Title: RE: ContentGuard IPR Declaration for OASIS re. XACML Hello Bruce, Thank you for your recent submission of ContentGuard's claimed IPR status with respect to the XACML Committee Specification. Members of the TC have discussed this and found the blanket statement "patent numbers [...numbers omitted...] may be technology required to implement the OASIS XACML Committee Specification Version 1.0" particularly unhelpful. Note that when IBM made a claim against XACML, they clarified in concurrent communications specifically which area of the specification they felt might infringe. Similarly, in the Security Services TC, when RSA Security made a claim against the SAML specification, they clarified in concurrent communications specifically which areas of the specification they felt might infringe. In that spirit, the members of the XACML TC respectfully request that ContentGuard show the same professionalism and courtesy. Section 2 of the XACML CS is very clear about the eleven (11) areas with respect to "a language for expressing information system security policy" that XACML addresses in its specification. These areas are as follows: To provide a method for combining individual rules and policies into a single policy set that applies to a given action. To provide a method for flexible definition of the procedure by which rules and policies are combined. To provide a method for dealing with multiple subjects acting in different capacities. To provide a method for basing an authorization decision on attributes of the subject and resource . To provide a method for dealing with multi-valued attributes . To provide a method for basing an authorization decision on the contents of an information resource . To provide a set of logical and mathematical operators on attributes of the subject , resource and environment . To provide a method for handling a distributed set of policy components, while abstracting the method for locating, retrieving and authenticating the policy components. To provide a method for rapidly identifying the policy that applies to a given action, based upon the values of attributes of the subjects, resource and action . To provide an abstraction-layer that insulates the policy-writer from the details of the application environment. To provide a method for specifying a set of actions that must be performed in conjunction with policy enforcement. Can ContentGuard please indicate which of the above areas (if any) it believes may be covered by ContentGuard intellectual property? As you may be aware, the XACML TC is at a critical stage in its process. A timely response would therefore be greatly appreciated! Carlisle Adams and Hal Lockhart, on behalf of the members of the OASIS XACML Technical Committee. ---------- From: Gitlin, Bruce[SMTP:
Bruce.Gitlin@CONTENTGUARD.COM] Sent: Tuesday, November 26, 2002 4:46 PM To: 'Gannon, Patrick' Cc: 'Karl F. Best'; '
carlisle.adams@entrust.com'; '
hal.lockhart@entegrity.com' Subject: ContentGuard IPR Declaration for OASIS re. XACML Dear Patrick, ContentGuard wishes to inform the Organization for the Advancement of Structured Information Standards (OASIS) that ContentGuard holds United States patents numbers 5,715,403, 5,629,980, 5,634,012, 5,638,443 and 6,236,971 which may be technology required to implement the OASIS XACML Committee Specification Version 1.0 (the "Specification"). Upon approval by the OASIS Board of Directors of the Specification, ContentGuard is willing to offer nonexclusive licenses to the patents to persons wishing to pursue compliant implementations of the Specification. These licenses will be provided under reasonable and non-discriminatory terms and conditions, in accordance with ContentGuard's then current licensing practices. For information concerning licensing of the patents, interest implementers may contact ContentGuard. ContentGuard Contact: Bruce Gitlin
Bruce.Gitlin@Contentguard.com < mailto:
Bruce.Gitlin@Contentguard.com > (240) 694-1223 Sincerely, Bruce Gitlin VP, Business Development