Windows Rights Management Services (also called Rights Management Services, Active Directory Rights Management Services or RMS) is a form of Information Rights Management used on Microsoft Windows that uses encryption and a form of selective functionality denial for limiting access to documents such as corporate e-mail, Word documents, and web pages, and the operations authorized users can perform on them. Companies can use this technology to encrypt information stored in such document formats, and through policies embedded in the documents, prevent the protected content from being decrypted except by specified people or groups, in certain environments, under certain conditions, and for certain periods of time. Specific operations like printing, copying, editing, forwarding, and deleting can be allowed or disallowed by content authors for individual pieces of content, and RMS administrators can deploy RMS templates that group these rights together into predefined rights that can be applied en masse.
The Rights Management Server debuted in Windows Server 2003, with client API libraries made available for Windows XP and Windows 2000 as well. Windows Vista, Windows 7 and Windows Server 2008 also support Rights Management Services. In Windows Server 2008, Windows Rights Management Services has been renamed to Active Directory Rights Management Services, reflecting a higher level of integration with Active Directory. The Rights Management Client is included in Windows Vista and later versions and downloadable for Windows XP, Windows 2000 or Windows Server 2003 [1].
Contents |
Rights Management Services is used for restricting access to rights-protected content to authorized users only. It uses a client–server architecture, using Windows Server 2003 or Windows Server 2008 to host the Active Directory Rights Management Server that issues RMS licenses. The RMS client is required for creating rights-protected content as well as accessing it. Applications that either create or provide access to protected content must be RMS-aware and have to implement the RMS client APIs explicitly. However, add-ons can be used to make an application RMS-enabled even if it does not natively implement RMS functionality.
RMS-protected documents can be created by RMS-enabled applications. RMS-protected content is encrypted and contains an embedded Usage Policy, which defines the restrictions each user or group has when using the content. The RMS system works by only assigning rights to trusted entities, which are either single users or groups of users. Rights are assigned on a per-entity basis. RMS defines and recognizes several rights by default - such as permission to read, copy, print, save, forward, and edit - and can be extended to recognize additional rights (which each application would have to explicitly implement). In Windows Server 2008, RMS rights can also be assigned to users who have federated trust via Active Directory Federation Services. Thus, a user's rights are treated by the system as if they were merely privileges.
When restricting rights to a document, a trusted entity encrypts a random AES key with an RSA public key that can be validated with the public key certificate in the XrML identity license that is issued to an RMS server. The AES key is used to encrypt the document. When accessing a protected document using an RMS-enabled application, the RMS client runtime authenticates the recipient to the Rights Management server, using the recipient's XrML identity license. The Rights Management server then issues a use license that can be used by the client application together with the RMS client to decrypt the document, which then enforces the document restrictions for that user.
One feature of the RMS system is that documents in certain formats can optionally include an HTML rendering of the document so that the document can be viewed when the intended application is not available. This is enabled using a compound document format. Both versions of the document are subject to the same usage policies, and an RMS-enabled HTML viewer is required to view this alternative form of the document content. For example, Microsoft Office 2003 Professional or greater is able to optionally include an HTML version of the document content. The Rights Management Add-on for Internet Explorer allows users who do not have Microsoft Office 2003 or later installed to view these RM-protected files.
RMS is supported (implemented) by the following Microsoft products: