Patent Application
20110019240
When documents were primarily on paper, such a document might be written on paper, and read by a user. There have been different ways of maintaining confidentiality of such a document. For example, a user could be allowed to read the document but not physically take it. A user could be given an original document, with certain markings on the document, make a promise not to copy, and a promise to shred or return the document when they were finished.
The present inventor recognized problems in the electronic formation and/or use and/or accessing of documents. These problems and issues are wholly different than any analogous actions that occurred in interaction with paper documents.
Even in the paper medium, there is no real way to enforce the restrictions, since a user can copy the document, and no one has any way of knowing that. However, watermarks, stamps, etc, could be used to attempt to show that a document is a copy.
The copying can be even easier, and harder to stop, in electronic media. When you send an electronic version of a document to a user, that document can be copied.
Accordingly, the present application describes electronically watermarking documents, and automatically determining permission information for these documents, e.g., keep, destroy and shred, for example.
The content is read under control of, or with cooperation of, the control information 105.
In one embodiment, the control information may include simple control instructions. Other embodiments, however, may provide additional details about what constitutes authorized operations. For example, in one embodiment, the content 110 of the document may be encrypted. The control information 105 includes the decryption information for reading the content 110. However, the control information 105 only allows the decryption information to be used for the decrypting according to certain rules that define access to the document.
Another embodiment describes forming these documents. In this embodiment, the date and time of the formation can be used as part of the encrypting. For example, this can use a cryptographic “token” technique. In a “token” technique, there may be hardware or software that can be part of the machine that carries out the formation. The token has a secret internal key that encrypts information using either a current date and time, or a date/time of the encryption, as part of its operation. The date and time of the creation of the original document (or encryption) can therefore be made into part of the decryption. This becomes part of the encryption operation.
In one embodiment, the control information is an executable file which decrypts or otherwise reads the document.
In one embodiment, the document may be in a proprietary format that can only be read by a reader of a type which is specified in the control information. Since the reader is read-only (that is, in one embodiment, does not have the capability to edit), it can be a small in size program, and not take up much room in the file. By including the reading program as part of the document, the reading program itself can enforce the rules described herein.
People may be concerned about viruses etc in such a file which is actually executed. In one embodiment, the reading program may be an executable, but may include security details that specify the safety of the executable, for example, a security certificate that indicates that the executable is safe to execute.
The operation of reading the file is shown in
At 117, the control information 105 or “header” is personalized to that machine, so that document can determine that it was 1) made on that machine, and/or 2), if desired, can only be executed on that machine. Another embodiment may allow any machine to read the document, in that case, the personalization information may be disabled. Other embodiments may allow some reading and/or actions on another machines, but not unlimited.
Once personalized at 117, or if the control information has already been detected to be personalized at 115, access to the document proceeds. The access first determines if the personalization 118 matches the ID at 120. The matching of the personalization may not require a machine-by-machine match—for example, as described above, the personalization may allow other machines access to the document according to the rules (e.g., once a day), or the personalization might only allow access by the specific machine.
If the personalization does not match the ID at 120, the document is locked against further use at 125. The locking against further use may later be unlocked using a special ID code that may be a secret code. The locking prevents viewing a document which has been moved from one computer to another.
In another embodiment, the locking allows the document to be viewed on any single computer but not on other computers. For example, this may personalize the document according to the computer information, or personalize the document with the computer information the first time it is used (using the computer information on which it was used).
If the personalization does match the ID at 120, the program determines at 126 if the document has expired. For example, if a document has expired, it may include an expiration date in the control information, e.g, shown as 107. Once 126 detects that the expiration date has passed, 127 takes an action on the document. The action that is taken may be as stated in the control information. The action for example may provide a warning and wait another time period for the document to be renewed, limit the functionality of the document, or take some other actions. In another embodiment, the expiration may digitally shred the document, by using a shred program which finds all bits forming the document, and writes over each of those bits, either once, or many times. For example, this may write over the bits 128 times, using random bits, or using all 0s then all 1s. It can, of course, write over the bits some other number of times, e.g, 10 times, 64 times, or any other amount of times.
If the document is not expired at 126, the program queries for the user's next desired action at 130. Different options may be available for different documents, depending on the content of the control information. For example, the control information may specify that the document can be read but cannot be printed. The control information can specify that the document can be copied once and sent once. Many different things that can be done with a document may be specified by this control information. In embodiments, as shown herein, the control information constrains what can be done by the reading and/or editing program.
One embodiment sets these rules, and allows decrypting at 140 only if these rules have been met.
In another embodiment, the control information makes rules that need to be enforced by any program. The digital millennium copyright act defines that intentional violation of copy protection is illegal. Hence, by specifying the kinds of actions that can be taken on the file, this constrains the program to take only those actions.
As described above, actions such as reading, print, send, copy, etc., are enabled by the control information shown as 106 within the header 105. The user is allowed to take these actions on the document according to these parameters at 130.
The action first checks at 135 to determine whether the action limit, e.g, copy limit, read limit, send limit, copy limit, etc has already been reached. If the limit has been reached, the process stops at 136. If not, the document can be decrypted at 140, if decryption is used in the specific embodiment
For any of these operations, the document can be decrypted at 140, and the action taken at 145. After the action has been taken on the document, a new header for the document is formed with the new information at 150. This can indicate, for example, the number of prints, copies, reads or sends being greater than a predetermined amount. Any of these features form new control information indicating the action which has been taken.
When a document copy has been made, for example, the copy will be made with new control information at 145. That document includes information indicating that it is a copy, and based on instructions 108 in the old control information, includes information about the capabilities of that copy.
Note that the copy will not have personalization information 118 when first made, so the “first time routine” will be run the first time that the copy is run on another machine.
Default instructions can also be used to determine how to handle any document for which specific instructions were not made. For, example, if a “copy” command is carried out without specific instructions on what to do with a copy command, a document just like the original document may be made, however indicating that it is a copy, and incrementing the total number of “copies made” variable in both the original document and the copy.
The original document 200 is shown with its mark 205, where the mark can be the marks a header file 105 shown in
In one embodiment, the original header 205 might not have information about a copy of the copy. In another embodiment, however, the original document includes communication information shown as 109 in its control information. In this embodiment, when a copy of a copy is made, that information may be sent shown is 214 to modify the original header. For example, the sending may be by e-mail, or may use any other form of information sending.
In another embodiment, the reading program requires a “phone home” before action can be taken on the document. The phone home can require a communication to a clearinghouse, or to a specified server, or to the creator of the document. The phone home can be a network connection that verifies that the document can and should be read. In one embodiment, communication to a specified recipient is required before any or certain actions can be taken on the document or only at certain times. For example, it may be required to phone home before copying or printing, but not before reading. The phone home embodiment may require communicating to a remote location to verify the access control, and allowing specified access only after the communication to the remote location has been successful.
The communication embodiment also provides an additional advantage in that when communication is possible between the different documents (for example the different computers holding the documents) then a shred routine can be carried out more effectively. For example, when a user issues a shred command to the original document, that shred command may also cause a header to send a shred command shown as 213 to any document that it has retained communication with. The shred command may add a shred bit to the header 106. In 105. As an alternative while there is the shred it 111 as an alternative, the shred it may simply set all permissions to know, changing the document so that it is no longer possible to view any actions on the document, that is they cannot be read, printed, copied, sent, or anything else.
This also allows the controller to re-set permissions after the document has left their control.
The phone home can use the flowchart of
In another embodiment, the shred routine, leaves the control information 105 intact, but shreds the content of the document. The control information can be sent back.
Another embodiment may allow an administrative password on the header, so that the header can be changed by an authorized person, e.g., to extend the expiration date, or to set a “shred now” option.
Although only a few embodiments have been disclosed in detail above, other embodiments are possible and the inventors intend these to be encompassed within this specification. The specification describes specific examples to accomplish a more general goal that may be accomplished in another way. This disclosure is intended to be exemplary, and the claims are intended to cover any modification or alternative which might be predictable to a person having ordinary skill in the art. For example, the above contemplates that the documents can be readable and/or editable documents, such as electronic paper substitutes (word processing documents, imaged documents such as PDF or tiffs, etc), more specifically documents that can be read and/or notated. However, the documents can be any electronic file, such as music or video files, read only files or any other kind of file.
Also, the personalization described above can personalize the document for multiple computers, so that the document could be accessed by any of those multiple computers.
Those of skill would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the exemplary embodiments of the invention.
The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein, may be implemented or performed with a general purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. These devices may also be used to select values for devices as described herein.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in Random Access Memory (RAM), flash memory, Read Only Memory (ROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a user terminal.
In one or more exemplary embodiments, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Also, any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk and disc, as used herein, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.
Also, the inventors intend that only those claims which use the words “means for” are intended to be interpreted under 35 USC 112, sixth paragraph. Moreover, no limitations from the specification are intended to be read into any claims, unless those limitations are expressly included in the claims. The computers described herein may be any kind of computer, either general purpose, or some specific purpose computer such as a workstation. The programs may be written in C, or Java, Brew or any other programming language. The programs may be resident on a storage medium, e.g., magnetic or optical, e.g. the computer hard drive, a removable disk or media such as a memory stick or SD media, or other removable medium. The programs may also be run over a network, for example, with a server or other machine sending signals to the local machine, which allows the local machine to carry out the operations described herein.
Where a specific numerical value is mentioned herein, it should be considered that the value may be increased or decreased by 20%, while still staying within the teachings of the present application, unless some different range is specifically mentioned. Where a specified logical sense is used, the opposite logical sense is also intended to be encompassed.
The previous description of the disclosed exemplary embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these exemplary embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
