Protecting the intellectual property associated with digital assets that come in a form other than software applications requires a different approach and dedicated tools. Technical, legal, and commercial know-how is frequently shared in a business environment, and the authors want to make sure their assets do not end up in the hands of unauthorized personnel or competitors, let alone media outlets. Certain reports are also for-sale products, in which case their cloning or distribution with non-eligible parties means an immediate monetary loss. However, a file that needs a standard application to be opened cannot include encryption and decryption methods: While CodeMeter Protection Suite protects software against illicit actions, SmartShelter and CodeMeter Core API are responsible for protecting and licensing digital documents. SmartShelter is available in two flavors: - SmartShelter|PDF, a certified plugin for Adobe Acrobat and Adobe Acrobat Reader that provides additional security functions on top of Adobe’s native protection mechanisms; these include the creation of stronger passwords unknown even to the file author, the storage of passwords on a computer-bound license file or a hardware secure element, and monitoring for disallowed applications. Additionally, the integration of CodeMeter License Central enables the generation of all CodeMeter licensing options and offers full control over the entitlement process. - SmartShelter|SDL, a secure data layer for any type of document that slips in between the operating system and the document reader. It configures which operations are allowed and which are prohibited based on the license rights: the ability to open, read only, or save documents is totally regulated with a fine-grained management console. In this new presentation, we see: - How document protection differs from software protection - Four basic scenarios for protecting documents * The documents take the form of PDF files that are displayed with a PDF viewer * The documents are opened and saved with one of your own applications * The documents come in a standard format and are opened and saved with a standard application * The documents come in a different standard format and can only be viewed with a standard document viewer application - DEMO: SmartShelter|PDF for protecting PDF files - DEMO: SmartShelter|SDL for protecting and licensing standard documents - DEMO: CodeMeter Core API for protecting and licensing files with a proprietary format Whether the prosperity of your business depends on protecting the IP of the documents you sell, the data your software produces, or the data from third parties you process, your top priority is defending your finances and reducing your liability risks. Watch the webinar: https://youtu.be/ImnFHW9yuA8

1. A Shelter to Protect your Documents Ruediger Kuegler | VP Sales
ruediger.kuegler@wibu.com
Stefan Bamberg | Senior Key Account Manager
stefan.bamberg@wibu.com
Document Protection
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 1

2. Applications vs
Documents
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 2

3. Protected Application
PE Header
Software Encryption with AxProtector
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 3
Application
Data Section
Resource Section
Code Section
AxEngine
(Security Engine)
AxProtector
PE Header
Data Section
Resource Section
Code Section Encrypted
Code Section
Encrypted
Data Section
Encrypted
Resource Section

4. Protected Document
Document Header
Document Encryption with AxProtector
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 4
Document
WIBU Header
AxProtector
Document Header
Data
Data
Encrypted Document Header
Encrypted
Data

5. Protected Document
Protected Application vs Protected Document
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 5
WIBU Header
Encrypted Document Header
Encrypted
Data
Protected Application
PE Header
AxEngine
(Security Engine)
Encrypted
Code Section
Encrypted
Data Section
Encrypted
Resource Section
An application
self-decrypts
A document needs
to be decrypted

6. DocumentApplication
Summary: Applications vs Documents
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 6
 AxProtector encrypts all sections
 AxProtector inserts decrypting code
(AxEngine)
 AxProtector modifies the OEP in the
PE Header
 The application is still executable and
decrypts itself at start
 AxProtector encrypts the complete
document, incl. possibly existing
Headers
 AxProtector sets its own Header
(WIBU Header) at the beginning of
the document
 An application is required to
recognize this document and decrypt
it when loaded

7. PDF Files
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 7

8. Protected PDF FilePDF File
Encrypting a PDF File
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 8
Adobe Acrobat
+
SmartShelter|PDF Author
+
Firm Security Box
Firm Code = 10
Product Code = 1000
SmartShelter|PDF

9. Encrypting a PDF File
 SmartShelter|PDF relies on the native encryption mechanism from Adobe
Acrobat (AES, 256 bit)
 SmartShelter|PDF creates a password for this encryption mechanism
 Invisible to the user and thus impossible to copy
 Derived from Firm Code and Product Code
 With high entropy and therefore secure against brute force attacks
 SmartShelter|PDF detects unwanted programs
 SmartShelter|PDF supports all CodeMeter Product Item Options
 SmartShelter|PDF supports all the security features of Adobe Acrobat
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 9

10. PDF File in MemoryProtected PDF File
Decrypting a PDF File
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 10
Adobe Acrobat Reader
+
SmartShelter|PDF Reader
+
License (CmDongle /
CmActLicense)
Firm Code = 10
Product Code = 1000
SmartShelter|PDF

11. Decrypting a PDF File
 SmartShelter|PDF verifies if a valid license (Firm Code / Product Code) is
available
 SmartShelter|PDF generates the decryption password
 The user is not aware of the used password
 The document is decrypted in the memory
 SmartShelter|PDF is on the alert for unwanted programs and ready to
close the PDF file immediately if any unwanted program is detected
 SmartShelter|PDF provides an interface for customized error dialogs
 SmartShelter|PDF supports all CodeMeter Product Item Options
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 11

12. Protecting PDF Documents (1)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 12

13. Protecting PDF Documents (2)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 13

14. Protecting PDF Documents (3)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 14

15. Protecting PDF Documents (4)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 15

16. Open a Protected PDF-Document (No License Available)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 16

17. Open a Protected PDF-Document (License Available)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 17

18. Standard Documents
in a Viewer
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 18

19. Protected DocumentDocument
Encrypting a Standard Document
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 19
AxProtector
+
Firm Security Box
Firm Code = 10
Product Code = 1000
AxProtector

20. Protected Document
Document Header
Encrypting a Standard Document with AxProtector
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 20
Document
WIBU HeaderDocument Header
Data
Data
Encrypted Document Header
Encrypted
Data
AxProtector
+
Firm Security Box
Firm Code = 10
Product Code = 1000
AxProtector

21. Encrypting a Standard Document with AxProtector
 AxProtector fully encrypts the file
 Including a possibly existing Document Header
 Algorithm: AES, 128 bit
 The key is derived from Firm Code and Product Code
 AxProtector inserts a specific WIBU Header at the beginning of the
protected document
 The decryption can be restricted to specific viewers
 Professional Services can help with customizations
 AxProtector supports all CodeMeter Product Item Options
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 21

22. Document in MemoryProtected Document
Decrypting a Standard Document
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 22
Document Viewer
+
SmartShelter|SDL
+
License (CmDongle /
CmActLicense)
Firm Code = 10
Product Code = 1000
Viewer

23. Decrypting a Standard Document
 SmartShelter|SDL is located between the viewer and the operating system
 Viewer is encrypted with AxProtector
 An encrypted .dll gets injected into the process of the viewer (by an SDL-start
application)
 SmartShelter|SDL verifies if a valid license (Firm Code / Product Code) is
available
 SmartShelter|SDL decrypts the document
 The user is not aware of the used password
 The document is decrypted in the memory
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 23

24. Decrypting a Standard Document
 SmartShelter|SDL is on the alert for unwanted programs closes the
application immediately if any unwanted program is detected
 SmartShelter|SDL controls all writing operation of the viewer
 Unencrypted
 Always encrypted
 Writing forbidden
 SmartShelter|SDL provides an interface for customized error dialogs
 SmartShelter|SDL supports all CodeMeter Product Item Options
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 24

25. Standard Documents
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 25

26. Writing Standard Documents?
 SmartShelter|SDL can verify if the application is writing files
 New file: Unencrypted | Writing forbidden | Encrypted
 Existing file: Condition maintained | Writing forbidden | Encrypted
 SmartShelter|SDL can monitor “Copy & Paste”
 Mode: Always allowed | Always forbidden
 SmartShelter|SDL does not know the context of the application
 “Copy & Paste” and “Save As” can only be monitored for all documents
unconditionally
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 26

27. Writing Standard Documents?
 Protecting standard documents is also technically possible, if the
application can write these documents
 A strong protection is only possible if the options “Copy & Paste” and
“Save As” are completely disabled
 Usually not compatible with the requirements in use
 Knowledge of the internal processes of the application is required (for example,
generation of temporary files)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 27

28. Proprietary Documents
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 28

29. Use Cases
 Music recording software
 My software should always run and record music
 Recorded music should only be accessible with a valid license
 Demo version
 My demo version can do anything but:
a) Saved files cannot be opened
b) No files may be saved
 Individual configuration files
 My customers are not allowed to exchange configuration files
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 29

30. Use Cases
 Protection of user’s data
 My users should be able to protect files themselves because these files contain
sensitive and trustworthy data
 Data from an authorized partner
 My software should only be able to process data that was created with my software
or the software of an authorized partner
 Data for authorized partners
 The data created with my software may only be processed with my software or that
of an authorized partner
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 30

31. The Solution
 CodeMeter provides top-of-the-breed cryptography
 CodeMeter provides secure key storage
 Solution approaches:
 A common symmetric key for all
 An individual symmetric key for everyone
 Encryption with an asymmetric keypair
 Signature with an asymmetric keypair
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 31

32. Sender
Symmetric Encryption
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 32
Data
Encrypted Data
Encrypted Data
Recipient
Data
Decrypt Shared KeyEncrypt Shared Key

33. A Common Symmetric Key for All
 The key is generated automatically via a license entry (Firm Code and
Product Code)
 All users who are allowed to decrypt the protected data will receive the
same license entry
 Groups of users and even individual users can be assigned different
licenses
 Use cases
 Sales of protected content, and not just software
 Protection of configuration files
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 33

34. An Individual Symmetric Key for Everyone
 Individual key for every user
 A separate license entry for every user
 A common license entry with randomly selected Secret Data or Hidden Data entries
 User-specific key, alternatively in separate Firm Code or the Firm Code of the
vendor
 Use cases
 Individually protected configuration files
 Protection of user’s data
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 34

35. Sender
Asymmetric Encryption
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 35
Data
Encrypted Data
Encrypted Data
Recipient
Data
Decrypt Private KeyEncrypt Public Key

36. Generation of an Asymmetric Keypair
 A keypair is generated and the private key is stored securely in the
CmContainer
 The manufacturer generates the keypair
 The user generates the keypair
 The public key is known to the system
 As a mini-certificate with root key (public key) in the application
 Hard-coded in the application
 The mini-certificate is signed with an individual root key (private key)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 36

37. Encryption with an Asymmetric Keypair
 Encryption with the public key is always possible
 Decryption is possible only if a valid license with the matching private key
is available
 Use cases
 Data encryption with a demo version
 Music recording software
 Data may only be processed by the software of an authorized partner who holds the
correct license
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 37

38. Sender
Signature
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 38
Data
Recipient
Validate Public Key
Sign Private Key
Data
Signature
Data
Signature
Hash
Hash
NoYes

39. Generation of an Asymmetric Keypair
 A keypair is generated and the private key is stored securely in the
CmContainer
 The manufacturer generates the keypair
 The user generates the keypair
 The public key is known to the system
 As a mini-certificate with root key (public key) in the application
 Hard-coded in the application
 The mini-certificate is signed with an individual root key (private key)
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 39

40. Signature with an Asymmetric Keypair
 The signature can only be created if a valid license with the matching
private key is available
 The verification of the signature with the public key is always possible
 The authentication of the public key can be ensured with a mini-certificate
 Use cases
 Protection of application data against tampering
 Secure (engine) journal
 Only data from an authorized partner is processed
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 40

41. Summary
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 43

42. Summary
 PDF Files
 Higher protection standards with SmartShelter|PDF
 Standard Documents
 Easy integration into a viewer and high protection with SmartShelter|SDL
 Integration into an Office application only under certain conditions
 Proprietary Documents
 Use of CodeMeter Core API
 Versatile applications
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 44

43. Deutschland: +49-721-931720
USA: +1-425-7756900
China: +86-21-55661790
http://www.wibu.com
info@wibu.com
Germany: +49-721-931720
USA: +1-425-7756900
China: +86-21-55661790
http://www.wibu.com
info@wibu.com
Thank you very much for your attention!
5 April 2017 © WIBU-SYSTEMS AG 2017 - A Shelter to Protect your Documents 45