|
Author uses AD RMS for the first time - recieves Rights Account Certificate (RAC)
and client Licensor Certificate (CLC). Happens once and enables user to publish
online or offline and consume rights-protected content.
|
|
Using AD RMS-enabled application, author creates file and specifies user rights.
Policy license containing user policies is generated.
|
|
Application generates content key, encrypts content with it.
Online Publish - Encrypts content key with AD RMS server public key and sends to
AD RMS server. Server creates and signs publishing license (PL).
Offline Publish - Encrypts content key with CLC public key, encrypts copy of key
with AD RMS server public key. Creates PL and signs with CLC private key.
Append PL to encrypted content.
|
|
AD RMS protected content file sent to Information Recipient. AD RMS-protected content
may also be represented by e-mail.
|
|
Recipient recives file, opens using AD RMS enabled application or browser. If no
account certificate on the current computer, the AD RMS server will issue one (AD
RMS document notifies applications of the AD RMS server URL).
|
|
Application sends request for use license to AD RMS server that issued publishing
license (if file published offline. send to server that issues the CLC). Request
includes RAC and PL for file.
|
|
AD RMS server confirms recipient is authorized, checks for a named user, and creates
use license for the user. Server decrypts content key using private key of server
and re-encrypts content key with public key of recipient. then adds encrypted session
key to the use license. This means only the intended recipient can access the file.
|
|
AD RMS server sends use license to information recipient's computer.
|
|
Application examines both the license and the recipient's account certificate to
determine whether any certificate in either chain of trust requires a revocation
list. user granted access as specified by information author.
|