ERCIM News No.45 - April 2001 [contents]
t.jpg" alt="TECHNOLOGY TRANSFER">
ERCIM News No.45 - April 2001 [contents]
CIPRESS - Cryptographic Intellectual Property Rights Enforcement SyStem
by Christoph Busch
The ReEncryption system resulting from the CIPRESS project was developed by the Fraunhofer Institute for Computer Graphics based in Darmstadt, Germany on behalf of Mitsubishi Corporation, Tokyo, Japan. It offers a high security environment for mission-critical applications based on commercial operating systems and standard applications. Data is protected by the patented ReEncryption™ providing mechanisms for access and use control including detailed auditing of usage trails. Even illegal analog audio and video recordings as well as eg printouts of images can be traced back due to the use of patented digital watermarking technologies.
The system consists of independent components, namely Client software extending the operating system with ReEncryption™ and digital watermarking for both file system and network communication channels to be installed on all protected systems; a Key Center maintaining a database of access permissions and keys and their associations with protected data objects along with audit trails for all relevant operations, and a number of data archives (Content Servers). All communication is performed over an integrated VPN layer. The system is integrated with directory services and standard public key infrastructure services.
These servers maintain storage of arbitrary digital data. They supply the content either directly and in encrypted form over a CIPRESS protocol to the client systems or use a standard WWW server for distribution of the materials and act as archives for protected data. All data registered with a content server will be marked with invisible (or inaudible) digital watermarks providing for both the identification of the copyright holder or owner of the data, permitting auditing and recovery of original digital data even based on analog copies of data.
The client system consists of a layer of operating system extensions providing security enhancement through the addition of mandatory encryption and access control using ReEncryption™ technology. Both network and all file system accesses are protected transparently without applications or users becoming aware of the process as long as only legitimate operations are performed. In addition, all multimedia data are marked with a digital watermark containing the identity of the user accessing the data object. Access to the archives contained on Content Servers is possible using CIPRESS applications, a WWW front-end, or a published application programming interface for use in value-added applications.
The Key Center is a trusted system providing access control and auditing services for all objects under its control. For this purpose, databases containing users, groups, access permissions, and Content Servers are maintained. The Key Center is also the repository for all ReEncryption™ keys associated with data objects. Access to controlled objects is verified by the client system every time a data object is referenced, so any change in access rights or classification is effective immediate regardless of where a copy of the data object resides. The Key Center also can audit the user and document identity along with the identity of the client computer used to access the object and the precise timestamp. This permits precise auditing of who used which data object when and where and even where a data object was obtained from.
Cipress architecture. CIPRESS provides a VPN mechanism transparently embedded into the operating system. This mechanism is invisible to application programs and, since it is implemented at the transport layer, does not interfere with network management and is suitable for communicating over wide area networks employing network address translation.
On the basis of the CIPRESS system attractive applications can be realized. For instance Data Linkage providing effective mechanism for protection of secondary copyright and integrity of interlinked documents. CIPRESS answers questions such as: “who accessed which document when and where through compound documents”. With the Trusted Mail users have not only a reliable email service but also convenient new features as proof of receipt and ‘unsend’ functionality of misdirected messages.
First field trials were conducted in 1999, the ReEncryption system is available commercially at the beginning of 2QCY01. Based on the core CIPRESS system, additional applications such as a secure and convenient messaging/email system and document management systems will be available. CIPRESS provides a open framework for third party application integration and can be extended efficiently to meet elaborate customization requirements.
Please contact:
Christoph Busch - Fraunhofer-Gesellschaft
Tel: +49 61 51/1 55-1 47
E-mail: busch@igd.fhg.de
