JP2010262445A - Device, system, method and program for converting use right - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a use right conversion device for converting the use right of digital right management. <P>SOLUTION: The use right conversion device includes: a use right conversion table storage part 20 for storing a use right conversion table for one-to-one converting the items of a use right set by one digital right management system into the items of the use right of a different digital right management system; a use right conversion table setting part 10 for creating the use right conversion table; a type AIF part 30 for identifying the digital right use management system of an input electronic file; and a use right conversion part 40 for extracting usable items by acquiring the information of the use right of the electronic file, and for converting the use right set in the electronic file into the use right of the different digital right management system based on the extracted usable items and the use right conversion table. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a usage right conversion device for converting usage rights for digital rights management.

  Conventionally, there is a digital rights management technique as a method for preventing information leakage and falsification. The digital rights management technology is to set in detail the range of operations (viewing, printing, saving, editing, etc.) that can be used on electronic files (hereinafter, the set operation range is the usage right). It is possible to manage “only for people”, “within the permitted functions”, and “sharing and sharing information safely”. Since it is possible to maintain a secure state in an environment protected by digital rights management, it is adopted as a means of information protection measures in the enterprise.

  Usage rights vary depending on the department or position to which the user belongs, and often change due to organizational changes, so it is necessary to respond flexibly. However, if it can be changed easily, it can also be changed by an unauthorized accessor. In view of this, Japanese Patent Application Laid-Open Publication No. 2004-228561 discloses a technique that allows the usage right to be flexibly changed while restricting unauthorized access.

JP 2003-85044 A

  However, the above-mentioned conventional technology converts the usage authority within a product (architecture) of the same digital rights management technology. For this reason, there has been a problem in that electronic files to which usage rights are given in different architectures cannot be used mutually between companies.

  In addition, when exchanging information using electronic files such as development design materials and deliverables between companies for business purposes, an electronic file that is protected with a right of use is temporarily transferred to plaintext (usage granted to the electronic file). It is necessary to release the right). Therefore, there is a problem that there is a risk of information leakage and falsification.

  The present invention has been made in view of the above, and when a transfer destination of an electronic file uses a digital rights management technology of a different architecture, the use right currently set is used on the transfer side. It is an object of the present invention to obtain a usage right conversion device that can be converted into a right.

  In order to solve the above-described problems and achieve the object, the present invention provides a usage right for converting a usage right set in an electronic file protected by a digital rights management method into a usage right of a different digital rights management method. A conversion device for storing a usage right conversion table for converting a usage right item set by one digital rights management method into a usage right item of a different digital rights management method on a one-to-one basis. A usage right conversion table storage unit, a usage right conversion table creation unit that creates the usage right conversion table and writes it in the usage right conversion table storage unit, and a file that identifies the digital right management method of the input electronic file An identification unit; a usage right information acquisition unit that acquires usage right information of the electronic file and extracts usable items; and the usage right information. Receiving an available item from the acquisition unit, reading the usage right conversion table from the usage right conversion table storage unit, and using the available item and the usage right set in the electronic file based on the usage right conversion table Using right conversion means for converting the use right into a use right of a different digital right management system.

  According to the present invention, it is possible to mutually use electronic files to which usage rights have been given in different architectures, and to reduce the risk of information leakage.

FIG. 1 is a diagram illustrating a configuration example of a usage right conversion system. FIG. 2 is a diagram illustrating a configuration example of the usage right conversion terminal. FIG. 3 is a flowchart showing the usage right conversion process. FIG. 4 is a diagram illustrating a configuration example of the usage right conversion table. FIG. 5 is a diagram illustrating a configuration example of a usage right table of a type A protected file. FIG. 6 is a diagram illustrating a configuration example of a usage right table of a type B protected file. FIG. 7 is a flowchart showing the conversion process of the encryption method. FIG. 8 is a flowchart showing a user addition / deletion process. FIG. 9 is a diagram showing a user right table added to the type B protected file. FIG. 10 is a diagram illustrating a configuration example of an electronic computer capable of executing the usage right conversion program.

  Embodiments of a usage right conversion apparatus according to the present invention will be described below in detail with reference to the drawings. Note that the present invention is not limited to the embodiments.

Embodiment 1 FIG.
First, two usage right management methods used in the present embodiment will be described. A number of products have already been sold in the market. Specifically, the method of centrally managing the usage rights information for electronic files with the management server is type A, and the usage rights information for electronic files is stored for each electronic file. A type B is a management method. Here, in a usage right conversion method based on different architectures such that one is type A and the other is type B, a method of converting a usage right of a type A protected file into a usage right of a type B protected file Will be described. A protected file refers to an electronic file to which usage rights are granted. When a file is used, only the operation menu for the granted usage rights is valid, and writing and reading are locked with a password or the like.

  FIG. 1 is a diagram illustrating a configuration example of a usage right conversion system. The usage right conversion system 1 includes a usage right management server 2, a right management server 3, terminals 4 and 5, and a usage right conversion terminal 6. The usage right management server 2, the terminal 4 and the usage right conversion terminal 6 are connected via a network 7. In addition, the authority management server 3, the terminal 5, and the usage right conversion terminal 6 are connected via a network 8. Here, the type A usage right management method is used on the side connected by the network 7, and the type B usage right management method is used on the side connected by the network 8.

  The usage right management server 2 manages usage right information and user information of type A protected files. The authority management server 3 manages information such as a user account certificate necessary for accessing each electronic file and a license certificate necessary for encryption (decryption). The terminal 4 is a terminal such as a personal computer capable of using a file protected by a type A usage right management method. The terminal 5 is a terminal such as a personal computer capable of using a file protected by the type B usage right management method. The usage right conversion terminal 6 is in an area where architectures with different usage rights management methods of type A and type B coexist, and converts the protection file between type A and type B to each other.

  The usage right information of the type A protected file is registered in the usage right management server 2 together with the document ID and user information (user ID, password information, etc.) when the protected file is created. Further, when creating a type B protected file, the user needs to register user information (user ID, password information, etc.) and an account certificate in the authority management server 3 in advance.

  FIG. 2 is a diagram illustrating a configuration example of the usage right conversion terminal 6. The usage right conversion terminal 6 includes a usage right conversion table setting unit 10, a usage right conversion table storage unit 20, a type AIF unit 30, a usage right conversion unit 40, a type BIF unit 50, and a user information editing unit 60. And an additional user information storage unit 70. The usage right conversion table setting unit 10 sets a usage right conversion table. The usage right conversion table storage unit 20 stores a usage right conversion table for converting usage rights of different usage right management systems. The type AIF unit 30 is an interface with each device of the network 7 that uses a type A protected file. The usage right conversion unit 40 identifies the type of the input protected file and converts the usage right of the protected file. The type BIF unit 50 is an interface with each device of the network 8 that uses a type B protected file. When converting the usage right, the user information editing unit 60 performs editing such as addition or deletion of a user who can use the converted protected file. The additional user information storage unit 70 stores additional user information when a user is added to the usage right.

  In addition, the usage right conversion unit 40 includes a usage right confirmation unit 41, a usage right release unit 42, and a protected file creation unit 43. The usage right confirmation unit 41 identifies the type of the input protected file and confirms the details of the usage right information. The usage right releasing unit 42 releases all the usage rights of the input protected file (plain text). The protection file creation unit 43 extracts the usage rights used at the output destination, and creates a protection file to which the extracted usage rights are added.

  Next, a process for converting type A usage rights to type B usage rights will be described. FIG. 3 is a flowchart showing the usage right conversion process. First, a user who uses the usage right conversion terminal 6 inputs his / her user ID and login password from an input unit (not shown) when the apparatus is activated (step S1). The input user ID and password information is notified from the input unit (not shown) to the usage right conversion unit 40 (the usage right confirmation unit 41, the usage right release unit 42, and the protected file creation unit 43). Thereafter, the user ID and login password input here are used as information for specifying the user. Next, the user creates a usage right conversion table for converting usage rights of protected files of different types in the usage right conversion table setting unit 10 of the usage right conversion terminal 6 (step S2).

  FIG. 4 is a diagram illustrating a configuration example of the usage right conversion table. Items indicating the same function are associated between type A and type B. Type A usage rights are listed in type A401, and type B usage rights corresponding to type A are set in type B402. If there is no corresponding usage right, “(No applicable authority)” is assumed. Specifically, an item managed as “browse” in type A is managed as an item name “display” in type B. In addition, since there is no type B item corresponding to the item A managed as “save as a new protected document”, it becomes “(no corresponding authority)”. The usage right conversion table setting unit 10 causes the usage right conversion table storage unit 20 to store the created usage right conversion table.

  Next, when a protected file is input to the usage right conversion terminal 6, the type AIF unit 30 outputs the protected file to the usage right conversion unit 40 (use right confirmation unit 41, usage right release unit 42). The usage right confirmation unit 41 that has received the protected file identifies the type of the protected file by using an identifier (document ID) embedded in the file format or file property (step S3). Here, since the protected file has a type A identifier (document ID: 0000001), it is identified as type A.

  Next, the usage right confirmation unit 41 acquires detailed information on the usage right based on the protected file and information indicating that the protected file is type A (step S4). Here, the usage right confirmation unit 41 obtains detailed information on the usage right by inquiring the usage right management server 2 about the usage right information of the protection file via the type AIF unit 30. For the inquiry of the usage right information, an identifier (document ID) or “information for identifying a user (user ID, login password)” input in step S1 is used. As a result, as shown in FIG. 5, it is possible to acquire detailed information (usage right table) of the usage right of the protected file.

  FIG. 5 is a diagram illustrating a configuration example of a usage right table of a type A protected file. A classification 501 indicates a major classification for the detailed items constituting the item 502. An item 502 indicates a detailed item of user information and a detailed item for which a usage right can be set by type A. The usage right part of the item 502 is the same as the item of type A401 in FIG. The content 503 indicates the content set for the detailed items constituting the item 502. Here, the usage right described as “True” in the contents 503 is valid, and the usage right described as “False” is invalid.

  After acquiring the detailed information on the usage right in the process of step S <b> 4, the usage right confirmation unit 41 outputs the detailed information to the usage right release unit 42. In order to convert to a type B protected file, the usage right releasing unit 42 releases (plain text) the usage right of the protected file with the document ID: 0000001 received via the type AIF unit 30 (step S5). At this time, the usage right release unit 42 manages the usage right management server 2 via the type AIF unit 30 based on the identifier (document ID) and information (user ID, login password) for specifying the user. The usage right information and user information of the protected file being deleted are deleted (step S5). The usage right release unit 42 outputs the protection file after the usage right is released and detailed information on the usage right to the protection file creation unit 43.

  Next, the protection file creation unit 43 performs a process of giving a type B usage right to the protected protection file received from the usage right cancellation unit 42 and protecting it. Specifically, the following processing is performed.

  Type B usage rights are granted for each electronic file. For example, all the usage rights information is registered in the file properties. When registering in the file properties, it is necessary to obtain from the authority management server 3 a user account certificate necessary for registration. Therefore, the protection file creation unit 43 acquires the account certificate of the user from the authority management server 3 via the type BIF unit 50 based on information (user ID, login password) for specifying the user. (Step S6).

  Furthermore, the protection file creation unit 43 extracts a valid usage right (True) from the received detailed information on the usage rights of type A (see FIG. 5) in order to convert the usage rights from type A to type B. The usage right corresponding to the usage right extracted above is extracted from the type B 402 of the usage right conversion table (see FIG. 4) stored in the usage right conversion table storage unit 20 (step S7). Here, the usage rights of “display”, “edit”, “save”, and “extract” are valid. Based on this, a type B usage right table is created (step S8). FIG. 6 is a diagram illustrating a configuration example of a usage right table of a type B protected file. A classification 601 indicates a major classification for the detailed item 602. An item 602 indicates a detailed item of user information and a detailed item in which a usage right can be set for type B. The usage right part of the item 602 is the same as the item of type B402 in FIG. A content 603 indicates the content set for the detailed item of the item 602.

  Next, the protection file creation unit 43 creates a type B protection file based on the acquired account certificate and the detailed information on the type B usage right (step S9). Then, the created type B protected file is output to the type BIF unit 50. As a result, the user can use the type B protected file output from the type BIF unit 50.

  As described above, in the present embodiment, the usage right conversion terminal 6 converts the usage right of the protected file into a different type based on the usage right conversion table. As a result, the usage rights can be converted between different architectures, so that the protected files can be mutually used. In addition, since the file is not used in a state where the protection of the file is released, information leakage and tampering can be prevented.

  In the present embodiment, as an example, the case of conversion from type A to type B has been described. However, the present invention is not limited to this. By preparing a usage right conversion table for converting from type B to type A and a usage right conversion unit, conversion in the reverse direction is also possible. Moreover, although this Embodiment demonstrated the case where different types of protected files were converted, it is not limited to this. For example, the present invention can also be applied to the case where the usage right is changed between types A and the case where the usage right is changed between types B.

  In the present embodiment, the case of a one-to-one relationship in which a specific type of usage right scheme is converted to a specific usage right scheme has been described. However, the present invention is not limited to this. For example, the usage right conversion terminal includes a plurality of usage right conversion tables and a usage right conversion unit, so that even when a file with a different type of usage right is input, the usage right of each file can be changed. It becomes possible to convert. In this case, conversion to a plurality of types can be realized by further including a configuration capable of selecting the usage right conversion table to be used and the usage right conversion unit (the type of protected file to be input and the type of protected file after conversion).

Embodiment 2. FIG.
In the digital usage right management technology, the protected file may be encrypted by an encryption technology. In the present embodiment, a case where the encryption method of the protected file is further converted will be described. Hereinafter, a different part from Embodiment 1 is demonstrated.

  FIG. 7 is a flowchart showing the conversion process of the encryption method. After the process of step S4, when the protected file is encrypted, the usage right release unit 42 decrypts the protected file before releasing the usage right of the protected file (step S5). The usage right management server 2 stores key information necessary for decrypting the protected file encrypted by the type A encryption method. Therefore, the usage right release unit 42 sends the key information necessary for decryption via the type AIF unit 30 based on the identifier (document ID) and information (user ID, login password) for specifying the user. Obtained from the usage right management server 2 (step S11). The key information is, for example, character string information expressed by numbers or alphabets. The usage right release unit 42 decrypts the protected file using the acquired key information (step S12). Thereafter, the usage right releasing unit 42 releases the usage right of the decrypted protected file (step S5), and outputs the protected file after the usage right is released to the protected file creating unit 43.

  Further, after creating the type B protected file (step S9), the protected file creating unit 43 further encrypts the protected file using the type B encryption method. Here, the authority management server 3 stores a license certificate necessary for encryption. Therefore, the protection file creation unit 43 creates a type B protection file in the process of step S9 in FIG. 3 and then uses the type BIF unit 50 based on information (user ID, login password) for specifying a user. Then, the license certificate of the user is obtained from the authority management server 3 (step S13). The protected file creation unit 43 uses the obtained license certificate to encrypt the type B protected file using the type B encryption method (step S14). Thereafter, the protection file creation unit 43 outputs the encrypted protection file to the type BIF unit 50.

  As described above, in the present embodiment, the usage right conversion terminal 6 decrypts the input protected file if it has been encrypted, and then applies to the protected file after the usage right conversion. Therefore, encryption is performed using the encryption method of the usage right type after conversion. Thereby, the user who uses the protected file after the usage right conversion can obtain the protected file encrypted in a decryptable manner.

Embodiment 3 FIG.
When converting the usage right, basically, the usage right after the conversion is granted to the user who has been given the usage right before the conversion. In the present embodiment, a case will be described in which a user is dynamically added or deleted when a usage right is converted. Hereinafter, a different part from Embodiment 1 is demonstrated.

  FIG. 8 is a flowchart showing processing when adding and deleting a user at the time of usage right conversion. Here, a case will be described in which user information is added and deleted when the right to use a protected file is converted. For example, after creating the usage right conversion table (step S2), the additional user information shown in FIG. 9 is registered in the additional user information storage unit 70 in advance (step S21).

  FIG. 9 is a diagram showing user authority information (added user information) to be added to the type B protected file. Compared with the type B usage right table of FIG. 6, the only difference is that there is no sentence ID item. The additional user information storage unit 70 may be provided in a database or the like, or may be provided in a portable file or the like. Further, the additional user information is not limited to the case where it is stored in advance, and may be set dynamically, for example, when the usage right is converted.

  After creating the type B usage right table (step S8), the user information editing unit 60 performs processing for adding user information in the usage right table based on the additional user information registered in the additional user information storage unit 70 (step S8). Step S22).

  In addition, when converting the usage right, if the usage right is given to a user who seems unnecessary, the user information editing unit 60 deletes the user information (unnecessary user information) from the type B usage right table. (Step S23). For example, when a protected file is received from another company, all information related to the user who has been granted the right to use the other company is deleted. In this case, it is not necessary to register detailed information such as additional user information when adding.

  Then, after adding and deleting user information as described above, the protection file creation unit 43 creates a type B protection file (step S9), and outputs the created type B protection file to the type BIF unit 50. .

  As described above, in the present embodiment, it is possible to add and delete available users to the protected file after the usage right conversion. Thereby, for example, when a file is transferred between companies, a flexible operation at a file transfer destination is possible.

(Usage rights conversion program)
FIG. 10 is a configuration of an electronic computer that has a function as a usage right conversion device for realizing the usage right conversion method according to the first to third embodiments and can execute the usage right conversion program according to each embodiment. It is a figure which shows an example.

  This computer includes, for example, a control unit 101 including a CPU (corresponding to the usage right conversion unit 40 and the user information editing unit 60) and a memory unit 102 (the usage right conversion table storage unit 20 and the additional user information storage unit 70). Display unit 103, input unit 104, CD-ROM drive unit 105, disk unit 106, and external I / F unit 107 (corresponding to type AIF unit 30 and type BIF unit 50). These units are connected to each other via a system bus A.

  In FIG. 10, the control unit 101 executes the usage right conversion program. The memory unit 102 includes various memories such as RAM and ROM, and stores programs to be executed by the control unit 101, necessary data obtained in the course of processing, and the like. The display unit 103 is composed of a CRT, LCD (liquid crystal display panel), or the like, and displays various screens to the user of the electronic computer. The input unit 104 includes a keyboard, a mouse, and the like, and is used by a user of an electronic computer to input various information. The illustrated CD-ROM 200 stores a usage right conversion program describing the processing of the present embodiment.

  Here, an operation example of the electronic computer until the usage right conversion program becomes executable will be described. First, in the electronic computer configured as described above, a usage right conversion program is installed in the disk unit 106 from the CD-ROM 200 set in the CD-ROM drive unit 105. Then, the program read from the disk unit 106 is stored in the memory unit 102 when the electronic computer is activated or when the program is executed. In this state, the control unit 101 executes the usage right conversion process according to the program stored in the memory unit 102.

  In the present embodiment, the use right conversion program is provided by the CD-ROM 200. However, the recording medium of this program is not limited to this, and it depends on the computer constituting the system. For example, other recording media such as a floppy (registered trademark) disk and a DVD can be used. Moreover, it is good also as using the program provided by transmission media, such as an email and the internet.

  As described above, the usage right conversion device according to the present invention is useful for digital rights management of electronic files, and is particularly suitable when a plurality of digital rights management methods are used.

DESCRIPTION OF SYMBOLS 1 Usage right conversion system 2 Usage right management server 3 Authority management server 4, 5 Terminal 6 Usage right conversion terminal 7, 8 Network 10 Usage right conversion table setting part 20 Usage right conversion table memory | storage part 30 Type AIF part 40 Usage right conversion part 41 usage right confirmation unit 42 usage right cancellation unit 43 protected file creation unit 50 type BIF unit 60 user information editing unit 70 additional user information storage unit

Claims (13)

A usage right conversion device that converts usage rights set in an electronic file protected by a digital rights management method into usage rights of a different digital rights management method,
Usage right conversion table storage for storing a usage right conversion table for converting a usage right item set by one digital right management method into a usage right item of a different digital right management method on a one-to-one basis Means,
A right-of-use conversion table creating means for creating the right-of-use conversion table and writing the right-of-use conversion table storage means;
File identification means for identifying the digital rights management method of the input electronic file;
Usage right information acquisition means for acquiring information on usage rights of the electronic file and extracting available items;
An available item is received from the usage right information acquisition means, a usage right conversion table is read from the usage right conversion table storage means, and the electronic file is set based on the available item and the usage right conversion table. A usage right converting means for converting the usage right to a usage right of a different digital rights management method;
A right-of-use conversion device comprising:   2. The usage right conversion apparatus according to claim 1, wherein the file identification unit identifies a digital rights management method based on an identifier of the electronic file included in the input electronic file. As a result of identification by the file identification means, when the digital rights management method of the input electronic file is a method of centrally managing the usage right information of the electronic file by the usage right management server,
The usage right conversion apparatus according to claim 1, wherein the usage right information acquisition unit acquires the usage right information from the usage right management server. As a result of identification by the file identification means, when the digital rights management method of the input electronic file is a method of managing the usage right information of the electronic file for each electronic file,
3. The usage right conversion apparatus according to claim 1, wherein the usage right information acquisition unit acquires the usage right information from the input electronic file. further,
A selection means capable of selecting a combination of the digital rights management method of the input electronic file and the converted digital rights management method;
With
The usage right conversion table storage means stores a usage right conversion table corresponding to a combination of a digital right management method for an input electronic file and a digital right management method for conversion and output. I mean,
The usage right conversion unit uses a usage right conversion table corresponding to a combination of the digital rights management method of the input electronic file and the converted digital rights management method selected by the selection unit when converting the usage right. To
The usage right conversion device according to any one of claims 1 to 4, wherein: If the input electronic file is encrypted,
The usage right converting means decrypts the electronic file, and then performs encryption corresponding to the converted digital rights management method for the electronic file after the usage right conversion.
The right-of-use conversion device according to any one of claims 1 to 5. further,
User information conversion means for adding and deleting available users to the electronic file after conversion of usage rights,
User information storage means for storing additional user information which is information for adding and deleting available users;
With
The user information conversion means adds or deletes available users to the electronic file after the usage right conversion based on the additional user information.
The right-of-use conversion device according to any one of claims 1 to 6. The usage right conversion device according to any one of claims 1 to 7,
In the case where the digital rights management method of the electronic file before conversion is a method of centrally managing the usage right information of the electronic file by the usage right management server, a usage right management server for managing the usage rights;
In the case where the digital rights management method of the electronic file after conversion is a method of managing the usage right information of the electronic file for each electronic file, an authority management server that manages the license certificate;
A usage right conversion system characterized by comprising: The usage right conversion device according to any one of claims 1 to 7,
In the case where the digital rights management method of the electronic file before conversion is a method of managing the usage right information of the electronic file for each electronic file, an authority management server that manages the license certificate,
In the case where the digital rights management method of the electronic file after conversion is a method in which the usage right information of the electronic file is centrally managed by the usage right management server, a usage right management server for managing the usage rights;
A usage right conversion system characterized by comprising: A usage right conversion method in a usage right conversion device for converting a usage right set in an electronic file protected by a digital rights management method into a usage right of a different digital rights management method,
Usage right conversion table storage for storing a usage right conversion table for converting a usage right item set by one digital right management method into a usage right item of a different digital right management method on a one-to-one basis means,
With
A usage right conversion table creating unit creates the usage right conversion table and writes the usage right conversion table in the usage right conversion table storage unit; and
A file identification step in which the file identification means identifies the digital rights management method of the input electronic file;
A usage right information acquisition unit acquires usage right information of the electronic file and extracts available items;
The usage right conversion means receives an available item from the usage right information acquisition means, reads the usage right conversion table from the usage right conversion table storage means, and based on the available item and the usage right conversion table, A usage right conversion step of converting the usage rights set in the electronic file into usage rights of different digital rights management methods;
A usage right conversion method comprising: When the input electronic file is encrypted, the usage right converting means decrypts the electronic file; and
After executing the decryption step, the usage right converting means performs encryption corresponding to the converted digital rights management method for the electronic file after the usage right conversion;
The usage right conversion method according to claim 10, further comprising: further,
A user information conversion step in which the user information conversion means adds and deletes available users to the electronic file after the usage right conversion;
A user information storage step in which user information storage means stores additional user information, which is information for adding and deleting available users;
Including
The user information conversion means adds or deletes available users to the electronic file after the usage right conversion based on the additional user information.
12. The usage right conversion method according to claim 10 or 11, wherein:   A use right conversion program for causing a computer to execute the use right conversion method according to claim 10, 11 or 12.

Images