Patent Grant
9098713
The present invention relates, in general, to a clipboard protection system in a Digital Rights Management (DRM) environment and a recording medium for storing a program for executing a clipboard protection method on a computer and, more particularly, to a clipboard protection system in a DRM environment and a recording medium for storing a program for executing a clipboard protection method on a computer, which prevent the leakage of information exceeding allowable rights using a clipboard in a DRM system.
A clipboard refers to a memory space in which data is temporarily stored when any data is copied or pasted to a file executed by an identical application or different applications. The copy and extraction of data using such a clipboard are functions basically provided by an Operating System (OS), such as Microsoft Windows or Apple Macintosh. The function of copying and extracting data using a clipboard is one of numerous targets that must be managed so as to prevent the leakage of data in a system to which Digital Rights Management (DRM) is applied. For example, when the movement of any data exceeding the allowable right of a user, or the movement of data or the like within the DRM system is attempted on a document to which DRM is applied, there is a need to block the movement of data related to the document to which DRM is applied.
Referring to
Referring to
As described above with reference to
An object of the present invention is to provide a system, which is capable of preventing the leakage of data to which DRM is applied by using a clipboard in a DRM environment, and guaranteeing the free use of the clipboard for data to which DRM is not applied.
Another object of the present invention is to provide a recording medium for storing a program for executing a method, which is capable of preventing the leakage of data to which DRM is applied by using a clipboard in a DRM environment and guaranteeing the free use of the clipboard for data to which DRM is not applied, on a computer.
In order to accomplish an object of the present invention, a preferred embodiment of a clipboard protection system in a DRM environment according to the present invention is provided, a clipboard protection system for protecting data stored in a clipboard in conjunction with a clipboard management system for storing, extracting and transferring data independently from an application as a basic function of an operating system, the clipboard protection system including an identification information management unit for, when an object desiring to store data in the clipboard is a reliable object, changing first identification information assigned to data to be stored in the clipboard into preset second identification information, managing the second identification information, and outputting second identification information corresponding to identification information of read target data requested to be extracted when the reliable object requests extraction of data stored in the clipboard; a data protection unit for encrypting and outputting data to be stored in the clipboard, and decrypting and outputting encrypted data read from the clipboard; and a control unit for requesting the clipboard management system to record encrypted security data in the clipboard in conjunction with the second identification information, and if a request to extract data stored in the clipboard is received from the reliable object, transferring second identification information corresponding to the identification information of the read target data to the clipboard management system, and requesting the clipboard management system to read encrypted security data from the clipboard and provide the encrypted security data.
In order to accomplish another object of the present invention, a computer-readable recording medium for storing a program for executing a clipboard protection method on a computer is provided, the method protecting data stored in a clipboard in conjunction with a clipboard management system for storing, extracting, and transferring data independently from an application as a basic function of an operating system, the clipboard protection method including (a) when an object desiring to store data in the clipboard is a reliable object, changing first identification information assigned to data to be stored in the clipboard into preset second identification information; (b) encrypting the data to be stored in the clipboard; and (c) providing second identification information corresponding to the data and the encrypted data to the clipboard management system, and then requesting the clipboard management system to record the data in the clipboard.
According to a clipboard protection system in a DRM environment and a recording medium for storing a program for executing a clipboard protection method on a computer in accordance with the present invention, when the storage of data in a clipboard is requested by a reliable object, the data is stored in the clipboard after the change of identification information of the data and the encryption of the data have been performed, and when the reading of data from the clipboard is requested by an unreliable object, a data read operation is performed by an existing clipboard management system, thus blocking the unreliable object from accessing security data. Further, when the reading of data is requested by a reliable object, it is determined whether data requested to be read is present by searching a mapping table managed by the clipboard management system and a mapping table managed by the clipboard protection system for both identification information of the data requested to be read and changed identification information, thus performing a data read operation without causing any errors.
Hereinafter, preferred embodiments of a clipboard protection system in a DRM environment and a recording medium for storing a program for executing a clipboard protection method on a computer according to the present invention will be described in detail with reference to the attached drawings.
Referring to
As shown in
The clipboard management system 410 stores data in the clipboard 420 in conjunction with data identification information included in a function that commands data to be stored in the clipboard 420 and that is input from the object (e.g., a SetClipboardData( ) function provided by the Windows OS), or data identification information included in a function that commands data to be stored in the clipboard 420 and that is input from the clipboard protection system 400. In this case, the identification information input from the object is an identifier related to a data format assigned by the object to the data stored in the clipboard 420, and is a standard clipboard format, such as CF_TEXT, CF_OEMTEXT, or CF_UNICODETEXT basically provided by the operating system, or a registered clipboard format randomly created and registered by the user. Further, the identification information input from the clipboard protection system 400 is identification information obtained by the clipboard protection system 400 changing data identification information, included in the function that commands data to be stored in the clipboard 420 and that is input from the object, into a registered clipboard format. Meanwhile, the clipboard management system 410 reads read target data from the clipboard 420 based on identification information included in a function that commands data to be read from the clipboard 420 and that is input from the object or the clipboard protection system 400 (e.g., an IsClipboardDataAvailable( ) function and a GetClipboardData( ) function provided by the Windows OS), and provides the read data to the object or the clipboard protection system 400.
Referring to
The identification information management unit 510 changes first identification information, uniquely assigned to security data to be stored in the clipboard 420, into preset second identification information. In this case, the first identification information may have a standard clipboard format, such as CF_TEXT, CF_OEMTEXT, or CF_UNICODETEXT basically provided by an operating system according to the format of clipboard data, or a registered clipboard format randomly created and registered by the user. The identification information management unit 510 changes the first identification information into second identification information which is separate identification information uniquely set by the clipboard protection system 400. In this case, in order for the clipboard management system 410 to recognize the second identification information, the second identification information must have the registered clipboard format. Further, when a request to read data stored in the clipboard 420 is input, the identification information management unit 510 outputs second identification information corresponding to the identification information of the read target data. Meanwhile, the identification information management unit 510 may record and manage a corresponding relation between the first identification information and the second identification information in a separate mapping table. This is intended to discriminate between pieces of first identification information and pieces of second identification information corresponding to respective pieces of data when there are a plurality of pieces of data (that is, security data and key information, security data and locale data, etc.) stored in the clipboard 420. When the mapping table is generated in this way, the identification information management unit 510 functions to search for second identification information corresponding to first identification information input from the control unit 530, and provide the second identification information to the control unit 530.
For example, Microsoft (MS) Word program to which DRM is applied corresponds to a reliable object. If the MS Word program is executed, and a user requests the copying of specific text in a specific document with the specific document opened, the Word program performs the operation of storing the corresponding data in the clipboard 420 according to the process shown in
Meanwhile, when the MS Word program that is an application to which DRM is applied is executed, and the user requests the reading of data stored in the clipboard 420 with a specific document opened, the Word program performs the operation of reading the corresponding data from the clipboard according to the process shown in
The data protection unit 520 encrypts and outputs security data to be stored in the clipboard 420, and decrypts and outputs encrypted data read from the clipboard 420. The data protection unit 520 is operated in conjunction with a DRM module (not shown). That is, an encryption key required by the data protection unit 520 to encrypt or decrypt data is obtained from the DRM module. Meanwhile, information about the encryption key may be added to data stored in the clipboard 420 and may be stored in the clipboard 420.
The control unit 530 controls the overall operation of the clipboard protection system 400 according to the present invention. That is, the control unit 530 hooks an API function related to a request made by a reliable object to store data in the clipboard 420 (that is, the SetClipboardData( ) function) and functions related to a request to read data from the clipboard 420 (that is, the IsClipboardDataAbailable( ) function and the GetClipboardData( ) function), and controls the operation of the identification information management unit 510 and the data protection unit 520. In particular, when the reading of data from the clipboard 420 is requested by the reliable object, the control unit 530 hooks the IsClipboardData( ) function output from the reliable object, transfers the IsClipboardData( ) function to the clipboard management system 410 without change, and performs different procedures depending on the conditions of responses (that is, the presence or non-presence of the corresponding data) from the clipboard management system 410. If a response indicating that the corresponding data is present is received from the clipboard management system 410, the control unit 530 transfers the GetClipboardData( ) function that is output from the reliable object so as to read data from the clipboard 420 to the clipboard management system 410 without change. In contrast, if a response indicating that the corresponding data is not present is received from the clipboard management system 410, the control unit 530 requests the identification information management unit 510 to provide second identification information corresponding to identification information that is the variable of the hooked GetClipboardData( ) function. Further, the second identification information provided by the identification information management unit 510 is transferred to the clipboard management system 410 to request the clipboard management system 410 to read data stored in the clipboard 420.
Meanwhile, the clipboard protection system 400 according to the present invention may additionally store separate key information in the clipboard 420 so as to decrypt encrypted data, in addition to the operation of storing data in the clipboard 420 by performing the change of identification information and the encryption of data so as to protect the data. Such key information may be either an encryption key itself or information enabling the encryption key to be obtained. For example, the key information may be a distinguished name of a certificate or the identification (ID) of the certificate when Public Key Infrastructure (PKI)-based encryption is applied, may be the pool ID of an encryption key when a key pool is used, and may be a key generation factor when Diffe-Helman and key exchange encryption using Diffe-Helman are applied. Therefore, the clipboard protection system 400 assigns preset second identification information to the key information obtained from the DRM module, and stores the key information in the clipboard 420. The obtainment of the key information is performed by a separate key management unit (not shown), or by the data protection unit 530, and the storage of the key information is performed by the data protection unit 530.
Furthermore, the clipboard protection system 400 according to the present invention may perform the operation of storing format-converted additional data in the clipboard 420, in addition to the operation of storing data in the clipboard 420 by changing identification information and encrypting the data so as to protect data. Generally, when data having identification information in a format used in the system is input, the operating system additionally generates data having identification information in other formats, in addition to the input data, and stores the generated data together with the input data in the clipboard 420. For example, when data having a CF_TEXT format is input, the clipboard management system 410 automatically generates data in formats, such as CF_LOCALE, CF_OEMTEXT, and CF_UNICODETEXT based on the CF_TEXT information, and stores the generated data in the clipboard 420. However, when the security data is encrypted, such an automatic change function is not supported. Therefore, in order to implement a basic conversion function provided by the operating system while maintaining a data protection function, the clipboard protection system 400 converts security data before being encrypted into another type of data, assigns preset second identification information to the corresponding data, encrypts the corresponding data, and stores the encrypted data in the clipboard 420. The conversion and storage of such data are performed either by a separately provided additional data generation unit (not shown), or by the data protection unit 530.
Referring to
Referring to
Referring to
Referring to
Meanwhile, if it is determined at step S1205 that the application that requested the reading of data is an unreliable object, the clipboard protection system 400 transfers the identification information of read target data to the clipboard management system 410, and the clipboard management system 410 determines whether identification information corresponding to the read target data is present (S1235). If identification information corresponding to the read target data is present (S1240), the clipboard management system 410 reads the read target data from the clipboard 420, and provides the read data to the application (S1245). In contrast, if identification information corresponding to the read target data is not present (S1240), the clipboard management system 410 outputs the message “data absence” to the application (S1250).
Referring to
The above-described clipboard protection system and method according to the present invention are configured to, when the storage of data in a clipboard is requested by a reliable object, store the data in the clipboard after the change of the identification information of the data and the encryption of the data have been performed. Further, when the reading of data is requested by an unreliable object, the operation of reading the data is performed by an existing clipboard management system, thus blocking the unreliable object from accessing the security data. In contrast, when the reading of data is requested by a reliable object, it is determined whether data requested to be read is present by searching a mapping table managed by searching the clipboard management system and a mapping table managed by the clipboard protection system for the identification information of the data requested to be read and changed identification information, thus performing a data read operation without causing any errors. Meanwhile, in the above-described embodiments, different operations are performed depending on the type of object (that is, a reliable object and an unreliable object). However, the present invention can also be applied even to lower objects managed by the reliable object (e.g., documents loaded by a Microsoft Word program). In this case, procedures for determining whether the object is a reliable object and determining whether the lower objects are reliable objects (that is, whether DRM has been applied) are performed either sequentially or simultaneously. Thereafter, only in cases where the reliability of the lower objects of the reliable object is guaranteed, the change of identification information and encryption of data are performed. Only in cases where a request to read data is received from the lower objects of the reliable object, it is determined whether the data requested to be read is present by searching a mapping table managed by the clipboard management system and a mapping table managed by the clipboard protection system for the identification information of the data requested to be read and the changed identification information.
The present invention may be implemented as computer-readable code stored in a computer-readable recording medium. The computer-readable recording medium includes all types of storage devices in which computer system-readable data is stored. Examples of the computer-readable recording medium are Read Only Memory (ROM), Random Access Memory (RAM), Compact Disk-Read Only Memory (CD-ROM), magnetic tape, a floppy disk, and an optical data storage device. Furthermore, the computer-readable recording medium may be implemented as carrier waves (for example, in the case of transmission over the Internet). Moreover, the computer-readable medium may be distributed across computer systems connected via a network, so that computer-readable code can be stored and executed in a distributed manner.
Although the preferred embodiments of the present invention have been illustrated and described, the present invention is not limited to the above-described specific preferred embodiments, and those having ordinary knowledge in the technical field to which the present invention pertains can make various modifications and variations without departing from the gist of the present invention that is claimed in the attached claims. Such modifications and variations fall within the scope of the claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 10-2010-0080938 | Aug 2010 | KR | national |
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/KR2011/000514 | 1/25/2011 | WO | 00 | 2/20/2013 |
| Publishing Document | Publishing Date | Country | Kind |
|---|---|---|---|
| WO2012/023674 | 2/23/2012 | WO | A |
| Number | Name | Date | Kind |
|---|---|---|---|
| 5504818 | Okano | Apr 1996 | A |
| 5680616 | Williams et al. | Oct 1997 | A |
| 6202100 | Maltby et al. | Mar 2001 | B1 |
| 6880022 | Waldspurger et al. | Apr 2005 | B1 |
| 7320069 | Sundharraj et al. | Jan 2008 | B1 |
| 7950066 | Zuili | May 2011 | B1 |
| 7984513 | Kyne et al. | Jul 2011 | B1 |
| 8489509 | Kim | Jul 2013 | B2 |
| 20010000541 | Schreiber et al. | Apr 2001 | A1 |
| 20020019941 | Chan et al. | Feb 2002 | A1 |
| 20020196939 | Unger et al. | Dec 2002 | A1 |
| 20030093351 | Sarabanchong | May 2003 | A1 |
| 20030120686 | Kim et al. | Jun 2003 | A1 |
| 20040070607 | Yalovsky et al. | Apr 2004 | A1 |
| 20040210846 | Olsen | Oct 2004 | A1 |
| 20040230907 | Yang | Nov 2004 | A1 |
| 20040250087 | Ray et al. | Dec 2004 | A1 |
| 20050008163 | Leser et al. | Jan 2005 | A1 |
| 20050066335 | Aarts | Mar 2005 | A1 |
| 20050149726 | Joshi et al. | Jul 2005 | A1 |
| 20050223224 | Carpentier et al. | Oct 2005 | A1 |
| 20060075279 | Cameros et al. | Apr 2006 | A1 |
| 20060117178 | Miyamoto et al. | Jun 2006 | A1 |
| 20060156400 | Shevchenko | Jul 2006 | A1 |
| 20060195907 | Delfs et al. | Aug 2006 | A1 |
| 20070011469 | Allison et al. | Jan 2007 | A1 |
| 20070011749 | Allison et al. | Jan 2007 | A1 |
| 20070016771 | Allison et al. | Jan 2007 | A1 |
| 20070027998 | Staats | Feb 2007 | A1 |
| 20070061747 | Hahn et al. | Mar 2007 | A1 |
| 20070074017 | Schmidt et al. | Mar 2007 | A1 |
| 20070101435 | Konanka et al. | May 2007 | A1 |
| 20070150685 | Shevchenko | Jun 2007 | A1 |
| 20070271433 | Takemura | Nov 2007 | A1 |
| 20080028442 | Kaza et al. | Jan 2008 | A1 |
| 20080066089 | Kamiya et al. | Mar 2008 | A1 |
| 20080109832 | Ozzie et al. | May 2008 | A1 |
| 20080215897 | Doyle et al. | Sep 2008 | A1 |
| 20080243994 | Kropivny | Oct 2008 | A1 |
| 20080256601 | Dutta et al. | Oct 2008 | A1 |
| 20090106550 | Mohamed | Apr 2009 | A1 |
| 20090287988 | Cohen et al. | Nov 2009 | A1 |
| 20090327617 | Furuichi et al. | Dec 2009 | A1 |
| 20100146600 | Eldar et al. | Jun 2010 | A1 |
| 20100299759 | Kim et al. | Nov 2010 | A1 |
| 20110038552 | Lam | Feb 2011 | A1 |
| 20120124675 | Lee et al. | May 2012 | A1 |
| Number | Date | Country |
|---|---|---|
| 1662356 | May 2006 | EP |
| 2608100 | Jun 2013 | EP |
| 2006054669 | Feb 2006 | JP |
| 2010055371 | Mar 2010 | JP |
| 390086 | Jul 2003 | KR |
| 521338 | Dec 2005 | KR |
| 10-0681696 | Feb 2006 | KR |
| 2006059759 | Jun 2006 | KR |
| 10-2007-0120413 | Dec 2007 | KR |
| 2009019484 | Feb 2009 | KR |
| 10-0943318 | Feb 2010 | KR |
| WO 2012023674 | Feb 2012 | WO |
| Entry |
|---|
| NNRD437107, “Method of SPY on externals of 3rd party MMC Snap-Ins”, IBM Technical Disclosure Bulletin, Sep. 1, 2000, UK, issue No. 437, p. 1680. |
| Sinha, “Data Paladin—An Application Independent Rights Management System”, Thesis, Stony Brook University, Dec. 2008, 44 pages. |
| Yu, “Display-Only File Server: A Solution against Information Theft Due to Insider Attack”, DRM'04, Oct. 25, 2004, pp. 31-39. |
| Number | Date | Country | |
|---|---|---|---|
| 20130151864 A1 | Jun 2013 | US |
