| 摘要 |
A method and a system for auditing and managing a license in a DRM environment are provided to manage all the processes from issuing the license to abolish the license, to monitor an illegal security threat, and to cope with the illegal security threat. A method for auditing and managing a license in a DRM environment comprises the following several steps. A forensic agent checks whether there exists a license hash profile in use(S210). If there does not exist the license hash profile, the forensic agent generates a new license hash profile(S220), records an alarm logo on a generation reason of the license hash profile(S250) and reports the alarm logo to a forensic management server(S260). If there exists the license hash profile, the forensic agent calls the license hash profile(S230) and compares cyclically the called license hash profile with the license file stored at a user terminal(S231). If the called license hash profile is not the same as the file stored at the user terminal, the forensic agent repeats the steps S250 and S260. If there exists the license hash profile, the forensic agent monitors system calls like an access, a modification, an addition, a deletion, a movement, a copy or a file opening by using the license stored at the user terminal(S240). If the forensic agent detects an item identical to a system call signature of a rule set while monitoring the system calls, the forensic agent recognizes the detected item as an abnormal behavior(S241) and repeats the steps S250 and S260. |
