1. SIM328

6. Access Control List Perimeter No Yes Firewall Perimeter Authorized Users Unauthorized Users Information Leakage Unauthorized Users …but not indirect usage

7. Protects documents and email Encrypts data Decrypts for authorized personnel Can restrict other capabilities Forward Print Cut/Copy/Paste Enforces document security after the file is opened Central policy management via templates

8. 1 3. 4. Consumption Protection 2. 5. ( Author automatically receives AD RMS credentials (“rights account certificate” and “client licensor certificate”) the FIRST TIME they rights-protect information The application works with the AD RMS client to create a “publishing license”, encrypts the file, and appends the publishing license to it The AD RMS Author distributes file Recipient clicks file to open. The application sends the recipient’s credentials and the publish license to the AD RMS server, which validates the user and issues a “use license.” Application renders file and enforces rights.

9. a Rights Info w/ email addresses Content Key Encrypted with the server’s public key Publishing License The Content of the File (Text, Pictures, metadata, etc) End User Licenses Content Key (big random number) Rights for a particular user Encrypted with the user’s public key Created when file is protected Only added to the file after server licenses a user to open it Encrypted with Content Key, a cryptographically secure 128-bit AES symmetric encryption key Encrypted with the server’s public key Encrypted with the user’s public key NOTE: Outlook E-mail EULs are stored in the local user profile directory

14. AD RMS server Information protection Recipient SQL Server keeps the latest templates Template Document protected based on template RM-enabled application requests use license with latest rights

15. AD RMS Client AD RMS Server

17. AD RMS Topology AD RMS Root Server Database License-only Server Database License-only Server Cluster AD RMS Root Cluster

18. AD RMS Server Active Directory SQL MOSS 2007 Exchange Server 2007 SP1 RMS Client RM-enabled application AD RMS Infrastructure Components (cont.)

19. AD RMS Server

21. Active Directory

24. User Identity SLC Issuer Pub key Signature Server Identity CLC Issuer Prv key Signature Pub key Encrypted with Issuer is Certificate key pairs : RSA-1024 Content key: AES-128 SLC: Server Licensor Certificate RAC: Rights Account Certificate CLC: Client Licensor Certificate SPC: Security Processor Certificate PL: Publish License UL: Use License PL Issuer Signature Content key Issuer is Encrypted with UL Issuer Signature Content key Issuer is Encrypted with AD RMS uses XrML certificates, not X.509 certificates AD RMS Certificates and Licenses Machine Identity SPC Issuer Pub key Prv key Signature Protected using both DPAPI and RSAVault (for obfuscation) Issuer Prv key Signature Pub key RAC

34. www.microsoft.com/teched Sessions On-Demand & CommunityMicrosoft Certification & Training Resources Resources for IT ProfessionalsResources for Developers www.microsoft.com/learning http://microsoft.com/technet http://microsoft.com/msdn http://northamerica.msteched.com Connect. Share. Discuss.

36. Scan the Tag to evaluate this session now on myTechEd Mobile

38. RMS Protected Document Signed

39. RMS Protected Document Signed Client Licensor Certificate Public Key Rights Account Certificate Public Key Unencrypted document Client Server ?