PDF DRM Security: restrict PDF access & control document use

Common weaknesses in most PDF protection products are to rely upon passwords being distributed by document publishers to those authorized to use them.  Apart from the obvious problems that passwords can be given away, there are a plethora of password recovery or cracking tools available on the Internet to remove passwords or reveal what they are.  See Removing PDF Passwords.

The Locklizard approach is to license the relationship between the document publisher and customer, and automatically establish and verify authorizations on a document by document basis.  No access control information travels with the documents, no passwords are given to users, and users have no means of entering passwords.  Access control information is negotiated cryptographically and the user (or any other attacker) cannot become involved in the process or capture any secret information.

So the commonest methods of attacking protected PDF documents – through attacking passwords, have been prevented.

A common approach to rendering PDF documents is to use the Adobe viewer, operating either as a plug-in (the security company provides add-on code that links into hooks provided by Adobe) or as a plug-out (where the security company puts a shell around Adobe and manipulates their interfaces).  Either way, plug-ins are just an EXE file installation by another name (require admin and firewall access), and they also have a number of weaknesses.

Plug-ins are notorious for failing to interact cleanly because there is no certification process by which their interoperation can be tested.  From a security standpoint there is little or nothing to stop people from creating plug-ins that compromise system security, and using them to bypass other plug-in controls.  Plug-ins are normally run on an ‘honor’ system, which is fine except that there is no honor among thieves!  In addition, every time Adobe does an update to Acrobat, third party security plug-ins stop working – resulting in a major support headache for you and your customers.  For further information see PDF plug-in vulnerabilities.

Plug-outs, by comparison, are notoriously difficult to get working, and tend to be highly fragile.  Even the slightest change in the application being plugged-out can render the entire security system unworkable, to the consternation of all users.  And there is no incentive for the supplier of the application being plugged out to be helpful.  Both approaches are also vulnerable to all the attacks against the underlying application since they cannot prevent them.

Locklizard has provided security by design.  Using our own secure PDF DRM viewer completely prevents the problems of plug-ins/outs allowing complete control over the environment that cannot be achieved by other approaches.

Zero footprint solutions sound brilliant – total security without doing anything!  Of course if it were true then there would be no software or music piracy – and we all know that is not the case.

The fundamental weakness of these systems is that they MUST send the decryption/ unscrambling key with the protected document.  So it can be easily found, and automatically removed.  To be fair, the technique does reduce trivial copying by those who cannot be bothered to do some trivial Internet searching.  But they are usually not the people you are trying to stop.

Without having anything implemented on the computer it is not possible to implement controls that can be enforced locally.  So the most powerful security controls and techniques are not available.

This approach leaves you largely relying on the DMCA (Digital Millennium Copyright Act) for protection of your PDF documents, always assuming you can afford the lawyers fees.  Another good example of a zero footprint solution?

Locklizard provides a zero installation viewer that can be distributed to users on USB sticks.  It is not a ‘lite’ version and does not use plug-ins, JavaScript, Flash, passwords, or self-extracting EXEs.  It provides the full DRM protection of our installed viewer, yet is truly portable.

We also provide a web browser viewer that requires no installation but requires users to be connected to the Internet.  Just like our installed viewers, content is decrypted in memory.

Generally PDF security and PDF DRM providers do not appear to have understood the need to be able to provide and support granular ranges of protection based upon the risk management stance of the publisher.  There is little demonstrated thought about how controls are supposed to relate to each other, or to DRM as a specific method of Intellectual Property Rights management.

For instance, allowing printing introduces a risk that documents may be sent to file drivers, and then reprinted at will, or physically printed out, scanned and then brought back as uncontrolled documents.  Different techniques may be used to resist these options, including the use of both static and dynamic watermarking to identify the user of the document or make it difficult to use scanning techniques and OCR to recreate documents.  Omnia Romae cum pretio (Juvenal), or more literally, everything has a price.

Locklizard provide a comprehensive series of methods for helping publishers identify dynamically who is the source of printed copies, which can be augmented by OCR preventing or copy revealing where the security requirement is very high.  The higher the strength of the controls, the more intense the demand on the computer hardware.  But this is transparent to both publisher and user (unless the user tries to break the rules, of course).

Requiring a license verification every time a document is opened is good practice for high security documents, or where you have to be able revoke them instantly, but it does mean they can never be used offline.

This can cause user problems if they need to use training materials and books offline, so you should take this into account when requiring license checks.

But most important is the ease of use for both PDF document publishers and their authorized users.

For there to be realistic security, an applications program must be installed on the user’s computer.  So Locklizard minimize the need of the user becoming involved in entering codes, passwords or similar.  The user establishes a single generic license with their publisher and Locklizard take care of all the document access permissions, monitoring, counts and so on without the need for any user or publisher intervention.

From the publisher’s side, the publisher is presented with a small number of panels that step them cleanly through the protection process.  They do not allocate codes or generate coding structures.  They are not involved in PKI administration (under the hood Locklizard use that technology, but the way it was originally intended, without anyone having to get involved with it, or understand it) and deal with questions that are business relevant – when is the document available from and to – how many prints are left – are thin client systems or similar environments forbidden – how often must the license be verified – and so on.

A quick look at screenshots of the Safeguard PDF DRM protection dialog shows that choices offered to the publisher are obvious and logical – no use of mysterious codes such as ‘enter -1 for unlimited’ are required.  Locklizard get the protection input from business people in their own language.  Not exactly rocket science, but it shows the gulf between suppliers who can’t even be bothered to understand their customers, and those who go the distance.

Locklizard’s DRM customers clearly identify that they chose Locklizard as their PDF DRM supplier because it is the most cost effective and the easiest system to implement.  It allows them to choose the level of controls that they believe are correct with respect to individual documents, and subsequently vary them in a meaningful way per customer.

So it is possible to have a high PDF DRM security system without making it impossible to use, but please don’t tell the security ‘experts’ since they might be out of a job.

Locklizard PDF DRM software is used by a wide variety of industries to protect everything from financial and share trading information, accounting and investigation information, maps and charts, service manuals, sales and competitive analysis, training materials, proprietary designs, open tender documentation, membership and subscription information for both professional associations and financial services businesses, and so on.