This past summer Adobe released the LiveCycle ES Update 1 release. This include LiveCycle Content Services ES, a fully integrated set of content services that enables organizations to "manage content in a lower-cost, extensible way for cross-company and cross-organizational processes". LiveCycle Rights Management ES is a core part of this offering, and allows organizations to include content protection as a part of these cross-organizational processes.

Each "space" within Content Services can be seen as a folder to hold sub-spaces or content. These spaces can be associated with business rules and security -- including various access control rights as defined by LiveCycle Rights Management ES.

It's easy for business users to interact with these spaces because content can be added in several different ways; for example: using the Web UI, FTP, CIFS, or WebDAV. Adding security is a breeze because the act of adding content can be associated with an automatic trigger that can protect the content with Rights Management. For example, an administrator can create a trigger to associate the "Confidential" policy for general documents, or the "Mergers & Acquisitions" policy for content being stored for the M&A team.

In today's blog entry we show off a simple example of how:

1. An administrator can create a rule to automatically protect all content with a specific predefined policy.
2. An end user can upload a document to be automatically protected.
3. A recipient can open a protected document within the Content Services repository.

Click on the following screenshot of LiveCycle Content Services for a brief tour of this functionality:

Guest Contributor: Neerav Aggarwal

Need more information on how your organization can effectively manage and protect your intellectual property? Further information can be obtained at http://www.adobe.com/go/rm or by contacting Adobe

DIRECTV is also providing SUPERCAST as a downloadable rich Internet application (RIA) built on Adobe AIR. Adobe AIR offers a new way to engage customers on the desktop with a downloadable, branded RIA that can be deployed across major operating systems. The SUPERCAST application on AIR provides a wide variety of real-time NFL SUNDAY TICKET content right on the desktop as games stream live in high-quality H.264 video, including Red Zone channel’s live-action of critical plays, statistics and moments from game broadcasts, as well as near real-time highlights from all the games. Additionally, only in the SUPERCAST application on Adobe AIR can fans receive desktop notification alerts when requested highlights become available. SUPERCAST is available at www.directv.com/supercast.

Content is streamed live via Adobe Flash Media Server software to the browser using Adobe Flash Player technology, which is installed on more than 98 percent of Internet-connected computers, and to the desktop via Adobe AIR. DIRECTV also uses Adobe Flash Media Rights Management Server software for digital rights management (DRM) to protect the NFL premium on-demand content downloaded to the desktop. Adobe Flash Media Server is helping enable DIRECTV to stream content more securely and cater to large volumes of fans with rapid, reliable delivery of exciting content. Adobe Flash Media Rights Management Server is a robust on-demand content protection solution that is non-intrusive to users, yet can allow DIRECTV to safeguard media integrity, authenticity and access, whether SuperFan subscribers are online or offline, even after the content has been viewed.

Signature credentials are trusted in Adobe products through the establishment and installation of trust anchors and trusted identities.  Trust anchors are typically root certificates—certificates at the top of the hierarchy from which other certificates are derived.  Trusted identities can be any certificate, even an end-entity, or user, certificate.  In any case, in order to pass validation, the signing certificate must either be a trust anchor (root) or be chained to (derived from) that root.

We’ll cover in this post the 3 ways an individual user can set trust in Adobe products.

This is the most straightforward method: a user receives a signed document from an individual who has not been previously trusted by the user. The user opens the document with Adobe Acrobat or Reader, right-clicks on the signature, chooses Show Signature Properties and then Show Certificate. By clicking on the Trust tab within that dialog box, the user can select Add to Trusted Identities to select whether the credential will be trusted for standard approval signatures and/or certification (publishing) signatures.

User Trust Setting #2: Trust Manager

In this method, a user may already have a number of certificates in hand or available (via email, for example) from approved signers and wishes to add them to the Trusted Identity list. The user clicks on the Advanced menu and then chooses Manage Trusted Identities. The user can then simply add or request ‘contacts’ (certificates) and go on to edit that trust.

User Trust Setting #3: Certificate Store (Windows)

In order to best serve the purposes of web browsing, operating system and browser vendors have created lists of trusted identities (SSL certificates) to enable more secure transactions online. Users of Adobe products have the option to allow the software to trust all of the certificates in the Windows Certificate Store, though this option is not selected by default. Why? Adobe believes the store casts too wide a net, and trusts a large number of both high and low assurance certificates, thereby introducing unnecessary risk into a document signing scenario. The rise of the enhanced validation (EV) SSL certificate also highlights this problem.

Despite these concerns, some users may still wish to enable this option. Within the Edit menu, select Preferences, and then Security. Click on the Advanced Preferences button, and then on the Windows Integration tab. The user can then choose to either trust certificates in the Store for validating standard signatures and/or certification signatures.

For more detailed information on these options, be sure to check out this link:

Tags:electronic signature,digital signature,trust,validity,acrobat,reader,trust settings

When we consider electronic signatures, recognize that there are typically two parties to the transaction: the author / signer and the recipient, or relying party.  The signer’s role is obvious.  The relying party, on the other hand, is the one who is in the position to accept the signature and therefore the signer’s approval of the terms or nature of the signed document.  When faced with an electronic signature, the relying party must be aware (or have resources he/she can turn to, such as a lawyer) of three intersecting zones of validity—legal, contractual, and intrinsic—and how Adobe products can assist. 

The second category is that of contractual validity. Organizations may jointly accept each other’s electronic signatures via contract and thus impart additional validity to those signatures. As an example, the SAFE-BioPharma initiative among pharmaceutical and life sciences companies has as its backbone a strong business contract that stipulates each member will trust other members’ digital signatures and accept them as legally valid. SAFE members can therefore easily rely on each other’s signatures without worry.

Adobe products cannot provide specific feedback on these first two aspects of trust and assurance. Adobe Reader can be found on practically every computer in the world and thus Adobe can’t be aware of every single law, regulation, or contractual relationship a user may be subject to—we have to leave the lawyers something. But, Adobe products can provide clear guidance on that most important aspect of electronic signatures, the signature’s intrinsic validity.

Adobe products like Acrobat, Reader and LiveCycle ES Digital Signatures ask three questions of an electronic signature:

1. Is the signature credential valid and in good working order?
• Is the digital certificate in good standing? Has it expired? Has it been revoked?
2. Has the document been altered since it was signed?
   • Integrity checking. Has the document been changed? What’s been changed, if so? Is it an authorized change (another signature, for example)?
3. Is the signer trusted by the relying party?

The answers to these questions remain critically important no matter whether a signature is governed by legislation or established in a contractual relationship. The first two questions are handled behind the scenes by Adobe products through industry standard cryptographic protocols. The third question, however, is, by its very nature, answered by the relying party, based on their knowledge of relationships the organization may have, business colleagues, etc.

Adobe products cannot answer this question in most circumstances. Adobe understands that the relying party must be free to make their own trust decisions based on their own unique circumstances. If Adobe were to trust every signature credential, users might accept signatures from false identities or trust documents that should not be trusted in the first place. However, as you’ll read later in this series, Adobe has been looking at ways to help relying parties make this determination since 2005, and will be announcing an even more comprehensive approach starting later this year.

Next time, though, I’ll cover how a relying party can trust a signer from a user perspective.

Tags:electronic signature,digital signature,valdiity,assurance,trust settings acrobat,reader,livecycle

http://www.adobe.com/cfusion/showcase/index.cfm?event=casestudydetail&casestudyid=510844&loc=en_us

Smart card / Certificate authentication

The fourth type of authentication that LiveCycle Rights Management ES supports is smart card, or certificate-based authentication. For some customers, this form of authentication is often more secure than the other forms of authentication supported. To understand how it works in LiveCycle Rights Management ES and the benefits it provides, however, requires some background and context.

A smart card, in its most well-known form, is a credit card-sized ‘intelligent card’ that carries user’s credentials in the form of Digital Certificates. Many variants today also possess processing capabilities like the ability to compute Digital Signatures. A smart card is a something-you-have type of authentication, as compared to Username/Password which is something-you-know.

A Digital Certificate, often just referred to as Certificate, is a digital document that at a minimum includes a Distinguished Name (DN) and an associated Public Key. The DN uniquely identifies a user’s identity, and the public key can be used to prove that identity. The Certificate is signed by a trusted third party known as Certificate Authority (CA). The CA vouches for the authenticity of the certificate holder. This Public Key Infrastructure (PKI) assumes the use of Public Key Cryptography, which is the most common method on the Internet for authenticating end parties or encrypting messages. PKI overcomes the significant flaws in the traditional cryptography or the symmetric cryptography, and at the same time provides added security by having strict requirements for key lengths and industry standard cryptographic algorithms (set forth by Public Key Cryptography Standards or PKCS, and governed by RSA Laboratories).

At the time of authentication, LiveCycle Rights Management ES validates the chosen Certificate’s signature against its cache of known and trusted CA certificates. The server verifies the Certificate, validates the Digital Signature, and finally maps this Certificate to a unique user through the rules an administrator creates when configuring LiveCycle. LiveCycle Rights Management ES also provides for flexibility and easier enterprise integration by providing server-based “SPIs,” which can be used to develop custom certificate authentication providers.

Many enterprises and governments today employ smart card based authentication, not only for its enhanced security but also for its ease of deployment and use for end users. For example the United States Department of Defense issues Common Access Cards (CAC cards) which can be used for secure user identification. These CAC cards can be used within LiveCycle Rights Management ES to authenticate users who are opening protected documents. A user would insert his card into a smart card reader on his machine to identify himself. These readers are available in a variety of form factors and can be connected to a computer using USB or PC card interface – and are integrated into many laptops today, such as the Dell Latitude line of business laptops.

To give you a better idea of how easy it is for an end user to authenticate to LiveCycle Rights Management ES using a smart card, click on the following demo:

Guest Contributor: Chaitanya Atreya

Questions or feedback on this entry? Contact us at RMFeedback@adobe.com

Need more information on how your organization can effectively manage and protect your intellectual property? Further information can be obtained at http://www.adobe.com/go/rm or by contacting Adobe