How to create secured PDF files without passwords

The first question to consider when creating a secured PDF is how easy it is for others to remove the security.

The most popular method for creating  secured PDF files was and still is password protection, but passwords are easily removed using any of the PDF password recovery programs – see PDF Encryption & Security.  If you truly want to secure your PDF files, passwords are clearly not the way forward.

Some businesses use secure document sharing sites such as secure data rooms but these have many security weaknesses.  Users can share login info, and modify or disable JavaScript to remove protection.  See Google Docs Security as an example of how easy it is to remove security from a PDF file and other document formats.

Adobe Content Server used PKI technology to replace passwords – see password or certificate encryption – but that meant that the publisher needed the customer’s public key in order to create a unique secure PDF file.  When using its PKI, a PDF file had to be protected independently for each individual recipient.  The same PDF file could end up being secured hundreds or thousands of times depending on how many recipients there were.  This was not a readily scalable architecture, particularly if your business went global.

Locklizard DRM secured PDF files only need to be encrypted once and use long and random encryption keys.  Decryption keys are required for authorized users to open protected PDF documents.  They do not travel with the PDFs themselves but are instead transparently relayed securely to the recipient’s device and stored encrypted in a keystore.  There are no passwords for users to enter so there are none to share, and users don’t have to send their public key to anyone.

If you use passwords to create secure PDF files, then users can easily share both the PDF file and the password with others.

Unauthorized recipients won’t be able to open a Locklizard DRM secured PDF since it is encrypted.  To open a Locklizard PDF, the user has to be both registered with the publisher and authorized to view it.  To stop users from sharing the PDF file along with their keystore, the keystore is locked to their individual device(s) and if it is copied to another device it will not work.

You can’t prevent users from forwarding secured PDF files (or indeed any files) to others.  Even if a corporate email policy system is in place, users will find a way around the system (e.g. saving the file to disk and sending it by webmail, usb stick, converting it to a zip file, etc.).

What you can prevent, however, is the opening of the PDF file on an unauthorized device.  This is because unauthorized recipients cannot use a PDF file without the publisher’s authority, which is controlled via the Locklizard administration system.

There is not much point in creating a secure PDF file if authorized users are allowed to copy and paste content from it.  It’s a bit like building a strong prison and then leaving the gaol door open.

Locklizard PDF DRM software prevents copying and pasting by using our own secure viewer environment to limit the functions available to users.  We prevent plug-ins from being loaded so that third party plug-ins cannot compromise the system by enabling features or bypassing other controls.

If users can edit or add to the content of a secured PDF, then they have to be able to copy and paste as a minimum, and likely have Save and Save As functionality too.  And as we already covered, allowing copy and paste is a bad idea.

In theory, you could allow Save/Save As functionality and create new encrypted files, but then there would be version control questions, access rights management hurdles with the new document, and so on to deal with.

So, on both counts, allowing editing is not compatible with secure PDF use.  Locklizard PDF DRM products prevent saving and editing of PDF documents as a result.

Locklizard employs various techniques to prevent the use of printscreen and third-party screen grabbers.

Whilst DRM cannot totally prevent screen grabbing from taking place (nothing can stop a photograph of the screen from being taken with an external device), it can make the task more laborious (and expensive).  When combined with other controls such as dynamic watermarking, it can also discourage users from grabbing screen content in order to share copies.

Stopping users from printing a PDF file is one of the most effective ways of preventing copies of your documents from being circulated since printed documents can be readily photocopied or scanned and then duplicated.  But it may be a requirement to let users print.  If you want to allow printing, then Locklizard DRM software enables you to apply secure watermarks (see Watermarking on view and/or print).  It can also enforce degraded printing, limit the number of high-quality prints allowed, and log print requests made by users so you can watch out for inappropriate behavior.

Locklizard PDF DRM software automatically prevents printing to PDF and other file formats so that PDFs cannot be readily converted to unprotected files.  Also, documents that have been printed, scanned back in, and then converted to PDF will only be image documents (so basically one big image in a PDF file).  They lose all the bookmarks, embedded links, and text search capabilities – which are key usage differentiators of electronic documents over paper copies.

Publishers can add dynamic watermarks to secured PDF files that automatically insert the user’s name, email, company name, and a date/time stamp at print time to discourage sharing of printed documents.  Once a user knows a shared printed copy will be immediately traced back to them, they’re much less likely to do so. Similarly, these dynamic variables can be inserted at view time to discourage screenshots from being taken and distributed.

Because Locklizard DRM software uses dynamic variables, the publisher only has to protect one PDF document for all users.  With Acrobat PDF security, you have to protect each PDF file individually for each user to customize it with their user details.

Locklizard DRM software also allows static watermarks (text and graphic images) to be applied at the same time as dynamic ones.

Document expiry can be enforced either on a fixed date or following document usage rules.

There are many reasons you may want to expire PDF documents such as:

• to comply with document retention policies
• to enforce version control
• trial usage (e.g. 1 or 2 views before purchase)
• enforcing compliance with disclosure requirements
• enforcing subscription periods to a service or series of documents

Locklizard PDF DRM software enables you to expire PDFs:

• After a number of views
• After a number of days
• On a fixed date
• After a number of prints
• When a subscription period has ended
• At any time you decide

Tracking if or when a  document has been opened or printed can be essential for accountability or auditing purposes.  You may need to prove that the recipient has not only received the PDF file but has also read and/or printed it.

You can track and monitor PDF use by recording document opens and prints and displaying the number of times each document has been opened and printed by each user.

There may be occasions when you do not want confidential or important documents to leave your office premises.  But with BYOD, this has become a difficult problem to solve.

Locklizard enables you to lock PDFs to specific locations (say an office) so that documents will only be viewable from this location and no other.

Location locking can be enabled on a global or user basis and at both country and IP levels.

Being able to revoke access can be vital when confidential documents have been distributed or where chargebacks have been applied against a purchase (e.g. a book, a report, or a training course).

Publishers can revoke access at any time, ensuring your documents are always under your control.

Being able to limit the number of computers that a PDF can be viewed on is at the heart of any DRM licensing system.  However, most DRM systems don’t prevent the viewing of PDF files in thin client / virtual environments.  If a PDF file can be viewed in a thin client or virtual environment then it means that a secured PDF licensed for a single computer can be used on all computers in that environment.  It may make you question why you bothered to secure it to begin with.

Locklizard automatically prevents the use of secured PDF documents in thin clients and virtual environments unless they have been specifically authorized by the publisher of those files.

Not everyone wants to be (or is able to be) connected to the internet every time they open a PDF.  Some PDF DRM systems force the user to always be connected to the internet when they want to view and/or print a secured PDF file, or even to be online the whole time it is in use.

Locklizard supports both online and offline use.  You can require users to always be connected to the Internet (so checks can always be made with the licensing server for any updates – like removal of access, etc.), make them go online every n days (e.g. check with the licensing server once a month for any updates), or allow them to view and print PDF files permanently offline.  The latter gives the publisher less control and means they cannot instantly revoke access, but it does provide greater flexibility for the user.  In the case of some documents, such as ebooks, this may be a market requirement.

Some business may not always be able to install software, so Locklizard provides zero installation viewers for locked PDF files.

We have two types of zero installation Viewer:

• Safeguard Web Viewer– enables users to view PDFs in a browser (Google Chrome, Edge, Firefox, etc.) on any operating system or device.
• Safeguard PDF Portable – is a method of loading a secure environment (Viewer, encrypted keystore and documents) onto a portable device such as a flash drive or USB stick.  Documents are linked to the USB stick instead of being linked to the computer on which they are loaded.  From a licensing perspective, it means that secured PDF documents may be used on any machine capable of running the viewer application.  This is exactly like owning a book in that the purchaser of the book may lend it to others (or even rent it), but only by giving it to them physically and thus being denied a right to continue to use it unless and until it is returned.