# US 2014/0208098 A1 · Method and system for digital rights management of documents > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0208098 A1 - Document ID: US20140208098A1 - Status: Published application - Kind: A1 - Application number: 14/162,979 - Filed: 2014-01-24 - Published: 2014-07-24 - Earliest claimed: 2005-09-28 - Assignees: NL Systems, LLC - Applicants: NL Systems, LLC - Inventors: Patrick Carson Meehan; Zachary Wisenbaker Price; Raymond Joseph Zambroski; William Henry Frenchu; Shawn Patrick Hickey; Jesse Lee White; Anthony Allen Mohr; Jeremy Wayne Gomsrud - Web page: https://patentgrep.com/patent/US20140208098A1 ## CPC - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2137: Time limited access, e.g. to a computer or data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and system for transmission of digital content via e-mail with point of use digital rights management is disclosed. The secured access rights to the digital content may be customized for individual recipients by the sender, and may evolve over time. The access rights are enforced according to a time-dependent scheme. A key server is used to arbitrate session keys for the encrypted content, eliminating the requirement to exchange public keys prior to transmission of the digital content. During the entire process of transmitting and receiving e-mail messages and documents, the exchange of cryptographic keys remains totally transparent to the users of the system. Additionally, electronic documents may be digitally signed with authentication of the signature. ## Claims ### Claim 1 A method for transmitting electronic documents over a communications network, wherein digital rights of access for each of said electronic documents are cryptographically managed and secured, comprising: installing an authoring tool for generating and distributing cryptocontainers comprising said electronic documents, wherein said authoring tool includes a public key belonging to a key server and a public key belonging to said authoring tool; authenticating an author of a cryptocontainer with a certificate issued by an authenticating server, wherein an author license is created and stored with said authoring tool, and wherein said author license comprises an electronic address of said author and said public key belonging to said authoring tool, signed by a private key belonging to said key server; entering an electronic address for each of a plurality of recipients into a recipient list of said cryptocontainer in said authoring tool; generating a symmetric session key for said recipient list; encrypting said symmetric session key for said recipient list in said cryptocontainer together with said public key belonging to said key server; adding said electronic documents to said cryptocontainer, wherein for each recipient on said recipient list a usage rights timeline is generated for each of said electronic documents; encrypting said cryptocontainer comprising said symmetric session key for said recipient list, together with said electronic documents, and together with each of said usage rights timelines, wherein said cryptocontainer enables said symmetric session key for said recipient list to be individually decrypted from said cryptocontainer; and transmitting said cryptocontainer over a communications network to each of said plurality of recipients in said recipient list of said cryptocontainer. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein said usage rights timeline comprises keyframes for digital rights management for each of said electronic documents in said cryptocontainer, wherein each of said keyframes comprises individual entries for granting rights for opening, copying, viewing, printing, exporting, deleting, making visible, showing thumbnails, renaming, forwarding, attaching, and moving each of said electronic documents in said cryptocontainer for a certain period in time. ### Claim 3 (depends on 1) The method as recited in claim 1, further comprising: signing a plurality of said electronic documents added to said cryptocontainer by said author using a digital signature, wherein the intent of said digital signature is specified in text form using a Signature Line entry. ### Claim 4 (depends on 1) The method as recited in claim 1, further comprising: notifying said author of the security rating of a client over a given time period, wherein said security rating comprises a ratio of a number of securely sent items to a total number of sent items. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein a recipient is assigned membership to a user group, wherein said user group is selected for generating said usage permission template for each of said electronic documents. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein said author license comprises an electronic address of said author and a hardware fingerprint encrypted together with said public key of said key server signed by a private key of said key server. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein said author license comprises an electronic address of said author and a biometric identification encrypted together with said public key of said key server signed by a private key of said key server. ### Claim 8 (depends on 1) The method as recited in claim 1, further comprising: recording a timestamped log of each individual operation performed on said cryptocontainer. ### Claim 9 (depends on 1) The method as recited in claim 1, wherein said authoring tool is a network application executed as a service by a network server. ### Claim 10 (depends on 1) The method as recited in claim 1, wherein said usage rights timelines are predefined and stored as a template for retrieving a set of usage rights for applying to a cryptocontainer. ### Claim 11 A method for receiving electronic documents over a communications network, wherein digital rights of access for each of said electronic documents are cryptographically managed and secured, comprising: electronically receiving via a cryptocontainer comprising a plurality of electronic documents by a recipient; installing a viewing tool from a public network server for accessing said plurality of electronic documents within said cryptocontainer; opening a secured connection with a key server and authenticating the identity of said recipient with a certificate issued by an authenticating server; comparing the identity of said recipient with each of a plurality of recipients listed in said cryptocontainer by said key server, and in case of a match, issuing a one-time license to decrypt a symmetric session key for said cryptocontainer to said recipient by said key server, and in case of no match, denying access to said recipient to said cryptocontainer. ### Claim 12 (depends on 11) The method as recited in claim 11, wherein said authenticating the identity of said recipient is performed using a hardware fingerprint together with said electronic address of said recipient. ### Claim 13 (depends on 11) The method as recited in claim 11, wherein said authenticating the identity of said recipient is performed using a biometric identifier together with said electronic address of said recipient. ### Claim 14 (depends on 11) The method as recited in claim 11, wherein said viewing tool is a network application executed as a service by a network server. ### Claim 15 (depends on 11) The method as recited in claim 11, further comprising: decrypting said symmetric session key for said cryptocontainer with said license; and decrypting and accessing said plurality of electronic documents by said recipient from said cryptocontainer. ### Claim 16 (depends on 15) The method as recited in claim 15, wherein a usage rights timeline, comprising individual keyframes, retrieved from said cryptocontainer for restricting the rights of said recipient is individually enforced by said viewing tool for each of said plurality of electronic documents accessed by said recipient over the time period for which said keyframes in said usage rights timeline have been defined. ### Claim 17 (depends on 15) The method as recited in claim 15, further comprising: recording a timestamped log of each individual operation performed on said cryptocontainer. ### Claim 18 A computer program product comprising a non-transitory computer-usable medium having computer-readable code embodied therein, the computer-readable coded adapted to be executed to implement a method for transmitting electronic documents over a communications network, wherein digital rights of access for each of said electronic documents are cryptographically managed and secured, the method comprising: installing an authoring tool for generating and distributing cryptocontainers comprising said electronic documents, wherein said authoring tool includes a public key belonging to a key server and a public key belonging to said authoring tool; authenticating an author of a cryptocontainer with a certificate issued by an authenticating server, wherein an author license is created and stored with said authoring tool, and wherein said author license comprises an electronic address of said author and said public key belonging to said authoring tool, signed by a private key belonging to said key server; entering an electronic address for each of a plurality of recipients into a recipient list of said cryptocontainer in said authoring tool; generating a symmetric session key for said recipient list; encrypting said symmetric session key for said recipient list in said cryptocontainer together with said public key belonging to said key server; adding said electronic documents to said cryptocontainer, wherein for each recipient on said recipient list a usage rights timeline is generated for each of said electronic documents; encrypting said cryptocontainer comprising said symmetric session key for said recipient list, together with said electronic documents, and together with each of said usage rights timelines, wherein said cryptocontainer enables said symmetric session key for said recipient list to be individually decrypted from said cryptocontainer; and transmitting said cryptocontainer over a communications network to each of said plurality of recipients in said recipient list of said cryptocontainer. ### Claim 19 (depends on 18) The computer program product as recited in claim 18, wherein said usage rights timeline comprises keyframes for digital rights management for each of said electronic documents in said cryptocontainer, wherein each of said keyframes comprises individual entries for granting rights for opening, copying, viewing, printing, exporting, deleting, making visible, showing thumbnails, renaming, forwarding, attaching, and moving each of said electronic documents in said cryptocontainer for a certain period in time. ### Claim 20 (depends on 18) The computer program product as recited in claim 18, the method comprising: signing a plurality of said electronic documents added to said cryptocontainer by said author using a digital signature, wherein the intent of said digital signature is specified in text form using a Signature Line entry.