运用版权管理服务实现文件控管稽核.ppt

運用版權管理服務實現文件控管稽核 主講人 精誠公司恆逸教育訓練中心資深講師 張書源 大綱 版權管理服務架構版權管理服務的設定與部署如何利用版權管理服務保護文件安全性 TheU S DeptofJusticeestimatesthatintellectualpropertytheftcostenterprises 250billionin2004Lossofrevenue marketcapitalization andcompetitiveadvantage InformationLossisCostlyInformationloss whetherviatheftoraccidentalleakage iscostlyonseverallevels Leakedexecutivee mailscanbeembarrassingUnintendedforwardingofsensitiveinformationcanadverselyimpactthecompany simageand orcredibility Increasingregulation SOX HIPAA GLBABringingacompanyintocompliancecanbecomplexandexpensiveNon compliancecanleadtosignificantlegalfees finesand orsettlements Financial Image Credibility Legal RegulatoryCompliance Informationleakageistop of mindwithBusinessDecisionMakers 0 10 20 30 40 50 60 70 Lossofdigitalassets restored E mailpiracy Passwordcompromise Lossofmobiledevices Unintendedforwardingofe mails Aftervirusinfections businessesreportunintendedforwardingofe mailsandlossofmobiledevicesmorefrequentlythantheydoanyothersecuritybreach JupiterResearchReport 2004 Virusinfection Traditionalsolutionsprotectinitialaccess AccessControlListPerimeter No Yes TrustedNetwork AuthorizedUsers UnauthorizedUsers InformationLeakage UnauthorizedUsers butnotongoingusage Today spolicyexpression lacksenforcementtools HowdoesRMSaddressthis Supportsdevelopmentofrich third partysolutionsontopofRMSviatheRMSSoftwareDevelopmentKit SDK Providesflexibilitytointegratewithanenterprise sexistinginternalapplications EncryptssensitivecontentProtectsinsideandoutsidethetrustednetworkProtectsduringandafterdelivery Allowsorganizationstoestablishandapplycentrally managedpoliciesAllowsorganizationstotracktheinformation slifecycleSupportssmartcardauthentication AugmentsExistingTechnologiestoProvidePersistentProtection EnforcesOrganizationalPolicies Providesaplatformforvalue addedsolutions CommonUsageScenarios ClientUsageScenarios RequiresRMS CommunicateinaMixedVersionEnvironment Do Not ForwardE mail ProtectSensitiveFiles ImprovedconfidentialityGreatend useradoptionduetointuitiveintegrationinOffice2003Strongplatformforextendedinformationprotectionsolutions Sensitiveexecutivee mailsandinternalconfidentialdocumentsneededtobeprotectedforcompetitivereasons TestedRMS IRMforsixmonths thenconductedpilotevaluationPositiveend userfeedbackdroveafullrolloutofOffice2003plusRMSto19 000desktops CaseStudy Swisscom Benefit Situation Solution TheintegrationofRMSwithOffice2003 combinedwiththeproduct seaseofdeploymentandmanagement makesiteasyforvirtuallyallofSwisscom semployeestokeeptheircriticaldocumentsandinformationsafe withouthavingtolearnacumbersomesetofnewtechnologies HeinzSch rMemberofManagementSwisscomITServicesAG ServerUsageScenarios ExtendsprotectiontomanagedcontentstoredbydocumentandrecordsmanagementsolutionsEnablesarchivalofRMS protectede mailsProtectedcontentcanbesecurelyindexedandsearched EnablesworkflowenginestoextendinformationprotectiontobusinessprocessautomationAppliesrightsprotectioninacentralizedway EnablescontentinspectiongatewaystoinspectRMS protectedcontentandapplyRMS protectioncentrallyEnablesISVstodevelopserver basedsolutions EnableRegulatoryCompliance IPProtection SecureBusinessProcessAutomation ControlInformationProtectionCentrally WindowsRMSWorkflow InformationAuthor TheRecipient RMSServer SQLServer ActiveDirectory 2 3 4 5 Authordefinesasetofusagerightsandrulesfortheirfile Applicationcreatesa publishinglicense andencryptsthefile Authordistributesfile Recipientclicksfiletoopen theapplicationcallstotheRMSserverwhichvalidatestheuserandissuesa uselicense Applicationrendersfileandenforcesrights Authorreceivesanidentitycertificatethefirsttimetheyrights protectinformation 1 OS OS RMSClient RMSClient App App HowdoesRMSwork OS RMSClient App RMSClient App Usertriestopublishorconsumecontent ApplicationcallsintoRMSClienttocreateanewsession Usertriestopublishorconsumecontent OS RMSClient App Usertriestopublishorconsumecontent ApplicationcallsintoRMSClienttocreateanewsession MachineActivation RMSClientstartsbootstrappingprocess MachineActivation RMSClientgenerates1024 bitRSAkeypair PrivatekeysecuredbyCAPI Publickeystoredinsecurityprocessorcertificate SPC SPCsignedbyclient OS RMSClient App RMSClientgenerates1024 bitRSAkeypair PrivatekeysecuredbyCAPI Publickeystoredinsecurityprocessorcertificate SPC SPCsignedbyclient MachineActivation OS RMSClient App PrivatekeysecuredbyCAPI Publickeystoredinsecurityprocessorcertificate SPC SPC MachineActivation SPCsignedbyclient RMSClientgenerates1024 bitRSAkeypair Theuser sidentitymustbeestablishedonthemachinebyaccountcertification NewforSP1 TheRMSClientisactivatedwithoutcontactingaserverorrequiringadminprivileges OS RMSClient App SPC RMS AccountCertification SPC RMSClientcontactsRMSServerwithacertificationrequest sendingSPC RMS Userisauthenticated DOMAIN usernameSID E mailaddressisretrievedfromAD DOMAIN usernameSIDusername User s1024 bitRSAkeypairisgeneratedandstoredindatabase SID AccountCertification SPC ServervalidatesSPC AccountCertification RMS SPC SPC RMSClientcontactsRMSServerwithacertificationrequest sendingSPC Userisauthenticated E mailaddressisretrievedfromAD User s1024 bitRSAkeypairisgeneratedandstoredindatabase User sprivatekeyisencryptedwithmachinepublickey ServervalidatesSPC DOMAIN usernameSIDusername RAC AccountCertification RMS SPC RACiscreatedanduser se mailaddressandpublickeyareadded ServersignsRAC User sprivatekeyisencryptedwithmachinepublickey DOMAIN usernameSIDusername SPC RAC AccountCertification RMS RACisreturnedtoclient RACiscreatedanduser se mailaddressandpublickeyareadded ServersignsRAC User sprivatekeyisencryptedwithmachinepublickey TheusernowhasaRACthatcanbeusedforconsumption Inordertopublish theuserneedsaClientLicensorCertificate CLC RAC ClientEnrollment RMS RMSClientcontactsRMSServerforclientenrollment sendingRAC ServergeneratesCLC1024 bitRSAkeypair CLCprivatekeyisencryptedwithRACpublickey RMSServervalidatesRAC CLC RAC ClientEnrollment RMS RMSClientcontactsRMSServerforclientenrollment sendingRAC ServergeneratesCLC1024 bitRSAkeypair CLCprivatekeyisencryptedwithRACpublickey CLCisgenerated grantingtheusertherighttopublish RMSServervalidatesRAC Serverinformation suchasURLandserverpublickey isalsoaddedtoCLC CLC ClientEnrollment RMS ServersignsCLC Serverinformation suchasURLandserverpublickey isalsoaddedtoCLC CLC CLCisreturnedtoclient Theclientisnowreadyforbothpublishingandconsumptionofprotectedcontent OS RMSClient App RMSClient App Publishing RMS UsercreatescontentusingRMS enabledapplication ApplicationcallsintoRMSClientforpublishing Userspecifiesrecipients rights andconditionstopublishcontent orchoosesatemplate group read printexpires30days ApplicationcallsintoRMSClientforpublishing PL Publishing RMS group read printexpires30days RMSClientgenerates128 bitAEScontentkey Clientencryptscontent Clientcreatespublishinglicense PL OS RMSClient App CLC SPC RAC Clientcreatespublishinglicense PL PL Publishing RMS RightsdataandcontentkeyareencryptedbyserverpublickeyfromCLC group read printexpires30days ServerURLisaddedtoPL group read printexpires30days CLCsignsPL OS RMSClient App Publishing RMS CLCsignsPL TheclientreturnsthePLtotheapplication TheapplicationcannowpackagethePLwiththecontent Thecontentcannowbesenttoitsrecipients OS RMSClient RMSClient App OS RMSClient App Thecontentcannowbesenttoitsrecipients Publishing RMS Publishersendsprotectedcontenttorecipientusinganymechanism Assumerecipienthasalreadybeenbootstrapped Therecipientneedsauselicenseinordertoaccessthecontent RecipientopensdocumentinRMS enabledapplication Licensing RMS ApplicationcallsRMSClienttoretrieveauselicense RMSClientsendsPLandRACtoRMSServer RAC ServervalidatesRACandPL DatafromPLisdecrypted PL group read printexpires30days group read printexpires30days OS RMSClient App RMSClient App RAC UL group read printexpires30days Licensing RMS Ifcontentwaspublishedtoagroup serverchecksgroupmembershipintheAD IfidentityinRACmatchesPLorgroupmembership serverbeginsconstructinguselicense UL DatafromPLisdecrypted Rightsaregrantedtouser OS RMSClient App user read printexpires30days group read printexpires30days user read printexpires30days RAC UL user read printexpires30days Licensing RMS ContentkeyencryptedbyRACpublickey EncryptedkeyaddedtoUL Rightsaregrantedtouser ULreturnedtoclient ULsignedbyserver OS RMSClient App Licensing RMS ContentkeyencryptedbyRACpublickey EncryptedkeyaddedtoUL Rightsaregrantedtouser ULreturnedtoclient ULsignedbyserver Recipientcannowbindthelicenseandopenthecontent OS RMSClient App OS RMSClient App AccessingContent SPC RAC CLC SPC RAC OS RMSClient App OS RMSClient App RMSClient App AccessingContent SPC UL user read printexpires30days RAC RMSClientusessecurityprocessortodecryptRACprivatekey ApplicationcallsRMSClienttobindlicenseanddecryptcontent RACprivatekeydecryptscontentkey AccessingContent SPC UL user read printexpires30days RAC RMSClientdecryptscontent RACprivatekeydecryptscontentkey Applicationrenderscontentandenforcesrights OS RMSClient RMSClient App RMSClientsoftwareAnRMS enabledapplicationRequiredforcreatingorviewingrights protectedcontentMicrosoftOffice2003EditionsincludesRMS enabledapplications Word Excel PowerPoint OutlookOfficeProfessional2003isrequiredforcreatingorviewingrights protectedcontentOtherOffice2003Editionsallowsuserstoview butnotcreate rights protectedcontent RightsManagementAdd on RMA forInternetExplorer6 0Allowsuserstoviewrights protectedcontentinIEEnablesdown levelviewingsupportforcontentprotectedbyOffice2003 RMSSolutionComponents Server RMSServerRunsonWindowsServer2003 Standard Enterprise WeborDatacenterEditions ProvidescertificationandlicensingActiveDirectory directoryserviceWindowsServer2000orlaterProvidesawell knownuniqueidentifierforeachuserE mailaddresspropertyforeachusermustbepopulatedDatabaseServerMicrosoftSQLServer recommended orMSDEStoresconfiguration userkeys andloggingdata Client RMSServer RMSserverisanASP NETWebserviceProtocolisSOAPoverHTTP HTTPSInternetInformationServer IIS 6onlySinglerequest responsetransactionmodelStatelessformostrequests allprocessingonfrontendDBsuchasSQL orMSDE usedforconfigurationOnetimepercontentperuserXrML basedinput outputPluggableCryptoProvider RMSServer RMSServerisanASP NETapplicationUsesADforauthenticatingusers determiningemailaddressesforusers confirmingmembershipofusersingroupsUsesMSMQtoforwardloggingentriestoSQLServerUsesSQLServertostoreRMSconfiguration ADgroupexpansioncache andallloggedclientactivitiesUsesIIS WindowsIntegratedauthentication toauthenticateallusers TechnologiesSupportingWindowsRMS AD LDAPStoreuseraccounts DLs providedirectoryofemailaddresses SCPlocation NETFramework ASP NETApplicationenvironmentforallcriticalRMSserverapplicationcodeMSMQ SQLStoresRMSconfigurationinformation userkeypairs activitylogs cacheofADgroupsforexpansionXrMLstandard inwhichallthelicenses certificatesarestructuredSOAPProtocolstandardforallmessageexchangesbetweenclientandserver serverandMSN andclientandMSNUDDIDirectoryforfindingtheMSNRMSservices RMS EnabledApplications RMS enabledapplicationsmayimplementRMSfeaturessuchaspre licensing contentaccess certificaterequestsApplicationscanbebasedontheServerSDK e g sample RMS enabledSPSserver fromServerSDK ApplicationscanbebasedontheClientSDK e g OfficeWord2003 OfficeOutlook2003 RMA ApplicationsneedtohaveallRMS enabledlibrariesandexecutablessignedwithanRMScode signingprivatekeyThesignatureisincludedinamanifest XMLfile fortheapplicationThemanifestisasignedXMLfilecontaininghashesofalllistedfilesThemanifestshouldincludeallfilesthatcallRMSClientAPIsRMSClientAPIsvalidatethehashesinthemanifestagainstalllistedfilesbeforeunlockingrights protectedinformation RMSClientComponents APIs ClientComponents theirAPIsarethegluebetweenRMS enabledapplicationsandthelockboxMsdrm dll Msdrmhid dll Msdrmctrl dllAllRMS enabledapplicationsperformtheirworkthroughtheseAPIs andanyapplicationscanprogramtotheseAPIs ClientSDK e g RequestingmachineactivationFindingRMSservicesRequesting parsinglicenses certificatesManaginglicenses enumerate store Creatingo