5/25/2018 2:39 AM © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Information Protection 5/25/2018 2:39 AM Information Protection Steve Marsh Technology Specialist Microsoft Corporation © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Overview Scenarios for Information Protection Ensuring document integrity Verifying that information came from a trusted source Restricting access to specific users Requiring periodic authentication to continue accessing information Restricting distribution of information Restricting editing capabilities Expiring content Signatures Encryption Rights Management

Customer Pain Points Encryption & Rights Management Increase security and control distribution Variety of WW encryption requirements Signing Keep documents digital throughout their life cycle Offer a rich platform to support unique features to your jurisdiction. Examples Support for government issued ID cards Specific hashing algorithms Authenticated time stamping

Cryptographic Agility In The 2007 Release Lots of new capabilities across Word, Excel, and PowerPoint Password Protection on Open XML files Supports any CAPI CSP (AES128 by default) Rights Management No changes to cryptography Lots of user experience improvements SharePoint and InfoPath support Two new areas Digital Signatures File Encryption Extensibility

(Re)-Introducing Digital Signing Replaces existing functionality Supports three scenarios out of the box Authenticity and Tamper Resistance Non-visible Digital Signature In-document Signatures Fully extensible platform It’s easy for ISVs to extend/replace our functionality Pluggable signing and verification Pluggable UI

5/25/2018 2:39 AM Signatures © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Digital Signing Add-ins Can… Show graphically as in-document objects or invisibly as metadata in the file Use an add-in provided hashing and signing algorithms We do not require CAPI or CNG – agnostic Provide custom authentication and verification Fully replace the user experience that we ship with our out-of-the-box feature Add additional capabilities that we don’t ship Authenticated time stamps Location awareness

Signing Interface public interface SignatureProvider { 5/25/2018 2:39 AM Signing Interface public interface SignatureProvider { public GetProviderDetail(…); public GenerateSignatureLineImage(…); public ShowSignatureSetup(…); public ShowSigningCeremony(…); public SignXmlDsig(…); public NotifySignatureAdded(…); public VerifyXmlDsig(…); public ShowSignatureDetails(…); public HashStream(…); }; © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Application Start-Up public interface SignatureProvider { 5/25/2018 2:39 AM Application Start-Up public interface SignatureProvider { public GetProviderDetail(…); public GenerateSignatureLineImage(…); public ShowSignatureSetup(…); public ShowSigningCeremony(…); public SignXmlDsig(…); public NotifySignatureAdded(…); public VerifyXmlDsig(…); public ShowSignatureDetails(…); public HashStream(…); }; public GetProviderDetail(…); © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Creating A Signature Line 5/25/2018 2:39 AM Creating A Signature Line public interface SignatureProvider { public GetProviderDetail(…); public GenerateSignatureLineImage(…); public ShowSignatureSetup(…); public ShowSigningCeremony(…); public SignXmlDsig(…); public NotifySignatureAdded(…); public VerifyXmlDsig(…); public ShowSignatureDetails(…); public HashStream(…); }; Software required to view this signature (double-click to install) public GenerateSignatureLineImage(…); public ShowSignatureSetup(…); © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Signing A Signature Line 5/25/2018 2:39 AM Signing A Signature Line public interface SignatureProvider { public GetProviderDetail(…); public GenerateSignatureLineImage(…); public ShowSignatureSetup(…); public ShowSigningCeremony(…); public SignXmlDsig(…); public NotifySignatureAdded(…); public VerifyXmlDsig(…); public ShowSignatureDetails(…); public HashStream(…); }; public GenerateSignatureLineImage(…); public ShowSigningCeremony(…); public SignXmlDsig(…); public NotifySignatureAdded(…); public HashStream(…); © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Verifying Signatures public interface SignatureProvider { 5/25/2018 2:39 AM Verifying Signatures public interface SignatureProvider { public GetProviderDetail(…); public GenerateSignatureLineImage(…); public ShowSignatureSetup(…); public ShowSigningCeremony(…); public SignXmlDsig(…); public NotifySignatureAdded(…); public VerifyXmlDsig(…); public ShowSignatureDetails(…); public HashStream(…); }; public VerifyXmlDsig(…); public ShowSignatureDetails(…); public HashStream(…); © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Sample Signature Provider Show Office B1TR with a sample signature provider. Show the entry points. © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Introducing File Encryption We are not building an out of the box feature for file encryption We are building extensibility to enable it Office enables an Add-in to Be a first class feature (e.g., temp files will be encrypted) Do all the encryption (we are API agnostic) Show UI to set up encryption and authenticate We only support Open XML File Formats, not binary files

File Encryption Add-ins Can… Hide all information (including metadata) Use an add-in provided encryption algorithm We do not require CAPI or CNG – agnostic Encrypt to one or more specified users Require authentication to open documents Add-ins can support two factor authentication Once authenticated, add-ins can specify the usage rights to enforce on documents

Encryption Interface public interface EncryptionProvider { public GetProviderDetail(…); public NewSession(…); public Authenticate(…); public CloneSession(…); public EndSession(…); public Save(…); public IStream EncryptStream(…); public IStream DecryptStream(…); public ShowSettings(…); };

Application Start-up public interface EncryptionProvider { public GetProviderDetail(…); public NewSession(…); public Authenticate(…); public CloneSession(…); public EndSession(…); public Save(…); public IStream EncryptStream(…); public IStream DecryptStream(…); public ShowSettings(…); }; public GetProviderDetail(…);

Adding Encryption public interface EncryptionProvider { public GetProviderDetail(…); public NewSession(…); public Authenticate(…); public CloneSession(…); public EndSession(…); public Save(…); public IStream EncryptStream(…); public IStream DecryptStream(…); public ShowSettings(…); }; public NewSession(…); public CloneSession(…); public EndSession(…); public Save(…); public IStream EncryptStream(…);

Loading An Encrypted File public interface EncryptionProvider { public GetProviderDetail(…); public NewSession(…); public Authenticate(…); public CloneSession(…); public EndSession(…); public Save(…); public IStream EncryptStream(…); public IStream DecryptStream(…); public ShowSettings(…); }; public Authenticate(…); public EndSession(…); public IStream DecryptStream(…);

Changing / Removing Encryption public interface EncryptionProvider { public GetProviderDetail(…); public NewSession(…); public Authenticate(…); public CloneSession(…); public EndSession(…); public Save(…); public IStream EncryptStream(…); public IStream DecryptStream(…); public ShowSettings(…); }; public ShowSettings(…);

Sample Encryption Provider © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Introducing SharePoint IRM “Protect documents on download” Maps a user’s access in SharePoint to persistent permissions within documents Out of the box support for Word, Excel, PowerPoint, InfoPath, and XPS files using Windows Rights Management Services SharePoint has extensibility to enable Support for other rights management server products Support for new file format protectors

Integrating your DRM server Our core WSS functionality is “rights management server” agnostic Our platform collects all of the information that you need to rights manage content on download: The requesting user The access controls for this user on this document The list the document is coming from SharePoint will call your code on each upload and download

Integrating Your DRM Server Guidelines we recommend you Ensure that documents can only be uploaded to the same server that protected them Ensure that documents are uploaded to the same list/library they came from

Building Custom File Protectors Rights management protectors are based on one or more file extensions We have built-in support for Windows Rights Management Services Dramatically reduces the work you need to do You build a “file packager” You don’t need to make any direct calls into WRMS APIs You can also build custom protectors for custom IRM server products.

5/25/2018 2:39 AM SharePoint IRM © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Interested In Learning More? Documentation is available as part of the Enterprise Content Management Starter Kit Including: 2007 Office System Digital Signatures Developers Guide 2007 Office System Encryption Developers Guide Information Rights Management - Pluggable Rights Management, Technical Overview

© 2006 Microsoft Corporation. All rights reserved. 5/25/2018 2:39 AM © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

5/25/2018 2:39 AM © 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.