Persistent information security: beyond the e-commerce threat model

This paper introduces a new class of information security solution. The core technology, to authorize and track the use of digital files, was originally developed in eCommerce applications, there known as Digital Rights Management (DRM). In applications to non-commercial confidential records, such as health and safety documents, we call the solution “Persistent Information Security”. We distinguish it from DRM because the threat models of the fields of application differ significantly. An implementation, RightsEnforcer, is described to clarify some concepts of operation. A simple model for a cost-benefit study of deploying a security technology is suggested and illustrated. Categories and Subject Descriptors H.4.3 [Information Systems Applications]: Communications Applications---Electronic mail; E.3 [Data Encryption] General Terms Security Keywords Persistent Information Security, document security, threat model, Digital Rights Management, DRM, risk remediation, insecurity expense...

• Type: Conference
• Year: 2006
• Where: ACMICEC
• Authors: Merv Matson, Mihaela Ulieru
• Keywords: ACMICEC 2006, Digital Rights Management, ECommerce, Information Security, Persistent Information Security