PDF protection with PDF DRM security to protect PDF files

PDF protection that enables you to prevent, allow or control the following functions:

• Viewing, copying, modifying and saving documents and contents
• Printing documents.  You can stop a PDF from being printed (prevent printing) or specify the number of times your documents can be printed
• How many times your protected PDF documents can be viewed
• How long your protected PDF documents can be viewed – days, months, years, forever, or a specific end date
• How long users can view a protected PDF document offline: always, n number of days, or they must connect every time to the administration server before they can view your protected documents.
• Expire and revoke distributed protected PDF documents at any time, automatically revoke access once view and/or print limits have been reached, manage offline access, and enforce content management system security policies no matter where your documents are
• Suspending documents if you want to enforce document start times or don’t want them viewable for a period of time
• Change expiry dates, and print and view allowances even after distribution
• Use of Windows print screen and screen grabber applications – stop users taking screen shots of your protected PDF documents
• Sharing protected PDF documents is prevented since users must have first registered with you and have the correct license and decryption keys in order to view a protected PDF file.  Decryption keys are stored encrypted and locked to individual computers, thus ensuring they cannot be shared
• Use of your documents in thin client environments (e.g. Citrix).  This enables you to prevent users installing one common copy for all available environment users
• Enforce your own house style and appearance by ensuring that protected PDF documents may only be seen in the format you have decided

Safeguard’s PDF protection provides complete PDF protection for even the most novice of users.  Protecting PDF documents couldn’t be simpler.

To protect PDF documents, right click on them in Windows Explorer and select the secure PDF document access rights (use of printing – including how many times, etc.), press the OK button and your PDF files are instantly protected (PDF files are encrypted and document usage rights applied).  PDF documents can be published on their own or assigned to publications for simple administration.

Multiple PDF files can be selected in Windows Explorer and you can choose the same PDF protection usage and access rights in one click.  Or you can automatically batch protect PDFs without user intervention using our pdf command line encryption tool.

Distribute your protected PDF documents just like any other file – upload them to your website or send them out on CD-ROM, DVD, etc., knowing that they will always be secure.  Dynamic document control maintains access rights and permissions assigned to a secure PDF once it has been published and distributed.

Batch PDF file protection enables you to effortlessly batch protect PDFs without user intervention.  See optional PDF command line encryption.

Safeguard’s PDF protection Command Line Utility allows the automation of actions that would otherwise have had to be carried out manually whilst protecting PDFs through the Writer GUI.  Commands can be run from the DOS prompt or a batch file without the need for manual input or user intervention.  All the PDF protection options available through the Safeguard Writer GUI can be accessed through the command-line utility.

This PDF protection feature can also be used by organizations internally to rapidly protect documents for secure distribution and to control what DRM protection features are made available to sub-administrators.

The use of publications ensures minimum administration overheads and enables you to effortlessly manage your user base.  The concept of the publication is a way of associating documents that are logically related.  Different enterprises may see this in different ways:

• a publisher could see it as the issues in a subscription (say to a magazine or a series of reports)
• a training course provider could see it as the content of a course
• a lawyer could see it as the items making up a bundle
• a businessman could see it as the collection of documents making a bid
• a corporate entity could see it as a collection of documents for a particular business unit or department (e.g. sales documents), or for issuing to particular groups of third-party contractors.

So being able to bring together collections of documents to create a publication, makes the administration of connected documents easier for the publisher, and makes those documents automatically available to authorized users.

If you choose to publish your PDF documents as separate items, then each one will have it’s own encryption key.  However, where users are purchasing subscriptions to publications they expect to register their subscription once and then be able to read each issue as it arrives.  Also, you as the publisher may find it easier to associate documents with publications.

To meet this operational flexibility, if PDF documents are protected as something in a publication, the encryption key of the publication is used to protect it rather than generating a new random key.  This means that the user is able to immediately use a new issue regardless of how you ship it to them (eMail, flash card, CD-ROM for instance), and without you having to grant individual access to that document on the administration system.  Of course if you send them a protected PDF document that is not part of a publication that they have been granted access to then they will have to connect to the administration server to retrieve the new key.  And if you set the rules so that they must connect before using your protected PDF documents then that will be enforced.

Safeguard enables you to manage your subscription base effortlessly by providing individual publication expiry on a per user basis – you can expire a user’s access to different publications at different times, and manage this all from a single user account.

For additional PDF protection against photos or photocopies being taken, you can add custom text, dynamic data, and image watermarking to a document.  This is displayed when a protected PDF document is printed and/or viewed in the Secure PDF Viewer software.

Unlike watermarks that are added using PDF editing software (that can be removed in a single action), Safeguard watermarks are permanent and cannot be easily removed.

The following items can be displayed – images, custom text, and dynamic data (date/time, user name, company name, email address).

System and user data is dynamically applied when the protected PDF is displayed and/or printed, ensuring you only ever have to protect a PDF once in order to customize it for multiple users.

You can prevent watermarks from displaying on the first page of your documents (for unmarked cover page/ branding) and behind or in front of your PDF content.

User information can be displayed to deter photocopying, and the use of moiré images (available for free download) can be used to ensure photocopying produces extremely poor-quality copies.

User expiry

Safeguard’s PDF protection gives you total control over when user accounts and PDF access expire.  You may want to, for example, give users access to documents during a specific time period, and let them be able to view those documents in the future, but not access any new ones you publish.

You can set user accounts to expire to enable time-limited trials and control subscription services.

Publication expiry

Safeguard’s PDF protection enables you to control the expiry of your publications on an individual, user, and publication basis.  Users, for example, may have subscribed to one of your publications for a year, and all documents in that publication are accessible to them for a year.  After a year, they will still be able to view their existing documents, but not any new ones that are published after their subscription period has ended, unless, of course, they subscribe for an additional period.  Users can be given access to multiple publications, each with its own expiry period.

Document expiry

Expire documents on a certain date, after a number of days, after a number of views, or after a number of prints.

Safeguard’s PDF protection also enables you to control document expiry (PDF expiration).  Regardless of a user’s subscription to your publications, you may have certain documents that are time-sensitive and must not be usable after a certain date.  It also means that you can sell documents which are accessible for a limited time period at a lower cost, rather than being available forever.  This enables you to reach new markets that are price sensitive. You can be sure that those users can only view a protected PDF for a day or a week, or whatever you choose.  This PDF protection feature also ensures that only the authorized or current versions of documents are used after publication because obsolete versions can no longer be accessed.

Protected PDFs can also be set to automatically expire once a specified number of views and/or prints have been reached.  You can specify both an expiry date and a number of views (e.g. 10 views and expiry 5 days from first use) and whatever expiry option is reached first will cause the document to expire.

Instant revocation

Instant user and document revocation – terminate access to protected PDFs instantly.

With Safeguard’s PDF protection you can force users to connect to the administration server (happens transparently) before they can view your protected PDFs.  This can be every time they want to view your protected PDFs or after a certain number of days.  If you choose a number of days, then after the length of time you set has passed users must go back online to gain further access.

Using this PDF protection option, you can instantly revoke user access to previously distributed documents as the access approval required to view your protected PDFs is instantly expired.

Your controls are locked into each protected PDF so there is no need for users to connect to the Internet in order to view your protected PDF files (assuming of course that they have the correct decryption key stored on their computer).

Whether you want users to connect to the Internet or not to use your protected PDFs is a decision you make when protecting your PDFs.

Safeguard’s PDF protection gives you complete control over printing of your protected PDFs.  Stop printing of your protected PDFs on Windows, Mac or all operating systems.

If you decide to allow printing you can control how many times your protected PDFs can be printed.  Document access can be automatically revoked once this number has been reached.

You can enable document printing on a document or individual user basis and change print controls even after publication.  Documents can be protected without printing enabled and prints granted on an individual user basis.

Safeguard’s Secure PDF Viewer automatically prevents printing to file, email, PDF format (Adobe Acrobat distiller, etc.), common image printers, etc.

Email Customization

When you set up user accounts on the administration server, users are automatically sent an email to the address you entered with a download link to the Secure PDF Viewer software and their license file.  This email is automatically customized with your company name and email address in it so that users know who to contact if they have any problems accessing your PDFs.

You can further customize this email with your own text and logo by purchasing your own Custom Viewer Registration Email.

You can also use your own SMTP server so that emails are sent from your own domain name rather than the domain name of the licensing server.

Unauthorized Use Message

You can specify the text that will be displayed if a user does not have the correct decryption key present to view your protected PDFs – e.g. where they can purchase a license from or who to contact.

Splash screen Image

Each time a protected PDF document is loaded, a splash screen can be displayed. You can insert your own image here (say your company logo and maybe a brief message) to customize Safeguard’s PDF protection to represent your company image.

Display Presentation

With Safeguard PDF Security, you can require protected PDFs to open in particular formats, and can prevent users from being able to change to another style of presentation.  This allows you to enforce your own house style and appearance.

Viewer Logo

You can brand the Windows Viewer and Web Viewer with your company logo – see Publisher Own Branding.

Safeguard PDF Security comes with its own simple to use web-based administration system, enabling you to control and revoke access to your secure PDFs in real-time even after distribution.

Once you have protected PDF files, it is a simple matter of setting up users on the administration system (user name, company, email address) and allowing them to use one or more of your publications or documents.  Each protected PDF document that belongs to a particular publication will then be accessible to all users that have subscribed to that publication.

The administration system can handle a large number of users, documents, and publications, and you can perform actions on multiple users, documents, and publications in one go.

Safeguard provides various search and sort filters to help you find the customers and documents you are looking for more easily.  You can search by ID, name and/or email, display records in date or alphabetical order, and specify the number of records displayed on each page.  You can show only specific classes of user accounts (e.g. only users that have registered, or whose accounts have expired), or documents that have been published to a specific publication and/or have limited prints/views allocated to them.  You can select two filters to be applied at once.

Safeguard records all the document protection options for each individual document on the administration system, and you can customize record displays, add and edit descriptions.

For extra security, a manual logon/logoff process is used.

You can import user data into the Safeguard Administration system, and export user, document, and publication information to separate CSV files.

CSV importing means you can interface systems that do not obey consistent standards.

Exporting information in a CSV format makes it readily accessible for spreadsheet manipulation and analysis.

User Logs

The administration system records the date, time and IP address of users when they first connect to the server to obtain their decryption keys and when they login to use the Web Viewer.  It also records whether a user has tried to register with you more than once (i.e. on another computer), when this occurred, and the IP address and Operating System they were using.

Administrator Logs

The administration system logs when administrators log on, when they performed an action (i.e. adding, deleting, or modifying a record), and when this occurred.

Ecommerce Logs

If you are using Safeguard Ecommerce Integration you can see what ecommerce commands were successfully actioned, the action/parameters used, when and where this took place, and export this information to a CSV file.

Undelivered Email Logs

A list of undelivered emails (e.g. emails that bounced, marked as spam, auto responded etc.) are recorded and you can export this information to a CSV file.

In the statistics section, the dashboard provides you with a summary of users, documents, and publications, and system-level actions.

This includes:

• Total number of users, unregistered users, registered users, suspended users, last registered user, expired users, deleted users, last added, last deleted, last import, last export
• Total number of documents, suspended documents, expired documents, last published, last export of document information
• Total number of publications, last added, last export
• Last logon, last action of an administrator

Selecting an entry shows more detailed information.  For example, clicking on ‘suspended documents’ will display all of the documents that are suspended.

Pie Charts

Pie charts provide a quick visual summary of the principal system details.

User licenses can be sent automatically by email (either an embedded link, or a link and attachments) or you can choose to display them on a web page (in conjunction with the ecommerce module) for instant license delivery.  You can also choose whether individual users are sent license files, and can resend registration emails if they have been blocked by SPAM filters or deleted by mistake by the user.

You can track the email delivery status from each user’s account.  This records when an email was sent, delivered, opened, or bounced.  A list of undelivered emails is recorded on a system-wide basis so you can easily identify any problems with users receiving their license emails.

You can save a user’s license file to the disk and as an email (the complete email text sent by the Administration System).  This is handy if a user wants their license file email sent to a different or additional email address to that stored in their customer record since the license file email can be quickly forwarded on.

You can resend license emaisl to a single customer or multiple customers in one go.  Enterprise PDF DRM also enables you to batch resend license files to all users who have not registered their licenses, in a single operation.

Every license file emailed from the administration system can also be sent to a monitor email address of your choice so that a record is available of who has been sent their license files, which you may also use to resend licenses.  You can use Locklizard’s email system or have emails delivered from your own domain by entering your own SMTP information.

Ecommerce integration enables you to automate your entire sales process so there is no manual intervention.  See optional ecommerce integration.

You can integrate Safeguard’s PDF protection with your existing e-commerce system to help provide a totally automated secure document distribution service.  Once users pay or are authorized to use a document or publication, their details are automatically set up on the administration server and assigned the appropriate publication / document access rights.  License file information is sent out automatically by email so users can view your protected PDF documents straight away.

You can either use our managed service (hosted on our own servers so no set up configuration required), or you can host the administration system on your own server (we can set up the system for you or you can choose to do this yourself).

Hosting on our servers requires a yearly maintenance fee but ensures you are up and running from day one as no server configuration is required at your end – saving you time, hassle and money.

Regardless of who hosts the administration system, you always protect PDF files locally on your own computer and distribute them just like any other file (from your web site, by email, CD-ROM, etc.).

Unlike other products, our PDF DRM protection software lets you protect as many PDFs as you want and manage as many users as you want for no additional cost.

There is no limit to the number of PDFs you can protect or the number of users you have viewing those protected PDFs.

Users can download the Secure PDF Viewer software totally free of charge, either from our website or from yours, or you can distribute it freely via email.

The FREE Secure PDF Viewer can be:

• installed on a computer
• run directly from any USB stick (no installation or registration required, offline access) – Secure USB Viewer
• accessed via a web browser (no installation or registration required, online access) – Secure Web Viewer

Our installed stand-alone Secure PDF Viewer has a small footprint (so users don’t have to spend hours downloading and installing Adobe Acrobat), is fast to load, and ensures all the DRM controls are applied without exposing you, as the publisher, to known Adobe PDF document security issues, plug-ins (see Adobe PDF plug-in vulnerabilities) or insecure JavaScript (which also puts users computers at risk from being hacked).  It is not invasive and does not use root kit technology.

Protected PDFs are decrypted on-the-fly in memory.  They are never saved to disk in temporary format or to the Windows swap file.  We do not create extra files on disk that can be copied to another computer along with the protected PDF files and therefore be easily shared and viewed.

Viewer updates can be enforced to ensure that users are always using the latest version.

Safeguard’s PDF protection ensures users don’t have to worry about entering passwords (we don’t use them) or managing decryption keys.

When a user views one of your secure PDFs for the first time, the Secure PDF Viewer software will check if it has the correct key to view it.  If it does not, the Secure PDF Viewer will check with the administration server to see if the user has been granted access to the protected PDF.  If access is allowed then the decryption key will be transparently relayed to the client.  If not, your custom message will be displayed telling the user how to contact you for access.

To ensure complete PDF protection, your PDFs are encrypted using industry-standard encryption – the US Government approved algorithm, AES.

PDF encryption allows us to enforce the digital rights management controls applied to your protected documents.

Since no decryption keys are included with the documents, an attacker faces the (currently) impossible task of breaking the encryption algorithm itself.

Safeguard’s PDF protection does NOT use passwords since PDF password protection is ineffective and can be easily removed.

• Strong public key technology is used rather than weak password mechanisms that are easily crackable.  Not using password protection ensures bullet-proof protection of your PDF documents – since there is nothing to enter the system is not vulnerable to password attacks.
• You don’t have to distribute passwords to users and they don’t need to type in access codes to get going.  Decryption keys are transparently relayed to the client computer and stored in encrypted format.  There are no passwords to enter, manage, compromise, forget or pass on to others.
• Whilst we use public key technology, no key management is required by you as the publisher or by users, as it is all handled transparently by the licensing system.  There are no certificates to revoke when you want to terminate a users access or any other PKI complexity.
• Locklizard provides a secure exchange mechanism in order to move the required key down to the user’s desktop at the same time as validating the user’s authorization to receive the key.  Keys are seamlessly delivered to user’s computers.
• Whilst user keys are stored on the user’s computer, they are also locked to that computer and cannot be moved.  So the user must be at that computer in order to be able to use the licensed documents.  Any attempt to move the keys system to another computer will invalidate it.

Secure PDF Technology

1. Safeguard creates secure PDFs by encrypting them and applying DRM controls.
2. Secure PDF files created with Safeguard PDF Security cannot be broken using password cracking mechanisms since users do not enter a password to open secure PDFs.  Decryption keys required to view secure PDF files are secretly transferred to a keystore that is encrypted and locked to the client computer or a USB device.  If a user copies the secure PDF files and the keystore to another computer the files will fail to open.
3. Safeguard PDF Security does not use plug-ins to Adobe Acrobat or JavaScript because they are major security weaknesses.

Safeguard’s PDF protection uses its own decryption application (a Secure PDF Viewer) rather than relying on a plug-in to present your information.  This ensures the security of your information is always under the tightest of controls, and is not vulnerable, or exposed to any errors in third party applications.  Protected PDFs are decrypted in the Secure PDF Viewer, which applies the necessary PDF DRM controls and ensures your PDF content cannot be compromised by other applications, JavaScript, plug-in failures or conflicts, or the common Adobe PDF document security flaws and cracks.

Read this article on Adobe Acrobat Security published by Bryan Guignard, an Adobe Certified expert, on why we don’t use Adobe’s implementation / Adobe plug-in for PDF protection.

To ensure total PDF protection for your source files, you protect PDFs on your own computer.  The source PDF files (unprotected files) are never exposed to a web server where they could be easily compromized.