Persistent access control of protected content

A method for providing content protection on a client information processing system, the method on the client information processing system comprising:

• acquiring on the client information processing system a file comprising content encrypted with a first encrypting key and a trailer related to the content;
• determining whether a connection to a server information processing system for access to the content is available, wherein the server information processing system comprises a set of access control policies, the set of access control policies remains with the server information processing system and is not transmitted to the client information processing system;
• wherein if the connection to the server information processing system is not available,
• determining if authorization for access to the content is cached in the client information processing system;
• and
• wherein if authorization for access to the content is cached in the client information processing system, accessing the content in the file using a client application, wherein authorization for access that is cached is an indication of prior authorization by the server information processing system.

A method on a server information processing system for providing authorization for access to content, the method on the server information processing system comprising:

• coupling communicatively a server information processing system to a set of access control policies;
• receiving a request from the client information processing system for access to content in a file residing at the client information processing system, wherein the file includes metadata associated with the content, and wherein the request includes an access control policy identifier from the metadata, wherein the access control policy identifier is separate and distinct from content identification data for identifying the content, wherein the request comprises at least one type of access required;
• identifying at least one access control policy associated with the content based on the identifier;
• identifying at least one type of access type required by the client information processing system based on the access type information;
• determining whether the request is in accordance with the access control policy associated with the content;
• and
• wherein if the request is in accordance with the access control policy associated with the content, wherein the access control policy is included in the set of access control policies, the set of access control policies remains with the server information processing system and is not transmitted to the client information processing system, sending a reply to the request to the client information processing system, wherein the reply includes a grant of access to the content to the client information processing system.

A computer readable storage medium including computer instructions for providing content protection on a client information processing system, the computer instructions providing instructions for:

• sending a request to a server information processing system for access to a file residing at the client information processing system using a client application, wherein the file comprises content encrypted with a first encrypting key and metadata associated with the content and wherein the request includes an access control policy identifier from the metadata for enabling the server information processing system to identify at least one access control policy associated with the content, wherein the access control policy identifier is separate and distinct from content identification data for identifying the content, and wherein the request comprises at least one type of access required;
• receiving a reply to the request from the server information processing system, wherein the reply includes a grant of access to the content in response to the server information processing system determining that the request is in accordance with a set of access control policy associated with the content, and wherein the set of access control policies remains with the server information processing system and is not transmitted to the client information processing system;
• and
• accessing the content in the file using the client application in response to the reply that is received from the server information processing system.

A client information processing system for providing content protection, the system comprising:

• a file comprising content encrypted with a first encrypting key and metadata related to the content;
• a request to the server information processing system for access to the content, wherein the request includes an access control policy identifier from the metadata related to the content for enabling the server information processing system to identify at least one access control policy associated with the content, wherein the access control policy identifier is separate and distinct from content identification data for identifying the content, and wherein the request comprises at least one type of access required;
• and
• a reply to the request from the server information processing system, wherein the reply includes a grant of access to the content, wherein the access control policy is included in the set of access control policies, the set of access control policies remains with the server information processing system and is not transmitted to the client information processing system.

A server information processing system for providing authorization for access to content, the system comprising:

• a set of access control policies for granting access to content in a file on at least one client information processing system;
• a request from the client information processing system for access to the content including metadata associated with the content, wherein the request includes an access control policy identifier from the metadata for enabling the identification of at least one access control policy associated with the content, wherein the access control policy identifier is separate and distinct from content identification data for identifying the content, and wherein the request comprises at least one type of access required;
• and
• a reply to the request to the client information processing system, wherein the reply includes a grant of access to the content to the client information processing system, wherein the set of access control policies includes the access control policy associated with the client information processing system, the set of access control policies remains with the server information processing system and is not transmitted to the client information processing system.