Data management system, data processing system, and computer-readable medium having on which data management program is recorded

• US 7,350,084 B2
• Filed: 03/08/2002
• Issued: 03/25/2008
• Est. Priority Date: 10/25/2001
• Status: Expired due to Fees

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Okada, Yoshiyuki, Abiko, Yukihiro
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US10/092,794
• Publication Number:
  US 20030084281A1
• Time in Patent Office: 2,209 Days
• Field of Search: 713/193, 726/27
• US Class Current: 713/193
• CPC Class Codes: G06F 21/1064 Restricting content processing at operating system level
• CPC Class Codes: G06F 21/126 Interacting with the operating system
• CPC Class Codes: G11B 20/00086 Circuits for prevention of unauthorised reproduction or copying, e.g. piracy indicating unauthorised use of record carriers in general G11B23/28; scrambling for television signal recording H04N5/913; network architectures or network protocols for network security H04L63/00; cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
• CPC Class Codes: G11B 20/00181 using a content identifier, e.g. an international standard recording code [ISRC] or a digital object identifier [DOI]
• CPC Class Codes: G11B 20/0021 involving encryption or decryption of contents recorded on or reproduced from a record carrier
• CPC Class Codes: G11B 20/00514 wherein the entire content is encrypted with the same key, e.g. disc key or master key
• CPC Class Codes: G11B 20/00528 wherein each title is encrypted with a separate encryption key for each title, e.g. title key for movie, song or data file
• CPC Class Codes: G11B 20/00659 involving a control step which is implemented as an executable file stored on the record carrier
• CPC Class Codes: G11B 20/00731 involving a digital rights management system for enforcing a usage restriction
• CPC Class Codes: G11B 20/00862 wherein the remote server can grant the permission to use a content
• CPC Class Codes: G11B 20/00869 wherein the remote server can deliver the content to a receiving device
• CPC Class Codes: G11B 27/32 on separate auxiliary tracks of the same or an auxiliary record carrier

Abstract

An object of the present invention is to provide a system which reliably protects a copyright of contents in a deciphered version without unreasonably restricting the execution of the copyright. To this end, according to the present invention, there is provided a system including a storage medium, application executing means for activating an application, access monitoring means for monitoring the status of access of the application to the contents by associating inherent information for the application brought into an activated status by the application executing means with inherent information for the contents accessed by the application, and filtering means for enciphering the contents with the inherent information for the application when the application writes the contents into the storage medium while deciphering the contents with the inherent information for the application when the application reads out the contents from the storage medium.

Claims

1. A data management system, comprising:

a storage medium for storing contents;

application executing means for activating an application so that the application accesses the contents stored in the storage medium and effects a processing on the contents;

access monitoring means for monitoring the status of access of the application to the contents by associating inherent information for the application brought into an activated status by the application executing means, with inherent information for the contents accessed by the application;

filtering means for enciphering the contents with the inherent information for the application when the application under the activated status writes the contents into the storage medium while deciphering the contents with the inherent information for the application when the application under the activated status reads out the contents in the storage medium; and

an operating system as a software for controlling the execution of the application, wherein the operating system assigns identification information to each process upon executing the application by the application executing means, and the access monitoring means utilizes the identification information as the inherent information for the application, and

wherein

the access monitoring means registers the inherent information for the application and the inherent information for the contents in a management table so that the inherent information for the application and the inherent information for the contents are associated with each other, and the access monitoring means monitors the status of access with the assistance of the management table, and

wherein

at least one piece of logical drive is built in the storage medium and the contents is reserved in the logical drive,

a file system for managing the logical drive is built in each of the logical drive, and

at least one file system is arranged to serve as an encryption file system which has a cryptographic attribute determined for each file or folder containing the contents, enciphers the contents at each file or folder upon storing the contents in the storage medium, and

wherein

when the application reads the contents stored in the logical drive managed by the encryption file system, the access monitoring means registers a drive name of the logical drive containing the contents read out by the application in the management table as the inherent information for the contents, and

wherein

the access monitoring means compares a drive name of the logical drive as a destination for storing a file, which is newly created when the application effects a processing on the contents, with a drive name of the logical drive registered in the management table, and if it is determined that both of the drive names disagree with each other as the result of comparison, the access monitoring means changes a file name of the newly created file so that the newly created file is stored in the logical drive of the drive name registered in the management table and registers the changed file name in the management table.

2. A data management system, comprising:

a storage medium for storing contents;

application executing means for activating an application so that the application accesses the contents stored in the storage medium and effects a processing on the contents;

access monitoring means for monitoring the status of access of the application to the contents by associating inherent information for the application brought into an activated status by the application executing means, with inherent information for the contents accessed by the application;

filtering means for enciphering the contents with the inherent information for the application when the application under the activated status writes the contents into the storage medium while deciphering the contents with the inherent information for the application when the application under the activated status reads out the contents in the storage medium; and

an operating system as a software for controlling the execution of the application, wherein the operating system assigns identification information to each process upon executing the application by the application executing means, and the access monitoring means utilizes the identification information as the inherent information for the application, and

wherein

the access monitoring means registers the inherent information for the application and the inherent information for the contents in a management table so that the inherent information for the application and the inherent information for the contents are associated with each other, and the access monitoring means monitors the status of access with the assistance of the management table, and

wherein

at least one piece of logical drive is built in the storage medium and the contents is reserved in the logical drive,

a file system for managing the logical drive is built in each of the logical drive, and

at least one file system is arranged to serve as an encryption file system which has a cryptographic attribute determined for each file or folder containing the contents, enciphers the contents at each file or folder upon storing the contents in the storage medium, and

wherein

when the application reads the contents stored in the logical drive managed by the encryption file system, the access monitoring means registers a drive name of the logical drive containing the contents read out by the application in the management table as the inherent information for the contents, and

the access monitoring means compares a drive name of the logical drive as a destination for storing a file, which is newly created when the application effects a processing on the contents, with a drive name of the logical drive registered in the management table, and if it is determined that both of the drive names are coincident with each other as the result of comparison, then the access monitoring means prohibits a file name of the newly created file from being registered in the management table.

3. A data management system, comprising:

a storage medium for storing contents;

application executing means for activating an application so that the application accesses the contents stored in the storage medium and effects a processing on the contents;

access monitoring means for monitoring the status of access of the application to the contents by associating inherent information for the application brought into an activated status by the application executing means, with inherent information for the contents accessed by the application;

filtering means for enciphering the contents with the inherent information for the application when the application under the activated status writes the contents into the storage medium while deciphering the contents with the inherent information for the application when the application under the activated status reads out the contents in the storage medium; and

an operating system as a software for controlling the execution of the application, wherein the operating system assigns identification information to each process upon executing the application by the application executing means, and the access monitoring means utilizes the identification information as the inherent information for the application, and

wherein

the access monitoring means registers the inherent information for the application and the inherent information for the contents in a management table so that the inherent information for the application and the inherent information for the contents are associated with each other, and the access monitoring means monitors the status of access with the assistance of the management table, and

wherein

at least one piece of logical drive is built in the storage medium and the contents is reserved in the logical drive,

a file system for managing the logical drive is built in each of the logical drive, and

at least one file system is arranged to serve as an encryption file system which has a cryptographic attribute determined for each file or folder containing the contents, enciphers the contents at each file or folder upon storing the contents in the storage medium, and

wherein

when the application reads the contents stored in the logical drive managed by the encryption file system, the access monitoring means registers a drive name of the logical drive containing the contents read out by the application in the management table as the inherent information for the contents, and

wherein

the access monitoring means compares a drive name of the logical drive as a destination for storing a file, which is newly created when the application effects a processing on the contents with a drive name of the logical drive registered in the management table, and

if it is determined that both of the drive names disagree with each other as the result of comparison, then the operation of the filtering means is validated.

4. A data management system according to claim 3, wherein

the storage medium comprises a primary storage means which erases data stored therein upon power supply cut, and

the filtering means stores an enciphered version of the newly created file in the primary storage means instead of the logical drive as the storage destination.