강민경, 최형기,

Vol. 34, No. 5, pp. 1007-1019, 10월. 2024
10.13089/JKIISC.2024.34.5.1007, Full Text:
Keywords: Microsoft RMS(Rights Management Services), data protection, information security
Abstract

Microsoft RMS(Rights Management Services) restricts access to organizational files by specifying which users can access them and managing detailed permissions on a per-user basis. To prevent unauthorized access and data leakage, RMS must ensure a high level of security. This paper evaluates the security of RMS from the perspective of data protection within devices. The credentials required to support access control in RMS are stored locally on the user's device. These credentials must be protected under all circumstances, including when the device is acquired by an unauthorized entity. In this paper, we analyze the protection mechanisms for credentials within the user's device. Based on our analysis, we propose two attacks that can bypass these protections, compromising protected documents on locked devices. The vulnerabilities that lead to data leakage through these attacks are verified across nine different Windows RMS operating environments.

Statistics
Cite this article