Windows Rights Management Services: Frequently Asked Questions

Microsoft Windows Rights Management Services (RMS) is information protection technology that works with RMS-enabled applications to help safeguard digital information from unauthorized use—both online and offline, inside and outside the firewall. Combining Windows Server 2003 features, developer tools and proven security technologies—including encryption, certificates and authentication—RMS helps organizations create reliable information protection solutions. RMS augments an organization's security strategy by providing protection of information through persistent usage policies, which remain with the information, no matter where it goes.

Information Rights Management, or IRM, is the functionality in Microsoft Office 2003 Professional (Office Word 2003, Office Excel 2003, Office PowerPoint 2003 and Office Outlook 2003) that uses RMS to help information workers protect sensitive word documents, spreadsheets, presentations, and e-mail.

Enterprise rights management, or ERM, is rights management focused on protecting business applications, including documents and e-mail. It is distinct from Digital Rights Management, or DRM. DRM is a specific kind of rights management, focused on protecting commercial media content such as songs and movies. Rights management, as a broader category, also encompasses enterprise rights management (which is the focus of RMS). In the future, we see other applications of rights management, too—personal rights management, privacy rights management—and many more. Anything that is digital can ultimately be protected—and that's rights management.

Windows Rights Management Services (RMS) technology includes the following components:

Since the release of RMS, Microsoft has listened to customers evaluating and deploying RMS, as well as to application vendors developing enterprise rights management (ERM) solutions on the RMS platform.

Here are some examples of what we've heard and how we've responded:

Today, RMS implementations in Microsoft Office 2003 Professional give the end user the ability to assign rights policies to documents or e-mail messages. Many organizations have asked Microsoft to allow them to apply rights protection policies to information in a more centralized way, for example at the server or network level.

Some scenarios that organizations have requested include:

To enable these types of scenarios more easily, RMS introduces something called the server lockbox. The RMS component that performs all encryption, decryption, signing, and validation necessary to publish and consume rights-protected information is called the "lockbox." In the first version of RMS, the lockbox was designed for client applications such as Microsoft Office. As a result, it lacked the performance characteristics required for a server application. With RMS Service Pack 1 (SP1), a new type of lockbox is introduced, in addition to the enhanced SP1 client lockbox. The new server lockbox extends the range of possible RMS solutions to include server applications.

The server lockbox enables server applications records management, messaging gateways, and e-mail archiving solutions to work with protected documents and e-mail more easily. Performance and functionality improvements have been implemented on this "server-friendly" lockbox so that server applications can, for example, automatically protect documents based on rights management policies, with the level of performance a server application needs.

The earlier version of Windows Rights Management Services (RMS) required customers to have a live Internet connection from their RMS server. This was required because two steps in the RMS setup process, called "server enrollment" and "client machine activation," required a connection from the customer's RMS server to services hosted on the Internet. With RMS Service Pack 1 (SP1), RMS can now be operated in networks with no Internet connection, sometimes known as "air-gap" networks. This has been accomplished by means of two changes.

The Federal Information Processing Standard (FIPS) 140-1 and 140-2 apply to cryptographic products and modules. Windows Rights Management Services with Service Pack 1 (SP1) has been updated to utilize FIPS-140-validated cryptographic modules available in Windows, accessible through the standard Windows CryptoAPI (CAPI) interface. The cryptographic algorithms contained in these modules include AES (FIPS 197) for symmetric encryption of content and RSA for asymmetric encryption of content keys and other credentials. Microsoft Data Protection API (DPAPI) is used for securing secret key material.

The FIPS certification levels are detailed below:

* FIPS-140-2 became official in May 2002. By then, Windows 2000 and Windows XP had already achieved their official FIPS-140-1 status. FIPS 140-1 is still a valid and recognized certification level and is expected to remain so through the Longhorn shipment timeframe.

With the first version of RMS, users were required to log in and authenticate to Microsoft Active Directory (AD) in order to obtain their RMS user credentials. Once they had obtained these RMS credentials, users could then publish and consume content without AD authentication.

Customers have asked for an enhanced level of authentication, including two-factor authentication methods.

With RMS SP1, it is possible to require end users to present an x.509 certificate from a smart card in order to obtain an RMS user credential. This will be done by (1) mapping users' Active Directory accounts to x.509 certificates, and then (2) placing an access control list on the RMS service that grants user credentials. Windows will then prompt users for their smart card-based PIN in order to authenticate them, and therefore to grant them RMS credentials. This provides an additional layer of security over the simpler user name and password AD authentication.

Organizations interested in a very high level of security can additionally place access control lists on the licensing service of RMS. With this safeguard in place, end users must present network credentials every time they consume or "license" new RMS-protected content. Just as in the above certification scenario, with RMS SP1 the administrator will be able to enforce smart card-based authentication for the licensing scenario as well.

Easier deployment with fewer end-user privileges required
With RMS SP1, client packages are much easier to roll out to desktop machines. For example, customers can deploy RMS clients across the network without "touching" desktops, nor requiring their end users to have administrative privileges, using deployment and installation technologies from Microsoft.

RMS SP1 uses installation technology that supports program "advertising." By having advertised programs, an organization can allow an installation program, invoked by a non-administrator, to temporarily "elevate privileges" to accomplish the installation. This can be done using group policy objects (GPO), or automated further with Microsoft Systems Management Server (SMS).

Also, the RMS SP1 client software will be distributed via Microsoft Windows Update channels, enabling customers to deploy the client using Software Update Services (SUS) or Windows Server Update Services (WSUS).

Easier Role-based Security
Many organizations have the requirement to restrict information to a group whose members are constantly changing, and they do not want to keep updating group definitions each time a person enters or leaves the group.

In RMS SP1, support for query-based groups enables rights management policies to be applied based on dynamic groups, defined by queries of Active Directory for certain attributes. For example, when a recipient attempts to "consume" or open rights-protected content, RMS checks their group membership against the rights assigned to the content. If the recipient is not a member of the correct group at the time they try to consume, they will fail to obtain the license required to access the content. This is true for statically-defined groups as well as query-based groups.

The use of query-based groups requires Microsoft Exchange 2000 Service Pack 3 (SP3) or higher, with Active Directory based on Windows 2000 SP3 or higher.

Improved Tools and Guidance
The RMS toolkit has been updated with the release of RMS SP1. The RMS SP1 toolkit includes new and updated tools, such as a web user interface that works with the existing RMS log analyzer tools, to provide customers with an easier way to view RMS actions such as certification, publishing, and licensing—per user, across an organization.

The most important update to the technical requirements for RMS SP1 is that an Internet connection is no longer required in order to install, deploy, or operate RMS. RMS can now operate in completely disconnected or "air-gap" networks. Beyond that, the technical requirements for RMS SP1 are similar to that of the first version of RMS:

Server Software Requirements

Server Hardware Requirements

Client Software Requirements

RMS is a platform technology and hence on an independent release schedule from applications such as Microsoft Office. The RMS SP1 platform will be supported with the existing Microsoft Office information rights management (IRM) functionality that uses RMS today. The Microsoft Office team plans to leverage enhanced RMS technology in future versions of their product, as do other application teams within Microsoft.

The key flow for RMS SP1 is largely the same as it was in the first version of RMS. For example, offline and online publishing, as well as consumption of content, work in exactly the same way. The two major differences are the two steps in the RMS setup process: offline server enrollment and client machine self-activation.