second RMS server implementing extended DRM policies. An application program on the client computer interacts with a document on the client computer, and communicates with the first RMS server to obtain access authorization for the document. A plug-in program in the client computer cooperates with the application program, and communicates with the second RMS server to obtain additional access authorization for the document. Access to the document is granted when both RMS servers grant access to the document. This achieves extended digital rights management control which can provide a more flexible access control than that provided by existing DRM systems.
1. A digital rights management method implemented in a system including a first digital rights management server (first RMS server), a second digital rights management server (second RMS server), and a client computer connected to the first RMS server and the second RMS server, the client computer including an application program for interacting with a document which is requested to be accessed by a user and a plug-in program which cooperates with the application program, the method comprising:
(a) the application program communicating with the first RMS server to obtain a first authorization response which indicates whether the first RMS server grants or denies access to the document by the user under a first digital rights management policy (first DRM policy) stored on the first RMS server;
(b) the plug-in program communicating with the second RMS server to obtain a second authorization response which indicates whether the second RMS server grants or denies access to the document by the user under a second digital rights management policy (second DRM policy) stored on the second RMS server, wherein the second RMS server is a separate and different server from the first RMS server, and wherein the second DRM policy contains additional policy terms not contained in the first DRM policy; and
(c) the plug-in program and the application program cooperating with each other to grant or deny access to the document by the user based on the first authorization response which has been obtained from the first RMS server and the second authorization response which has been obtained from the second RMS server, wherein the plug-in program and the application program grant access to the document by the user only if the first authorization response indicates that the first RMS server grants access to the document by the user and the second authorization response indicate that the second RMS server grants access to the document by the user.
2. The method of claim 1 , wherein the second RMS server stores a document authorization table, the document authorization table containing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to a document represented by the document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a user ID of the user requesting the access;
the second RMS server extracting the document ID and the user ID from the authorization request received from the plug-in program;
the second RMS server querying the document authorization table using the document ID to obtain the full policy information associated with the document ID, and based on the full policy information, determining whether the user is to be granted or denied access to the document; and
the second RMS server transmitting the authorization response to indicate whether the user is granted or denied access to the document.
3. The method of claim 1 , wherein the second RMS server stores a document authorization table, the document authorization table storing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to the document, the document authorization table further including a status associated with each document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a user ID of the user requesting access;
the second RMS server extracting the document ID and the user ID from the authorization request received from the plug-in program;
the second RMS server querying the document authorization table using the document ID to first determine whether the associated status is a first value, and if it is, to obtain the associated full policy information, and based on the full policy information, determining whether the user is to be granted or denied access to the document; and
the second RMS server transmitting the authorization response to indicate whether the user is granted or denied access to the document.
4. The method of claim 1 , wherein the second RMS server is a Microsoft Active Directory RMS server and the application program is a Microsoft Office program.
5. The method of claim 1 , wherein step (c) includes:
after step (b), the plug-in program passing the second authorization response to the application program; and
the application program granting or denying access to the document by the user based on the first authorization response received from the first RMS server and the second authorization response received from the plug-in program.
6. A digital rights management method implemented in a system including a first digital rights management server (first RMS server), a second digital rights management server (second RMS server), and a client computer connected to the first RMS server and the second RMS server, the client computer including an application program for interacting with a document which is requested to be accessed by a user and a plug-in program which cooperates with the application program, the method comprising:
(a) the application program communicating with the first RMS server to obtain a first authorization response which indicates whether the first RMS server grants or denies access to the document by the user under a first digital rights management policy (first DRM policy) stored on the first RMS server, wherein when the first authorization response indicates that the first RMS server grants access to the document, the first authorization response further includes a decryption key for decrypting the document, and
(b) the plug-in program communicating with the second RMS server to obtain a second authorization response which indicates whether the second RMS server grants or denies access to the document by the user under a second digital rights management policy (second DRM policy) stored on the second RMS server, wherein the second authorization response includes no decryption key regardless of whether the second RMS server grants or denies access to the document, wherein the second RMS server is a separate and different server from the first RMS server, and wherein the second DRM policy contains additional policy terms not contained in the first DRM policy; and
(c) the plug-in program and the application program cooperating with each other to grant or deny access to the document by the user based on the first authorization response which has been obtained from the first RMS server and the second authorization response which has been obtained from the second RMS server, wherein the plug-in program and the application program grant access to the document by the user only if the first authorization response indicates that the first RMS server grants access to the document by the user and the second authorization response indicate that the second RMS server grants access to the document by the user.
7. The method of claim 6 , wherein the second RMS server stores a document authorization table, the document authorization table containing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to a document represented by the document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a user ID of the user requesting the access;
the second RMS server extracting the document ID and the user ID from the authorization request received from the plug-in program;
the second RMS server querying the document authorization table using the document ID to obtain the full policy information associated with the document ID, and based on the full policy information, determining whether the user is to be granted or denied access to the document; and
the second RMS server transmitting the authorization response to indicate whether the user is granted or denied access to the document.
8. The method of claim 6 , wherein the second RMS server stores a document authorization table, the document authorization table storing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to the document, the document authorization table further including a status associated with each document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a user ID of the user requesting access;
the second RMS server extracting the document ID and the user ID from the authorization request received from the plug-in program;
the second RMS server querying the document authorization table using the document ID to first determine whether the associated status is a first value, and if it is, to obtain the associated full policy information, and based on the full policy information, determining whether the user is to be granted or denied access to the document; and
the second RMS server transmitting the authorization response to indicate whether the user is granted or denied access to the document.
9. The method of claim 6 , wherein the second RMS server is a Microsoft Active Directory RMS server and the application program is a Microsoft Office program.
10. The method of claim 6 , wherein step (c) includes:
after step (b), the plug-in program passing the second authorization response to the application program; and
the application program granting or denying access to the document by the user based on the first authorization response received from the first RMS server and the second authorization response received from the plug-in program.
11. A digital rights management method implemented in a system including a first digital rights management server (first RMS server), a second digital rights management server (second RMS server), and a client computer connected to the first RMS server and the second RMS server, the client computer including an application program for interacting with a document which is requested to be accessed by a user and a plug-in program which cooperates with the application program, the method comprising:
(a) the application program communicating with the first RMS server to obtain a first authorization response which indicates whether the first RMS server grants or denies access to the document by the user under a first digital rights management policy (first DRM policy) stored on the first RMS server;
(b) the plug-in program communicating with the second RMS server to obtain a second authorization response which indicates whether the second RMS server grants or denies access to the document by the user under a second digital rights management policy (second DRM policy) stored on the second RMS server, wherein the second DRM policy contains additional policy terms not contained in the first DRM policy; and
(c) the plug-in program and the application program cooperating with each other to grant or deny access to the document by the user based on the first authorization response and the second authorization response,
wherein step (c) includes:
after step (a) and before step (b), the application program opening the document if the first authorization response indicates that the first RMS server grants access to the document by the user, and otherwise denies access to the document;
wherein step (b) is performed after the step of opening the document; and
after step (b), if the second authorization response indicates that the second RMS server denies access to the document by the user, the plug-in program closes the document that was opened by the application program.
12. The method of claim 11 , wherein the second RMS server stores a document authorization table, the document authorization table containing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to a document represented by the document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a user ID of the user requesting the access;
the second RMS server extracting the document ID and the user ID from the authorization request received from the plug-in program;
the second RMS server querying the document authorization table using the document ID to obtain the full policy information associated with the document ID, and based on the full policy information, determining whether the user is to be granted or denied access to the document; and
the second RMS server transmitting the authorization response to indicate whether the user is granted or denied access to the document.
13. The method of claim 11 , wherein the second RMS server stores a document authorization table, the document authorization table storing a plurality of document IDs and a DRM policy associated with each document ID including full policy information regarding which users have what access rights to the document, the document authorization table further including a status associated with each document ID,
wherein step (b) includes:
the plug-in program transmitting an authorization request to the second RMS server, the authorization request including a document ID of the document requested to be accessed and a user ID of the user requesting access;
the second RMS server extracting the document ID and the user ID from the authorization request received from the plug-in program;
the second RMS server querying the document authorization table using the document ID to first determine whether the associated status is a first value, and if it is, to obtain the associated full policy information, and based on the full policy information, determining whether the user is to be granted or denied access to the document; and
the second RMS server transmitting the authorization response to indicate whether the user is granted or denied access to the document.
14. The method of claim 11 , wherein the second RMS server is a Microsoft Active Directory RMS server and the application program is a Microsoft Office program.