JP2010146400A - Drm system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system for preventing information leakage even if a user ID or password is leaked, and rapidly making a response to spread of damage at the information leak. <P>SOLUTION: The system includes: a time synchronous server 46 for synchronizing the time between a DRM (digital rights management) server (authentication server) 44 and a client PC 43; a USB token 41 for generating a one-time password; the DRM server (authentication server) 44 for verifying authentication and authority of a client; and a product to which the system is applied. When opening a file from the client PC 43, the USB token 41 is inserted, and authentication information and an IP/MAC address are transmitted to the DRM server (authentication server) 44 at the time of authentication. According to this, even if the user ID or password is leaked, a document cannot be opened. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a secure DRM system using an authentication device, and more particularly to a secure DRM system using a USB token.

  With the enforcement of the Personal Information Protection Law, the necessity of various measures for preventing information leakage countermeasures is increasing in each company. However, the reality is that there is no end to information leakage incidents.

  Recently, not only an authentication technique for encrypting a document and permitting an operation only to an authorized person, but also a DRM (Digital Rights Management) technique for realizing dynamic security control after document distribution is becoming widespread.

  FIG. 1 is a functional block diagram showing an overview of a system using DRM technology. When a user installs the viewer application 1a and tries to open a document to which a set of security settings called a policy is assigned using the client PC 1 having the display screen 1b, the DRM server is always transmitted via the network. 2 is a mechanism for performing authentication processing (L1, L2). Furthermore, the AD server 3 and the DB server 4 are connected to the DRM server 2 (L3, L4). In this system, user authentication, operation permission confirmation (event notification such as opening, printing, etc.), confirmation of a browsing deadline, and the like are performed. The DRM server 2 performs user authentication, browsing time limit management, event auditing, authentication policy control, and the like. The AD server 3 holds internal user information. The DB server 4 has a database 4a, and holds external user information, administrator user information, policy information, event information, and the like. The policy can be set for each document.

  When the user inputs an ID and a password from the client PC 1 to request authentication for viewing the document file using the viewer application 1a (L1), and receives authentication of viewing OK from the DRM server 2 Only (L2), browsing is possible.

In such a secondary authentication system using an authentication device, a document management server and an authentication server are combined, and not only primary authentication at the time of starting an application, but further authentication such as fingerprint authentication (hereinafter referred to as “secondary authentication”). Document data can be displayed. Note that document data cannot be displayed in a state where the secondary authentication has been canceled.
The following Patent Document 1 is cited as a document related to such a technique.

JP 2004-295632 A

  By the way, products using DRM technology can realize dynamic security control after document distribution, but cannot completely prevent information leakage.

1) For products that use DRM technology, authentication when browsing a document using the Reader application is performed by entering an ID and password. Therefore, when an ID and a password are leaked, all documents that can be browsed by the user can be viewed by impersonating the user. Also, there is a problem that it is highly possible that the person who impersonated (the document (confidential information) was obtained) could not be identified in practice.

2) The fact that a document (confidential information) has been leaked is also not noticed when an unauthorized third party impersonates and asks the DRM server 2 to authenticate. I notice that it was done. In other words, since unauthorized access is a post-action measure, it will be a response after the user recognizes it, so there is a very high possibility that information will be leaked before it is noticed after unauthorized access. is there.

3) If the ID and password are leaked to a third party, all documents for which the user is authorized to view must be revoked. However, there is a problem that it is practically difficult for the user to find all documents for which viewing is authorized.

4) In the DRM server, once a protected file is opened, a document for which the user has viewing authority can be continuously viewed even if there is no authentication processing for that word, unless the Viewer operation by the Reader application is terminated. There is a problem that it ends up. For example, if the user forgets to close the Viewer when the user leaves the seat, another document may be illegally accessed by a third party.

  In addition, when a file with a policy is posted on a web page together with an ID or password, or shared by Winny or the like, anyone can view the document.

  As a similar case, there is a case of secondary authentication between a document management server and an authentication server, but there is no DRM product using secondary authentication at present.

  Moreover, it is possible to prevent unauthorized use by a malicious user by temporarily canceling secondary authentication using a card or the like when the user removes his / her seat. However, unless the Viewer is terminated, the problem that the user can view documents without the authorization cannot be solved.

  An object of the present invention is to prevent information leakage even when a user ID or password is leaked by compensating for security vulnerabilities of conventional DRM products. In addition, the purpose is to quickly take measures to expand the damage caused by information leakage.

  According to one aspect of the present invention, a secure DRM authentication system that includes a server and a client and uses an authentication device, and stores a time synchronization server that synchronizes time between the server and the client, and a PIN code An authentication device that generates a one-time password based on the time and the PIN code when connected to the client, a DRM server (authentication server) that holds authentication and authority of the client, and a user And an AD server that holds the ID and password of the authentication device, wherein the authentication device is synchronized with the time synchronization server, in addition to the user ID and password managed by the AD server, The authentication process is performed using the PIN you have and the generated one-time password. DRM authentication system characterized Ukoto is provided.

  It is preferable that an IP / MAC address that identifies the client PC is extracted when the authentication device is inserted, and is transmitted to the DRM server together with authentication information to the server at the time of authentication. As a result, the access source client can be specified even when it is illegally accessed.

  When the DRM server receives the PIN from the client, a one-time password is generated on the DRM server side, primary authentication is performed based on whether the one-time password generated on the client side is the same, and then It is preferable that authentication is finally possible only when secondary authentication by the AD server is performed with the user ID and the password, and the primary and secondary authentication results are acceptable. When the connection of the authentication device is disconnected from the client, a session that can access a file permitted by authentication may be disconnected. Thus, the document is configured such that authentication is permitted and the document cannot be accessed unless the authentication device is connected again.

  It is preferable to confirm the connection every certain period after detecting the connection of the authentication device. When opening a file from the client, the authentication device is connected to the client, and the PIN and MAC address are first transmitted from the client to the DRM server, and the DRM server requests a one-time password from the client. Generating a one-time password on the client side, sending it to the DRM server, requesting the time synchronization server for authentication based on the sent one-time password and the PIN, and sending the time of the client It is preferable that authentication is disabled unless the time of the DRM server is synchronized. If the synchronization is not established, authentication fails, so even if a malicious user takes out data illegally, it cannot be seen by other clients.

  It is preferable to disconnect the session in response to the disconnection so that the authentication with the PIN and the one-time password, which are information held by the authentication device, is required every time the operation is performed. The operation is, for example, a printing or changing operation.

  If the synchronization is not established, authentication fails, and even if a malicious user illegally takes out data, it cannot be viewed on other client PCs.

  In addition, each time a print or change operation is performed, the session is disconnected in response to the disconnection so that authentication using the PIN and the one-time password that is the information possessed by the authentication device is required. Also good.

  As described above, the secure DRM system using the authentication device of the present invention has the following effects.

  By compensating for security vulnerabilities of conventional DRM products, information leakage can be prevented even when a user ID or password is leaked. In addition, it is possible to quickly take measures to expand damage at the time of information leakage.

  Terms used in this specification are defined. One Time Password (OTP) is a “disposable password” that can be used only once for authentication. There are several ways to generate a one-time password, but SecurID uses time synchronization with the server. A one-time password generator called a token is usually a keychain type or PDA software, and the time is synchronized with the server in advance.

  The token generates a seemingly random number of about 10 digits from a combination of a user-specific PIN (Personal Identification Number) or personal identification number and time. This number is used when logging into the server as a one-time password. The server can use the same algorithm as the token to check whether the password is from a legitimate user. Since the password generated by the token changes every very short time (for example, 1 minute), even if the password is sniffed, the valid period is only about 1 minute at the maximum. Since all passwords are disposable without being used repeatedly, high security can be maintained.

  The features of the authentication technology according to the present embodiment are a time synchronization server for synchronizing the time of the server and the client, a USB token for generating a one-time password, and a DRM for confirming the authentication / authority of the client. A method that consists of a server (authentication server) and a system consisting of the prerequisite products, and extracts the IP / MAC address that identifies the terminal when the USB token is inserted, and sends it to the server together with the authentication information at the time of authentication Have As a result, even if the USB token is lost, the USB token can be invalidated by notifying the administrator when the loss is noticed, and not only the first file browsing but also the printing and changing operations are performed. Each time authentication with the information (PIN and one-time password) possessed by the USB token is required, and when the USB token is removed from the client PC, the viewer application session such as a reader is disconnected. Therefore, the document cannot be opened unless the USB token is authenticated again. Also, when a file is opened on the client PC, authentication fails if the time of the client PC is not synchronized with the time of the DRM server.

  FIG. 2 is a diagram illustrating the principle of one-time password authentication processing using a USB token as an authentication device. The USB token 22 has a built-in chip 23 that stores data for arithmetic processing. When the USB token 22 is inserted into the USB interface of the client PC 21 having the display screen 21b and the input device 21c, the encryption processing unit 22c stored in the built-in chip 23 receives time data (for example, the first timer 22a built in the USB token). Applying an encryption algorithm (RSA cipher, AES cipher, etc.) to a combination of USB token specific seed value 22b (for example, “132187sx”) when changing every minute, such as “200811241256” An encrypted token code 25a (usually a 6-digit password such as “As13dj”) is generated. The USB token specific seed value 22b is normally assigned a unique value when the USB token is shipped.

  Next, a password generation unit (not shown) stored in the built-in chip 23 combines the token code 25a with a PIN code 25b (usually a four-digit personal identification number, for example, “1012”) that identifies the user. The one-time password 26a (for example, “1012As13dj”) is generated. The PIN code 25b can be considered both when the user inputs it with the input device 21c and when the PIN code 25b is built in the USB token 22.

  This one-time password 26a is transmitted to the DRM server 24 by the client PC 21 (L11).

  On the other hand, on the DRM server 24 side, the encryption processing unit 24c combines the time data (for example, “200811241256”) from the second timer 24a built in the server and the USB token specific seed value 22b (for example, “132187sx”). On the other hand, by applying the same encryption algorithm as the encryption algorithm built in the USB token, an encrypted token code 28a (for example, “As13dj”) is generated.

  Next, a password generation unit (not shown) combines the token code 28a and the PIN code 28b (for example, “1012”) to generate a one-time password 26b (for example, “1012As13dj”). Authentication is performed by comparing the one-time password 26b with the one-time password 26a transmitted from the client PC 21.

  The unique seed value 23b and the PIN code 25b of the USB token to be used are registered in the DRM server 24 in advance. If the time difference between the token code 25a on the client PC 21 side and the token code 28a on the DRM server 24 side is within a certain time (for example, within 1 minute), the time lag on the DRM server 24 side is automatically corrected during authentication.

  Hereinafter, a secure DRM system using an authentication device according to an embodiment of the present invention will be described with reference to the drawings.

  FIG. 3 is a diagram illustrating a configuration example of an authentication system according to an embodiment of the present invention. A more secure DRM system using an authentication device according to the present embodiment includes a server and clients 301, 302, and 304. Browsers 301a and 302a are installed in the clients 301 and 302, respectively. The client 304 is installed with a viewer application 303 and includes a time synchronization agent 304a. The client 304 is provided with a USB interface into which a USB token 305 as an example of an authentication device is inserted. A USB token 305 (generally owned by a user) is an authentication device for generating a one-time password.

  On the other hand, the client side and the server side connected by the network 306 such as the Internet, the proxy server 307 and the time for synchronizing the time via the proxy server 307 so that the viewer file 303a can be referred to. A synchronization server 310, a DRM server (authentication server) 311 provided with a time synchronization agent 304a for confirming client authentication / authority, an AD (Active Directory) server 312 and a DB (database) server 313 as prerequisites thereof , An SMTP (Simple Mail Transfer Protocol) server 308 for access by an external user, and a backup server 309 for backup.

  A time synchronization agent is installed in the DRM server (authentication server) 311 and the client PC 304, and the time synchronization server 310 is always synchronized. In the time synchronization server 310, a time and a password are stored in pairs for each user ID, as in a table indicated by reference numeral 310a. As described above, the time synchronization server 310 manages the one-time password for each user, and when the authentication request is received from the DRM server 311, the time is the same as the time when the user generated the token code by the USB token 305. Generate token code. Thereafter, the client 304 and the DRM server 311 generate a one-time password in combination with the PIN of the client. If the one-time passwords generated by both are the same, the authentication is successful (primary authentication).

  A DRM server (authentication server) 311 manages authority information of each client associated with a set of security settings called a policy. When authentication information is input and transmitted from the client, the identity of the user managed by the AD server 312 is confirmed. In this embodiment, not only the ID and password of the user managed by the AD server 312 at the time of authentication, but also the PIN of the USB token and the generated one-time password information are required (secondary authentication). Here, when the USB token is extracted from the client 304, the DRM product session is also cut off, and the file cannot be opened.

FIG. 4 is a diagram showing the authentication mechanism in the system according to the present embodiment in chronological order, and FIG. 5 is a diagram showing a screen image for forming a GUI at that time.
When the user opens a file on the client PC 43, it is assumed that the USB token 41 has been inserted into the client PC 43 (if the USB token 41 has not been inserted, transition to the DRM system authentication screen) Is not possible). When the user tries to open a file from the client PC 43 by the viewer application 42, first, the PIN and MAC address are transmitted from the client PC 43 to the DRM server 44 (1). In response, the DRM server 44 requests a one-time password from the client PC 43 (2). A one-time password is generated on the client PC 43 side and transmitted to the DRM server 44 (3). The time synchronization server 46 is requested to authenticate based on the transmitted one-time password and PIN (4). The time synchronization server 46 stores a correspondence table 46a of time and password generated at that time for each user ID. Here, since the authentication fails if the time of the client PC 43 is not synchronized with the DRM server 44, even if a malicious user illegally takes out the data, the client PC other than the client PC 43 can view the data. Can not. If the time of the client PC 43 is synchronized with the DRM server 44, authentication in the time synchronization server 46 is OK (4, 5), primary authentication is OK (6), and the DRM system authentication screen is the display screen of the client PC 43. (Refer to FIG. 5A). The user ID 502 and password 503 of the user are input from the client PC 43 (7), and authentication is performed in the DRM server 44. Here, the ID and password are sent from the DRM server 44 to the AD server 45 (7-1), and it is checked whether the PIN and the one-time password are the same, and then AD (user authentication) The server 45 notifies the DRM server 44 whether the secondary authentication is OK. At that time, PIN and one-time passwords are also used for authentication, which can enhance security during authentication. If the authentication with the DRM server 44 is also successful, the fact is notified to the client PC 43 (8), and the document on the client PC 43 can be viewed.

  Note that the system according to the present embodiment is configured such that the session of the Viewer application 42 is disconnected when the USB token 41 is removed from the client PC 43, and if the user does not start again from the USB token authentication (9), the document Is a mechanism that can not be opened. FIG. 5B is an authentication failure example 1 of the user authentication screen. When there is no token, an error (510) occurs when opening a document, and the screen cannot be changed to the authentication screen. Failure example 2) is an example in which there is no authority, and an error (520) occurs when an unauthorized client opens a document, which makes browsing impossible.

  In addition, every time a printing or changing operation is performed, authentication based on information (PIN and one-time password) stored in the USB token 41 is required. Therefore, if the user walks with the USB token 41 when the user leaves the seat, there is an advantage that the document is not illegally viewed by others.

  FIG. 6 is a diagram illustrating a data configuration example of acquired log information held by the DB server 313 in the authentication system according to the present embodiment. As shown in FIG. 6, this data structure is policy ID = 19780320, name 601, group 602, IP / MAC address 603, ID 604, password 605, personal PIN PIN 606, time 607, an operation log (result of success, failure, etc.) 608, and USB No. 609. This table stores data used later when checking the log. With this figure, operation logs can be obtained for each name and for each group. Thereby, the administrator can confirm the content regarding authentication later.

  FIG. 7 is a diagram illustrating a configuration example of a data table of authentication information held by the DRM server, which is a data group used when authentication is performed. This data includes an ID 71 and a password 72 that are necessary for verifying the identity of the AD server, and a user (USB token) that is a unique personal information number given in advance in order to improve the security level. ), The PIN 73 and the one-time password 74 allocated for each, the USB No. information 75 indicating who the USB token belongs to, the session information 76, and the authentication permission / inhibition 77 are held. Therefore, even if the ID and password are obtained illegally, the unauthorized access can be suppressed by failing the authentication of the PIN and the one-time password unless the user has a USB token. By referring to the session information, it is possible to specify at which timing authentication is performed.

  FIG. 8 is a flowchart showing an outline of an example of authentication processing in the authentication system according to the present embodiment.

  When an operation for opening a file with a policy is performed in the client PC, first, authentication of whether or not a USB token is inserted is performed. Here, when a USB token is inserted (Y), a one-time password generation process is performed, but when it is not inserted (N), an error screen is displayed and a dialog prompting the insertion of a USB token Is displayed (step S801).

  When a USB token is inserted, a one-time password generation process is performed on the client PC side based on the token code and PIN. On the other hand, the time synchronization server also generates a one-time password based on the time when the one-time password was generated on the client PC side and the PIN of the user (step S802).

  Authentication processing is performed using the one-time password and PIN generated on the client PC side and the one-time password and PIN generated on the time synchronization server side. If the authentication is successful (Y), the DRM system authentication screen is displayed. If the authentication fails (N), the processing is performed again from step S801 (step 803).

  On the authentication screen in the DRM system, an input of ID and password necessary for authentication is prompted by issuing a dialog prompting input of ID and password (step S804).

  In step S804, an authentication process is performed with the DRM server (authentication server) including not only the input and transmitted ID and password but also the PIN and one-time password held by the USB token. If the authentication is successful, the document can be browsed. If the authentication fails, the process is performed again from step S801 (step S805).

  If the secondary authentication is successful (Y), the document can be browsed (step S806). In step S807, it is confirmed whether or not a USB token is inserted. If it is Y, the document browsing in step S807 is maintained. If N, the session is disconnected (step S808), and the process is repeated from step S801. It will be. As described above, when it is detected that the USB token is not inserted (removed), the authentication processing from step S801 is requested again, and when another person tries to authenticate by removing the USB token. Since the processing from step S801 is required, the security in authentication can be further enhanced.

  As described above, the secure DRM system using the authentication device according to the present embodiment has the following advantages. By compensating for security vulnerabilities of conventional DRM products, information leakage can be prevented even when a user ID or password is leaked. In addition, it is possible to quickly take measures to expand damage at the time of information leakage.

  Even when the USB token is lost, it is easy to find the fact that it was lost. In addition, the USB token can be invalidated by contacting an administrator or the like at the time of discovery. In addition, it is not necessary to search for all the documents of the user and delete the authority, so that information leakage can be prevented more quickly. Also, by extracting the IP / MAC address that identifies the terminal when the USB token is inserted and sending it along with the authentication information to the server at the time of authentication, the access source PC can be specified even when unauthorized access is made Easy to do.

  In the above-described embodiment, the configuration and the like illustrated in the accompanying drawings are not limited to these, and can be appropriately changed within a range in which the effect of the present invention is exhibited. In addition, various modifications can be made without departing from the scope of the object of the present invention.

  In addition, a program for realizing the functions described in the present embodiment is recorded on a computer-readable recording medium, and the program recorded on the recording medium is read into a computer system and executed to execute processing of each unit. May be performed. The “computer system” here includes an OS and hardware such as peripheral devices.

  Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used.

  The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Furthermore, the “computer-readable recording medium” dynamically holds a program for a short time, like a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line. In this case, a volatile memory in a computer system serving as a server or a client in that case is also used to hold a program for a certain period of time. The program may be a program for realizing a part of the above-described functions, or may be a program that can realize the above-described functions in combination with a program already recorded in a computer system.

  The present invention can be used for a secure DRM system using an authentication device.

It is a functional block diagram which shows the outline | summary of a DRM system. It is a figure which shows the outline | summary of the process of the one time password authentication by a USB token. It is a figure which shows the structural example of the whole more secure DRM system using an authentication device. It is a figure which shows the mechanism (authentication flow) of the authentication in the system by this Embodiment. It is a figure which shows the mechanism (authentication screen) of the authentication in this system. It is a figure which shows the structural example of the data table which the acquisition log in this system has. It is a figure which shows the structural example of the data table which the authentication data in this system has. It is a flowchart of the authentication process in this system.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Client PC, 2 ... DRM server, 3 ... AD server, 4 ... DB server, 21 ... Client, 22 ... USB token, 23 ... Built-in chip, 24 ... DRM server (authentication server), 301 ... Client PC (Policy management) 302) client PC (policy grantor), 303 ... viewer application, 304 ... client PC, 305 ... USB token, 306 ... internet, 307 ... proxy server, 308 ... SMTP server, 309 ... backup server, 310 ... Time synchronization server, 311 ... DRM server (authentication server), 312 ... AD server, 313 ... DB server, 41 ... USB token, 42 ... viewer application, 43 ... client PC, 44 ... DRM server (authentication server), 45 ... AD server, 46... Time synchronization server, 6... Acquisition log table item, 7. Item of proof data table.

Claims (7)

A secure DRM authentication system that includes a server and a client and uses an authentication device,
A time synchronization server that synchronizes the time between the server and the client, and an authentication device that stores a unique seed value, and is connected to the client so that the one-time password is determined by the time, the unique seed value, and the PIN code. An authentication device that generates an authentication device, a DRM server (authentication server) that holds client authentication and authority, and an AD server that holds a user ID and password,
While synchronizing with the time synchronization server, in addition to the user ID and password managed by the AD server, the PIN code corresponding to the authentication device and the generated one-time password are used for authentication processing. A DRM authentication system characterized by performing.   2. The DRM authentication system according to claim 1, wherein when the authentication device is inserted, an IP / MAC address that identifies the client PC is extracted and transmitted to the DRM server together with authentication information to the server at the time of authentication. .   When the DRM server receives the PIN from the client, a one-time password is generated on the DRM server side, primary authentication is performed based on whether the one-time password generated on the client side is the same, and then The secondary authentication by the AD server using the user ID and the password is performed, and the authentication is finally possible only when the primary and secondary authentication results are acceptable. The DRM authentication system according to claim 1 or 2.   3. The DRM authentication system according to claim 1, wherein when the connection of the authentication device is disconnected from the client, a session capable of accessing a file permitted by the authentication is disconnected.   The DRM authentication system according to claim 4, wherein the connection is confirmed every certain period after detecting the connection of the authentication device.   When opening a file from the client, the authentication device is connected to the client, the PIN and MAC address are first transmitted from the client to the DRM server, and the DRM server requests the client for a one-time password. Generating a one-time password on the client side, sending it to the DRM server, requesting the time synchronization server for authentication based on the sent one-time password and the PIN, and sending the time of the client The DRM authentication system according to any one of claims 1 to 5, wherein authentication is not possible unless synchronization is established with the time of the DRM server. 2. The session is disconnected in response to disconnection so that authentication with the PIN and the one-time password, which are information held by the authentication device, is required each time an operation is performed. The DRM authentication system according to any one of 5 to 5.

Images