1. 5/25/2018 2:39 AM © 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

2. Information Protection
5/25/2018 2:39 AM
Information Protection
Steve Marsh
Technology Specialist
Microsoft Corporation
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

3. Overview Scenarios for Information Protection
Ensuring document integrity
Verifying that information came from a trusted source
Restricting access to specific users
Requiring periodic authentication to continue accessing information
Restricting distribution of information
Restricting editing capabilities
Expiring content
Signatures
Encryption
Rights
Management

4. Customer Pain Points Encryption & Rights Management
Increase security and control distribution
Variety of WW encryption requirements
Signing
Keep documents digital throughout their life cycle
Offer a rich platform to support unique features to your jurisdiction. Examples
Support for government issued ID cards
Specific hashing algorithms
Authenticated time stamping

5. Cryptographic Agility In The 2007 Release
Lots of new capabilities across Word, Excel, and PowerPoint
Password Protection on Open XML files
Supports any CAPI CSP (AES128 by default)
Rights Management
No changes to cryptography
Lots of user experience improvements
SharePoint and InfoPath support
Two new areas
Digital Signatures
File Encryption Extensibility

6. (Re)-Introducing Digital Signing
Replaces existing functionality
Supports three scenarios out of the box
Authenticity and Tamper Resistance
Non-visible Digital Signature
In-document Signatures
Fully extensible platform
It’s easy for ISVs to extend/replace our functionality
Pluggable signing and verification
Pluggable UI

7. 5/25/2018 2:39 AM
Signatures
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

8. Digital Signing Add-ins Can…
Show graphically as in-document objects or invisibly as metadata in the file
Use an add-in provided hashing and signing algorithms
We do not require CAPI or CNG – agnostic
Provide custom authentication and verification
Fully replace the user experience that we ship with our out-of-the-box feature
Add additional capabilities that we don’t ship
Authenticated time stamps
Location awareness

9. Signing Interface public interface SignatureProvider {
5/25/2018 2:39 AM
Signing Interface
public interface SignatureProvider {
public GetProviderDetail(…);
public GenerateSignatureLineImage(…);
public ShowSignatureSetup(…);
public ShowSigningCeremony(…);
public SignXmlDsig(…);
public NotifySignatureAdded(…);
public VerifyXmlDsig(…);
public ShowSignatureDetails(…);
public HashStream(…); };
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

10. Application Start-Up public interface SignatureProvider {
5/25/2018 2:39 AM
Application Start-Up
public interface SignatureProvider {
public GetProviderDetail(…);
public GenerateSignatureLineImage(…);
public ShowSignatureSetup(…);
public ShowSigningCeremony(…);
public SignXmlDsig(…);
public NotifySignatureAdded(…);
public VerifyXmlDsig(…);
public ShowSignatureDetails(…);
public HashStream(…); };
public GetProviderDetail(…);
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

11. Creating A Signature Line
5/25/2018 2:39 AM
Creating A Signature Line
public interface SignatureProvider {
public GetProviderDetail(…);
public GenerateSignatureLineImage(…);
public ShowSignatureSetup(…);
public ShowSigningCeremony(…);
public SignXmlDsig(…);
public NotifySignatureAdded(…);
public VerifyXmlDsig(…);
public ShowSignatureDetails(…);
public HashStream(…); };
Software required
to view this signature
(double-click to install)
public GenerateSignatureLineImage(…);
public ShowSignatureSetup(…);
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

12. Signing A Signature Line
5/25/2018 2:39 AM
Signing A Signature Line
public interface SignatureProvider {
public GetProviderDetail(…);
public GenerateSignatureLineImage(…);
public ShowSignatureSetup(…);
public ShowSigningCeremony(…);
public SignXmlDsig(…);
public NotifySignatureAdded(…);
public VerifyXmlDsig(…);
public ShowSignatureDetails(…);
public HashStream(…); };
public GenerateSignatureLineImage(…);
public ShowSigningCeremony(…);
public SignXmlDsig(…);
public NotifySignatureAdded(…);
public HashStream(…);
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

13. Verifying Signatures public interface SignatureProvider {
5/25/2018 2:39 AM
Verifying Signatures
public interface SignatureProvider {
public GetProviderDetail(…);
public GenerateSignatureLineImage(…);
public ShowSignatureSetup(…);
public ShowSigningCeremony(…);
public SignXmlDsig(…);
public NotifySignatureAdded(…);
public VerifyXmlDsig(…);
public ShowSignatureDetails(…);
public HashStream(…); };
public VerifyXmlDsig(…);
public ShowSignatureDetails(…);
public HashStream(…);
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

14. Sample Signature Provider
Show Office B1TR with a sample signature provider. Show the entry points.
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

15. Introducing File Encryption
We are not building an out of the box feature for file encryption
We are building extensibility to enable it
Office enables an Add-in to
Be a first class feature (e.g., temp files will be encrypted)
Do all the encryption (we are API agnostic)
Show UI to set up encryption and authenticate
We only support Open XML File Formats, not binary files

16. File Encryption Add-ins Can…
Hide all information (including metadata)
Use an add-in provided encryption algorithm
We do not require CAPI or CNG – agnostic
Encrypt to one or more specified users
Require authentication to open documents
Add-ins can support two factor authentication
Once authenticated, add-ins can specify the usage rights to enforce on documents

17. Encryption Interface public interface EncryptionProvider {
public GetProviderDetail(…);
public NewSession(…);
public Authenticate(…);
public CloneSession(…);
public EndSession(…);
public Save(…);
public IStream EncryptStream(…);
public IStream DecryptStream(…);
public ShowSettings(…); };

18. Application Start-up public interface EncryptionProvider {
public GetProviderDetail(…);
public NewSession(…);
public Authenticate(…);
public CloneSession(…);
public EndSession(…);
public Save(…);
public IStream EncryptStream(…);
public IStream DecryptStream(…);
public ShowSettings(…); };
public GetProviderDetail(…);

19. Adding Encryption public interface EncryptionProvider {
public GetProviderDetail(…);
public NewSession(…);
public Authenticate(…);
public CloneSession(…);
public EndSession(…);
public Save(…);
public IStream EncryptStream(…);
public IStream DecryptStream(…);
public ShowSettings(…); };
public NewSession(…);
public CloneSession(…);
public EndSession(…);
public Save(…);
public IStream EncryptStream(…);

20. Loading An Encrypted File
public interface EncryptionProvider {
public GetProviderDetail(…);
public NewSession(…);
public Authenticate(…);
public CloneSession(…);
public EndSession(…);
public Save(…);
public IStream EncryptStream(…);
public IStream DecryptStream(…);
public ShowSettings(…); };
public Authenticate(…);
public EndSession(…);
public IStream DecryptStream(…);

21. Changing / Removing Encryption
public interface EncryptionProvider {
public GetProviderDetail(…);
public NewSession(…);
public Authenticate(…);
public CloneSession(…);
public EndSession(…);
public Save(…);
public IStream EncryptStream(…);
public IStream DecryptStream(…);
public ShowSettings(…); };
public ShowSettings(…);

22. Sample Encryption Provider
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

23. Introducing SharePoint IRM
“Protect documents on download”
Maps a user’s access in SharePoint to persistent permissions within documents
Out of the box support for Word, Excel, PowerPoint, InfoPath, and XPS files using Windows Rights Management Services
SharePoint has extensibility to enable
Support for other rights management server products
Support for new file format protectors

24. Integrating your DRM server
Our core WSS functionality is “rights management server” agnostic
Our platform collects all of the information that you need to rights manage content on download:
The requesting user
The access controls for this user on this document
The list the document is coming from
SharePoint will call your code on each upload and download

25. Integrating Your DRM Server
Guidelines we recommend you
Ensure that documents can only be uploaded to the same server that protected them
Ensure that documents are uploaded to the same list/library they came from

26. Building Custom File Protectors
Rights management protectors are based on one or more file extensions
We have built-in support for Windows Rights Management Services
Dramatically reduces the work you need to do
You build a “file packager”
You don’t need to make any direct calls into WRMS APIs
You can also build custom protectors for custom IRM server products.

27. 5/25/2018 2:39 AM
SharePoint IRM
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

28. Interested In Learning More?
Documentation is available as part of the Enterprise Content Management Starter Kit
Including:
2007 Office System Digital Signatures Developers Guide
2007 Office System Encryption Developers Guide
Information Rights Management - Pluggable Rights Management, Technical Overview

29. © 2006 Microsoft Corporation. All rights reserved.
5/25/2018 2:39 AM
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.
© 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

30. 5/25/2018 2:39 AM © 2006 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.