Testing RMS enabled Applications

What is RMS?
Rights Management Services or RMS is a Microsoft Windows technology that is a form of selective functionality denial used for limiting the uses of documents such as corporate e-mail,Worddocuments, and web pages.
Advantages of RMS
This technology can be used to encrypt information stored in documents. Unauthorized decryption can be prevented through server-based policies. Only specific or authorized people or groups can decrypt the content in certain environments for certain period of time under certain conditions. Specific operations like printing, copying, editing, forwarding, and deleting can be allowed or disallowed by content authors for individual pieces of content.
Implementing RMS enabled applications
RMS enabled applications uses client-server architecture, using Windows Server 2003or Windows Server 2008 to host the Active Directory Rights Management Server that issues RMS licenses. The RMS client is required for both creating rights-protected content as well as accessing it. Applications that either create or provide access to protected content must be RMS-aware.
When restricting rights to a document, a trusted entity encrypts a random AES key with an RSA public key that can be validated with the public key certificate in the XrML identity license that is issued to an RMS server. The AES key is used to encrypt the document. When accessing a protected document using an RMS-enabled application, the RMS client runtime authenticates the recipient to the RM server, using the recipient's XrML identity license. The RM server then issues a use license that can be used by the RMS client runtime to decrypt the document. The RMS client uses this use license to provide access to the application, which enforces the document restrictions for that user.
Testing RMS enabled applications
Testing should ensure that content cannot be viewed by unauthorized users in unauthorized conditions.
I’m generalizing some of the scenarios to test to make sure the RMS enabled application is working as expected. We need to test below scenarios –
· Encryption process of the content – getting the encryption key from certificate Server and using it to encrypt the content, we should make sure that encryption key is transferred in secure protocol.
· Transferring the encrypted content to the specified user.
· Decrypting the encrypted content - Getting the Decryption key from the Server and decrypting the content, we should make sure that decryption key is transferred in to the correct destination. This should be transferred only to the machine or user which is RMS enabled and registered in the Server.
· Verify decryption process – Is it one time decryption for content or is the content decryption required for each view of the content? If it is required to decrypt for each view of the content, is the decryption key should be downloaded from server every time? If it is one time decryption, where will the content stored to view for the next time?
· Using the application in offline support, if supported – Use the application, view content when the user is not online, Verify the certificate or license which is used to decrypt the content offline. Verify, is it secure to store the certificate or license in the local drive?
· Getting the license or certificate regular interval from the server – how frequently the certificate is downloaded? What if user is offline during the time when the certificate needs to be downloaded?
· Verify the decryption of the content when the decryption certificate is expired
· Verify application behavior when the system time is changed or machine is moved other time zone, does the application should work with existing certificate or need to get new certificate to decrypt the content?
· Verify the decryption of the content using the decryption certificate of the another user or another machine – Decryption should not happen, for each and every decryption of content, application should check for correct user name or machine details or content details in the certificate, it should not allow to decrypt content with other machine’s or user’s certificate or certificate generated for a particular content.
· Viewing the encrypted content without decryption- Content should not be displayed to the user, if s/he tries to open the content without using the RMS enabled application.
· Verify the application when the RMS server or content server is down, user should not be allowed to get the content or certificate to view the content
· Performance testing during encryption of the content and decryption of the content, see encryption and decryption when the hard disc does not have the minimum required space
· Performance testing when multiple requests for RMS certificate at the same time from the RMS server
· Verify log of the application for any encryption keys or certificate or license values, no license key or security information should be logged in the log files