Patent ID: 8448228

Claim:
A method at an authorization server including one or more processors and system memory for issuing a usage license for protected content directed to an authorization principal, the method comprising: an act of the authorization server receiving a usage license request from a policy enforcement principal on behalf of the authorization principal, the usage license request requesting a usage license for the authorization principal to access the protected content, the usage license request including: an authorization identity statement for the authorization principal, the authorization identity statement containing identity information identifying the authorization principal; and a policy enforcement certificate, the policy enforcement certificate containing a policy enforcement identity statement and a cryptographic key, the policy enforcement identity statement containing identity information identifying the policy enforcement principal, the cryptographic key provisioned for the policy enforcement principal; an act of the authorization server accessing coupling information, the coupling information usable to determine that the policy enforcement principal is coupled to the authorization principal and that the policy enforcement principal is trusted to request a usage license on behalf of the authorization principal; an act of the authorization server accessing a usage policy for the protected content; an act of the authorization server verifying that the policy enforcement principal is permitted to request the usage license on behalf of the authorization principal based on the coupling information which includes at least one of an enterprise-wide coupling policy, an individual consent policy or a delegation token from a trusted authority, or by verifying that the policy enforcement identity statement was signed with a key held by the authorization principal; an act of the authorization server verifying that unwanted permission elevation is not to occur based on the coupling between the policy enforcement principal and the authorization principal; an act of the authorization server formulating a usage license by evaluating the authorization principal against contents of the usage policy, the usage license including permissions granted to the authorization principal and a content key; an act of the authorization server encrypting the usage license, including encrypting the granted permissions and the content key with the cryptographic key provisioned for the policy enforcement principal; and an act of the authorization server returning the encrypted usage license to the policy enforcement principal.