The Challenge of Securing Corporate Intellectual Property

When faced with the challenge of securing critical business information, the first reaction is often to place restrictions on employees' ability to accidentally or intentionally leak information to competitors or other unauthorized parties. The earliest methods of protecting corporate information were "restriction" methods; i.e., methods that limit how and when documents can be accessed.

One obvious disadvantage of the restriction approach is that it provides no protection once documents have left the company's network. Design companies, for example, often need to send their designs to partners for additional work. As soon as the files leave the network however, the design company immediately loses control of the documents' privacy as there is no way to control the partner company's security measures.

Another disadvantage is that, as advances in communication technologies make it easier to communicate, more and more restrictions must be placed on employees with access to sensitive documents. As new communication technologies are developed, new methods of restricting their use must be developed and enforced. These restrictions can quickly become overwhelming to both the company's security administrators and to employees, who have to embrace new communication technologies but also must comply with increasingly complex security policies. With increasing mobility comes a growing need for employees to travel and take important documents with them in their notebooks and other devices. If not properly secured, this information could easily be copied or printed from outside the company. Companies are left with the choice of sacrificing convenience for security, and employees are dissatisfied with the restrictions placed on them.

The newest and potentially most critical escape route for sensitive corporate data is Web applications. As more applications take advantage of online resources and more users enjoy the convenience of web-based programs, the limitations of the "restriction" methods of securing data grow increasingly apparent.

Digital Rights Management and Restriction Methods
Because of the limitations of the restriction methods of securing data for businesses, a new system called Digital Rights Management, or DRM, was developed. The DRM concept was designed based on the knowledge that all Windows® applications must communicate with the Windows API before reading or writing to files. Whenever a file is opened, saved or a new file is created, the application must call the Windows API function. To allow Windows files to be read and written to, the Windows API uses messages called "hooks" to give permission to the application to install subroutines in other applications that will monitor certain types of information within a specified window. When data is received, Windows first processes these subroutines before executing the main program.

DRM evaluates the user's privileges and decides how to control application access to files (whether opening, saving or copying is allowed) using hooks. When a file is opened, the DRM system first decrypts the content, then reads the application into memory, and then re-encrypts the code from memory before writing to disk. The following diagram illustrates the basic process by which applications access files through the operating system.

Because hook encryption technology is closely connected with the applications, whenever an application file name is changed, the hooks will no longer work. At the same time, because different applications may use different methods to read and write to files - and even different versions of the same software may have different methods of handling data - hook encryption methods must be developed for each separate application and even for different versions of the same programs. Additionally, many modern applications incorporate "anti-hook" mechanisms to prevent unauthorized access to files (from hackers, viruses, etc.). When these applications detect hook intrusion, they automatically terminate the application. This is another challenge for DRM, because with every new application comes another set of difficulties in accessing and manipulating application hooks.

Under the DRM protection framework, "individuals" and "documents" are the two main factors in administration. Administrators can set different access restrictions for different individuals for every different document. DRM provides the best protection when completed files are uploaded to the file server, where they can be fully controlled and deployed when needed. However, in a best case scenario, documents should be protected from the moment they are created. For example, software programs are usually written by multiple teams working on different parts of the same program. Each team member may have access to the complete code prior to uploading it to the file server, and could easily copy or distribute the program code to a competitor.

Another problem with DRM is that it takes considerable time to open or save files because it runs at the application layer. This can be especially cumbersome when encrypting and decrypting large design files of up to hundreds of megabytes.

Transparent Encryption
Transparent encryption technology is a new approach to document protection that addresses the needs of enterprises for comprehensive, efficient and convenient document security. Because it runs at the OS layer, transparent encryption technology automatically encrypts files when a user saves, edits, or opens a new file with the specified file extension. When an encrypted file is opened, it is automatically decrypted without having to enter a password. Users can access and edit encrypted files within the secure environment as normal, but the files stay encrypted throughout. If the files leave the environment, they will be unreadable to any other system, regardless of whether the files leave the network through email, on a USB drive or any other means.

Transparent Encryption has the following characteristics
Compulsory File Encryption: Once the system has been installed, all specified applications and document types will be automatically secured, so that no matter who creates, opens or saves a file, it will only be accessible within the secure environment.
Ease of Use: No impact on existing business processes. No communication ports or services need to be disabled, and no user training is required.
Internal Accessibility: Internal communications are not obstructed and employees can exchange files as normal.
External Protection: Protected files become unreadable as soon as they leave the secure environment, thereby automatically protecting private corporate information.

Transparent Encryption technology is built on the Windows® file system and utilizes Windows driver technologies to perform its tasks at the core OS layer. When installing computer hardware, we often have to install drivers for printers, network cards, USB devices, etc. The document system drivers work in a similar way, by viewing documents like hardware devices that can be accessed via virtual drivers. When an application attempts to process a file with a specified file extension, the document driver monitors the application's processes and controls how the file is encrypted and decrypted.

Driver-level encryption technologies are independent of applications, and they run under the Windows API. When the API executes a command on a specified file type, the driver automatically decrypts the file and gives the application access to the decrypted content. When the file is saved, the driver automatically encrypts it before saving to disk. Because it runs at the Windows OS layer, processing time is considerably faster and encryption is more stable than technologies that run at the application layer. 

Driver-level encryption tasks are performed at the core OS layer, as shown: 

Although driver-level encryption technologies have many advantages, the biggest disadvantage is the difficulty in developing them. Driver-level encryption involves many lower level Windows processes and care must be taken to prevent conflict with other drivers or applications.

Advantages and Disadvantages of the 3 Types of Enterprise Document Protection: