Behind the Scenes with RMS

RMS in B2B Scenarios
Although RMS is designed to protect content for enterprises, you can also use it in business-to-business (B2B) interactions by establishing Use Trusts between RMS installations. You can establish a Use Trust by exporting the SLC from a trusted RMS server and importing it to a trusting RMS Server in another organization. You're not required to establish a trust relationship between AD infrastructures. A user in the organization using the trusting RMS Server can send rights-protected email and documents to a user in the organization with the trusted RMS Server. The recipient of the rights-protected content will launch his or her RMS-aware applications, which will make an EUL request not to the recipient's RMS Server but to the trusting RMS Server. The EUL request contains the RAC issued by the trusted RMS infrastructure and the PL. The trusting RMS Server uses the imported SLC to validate the RAC before checking to make sure the recipient is permitted to access the content, then issues an EUL.

Enterprises that want to communicate with business partners who don't use the RMS technology, can take advantage of the Passport-based RMS Certification Service. This service allows one-way communication from a user with RMS to a user using the Passport-based service. The non-RMS user is required to obtain a Microsoft Passport. With a Passport-issued RAC, the recipient will be able to make an EUL request of the sender's RMS Server. If the RMS Server receiving the request was configured to trust RACs issued by the Passport-based service and the Extranet Cluster URL was configured on the server, it will issue an EUL.

RMS?Trust It
RMS's method of operation has several benefits over other information protection systems, such as pretty good privacy (PGP) and Secure MIME (S/MIME). First, PGP and S/MIME can only guarantee data confidentiality until the data is received by the recipient, who is then free to modify and redistribute it. Second, with systems such as PGP and S/MIME, it's necessary to obtain the recipient's public key or X.509v3 certificate before you can protect content you wish to send them. Last, protecting content for large groups of users using PGP or S/MIME can be impractical because you need to protect the content for each member of the group and send it individually. RMS overcomes all these problems through its unique architecture.

For more information about RMS, visit the Microsoft Web site dedicated to the product, at http://www.microsoft.com/rms. There, you can download the RMS Server and Client software and find tips to help you install and troubleshoot RMS, as well as links to partners who provide complementary services and who have developed their own RMS-aware applications.

John Howie (jhowie@microsoft.com) is Director of the World Wide Services and IT Technical Community for Security at Microsoft. He has more than 15 years of experience in information security and is a CISA, a CISM, and a CISSP.