Attribute-based encryption for selective document content protection

Abstract

To provide an attribute-based encryption system and method for selectively encrypting and decrypting portions of documents based on user attributes in order to protect document content.SOLUTION: A document encryption method comprises: receiving, by a document security manager, a digital document containing original text and image content; processing the original text content to identify each of text portions and image portions; generating encrypt content requests including the identified text and image portions with associated attributes and metadata; transmitting the requests to a cryptographic engine, which returns encrypted content; receiving the encrypted content from the cryptographic engine; and replacing original content with masking symbols, applying visual obfuscation, embedding the encrypted content as metadata, and updating document properties to indicate the encrypted content.SELECTED DRAWING: Figure 12

Description

Technical Field

[0001] [Cross - Reference to Related Applications] This application claims the benefit of U.S. Provisional Application No. 63 / 600,025, filed on November 16, 2023, and U.S. Provisional Application No. 63 / 670,692, filed on July 12, 2024, and incorporates by reference the entire contents of both of them.

[0002] [Technical Field] The present disclosure relates to document security systems, and more particularly, to attribute - based encryption systems for selectively encrypting and decrypting portions of a document based on user attributes.

Background Art

[0003] Document and image security has been an important concern for organizations and individuals since the advent of digital information systems. As the quantity and sensitivity (confidentiality) of digital documents and images increase year by year, sophisticated security measures are also required to protect this valuable information from unauthorized access, alteration, or distribution.

[0004] Conventional document and image security methods mainly rely on access control lists (ACLs) and role - based access control (RBAC) systems to manage user permissions. These methods were effective in controlling access at the file or folder level, but they may lack the granularity required to protect specific portions of a document or regions of an image that can contain various levels of sensitive information.

[0005] The concept of data classification has emerged as an important component in modern information security frameworks. Typically, organizations classify their data into different levels of sensitivity such as public, internal, confidential, and highly confidential. However, implementing these classifications within individual documents and images has been found to be a significant challenge, especially when dealing with complex multi-section documents or images that may contain information with varying sensitivity levels.

[0006] Encryption has long been recognized as a powerful tool for protecting sensitive information. Symmetric key encryption algorithms such as the Advanced Encryption Standard (AES) provide robust protection for data at rest and in transit. However, traditional encryption methods typically encrypt entire files, documents, or images, which can be problematic when different users need access to different parts of the same document or regions of an image based on their security clearances or roles within an organization.

[0007] Attribute-Based Encryption (ABE) has emerged as a promising solution to address the limitations of traditional encryption methods. ABE enables fine-grained access control by encrypting data based on a set of attributes or policies. This approach allows for more flexible and expressive access control policies compared to traditional methods. However, the implementation of ABE in real-world document and image security systems is hampered by several factors, including key management complexity, performance overhead, and the lack of a user-friendly interface for specifying encryption policies.

[0008] The integration of widely used document and image formats with encryption technologies, such as those used in Microsoft Office applications or common image file types, remains an ongoing challenge. These applications often provide basic password protection features but may lack the sophistication necessary to enforce fine-grained attribute-based access control within documents and images. This limitation has forced organizations to rely on separate, often cumbersome document and image management systems to enforce security policies.

[0009] One important issue in implementing advanced document and image security measures is maintaining the usability and readability of the protected content. When parts of a document or regions of an image are encrypted or edited, the overall structure and format can be significantly altered, making it difficult for users to effectively handle the content. This is particularly problematic in collaborative work environments where multiple users with different access levels need to work on the same document or image simultaneously.

[0010] The visual representation of encrypted or edited content within documents and images is also a persistent problem. Traditional methods often replace sensitive content with obvious placeholders or blank spaces, which can disrupt the flow of the document or the integrity of the image and potentially reveal the existence and extent of hidden information. This can be particularly problematic in situations where the mere recognition of the existence of sensitive information can be valuable to unauthorized parties.

[0011] Furthermore, the process of specifying which parts of a document or which regions of an image should be encrypted at which security level has traditionally been a time-consuming manual task. The document author or security administrator often has to manually mark or tag sensitive sections, which is prone to human error and may not be practical for large volumes of documents and images. This process becomes even more complex when dealing with dynamically updated documents or when security classifications need to be changed over time.

[0012] Existing solutions have attempted to address these issues through various means such as special document and image viewers, custom file formats, or complex document management systems. However, these approaches often require significant changes to existing workflows, extensive user training, and may not integrate well with standard office productivity tools. This has, in practice, led to resistance to the adoption of security measures and a decrease in effectiveness.

[0013] The lack of an intuitive user interface for managing the security of documents and images is a major barrier to the widespread adoption of advanced security measures. Many existing systems require users to have a deep understanding of encryption concepts or to navigate complex policy definition interfaces. This complexity not only increases the likelihood of configuration errors but also discourages users from fully utilizing the available security features.

[0014] Furthermore, the management of encryption keys and access policies across large organizations with dynamic user roles and responsibilities has been found to be a significant challenge. The need for frequent updates to access rights, user onboarding and offboarding, and the management of temporary access permissions all contribute to the complexity of maintaining an effective document and image security system.

[0015] Another important issue is the impact on the performance of encryption and decryption operations, especially when dealing with large documents, high-resolution images, or a large number of access requests. The computational overhead of these operations can cause significant delays in accessing and editing documents and images, potentially affecting user productivity and satisfaction.

[0016] In view of these challenges, there is clearly a need for an innovative solution that can provide fine-grained attribute-based encryption for documents and images while maintaining usability, preserving the integrity of document structures and images, and integrating seamlessly with existing document and image workflows. Such a solution can strike a balance between robust security and user-friendly operation, enabling organizations to effectively protect their sensitive information without imposing an excessive burden on their users or IT infrastructure. SUMMARY OF THE INVENTION

[0017] This summary is provided to introduce, in a simplified form, a selection of concepts that are further described in the detailed description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0018] According to one aspect of the present disclosure, a method for protecting document content is provided. The method includes receiving, by a document security manager implemented on a computing device, a digital document including original text content and original image content. The method includes processing the original text content to identify text content portions by parsing the document to locate inline text annotations, analyzing neighboring text to determine the scope of each annotation, extracting the text content within the determined scope, and determining encryption attributes for an attribute-based encryption scheme based on the inline text annotations. The method includes processing the original image content to identify image portions by detecting a user-defined selection of an image region through a graphical interface or by automatically identifying and classifying sensitive objects within the image using a trained neural network. The method includes generating one or more encrypted content requests, the one or more requests including identified text portions with associated encryption attributes, identified image portions with corresponding bounding box coordinates, and metadata specifying the encryption scheme to be applied. The method includes transmitting the encrypted content requests to an encryption engine via a secure communication channel. The method includes receiving from the encryption engine encrypted text content of the text portions and encrypted image content of the image portions, the encryption engine applying an attribute-based encryption scheme to the text portions and the image portions. The method includes constructing a partially encrypted document by replacing the original text content with masking symbols, programmatically adjusting the masking symbol width to maintain the document layout and format, applying visual obfuscation techniques to the original image content based on a sensitivity level, embedding the encrypted text and image content into the document structure as metadata, and updating the document properties to indicate the presence of the encrypted content.

[0019] According to other aspects of the present disclosure, the method may include one or more of the following features. The attribute-based encryption method may utilize a ciphertext-policy attribute-based encryption (CP-ABE) algorithm, and the encrypted attributes of the text portion may include an access policy expression that defines a combination of user attributes required for decryption, a time-based constraint that specifies the expiration period of the decryption key, and a hierarchical attribute structure that represents the roles and clearance levels of the organization. Processing the original image content may further include segmenting the image into multiple regions using a convolutional neural network, extracting feature vectors of each segmented region using a pre-trained deep learning model, classifying the sensitivity level of each region based on the extracted features, and generating encrypted attributes for each region based on the classified sensitivity level and content type. The method further includes generating a decryption key request based on the authenticated user attributes, sending the decryption key request to a key management server, receiving a decryption key from the key management server, where the decryption key is derived from the user's set of attributes and the master secret key, selectively decrypting a portion of the document using the received decryption key, and rendering the partially decrypted version of the document to make the permitted content visible and keep the unpermitted content obfuscated. The encryption engine may implement a multi-authority attribute-based encryption method, and generating an encrypted content request may further include assigning each text and image portion to one or more attribute authorities based on the content type and sensitivity, generating separate encryption policies for each assigned authority, and including the authority identifier and the corresponding encryption policy in the encrypted content request.Constructing a partially encrypted document may further include generating a document-specific symmetric key, encrypting the symmetric key using an attribute-based encryption scheme with a master public key, encrypting text and image portions using the symmetric key, embedding the encrypted symmetric key and the encrypted content within the document structure, and including key recovery information that enables an authorized user to reconstruct the decryption key using a subset of its attribute certificate and master secret key shares. The digital document may include a video file, and processing the original image content may further include extracting individual frames from the video file, analyzing the extracted frames to identify sensitive objects or regions, generating temporal boundary boxes to track the sensitive objects or regions identified over multiple frames, applying visual obfuscation techniques to the sensitive objects or regions within each affected frame, and reconstructing the video file using the obfuscated frames while maintaining the original video format and playback characteristics. Processing the original text content may further include identifying text decorations within the document, including bold, italic, underline, strikethrough, or color formatting, associating the identified text decorations with corresponding sensitivity levels or encryption attributes, and adjusting the encryption attributes of the text portion based on the associated text decorations.

[0020] According to another aspect of the present disclosure, a system for protecting document content is provided. The system includes a document security manager implemented on a computing device, and the document security manager receives a digital document including original text content and original image content; analyzes the document to locate inline text annotations, analyzes the surrounding text to determine the scope of each annotation, extracts the text content within the determined scope, and determines encryption attributes for an attribute-based encryption scheme based on the inline text annotations to process the original text content to identify text content portions; processes the original image content to identify image portions by detecting user-defined selections of image regions through a graphical interface or by automatically identifying and classifying sensitive objects within the image using a trained neural network; generates one or more encrypted content requests, where the one or more requests include the identified text portions with associated encryption attributes, the identified image portions with corresponding bounding box coordinates, and metadata specifying the encryption scheme to be applied; transmits the encrypted content requests to an encryption engine via a secure communication channel; receives from the encryption engine the encrypted text content of the text portions and the encrypted image content of the image portions, where the encryption engine applies an attribute-based encryption scheme to the text portions and the image portions; replaces the original text content with masking symbols, programmatically adjusts the masking symbol width to maintain the document layout and format, applies visual obfuscation techniques to the original image content based on the sensitivity level, embeds the encrypted text and image content into the document structure as metadata, and updates the document properties to indicate the presence of the encrypted content, and is configured to construct a partially encrypted document.

[0021] According to other aspects of the present disclosure, the system may include one or more of the following features. The attribute-based encryption method may utilize a ciphertext-policy attribute-based encryption (CP-ABE) algorithm, and the encrypted attributes of the text part may include an access policy expression that defines a combination of user attributes required for decryption, a time-based constraint that specifies the expiration period of the decryption key, and a hierarchical attribute structure that represents the roles and clearance levels of the organization. Processing the original image content may further include segmenting the image into multiple regions using a convolutional neural network, extracting the feature vectors of each segmented region using a pre-trained deep learning model, classifying the sensitivity level of each region based on the extracted features, and generating the encrypted attributes of each region based on the classified sensitivity level and content type. The document security manager generates a decryption key request based on the authenticated user attributes, sends the decryption key request to the key management server, receives the decryption key from the key management server, where the decryption key is derived from the user's attribute set and the master secret key, selectively decrypts parts of the document using the received decryption key, and may be further configured to render the partially decrypted version of the document such that the permitted content is made visible and the unpermitted content remains illegible. The encryption engine may implement a multi-authority attribute-based encryption method, and generating the encrypted content request may further include assigning each text and image part to one or more attribute authorities based on the content type and sensitivity, generating separate encryption policies for each assigned authority, and including the authority identifier and the corresponding encryption policy in the encrypted content request.Constructing a partially encrypted document may further include generating a document-specific symmetric key, encrypting the symmetric key using an attribute-based encryption scheme with a master public key, encrypting text and image portions using the symmetric key, embedding the encrypted symmetric key and the encrypted content within the document structure, and including key recovery information that enables an authorized user to reconstruct the decryption key using a subset of its attribute certificate and master secret key shares. The digital document may include a video file, and processing the original image content may further include extracting individual frames from the video file, analyzing the extracted frames to identify sensitive objects or regions, generating temporal boundary boxes to track the sensitive objects or regions identified over multiple frames, applying visual obfuscation techniques to the sensitive objects or regions within each affected frame, and reconstructing the video file using the obfuscated frames while maintaining the original video format and playback characteristics.

[0022] According to another aspect of the present disclosure, there is provided a non - transitory computer - readable medium that stores instructions which, when executed by a processor, cause the processor to execute a method for protecting document content. The method includes receiving a digital document including original text content and original image content. The method includes processing the original text content to identify text content portions by parsing the document to locate in - line text annotations, analyzing neighboring text to determine the scope of each annotation, extracting the text content within the determined scope, and determining encryption attributes for an attribute - based encryption scheme based on the in - line text annotations. The method includes processing the original image content to identify image portions by detecting user - defined selections of image regions through a graphical interface or by automatically identifying and classifying sensitive objects within the image using a trained neural network. The method includes generating one or more encrypted content requests, where the one or more requests include identified text portions with associated encryption attributes, identified image portions with corresponding bounding box coordinates, and metadata specifying the encryption scheme to be applied. The method includes sending the encrypted content requests to an encryption engine via a secure communication channel. The method includes receiving from the encryption engine the encrypted text content of the text portions and the encrypted image content of the image portions, where the encryption engine applies an attribute - based encryption scheme to the text portions and the image portions. The method includes constructing a partially encrypted document by replacing the original text content with masking symbols, programmatically adjusting the masking symbol width to maintain the document layout and format, applying visual obfuscation techniques to the original image content based on the sensitivity level, embedding the encrypted text and image content as metadata within the document structure, and updating the document properties to indicate the presence of the encrypted content.

[0023] According to other aspects of the present disclosure, the non-transitory computer-readable medium may include one or more of the following features. The attribute-based encryption method may utilize a ciphertext-policy attribute-based encryption (CP-ABE) algorithm, and the encrypted attributes of the text portion may include an access policy expression that defines a combination of user attributes required for decryption, a time-based constraint that specifies the expiration period of the decryption key, and a hierarchical attribute structure that represents the roles and clearance levels of the organization. Processing the original image content may further include segmenting the image into a plurality of regions using a convolutional neural network, extracting feature vectors of each segmented region using a pre-trained deep learning model, classifying the sensitivity level of each region based on the extracted features, and generating encrypted attributes for each region based on the classified sensitivity level and content type. The method includes generating a decryption key request based on the authenticated user attributes, sending the decryption key request to a key management server, receiving a decryption key from the key management server, where the decryption key is derived from the user's set of attributes and a master secret key, and selectively decrypting a portion of the document using the received decryption key, and rendering the partially decrypted version of the document to make the permitted content visible and keep the unpermitted content obfuscated. The encryption engine may implement a multi-authority attribute-based encryption method, and generating an encrypted content request may further include assigning each text and image portion to one or more attribute authorities based on the content type and sensitivity, generating a separate encryption policy for each assigned authority, and including the authority identifier and the corresponding encryption policy in the encrypted content request.

[0024] The above general description of the exemplary embodiments and the following detailed description are merely exemplary aspects of the teachings of the present disclosure and are not limiting.

Brief Description of the Drawings

[0025] Non - limiting and non - exhaustive examples are described with reference to the following figures.

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Figure 17

Figure 18

Figure 19

Figure 20

Figure 21

Figure 22

DETAILED DESCRIPTION OF THE INVENTION

[0026] The following description shows exemplary aspects of the present disclosure. However, it should be recognized that such description is not intended to limit the scope of the present disclosure. Rather, this description also includes combinations and modifications to the exemplary aspects described herein.

[0027] The present disclosure relates to systems and methods for protecting document content using attribute-based encryption. In some aspects, a document security manager may receive a digital document that includes original text content and original image content. The document security manager may process the original text content to identify text content portions. This processing may include parsing the document to locate in-line text annotations, analyzing neighboring text to determine the extent of each annotation, extracting the text content within the determined extent, and determining encryption attributes for an attribute-based encryption scheme based on the in-line text annotations.

[0028] In some cases, the document security manager may process the original image content to identify image portions. This processing may include detecting user-defined selections of image regions through a graphical interface. Alternatively or additionally, the processing may include automatically identifying and classifying sensitive objects within the image using a trained neural network.

[0029] The document security manager may generate one or more encrypted content requests. These requests may include the identified text portions with associated encryption attributes, the identified image portions with corresponding bounding box coordinates, and metadata specifying the encryption scheme to be applied. The encrypted content requests may be sent to an encryption engine via a secure communication channel.

[0030] In some aspects, the document security manager may receive from the encryption engine the encrypted text content of the text portions and the encrypted image content of the image portions. The encryption engine may apply an attribute-based encryption scheme to the text portions and the image portions.

[0031] The document security manager may construct a partially encrypted document. This construction process may include replacing the original text content with masking symbols, programmatically adjusting the masking symbol width to maintain the document layout and format, applying visual obfuscation techniques to the original image content based on the sensitivity level, embedding the encrypted text and image content as metadata within the document structure, and updating the document properties to indicate the presence of the encrypted content.

[0032] In some cases, the attribute-based encryption method may utilize the ciphertext-policy attribute-based encryption (CP-ABE) algorithm. The encryption attributes of the text part may include an access policy expression that defines the combination of user attributes required for decryption, a time-based constraint that specifies the expiration period of the decryption key, and a hierarchical attribute structure that represents the organization's roles and clearance levels.

[0033] The processing of the original image content may include segmenting the image into multiple regions using a convolutional neural network, extracting the feature vectors of each segmented region using a pre-trained deep learning model, classifying the sensitivity level of each region based on the extracted features, and generating the encryption attributes of each region based on the classified sensitivity level and content type.

[0034] In some aspects, the system may generate a decryption key request based on the authenticated user attributes, send the decryption key request to the key management server, receive the decryption key from the key management server, selectively decrypt parts of the document using the received decryption key, and render a partially decrypted version of the document that makes the permitted content visible and keeps the unpermitted content obfuscated.

[0035] The encryption engine may implement a multi-authority attribute-based encryption scheme. In such cases, generating an encrypted content request may include assigning each text and image portion to one or more attribute authorities based on the content type and sensitivity, generating separate encryption policies for each assigned authority, and including the authority identifier and the corresponding encryption policy in the encrypted content request.

[0036] In some cases, constructing a partially encrypted document may include generating a document-specific symmetric key, encrypting the symmetric key using an attribute-based encryption scheme with the master public key, encrypting the text and image portions using the symmetric key, embedding the encrypted symmetric key and the encrypted content within the document structure, and including key recovery information that enables an authorized user to reconstruct the decryption key using a subset of its attribute certificate and master secret key shares.

[0037] When the digital document includes a video file, processing the original image content may include extracting individual frames from the video file, analyzing the extracted frames to identify sensitive objects or regions, generating time boundary boxes to track the sensitive objects or regions identified over multiple frames, applying visual obfuscation techniques to the sensitive objects or regions within each affected frame, and reconstructing the video file using the obfuscated frames while maintaining the original video format and playback characteristics.

[0038] In some aspects, processing the original text content may include identifying text decorations within the document, such as bold, italic, underline, strikethrough, or color formatting, associating the identified text decorations with the corresponding sensitivity level or encryption attribute, and adjusting the encryption attribute of the text portion based on the associated text decorations.

[0039] Referring to FIG. 1, an image confidentiality management system (ICMS) 100 is shown. The ICMS 100 may include several interconnected components designed to manage and process images while maintaining confidentiality. In some embodiments, the ICMS 100 may include an image repository 105 configured to store digital images and associated metadata that defines confidential regions within the images. The image repository 105 may be represented as a cylindrical shape indicating the storage component for the images. In some cases, the image repository 105 may be bi-directionally connected to an image processing engine 115 to enable storage and retrieval of images.

[0040] The image processing engine 115 may be shown as a rectangular block and may be connected to multiple components of the system. In some embodiments, the image processing engine 115 may interface with the image repository 105 for image data exchange and processing. The image processing engine 115 may be configured to process the digital images, and the processing may include identifying confidential regions within the images based on the associated metadata and applying obfuscation to the confidential regions based on user attributes.

[0041] A user management module 110 may be included in the ICMS 100. The user management module 110 may be configured to store user profiles, with each profile associated with a set of user attributes. In some cases, the user management module 110 may be bi-directionally connected to a user interface 130 to enable user interaction and management within the system.

[0042] The user interface 130 may be represented as a separate rectangular block that provides a means for users to interact with the system 100. In some embodiments, the user interface 130 may be configured to display processed images to authenticated users and enable administrators to define and modify confidential regions within the images.

[0043] The access control layer 120 may be as shown at the lower part of the figure. The access control layer 120 may be connected to the image repository 105, the image processing engine 115, and the user management module 110. In some cases, the access control layer 120 may be configured to authenticate users and determine user access rights based on the above user attributes.

[0044] The layout of the components and their connections may imply the flow of information and control within the system. The image processing engine 115 may appear to be a central component that interacts with the image repository 105 for data and with the access control layer 120 for permission. The user management module 110 may interface with both the user interface 130 and the access control layer 120, indicating its role in managing user interactions and permissions.

[0045] In some aspects, the ICMS 100 may be designed to process and manage images while maintaining confidentiality through user management and access control mechanisms. The system may support various types of digital images and may be able to process a wide range of confidential information such as personal identifiers, financial data, proprietary content, and other types of sensitive information.

[0046] Referring to FIG. 2, the flowchart shows a method 200 for processing and protecting image data using attribute-based encryption (ABE). In some aspects, the method 200 may start at step 205, where the original image is input into the system. At the same time, step 210 may provide the encryption keys and policies for the ABE process. These encryption keys and policies may define the attributes and access control rules applied to the encrypted content.

[0047] Next, method 200 may proceed to step 215, where automatic detection of sub-images within the original image is performed. This step may identify specific regions or elements within the image that require encryption. In some cases, the detection may be performed using a machine learning algorithm such as a convolutional neural network trained to recognize sensitive objects or regions within the image. The detected sub-images are then passed to step 220, where ABE encryption may be applied to these sub-images using the encryption key and policy from step 210.

[0048] Following encryption, method 200 may proceed to step 225, where obfuscation of the sub-images is performed. This step may include making the sensitive portions of the image visually unclear. In some embodiments, the obfuscation technique may include blurring, pixelation, or replacement with a solid color or pattern. The degree of obfuscation may be determined based on the sensitivity level of the content and the specific requirements of the encryption policy.

[0049] Simultaneously with step 225, step 230 may generate metadata associated with the encrypted sub-images. This metadata may include information about the encryption method used, the attributes required for decryption, and other relevant details that may be necessary for later decryption and access control.

[0050] The outputs from steps 225 and 230 may be combined at step 235, which may generate an obfuscated version of the original image along with the associated metadata. This step may create a visually modified image with the sensitive regions obscured while maintaining the encrypted data regarding these regions. In some cases, the obfuscated image may retain the overall structure and non-sensitive portions of the original image, allowing for limited viewing without compromising the sensitive information.

[0051] Next, method 200 proceeds to step 240, where metadata extraction and partial image detection are performed. This step may prepare the obfuscated image and its associated data for the decoding process. The extracted information is passed to step 245, where ABE decoding of the partial image is performed. In some embodiments, the decoding process may include verifying the attributes of the user attempting to access the image against the encryption policy defined at step 210. Only users with appropriate attributes may be able to decrypt and view sensitive partial images.

[0052] Finally, method 200 may end at step 250, which may include reconstructing the original image from the decoded partial images. This step may reconstruct the fully unobfuscated image using the decoded data. In some cases, the reconstruction process may include replacing the obfuscated regions within the image with their corresponding decoded partial images to restore the original visual content for authorized users.

[0053] Method 200 provides a flexible approach to image security and may enable selective encryption and decryption of image components based on user attributes and defined policies. This approach may maintain the overall structure and usefulness of the image for the user with various levels of permission while allowing fine-grained access control to sensitive image elements.

[0054] Referring to FIG. 3, an encryption process 300 for protecting image data is shown. Encryption process 300 may include several interconnected components that operate together to process and encrypt the image content.

[0055] In some embodiments, the encryption process 300 may begin with an image input 305 that may be provided to two parallel paths. One path may lead to a sub-image detection module, and the other path may lead to a metadata extraction module 315. At the same time, a class-based mapping 310 may be provided to the system. The class-based mapping 310 may define the relationship between image classes and encryption formulas and may enable fine-grained access control based on image content.

[0056] The sub-image detection module may generate a mask, class pair 320 that can identify specific regions or objects within the image. In some cases, sub-image detection may be performed using a machine learning algorithm such as a convolutional neural network trained to recognize sensitive objects or regions within the image. The metadata extraction module 315 may generate metadata 325 from the input image. This metadata may include information such as the image creation date, camera settings, or location data that may be relevant to access control decisions.

[0057] Next, the mask, class pair 320, and original image input 305 may be sent to an obfuscation and extraction module 330. This module may perform two main functions, namely, create an image with an obfuscated sub-image 335 in which sensitive regions are visually obscured, and extract unobfuscated sub-image, class, mask information 340. The obfuscation technique applied may vary based on the sensitivity level of the detected sub-image and may include methods such as blurring, pixelation, or replacement with a solid color or pattern.

[0058] In some embodiments, the unobfuscated partial image, class, and mask 340 may be passed to the ABE encryption of the partial image module 345. This module may apply attribute-based encryption to the partial image. The ABE encryption may utilize the class formula mapping 310 to determine an appropriate encryption policy for each partial image based on its detected class. Similarly, the metadata 325 may be processed by the ABE encryption of the metadata module 350. This separate encryption of the metadata may allow for fine-grained access control across different aspects of the image information.

[0059] The outputs of these encryption modules may be, respectively, the encrypted partial image 355 and the encrypted metadata 360. In some cases, the encryption may be performed using the multi-authority ABE scheme, where different attributes or policies are managed by separate authorities, allowing for a more complex and flexible access control structure.

[0060] These encrypted components may then be stored in the database 370 along with the image 335 having the obfuscated partial image. The database 370 may be a secure storage system capable of processing encrypted data and associated access policies. In some implementations, the database 370 may be a distributed system that ensures redundancy and high availability of the encrypted image data.

[0061] The encryption process 300 may maintain a balance between protecting sensitive information and preserving the overall structure and utility of the image. The image having the obfuscated partial image 335 may be used for general viewing, while the encrypted partial image 355 and the encrypted metadata 360 may ensure that sensitive details are accessible only to authorized users having appropriate attributes or permissions.

[0062] In some embodiments, the encryption process 300 may include additional steps for key management and policy updates. For example, the system may periodically update the class-based mapping 310 to reflect changes in the security policy or to address newly identified sensitive image classes. The system may also implement a key rotation mechanism to enhance the long-term security of the encrypted data.

[0063] The encryption process 300 may be designed to process various types of images including photographs, medical images, satellite images, or scanned documents. The specific implementation of each module within the process may be adjusted according to the specific requirements of the image type and the security needs of the organization using the system.

[0064] Referring to FIG. 4, an encryption process 400 for protecting image data is shown. The encryption process 400 may begin with an image input 405, and the image input 310 may be processed through a detection module 415. In some embodiments, the detection module 415 may use advanced image processing techniques to identify and classify sensitive content within the image.

[0065] The detection module 415 may utilize a convolutional neural network to segment the image input 405 into multiple regions. This segmentation process may enable a detailed analysis of different parts of the image. In some cases, the convolutional neural network may be trained on a diverse dataset of images containing various types of sensitive information to enable the recognition of complex patterns and objects.

[0066] Following segmentation, the detection module 415 may extract feature vectors for each segmented region using a pre-trained deep learning model. These feature vectors may capture a high-level representation of the visual content within each region. The pre-trained model may be based on an architecture such as ResNet, Inception, or EfficientNet, which has shown strong performance in image recognition tasks.

[0067] The detection module 415 may then classify the sensitivity level of each region based on the extracted features. This classification process may include comparing the extracted features to a database of known sensitive content types or applying a machine learning algorithm to determine the likelihood of the presence of sensitive information. In some aspects, the classification may assign multiple sensitivity levels to a single region, allowing for a nuanced handling of complex visual information.

[0068] Based on the classified sensitivity levels and content types, the detection module 415 may generate encryption attributes for each region. These attributes may be used to determine the appropriate encryption policies and obfuscation techniques to be applied. The output of the detection module 415 may be a mask class pair 420 that represents the detected sensitive regions along with their associated classifications and encryption attributes.

[0069] In some cases, the image input 405 may be a video file. When processing video content, the encryption process 400 may include additional steps to handle the temporal nature of the data. The detection module 415 may extract individual frames from the video file at regular intervals or at key points determined by a scene change detection algorithm.

[0070] The extracted frames may be analyzed using the same convolutional neural networks and feature extraction techniques applied to still images. However, the detection module 415 may also incorporate temporal information to improve the accuracy of identifying sensitive objects or regions. This may include using recurrent neural networks or 3D convolutional networks that can capture motion and temporal dependencies across multiple frames.

[0071] Once sensitive objects or regions are identified within a video frame, the detection module 415 may generate temporal bounding boxes to track these elements across multiple frames. These temporal bounding boxes may be represented as a series of spatial coordinates coupled with frame numbers or timestamps, enabling consistent tracking of sensitive content throughout the video.

[0072] The obfuscation extraction module 425 may apply visual obfuscation techniques to sensitive objects or regions within each affected frame. These techniques may include blurring, pixelation, or replacement with solid colors or patterns. The level and type of obfuscation applied may vary based on the sensitivity classification of each region.

[0073] When reconstructing a video file with obfuscated frames, the encryption process 400 may maintain the original video format and playback characteristics. This may include careful handling of video codec parameters, frame rate, and metadata to ensure that the obfuscated video remains compatible with standard video players and streaming protocols.

[0074] The encryption process 400 may also include steps to process audio content associated with the video. In some embodiments, techniques such as audio editing or replacement with neutral tones may be used to detect and obfuscate sensitive audio information.

[0075] The class mapping 410 provided to the system includes specific policies for processing video content and may potentially define different encryption and obfuscation rules for various types of motion or temporal patterns in addition to static visual elements.

[0076] The ABE encryption module 430 may apply attribute-based encryption to the processed image or video data using the encrypted attributes generated during the detection and classification stages. This encryption may be applied to individual regions of a still image or to temporal segments of video content, enabling fine-grained access control based on user attributes and the sensitivity of different portions of the visual data.

[0077] The encryption process 400 may output the encrypted data 435 and the obfuscated image or video 440 to provide a balance between protecting sensitive content and maintaining the overall structure and usability of visual information for users with different levels of access rights.

[0078] Referring to FIG. 5, a decoding process 500 for an image security system is shown. The decoding process 500 may include several interconnected components that operate together to decrypt and reconstruct a partially encrypted image.

[0079] In some embodiments, the decoding process 500 may begin by retrieving encrypted data from a database 505. The database 505 may store three types of data, namely, encrypted partial images 510, encrypted metadata 520, and an image 525 having an obfuscated partial image. These components may represent the encrypted and obfuscated portions of the original image.

[0080] The user key 515 may be provided to the system and may be used in both the ABE decryption of the partial image 530 and the ABE decryption of the metadata 535. These decryption modules may selectively decrypt the encrypted components based on the user's attributes encoded in the user key 515 using Attribute-Based Encryption (ABE) technology.

[0081] In some cases, the decryption process 500 may include generating a decryption key request based on the authenticated user attributes. This request may be sent to a key management server, which may be a separate entity from the components shown in FIG. 5. The key management server may process the request and return a decryption key and a master secret key derived from the user's set of attributes.

[0082] The ABE decryption of the partial image 530 may process the encrypted partial image 510 to generate a deobfuscated partial image 540. At the same time, the ABE decryption of the metadata 535 may process the encrypted metadata 520 to yield decrypted metadata 545. The decryption process may use the received decryption key to selectively decrypt parts of the document, ensuring that only the permitted content is made visible and the unpermitted content remains obfuscated.

[0083] In some aspects, the system may use an image inpainting and metadata insertion module 550. This module may combine three inputs, namely, the deobfuscated partial image 540, the decrypted metadata 545, and the image 525 with the obfuscated partial image. The image inpainting process may include reconstructing the original image by replacing the obfuscated regions with the decrypted partial image and incorporating the decrypted metadata.

[0084] The final output of the decryption process 500 may be a partially decrypted image 555. This image may represent the result of the decryption process, and the portions of the original image are reconstructed based on the user's decryption privileges determined by the user key 515. The partially decrypted image 555 may be rendered to make the permitted content visible and leave the unpermitted content obfuscated.

[0085] In some cases, the decryption process 500 may incorporate additional security measures. For example, the system may implement a secure viewing environment that prevents unauthorized copying, printing, or screen capturing of the decrypted content. This environment may include features such as dynamically watermarking the content displayed using the user's identification and access timestamp, disabling the system clipboard function within the secure viewer, and implementing a secure printing protocol that requires additional authentication and logging.

[0086] The decryption process 500 may also maintain detailed logs of each decryption attempt and access to the encrypted portions of the document. These logs may include user identification, the timestamp of the decryption attempt, the specific portions of the document accessed, the user attributes used for decryption, and the success or failure of the decryption attempt. Such a logging mechanism can be important for auditing purposes, detecting potential security violations, and ensuring compliance with data protection regulations.

[0087] In some aspects, the decryption process 500 may support a hierarchical attribute structure representing organizational roles and clearance levels. This enables more complex access control policies and allows users with higher-level attributes to be permitted access to a wider range of encrypted content within the document.

[0088] The system may also enforce a time - based constraint on the decryption key that specifies a validity period for decryption. This feature may enable temporary access permissions or the automatic revocation of access rights after a specified period, strengthening the overall security of the encrypted content.

[0089] Referring to FIG. 6, a block diagram of a processing system is shown. The processing system may include several interconnected components organized in a hierarchical structure. In some embodiments, the processing system may be connected to three main components, namely, a control unit, a communication module, and a memory system.

[0090] The control unit may be linked to two sub - components, namely, access management and session management. These components may interact with each other and suggest the flow of information between access control and session processing. In some cases, the access management component may be responsible for implementing an attribute - based access control policy and determining user permissions based on the user's attributes and the sensitivity levels of different parts of the document.

[0091] The communication module may be connected to a program memory component. This connection may indicate that the communication module can utilize or manage program data stored in the memory. In some embodiments, the communication module may handle a secure communication channel for sending encrypted content requests and receiving encrypted data from an encryption engine.

[0092] The memory system may be connected to two sub - components, namely, program memory and configuration data. The program memory is shared between the communication module and the memory system, which may imply the possibility of data exchange or shared access to program information. In some cases, the program memory may store encryption and decryption algorithms, as well as machine - learning models used for sensitive object detection within an image.

[0093] The configuration data component may imply being exclusively connected to the memory system and being able to store system settings or parameters. This may include encryption policies, attribute mappings, and other configuration details necessary for the attribute-based encryption system.

[0094] The layout of the drawings may imply a modular design where different functions are separated into distinct units. This modular approach may allow for flexibility when updating or modifying specific components of the system without affecting others. For example, the encryption policy stored in the configuration data component may be updated independently of the encryption algorithm stored in the program memory.

[0095] The processing system may appear to supervise and regulate the activities of the control unit, communication module, and memory system. In some aspects, the processing system may manage the flow of data between these components and ensure that sensitive information is properly processed and protected throughout the document encryption and decryption processes.

[0096] The structure of the system may imply being designed to handle tasks related to data processing, access control, communication, and data storage. The presence of session management and access management components may indicate that the system can handle user interactions or networked operations and potentially manage multiple simultaneous user sessions with various levels of access rights.

[0097] In some cases, the processing system may implement a multi-authority attribute-based encryption scheme. This may involve coordination with multiple attribute authorities, each responsible for managing a subset of the attributes used in the encryption policy. The communication module may handle the interaction with these external attribute authorities, while the access management component may integrate the attribute information into the overall access control decision.

[0098] The system may also support dynamic policy updates. For example, the configuration data component may store time-based constraints for decryption keys. The access management component may periodically check these constraints, update user access rights accordingly, and potentially revoke access to specific document parts when the key expiration period has elapsed.

[0099] Referring to FIG. 7, the flowchart shows a decryption process using Attribute-Based Encryption (ABE). In some embodiments, the process may start with input parameters of blurredImage, encryptedData, and decryptionKey. These input parameters may represent the blurred image, the encrypted sensitive part of the image, and the user's decryption key, respectively.

[0100] The first step of the decryption process may include ABE decryption. In some cases, the DecryptionABE function may take encryptedData and decryptionKey as inputs and generate detections, stringSubimages, and status. Detections may represent the location and type of sensitive regions within the image. StringSubimages may be the decrypted version of the sensitive regions and may still be in string format. Status may indicate whether decryption was successful for each sub-image.

[0101] Following ABE decryption, the process may proceed to restore the image. In some embodiments, this restoration process may start by initializing an Image variable with blurredImage. This step may create a base image onto which the decrypted sub-images are overlaid.

[0102] Next, the decoding process may enter a loop that iterates through the range of the status length. This loop may allow the system to process each sub-image individually. For each iteration, the process may check whether the decoding of that particular sub-image was successful. This check can be important for maintaining the security of the system as it ensures that only successfully decoded sub-images are revealed.

[0103] If the decoding of the sub-image is successful, the process may convert the string sub-image back to the image format. In some cases, this conversion may be performed using the String2Image function. This function may take the decoded string representation of the sub-image and reconstruct it into a visual format that can be inserted into the main image.

[0104] After converting the sub-image, the process may use the ImageInpainting function to restore the sub-image within the main image. This function may take as input the current image, the converted sub-image, and the corresponding detection. The ImageInpainting function may carefully blend the decoded sub-image into the main image, ensuring a seamless integration that maintains the overall visual integrity of the image.

[0105] In some aspects, if the decoding of a particular sub-image fails, that region of the image may remain blurred or may remain obfuscated. This selective decoding based on the success status may allow for fine-grained access control, and the user may only be able to view the portions of the image that have the necessary decoding attributes.

[0106] The process may end by returning the restored image. This final image may be a combination of the original blurred image and the successfully decoded sub-images inserted in the appropriate positions. In some cases, the restored image may include a mixture of clear regions and obfuscated regions depending on the user's decoding privileges.

[0107] The decoding process shown in FIG. 7 may provide a structured approach for selectively decrypting and restoring portions of a previously encrypted image using ABE. This process may maintain the blurred state of areas that could not be decoded while maintaining the integrity of areas that were successfully decoded, thereby ensuring that sensitive information remains protected from unauthorized access.

[0108] Referring to FIG. 8, the flowchart shows an image encryption process using Attribute - Based Encryption (ABE). In some embodiments, the process may start from input parameters of image and classMappings. ClassMappings may define the relationship between image classes and encryption policies and may enable fine - grained access control based on image content.

[0109] The flowchart may then proceed through several steps to encrypt the sensitive portions of the image. In some cases, the first step may include detecting masks and object classes within the image. This detection may be performed by a Detector function that can take the input image and generate detections. The Detector function may use advanced image processing techniques such as convolutional neural networks or other machine learning algorithms to identify and classify sensitive content within the image.

[0110] Following the detection step, the process may proceed to the blurring and extraction step. In some embodiments, this step may use an ExtractAndBlur function that takes the original image and detections as inputs. This function may output subimages and a blurred image. The ExtractAndBlur function may apply various obfuscation techniques to the sensitive regions identified in the detection step. These techniques may include Gaussian blurring, pixelation, or more advanced methods such as inpainting or content-adaptive filling algorithms.

[0111] The third step of this process may include converting the subimages to an encryptable format. In some cases, this conversion may be performed using an Image2String function that can convert the subimages to stringSubimages. This conversion step may be necessary to prepare the image data for an attribute-based encryption process since many encryption algorithms operate on strings or binary data rather than raw image data.

[0112] The final processing step may be ABE encryption. This step may use an EncryptionABE function that takes detections, stringSubimages, and classMappings as inputs. The EncryptionABE function may use the classMappings to apply attribute-based encryption to the sensitive parts of the image and determine the appropriate encryption policy for each subimage based on the detected classes. In some embodiments, ABE encryption may include complex mathematical operations such as bilinear pairings and utilize advanced cryptographic primitives to ensure the security and fine-grained access control of the encrypted data.

[0113] The process may end by returning two outputs, namely, encryptedData and blurredImage. EncryptedData may represent the encrypted sensitive portion of the image, while blurredImage may be a visually obfuscated version of the original image where the sensitive regions are blurred or otherwise obfuscated.

[0114] In some cases, the encryption process may include additional steps for key management and policy updates. For example, the system may periodically update classMappings to reflect changes in security policies or to handle newly identified sensitive image classes. The system may also implement a key rotation mechanism to enhance the long-term security of the encrypted data.

[0115] The encryption process shown in FIG. 8 may illustrate a sequential approach for selectively encrypting sensitive portions of an image while maintaining a blurred version of the overall image. The use of ABE may enable fine-grained access control to the encrypted image data based on user attributes defined in classMappings. This approach provides a balance between security and usability, allowing authorized users to access sensitive image content while protecting against unauthorized viewers.

[0116] Referring to FIG. 9, a system diagram 900 of a computing device is shown. System diagram 900 may include several interconnected components centered around a bus 930. In some aspects, a processing device 902 may be connected to the bus 930 and may function as the central processing unit of the system. The processing device 902 may include instructions 926, which may be executable code for implementing an attribute-based encryption system for document security.

[0117] The main memory 904 may be linked to the bus 930 and provide primary storage for the system. In some cases, the main memory 904 may also include instructions 926 that enable quick access to code implementing the document security method. The system may include static memory 906 connected to the bus 930, which may provide additional storage capabilities for attribute-based encryption algorithms and related data structures.

[0118] The video display unit 908 may be connected to the bus 930 and enable visual output from the system. This may be used to display a partially decrypted document or a user interface for managing document security policies. User input may be realized through the alphanumeric input device 912 and the cursor control device 914, both of which are connected to the bus 930. These components may enable the user to interact with the document security system and enter encryption attributes or select an image area for encryption.

[0119] The system may incorporate dedicated processing units for various tasks related to attribute-based encryption and image processing. The graphics processing unit 922 may be connected to the bus 930 to process graphic calculations, which is particularly useful for image segmentation and feature extraction in the document security process. The video processing unit 928 may be included for video-related tasks and potentially process the encryption and decryption of video content within a document. The audio processing unit 932 may manage audio processing related to protecting the audio components of multimedia documents.

[0120] For data storage, the system may include a data storage device 918. Within this device, there may be a machine-readable medium 924 that may include instructions 926. This may provide non-volatile storage for the software and data of the system, including encrypted document content and related metadata.

[0121] The system may communicate with an external network through a network interface device 908 that can be connected to both the bus 930 and the external network 920. This may enable secure transmission of encrypted documents and communication with a remote key management server or an attribute authority in a distributed attribute-based encryption system.

[0122] The bus 930 may function as a central connection point for all components and may enable data transfer and communication between various parts of the system. This interconnected architecture may support the implementation of an attribute-based encryption system by enabling efficient data flow between components during encryption, decryption, and document processing operations.

[0123] In some aspects, a method for protecting document content may be implemented as instructions 926 stored on a non-transitory computer-readable medium such as the machine-readable medium 924 within the data storage device 918. When executed by the processing device 902, these instructions 926 may cause the computing device to perform various steps of a document security process including receiving a digital document, processing text and image content, generating encryption requests, and constructing a partially encrypted document.

[0124] The system architecture shown in FIG. 9 may provide a flexible and powerful platform for implementing complex attribute-based encryption schemes. The combination of general-purpose processing capabilities and dedicated units for graphics, video, and audio processing may enable efficient processing of various document types and content formats within the security framework.

[0125] Referring to FIG. 10, a block diagram of a computer system 500 is shown. The system 500 may include several interconnected components centered around a communication infrastructure 506, which may enable communication between various elements.

[0126] Processor 504 may be connected to communication infrastructure 506 and may function as the central processing unit of the system. In some embodiments, processor 504 may execute instructions for performing the attribute-based encryption and decryption processes described herein.

[0127] Main memory 508 may also be linked to communication infrastructure 506 and may provide primary storage for the system. In some cases, main memory 508 may store encryption keys, user attributes, and temporary data used during document security operations.

[0128] User interaction may be realized through user input / output interface 502 connected to communication infrastructure 506. This interface may be further connected to user input / output device 503 to enable direct user interaction with the system. In some embodiments, user input / output device 503 may enable the user to select an image area for encryption or enter encryption attributes.

[0129] System 500 may include secondary memory 510 connected to communication infrastructure 506, and secondary memory 220 may provide additional storage capabilities. Secondary memory 510 may include hard disk memory 512 for long-term data storage. In some cases, hard disk memory 512 may store encrypted documents, encryption policies, and audit logs.

[0130] Removable storage drive 514 may also be part of secondary memory 510 and may enable the use of removable storage units 518 and 522. Interface 520 within secondary memory 510 may provide a connection to these removable storage units. In some embodiments, the removable storage units may be used to securely transfer encrypted documents or encryption keys between different systems.

[0131] External communication may be enabled through a communication interface 524 that may be connected to the communication infrastructure 506. The communication interface 524 may enable the system to interact with a remote device, network, or entity 528 via a communication path 526. In some cases, this may enable secure communication with an external key management server or attribute authority in a decentralized attribute-based encryption system.

[0132] The communication infrastructure 506 may function as a central connection point for all components and enable data transfer and communication between various parts of the system. This architecture may enable efficient processing, storage, user interaction, and network communication within the computer system 500.

[0133] In some aspects, the system 500 may implement a multi-authority attribute-based encryption scheme. The processor 504 may cooperate with multiple attribute authorities, each responsible for managing a subset of the attributes used in the encryption policy. The communication interface 524 may handle the interaction with these external attribute authorities, while the user input / output interface 502 may integrate the attribute information into the overall access control decision.

[0134] The system 500 may also support dynamic policy updates. For example, the secondary memory 510 may store time-based constraints for decryption keys. The processor 504 may periodically inspect these constraints, update the user access rights accordingly, and potentially revoke access to specific document parts when the key expiration period has elapsed.

[0135] In some cases, the computer system 500 may be configured to process video content within a document. The processor 504 may extract individual frames from a video file, analyze the extracted frames to identify sensitive objects or regions, generate temporal boundary boxes to track these elements across multiple frames, and then apply visual obfuscation techniques to the sensitive objects or regions within each affected frame while maintaining the original video format and playback characteristics, and reconstruct a video file with the obfuscated frames.

[0136] The computer system 500 may provide a flexible and powerful platform for implementing an attribute-based encryption system for document security. Its modular design may allow for updates or modifications to specific components without otherwise affecting the system and enable it to adapt to evolving security requirements and encryption technologies.

[0137] Referring to FIG. 11, the flowchart illustrates a document encryption process. In some embodiments, the process may begin by receiving a digital document that includes original text content and original image content. The digital document may be received by a document security manager implemented on a computing device.

[0138] The process may then proceed to process the original text content to identify the text content portion. In some cases, this processing may include parsing the document to locate in-line text annotations. The document security manager may analyze the surrounding text to determine the scope of each annotation. The text content within the determined scope may be extracted. Based on the in-line text annotations, the document security manager may determine encryption attributes for an attribute-based encryption scheme.

[0139] In parallel or sequentially, the process may include processing the original image content to identify image portions. This step may be accomplished through multiple ways. In some embodiments, the document security manager may detect user-defined selections of image regions through a graphical interface. In other cases, a trained neural network may be used to automatically identify and classify sensitive objects within the image.

[0140] Following the processing of text and image content, the document security manager may generate one or more encryption content requests. These requests may include identified text portions with associated encryption attributes. The requests may also include identified image portions with corresponding bounding box coordinates. Additionally, metadata specifying the encryption scheme to be applied may be included in these requests.

[0141] The encryption content requests may then be sent to the encryption engine via a secure communication channel. In some cases, the encryption engine may be a separate component from the document security manager and may potentially reside on a different computing device or server.

[0142] After transmission, the document security manager may receive from the encryption engine the encrypted text content of the text portions and the encrypted image content of the image portions. The encryption engine may apply an attribute-based encryption scheme to the text portions and the image portions.

[0143] The final step of the process may include constructing a partially encrypted document. This step may include several sub-steps. The document security manager may replace the original text content with masking symbols. The width of these masking symbols may be programmatically adjusted to maintain the document layout and format.

[0144] For image content, the document security manager may apply visual obfuscation techniques to the original image content. The level of obfuscation may be based on a predetermined sensitivity level associated with different types of image content or regions.

[0145] The encrypted text and image content may be embedded within the document structure as metadata. This approach may enable the encrypted content to be stored securely while allowing the document to retain its original format.

[0146] Finally, the document security manager may update the document properties to indicate the presence of encrypted content. This step can be important to alert the user and the system about the special processing required for this partially encrypted document.

[0147] In some embodiments, the document encryption process may include additional steps for processing different types of digital content, such as audio or video embedded within the document. The process may also incorporate mechanisms for version control and change tracking to maintain a history of the encryption operations performed on the document.

[0148] Referring to FIG. 12, the sequence diagram illustrates the process of protecting document content through selective encryption and includes three main components: a document security manager, an encryption engine, and a key management server.

[0149] In some embodiments, the process may begin in step 1 where a document security manager receives a digital document that includes original text and image content. Next, in step 2, the document security manager may process the text content to identify portions by analyzing the annotations and determining encryption attributes. This step may include analyzing the surrounding text to determine the scope of each annotation and extracting the text content within the determined scope.

[0150] Step 3 may include processing the image content to identify portions by detecting user selection or by using a neural network. In some cases, the neural network may be trained to automatically identify and classify sensitive objects within the image.

[0151] In step 4, the document security manager may generate an encryption content request having the identified text and image portions, attributes, and metadata. In step 5, these requests may be sent to an encryption engine via a secure channel. The secure communication channel may use various encryption protocols to ensure the confidentiality and integrity of the data being transmitted.

[0152] In step 6, the encryption engine may apply attribute-based encryption to the text and image portions. This encryption process may utilize complex mathematical operations and cryptographic primitives to ensure the security and fine-grained access control of the encrypted data. In step 7, the encryption engine may return the encrypted text and image content to the document security manager. The encrypted content returned by the encryption engine may include both the encrypted text portion and the encrypted image portion, each processed according to an attribute-based encryption scheme.

[0153] Steps 8 and 9 may include the document security manager constructing a partially encrypted document. This process may include replacing content with masking symbols, applying obfuscation techniques, embedding the encrypted content as metadata, and updating document properties. The masking symbols may be programmatically adjusted to maintain the layout and format of the document.

[0154] In step 10, the document security manager may generate a decryption key request based on user authentication. In step 11, this request may be sent to the key management server. In step 12, the key management server may respond by sending a decryption key. The decryption key may be derived from the user's set of attributes and the master secret key.

[0155] In step 13, using the received key, the document security manager may selectively decrypt parts of the document. This selective decryption process may ensure that the user can only access parts of the document for which they have the necessary attributes or permissions.

[0156] Finally, in step 14, the document security manager may maintain an audit log of all encryption and decryption operations performed on the document. This logging mechanism can be important for security audits and compliance with data protection regulations.

[0157] In some cases, the sequence diagram may incorporate additional steps for processing different types of digital content, such as audio or video embedded within the document. This process may also include mechanisms for policy updates and key rotation to enhance the long-term security of the encrypted data.

[0158] Referring to FIG. 13, an attribute-based encryption (ABE) system for secure document processing and encryption is shown. The system may include several interconnected components that operate together to provide fine-grained control over document encryption and access.

[0159] In some embodiments, the system may include a document security manager and a cryptographic engine as core components for performing attribute-based encryption of documents. The document security manager may be configured to receive a document, identify security attributes, and coordinate the encryption and decryption processes. The cryptographic engine may be responsible for performing the actual encryption and decryption operations based on the specified attributes and policies.

[0160] The attribute-based encryption scheme may utilize a ciphertext-policy attribute-based encryption (CP-ABE) algorithm. In some cases, the CP-ABE algorithm may enable the creation of complex access policies that determine who can access specific parts of an encrypted document. These access policies may be expressed as boolean expressions that include user attributes such as organizational roles, security clearance levels, or project affiliations.

[0161] In some embodiments, the cryptographic engine may implement a multi-authority attribute-based encryption scheme. This approach may allow different authorities to manage separate sets of attributes, potentially improving the flexibility and scalability of the system. For example, one authority may manage attributes related to the organizational structure, while another authority may handle attributes related to security clearance levels.

[0162] The system may control access to encrypted document content using specific user attributes. These attributes may include, but are not limited to, security clearance levels, organizational affiliation, or job roles. For example, a user with a "Top Secret" security clearance level may be permitted access to the highly classified portions of a document, while a user with a lower clearance level may only be able to view non-confidential sections.

[0163] In some implementations, the system may include a Zero Trust Attribute-Based Access Control (ZT ABAC) application. This application may function as an interface between various services within the system and may coordinate authentication, policy enforcement, and access control decisions. The ZT ABAC application may implement a zero-trust security model where trust is never assumed and must be continuously verified based on user attributes and context.

[0164] A DoD classification marking to ABE conversion service may be incorporated into the system. This service may be capable of processing documents with traditional Department of Defense (DoD) classification markings and converting them to an attribute-based encryption scheme. For example, a document section marked "SECTET" may be automatically assigned appropriate ABE attributes that restrict access to users with the necessary security clearance.

[0165] The system may also include an ABE policy manager that interfaces with both the ABAC policy store and the ABE policy store. This component may be responsible for managing and enforcing access control policies across the system. The ABAC policy store may include attribute-based access control policies that define rules for resource access based on user attributes. The ABE policy store may hold specific encryption policies that determine how different parts of a document should be encrypted based on their sensitivities and classifications.

[0166] In some cases, the ABE policy manager may dynamically combine policies from both stores to create comprehensive encryption and access control rules. For example, an ABAC policy may be used to determine which users can access a document, and then an ABE policy may be applied to encrypt specific sections of the document based on the users' attributes.

[0167] The system may incorporate an identity provider (IdP) that manages user information and authentication. This component may operate in conjunction with an authentication service to process authentication requests and provide bearer tokens. These tokens may contain encrypted information about the user's attributes, which may be used by other components of the system to make access control decisions.

[0168] The ABE encryption interface is central to the encryption process and may receive encryption requests from a document security manager and apply appropriate ABE policies. This interface may communicate with an ABE encryption engine that may include core algorithms for attribute-based encryption.

[0169] In some embodiments, the system may use a hybrid encryption approach. A document-specific symmetric key may be generated and used to encrypt the actual document content. This symmetric key may then be encrypted using an attribute-based encryption scheme with the master public key. The encrypted symmetric key and the encrypted content may be embedded within the document structure. This approach may combine the efficiency of symmetric encryption for large documents with the fine-grained access control provided by ABE.

[0170] The system may include key recovery information that enables authorized users to reconstruct the decryption key using a subset of their attribute certificates and master secret key shares. This feature may provide a mechanism for key recovery in the case of lost or compromised user keys while still maintaining the security properties of the ABE scheme.

[0171] For decryption, the system may include a decryption service component that interfaces with the ABE key generation interface service. This service may communicate with the key generation service to generate the necessary decryption key based on the user's attributes and the document's encryption policy.

[0172] The system may also feature an offline decryption application that enables decryption of documents on various devices, including laptops and mobile phones, even when not connected to the network. This may maintain security by implementing attribute-based access control in an offline scenario while improving usability. In some cases, the offline decryption application may store a local copy of the user's attributes and a subset of the ABE policy, thereby enabling access control decisions and execution of the decryption operation without the need for a persistent network connection.

[0173] It may be suggested that a time server is incorporated into the system and that time-based elements can play a role in the encryption or access control process. For example, certain documents or sections may have time-limited access and require that the user not only possess the correct attributes but also attempt access within a specified time window. In some aspects, the time server may provide a reliable time source for implementing time-based access control. Documents or specific sections within a document may have associated time windows during which they can be accessed. The system may examine the current time against these windows when determining whether to permit access to encrypted content.

[0174] The system may function as an interface between various services within the system and implement zero trust attribute-based access control (ZT ABAC) that coordinates authentication, policy enforcement, and access control decisions. This application may implement a zero trust security model where trust is never assumed and must be continuously verified based on user attributes and context. In some cases, the ZT ABAC application may evaluate each access request independently regardless of the user's previous authentication status or network location.

[0175] The overall architecture of the ABE system highlights the flow of data and requests between components and can show how encrypted files are processed, how keys are generated and managed, and how authentication and decryption are handled across the system. This design may be tailored to the specific security needs of organizations handling confidential or sensitive data and may enable flexible and fine-grained security controls over sensitive information within documents.

[0176] In some embodiments, the system may use advanced analytics and machine learning techniques to identify abnormal access patterns or potential insider threats. By analyzing audit logs and user behavior, the system may detect abnormal access attempts or data extraction activities, identify users accessing an unusually large amount of sensitive information, and flag suspicious patterns of document decryption or sharing.

[0177] The system may also support secure collaboration features for sensitive documents. These features may include real-time co-authoring with dynamic access control based on each user's attributes, secure commenting and annotation capabilities that respect classification levels, and version control and change tracking that maintain the security and integrity of all document versions.

[0178] Referring to FIG. 14, a block diagram of an attribute-based encryption system is shown. The system may include, as a main component, a document security manager that may include several sub-modules for processing and protecting document content.

[0179] In some embodiments, the document security manager may include a document builder module. The document builder module may include a text replacer, a metadata embedder, an image obfuscator, and a property updater. These components may work together to construct the final encrypted document.

[0180] The document builder module may be responsible for constructing a partially encrypted document. In some cases, this process may include generating a document-specific symmetric key. The symmetric key may be used to encrypt the text and image portions of the document. This approach may combine the efficiency of symmetric encryption for large documents with the fine-grained access control provided by attribute-based encryption.

[0181] In some embodiments, the document builder module may encrypt the document-specific symmetric key using an attribute-based encryption scheme with the master public key. The encrypted symmetric key and the encrypted content may then be embedded within the document structure. This embedding process may be performed by the metadata embedder component of the document builder module.

[0182] The document builder module may also include key recovery information in the partially encrypted document. This key recovery information may enable an authorized user to reconstruct the decryption key using a subset of their attribute certificate and master secret key shares. In some cases, this feature may provide a mechanism for key recovery in the event of a lost or compromised user key while still maintaining the security properties of the attribute-based encryption scheme.

[0183] The document security manager may include an encryption request generator module. This module may include a text request builder, an image request builder, and a metadata generator, which may prepare encryption requests for different types of content. In some embodiments, the encryption request generator module may create separate encryption requests for the text portion, image portion, and metadata of the document.

[0184] The system may include two text content processor modules. One may include an annotation parser, a symbol adjuster, an encryption engine, and an attribute determiner. The other may be a stand-alone module that can operate in parallel with the image content processor and the encryption request generator. These text content processor modules may be responsible for identifying and processing the text portion of the document that requires encryption.

[0185] An encryption interface module consisting of a request transmitter and a response receiver may be included in the document security manager. This interface may enable communication with external encryption services. In some cases, the encryption interface module may send an encryption request generated by an encryption request generator module to an external encryption engine and receive encrypted content in response.

[0186] The image content processor module may include a user selection detector and a neural network classifier, which may be used to process and classify the image content within the document. In some embodiments, the neural network classifier may use advanced machine learning techniques to automatically identify sensitive objects or regions within the image that require encryption.

[0187] In addition to the document security manager, the system may include a key management server that can handle the generation and management of encryption keys for an attribute-based encryption process. In some cases, the key management server may be responsible for generating and managing the master public key used for encrypting document-specific symmetric keys.

[0188] The system layout may suggest a modular approach to document security with separate components handling different aspects of content processing, encryption request generation, and document construction. This modular design may allow for flexibility when updating or modifying specific components of the system without affecting others. The system may be designed to provide flexible attribute-based encryption for various types of document content, including text and images, while maintaining a high level of security and fine-grained access control.

[0189] Continuing the description of FIG. 14, the document builder module may include additional components for processing and protecting different types of document content. In some embodiments, the document builder module may include a text decoration analyzer. This component may be responsible for identifying text decorations in the document, including bold, italic, underline, strikethrough, or color formatting. The text decoration analyzer may associate the identified text decorations with corresponding sensitivity levels or encryption attributes.

[0190] In some cases, the text decoration analyzer may operate in conjunction with a text replacement component to adjust the encryption attributes of text portions based on the associated text decorations. For example, text marked with double underlines may be associated with a higher sensitivity level and, as a result, may be assigned stronger encryption attributes compared to text with single underlines.

[0191] In addition to the text request builder and the image request builder, the encryption requirements generator module may include a text decoration request builder. This component may generate specific encryption requirements for text portions based on the identified decorations and associated sensitivity levels of the text portions. In some embodiments, the text decoration request builder may create separate encryption policies for different text decoration types to enable fine-grained access control based on visual formatting cues within the document.

[0192] The document security manager may be implemented on a computing device, which may provide the processing power and resources necessary to handle complex encryption operations and manage large documents with various content types. In some cases, the computing device may be a dedicated server or a distributed system to ensure high performance and scalability.

[0193] The image content processor module may incorporate advanced image analysis techniques to identify sensitive objects or regions within an image. In some aspects, this module may use multiple neural network models, each specialized to detect a specific type of sensitive content such as faces, license plates, or confidential documents within the image. The results from these specialized models may be combined to create a comprehensive sensitivity map for each image within the document.

[0194] The encryption interface module may support multiple encryption schemes in addition to attribute-based encryption. In some cases, this module may dynamically select the most appropriate encryption method based on content type, sensitivity level, and user attributes. For example, this may apply a more robust encryption scheme to highly sensitive image regions while using lightweight encryption for less sensitive text portions.

[0195] The system may also include a version control module that operates in conjunction with a document builder and an encryption requirement generator. This module may track changes over time to document content and encryption attributes, maintain a history of access control changes, and enable secure co-editing. In some aspects, the version control module may generate differential encryption requirements for document updates and minimize the amount of re-encryption required when small changes are made to the document.

[0196] Referring to FIG. 15, an integrated access control policy manager system is shown. The system may include a central integrated ABAC policy manager, which may interact with various policy components and stores to create a comprehensive access control framework. In some aspects, the system may include an application and data access Attribute-Based Access Control (ABAC) policy store. This store may provide data access ABAC policies to the integrated ABAC policy manager. The data access ABAC policies may define rules for accessing specific applications and data resources based on user attributes, environmental factors, and resource characteristics.

[0197] A perimeter (API) ABAC policy store may be incorporated into the system. This store may supply ABAC policies to the central integrated ABAC policy manager. The perimeter ABAC policy may focus on controlling access to APIs and other entry points to the system and may potentially implement a zero-trust security model where each request can be evaluated based on attributes regardless of its origin.

[0198] In some cases, a data analysis ABAC policy store may be connected to the integrated ABAC policy manager. This store may provide data security and control platform ABAC policies. Such policies may define rules for accessing and manipulating data within the analysis platform and may ensure that data privacy and control requirements can be met during the analysis process.

[0199] The system may also include an ABE policy store that interacts with a central integrated ABAC policy manager to exchange ABE policy information. This store contains policies specific to attribute-based encryption and may define how different parts of a document or data can be encrypted based on their sensitivities and the attributes required to access them.

[0200] In some aspects, the integrated ABAC policy manager may process and integrate policies from these various sources to create a unified access control framework. This integration may enable a consistent approach for managing access control across different aspects of an organization's data, applications, and infrastructure.

[0201] The system architecture may emphasize the central role of the integrated ABAC policy manager in coordinating and synthesizing different policy types. The connections between components may show the flow of policy information from specialized stores to the central manager and may enable a comprehensive access control strategy.

[0202] In some cases, the encryption attributes for a text portion may include an access policy expression that defines the combination of user attributes required for decryption. These expressions may be complex boolean formulas that specify the exact combination of attributes a user must possess to decrypt a particular text portion. For example, an access policy expression may require that a user have both a "finance" attribute and a "manager" attribute to decrypt sensitive financial data.

[0203] The encryption attributes may also include time-based constraints that specify the validity period of the decryption key. These constraints may enable the automatic revocation of access rights after a specified period and may enhance the security of sensitive information. For example, the decryption key may be valid for only a 24-hour period, after which a new key is generated and the user must be re-authenticated.

[0204] Hierarchical attribute structures representing organizational roles and clearance levels may be incorporated into the encryption attributes. These structures may enable more nuanced access control policies that reflect the complexity of the organizational hierarchy. For example, a user with a "top secret" clearance level may be able to automatically access all documents classified at lower levels, while a user with a "confidential" clearance may only access documents at or below that level.

[0205] In some aspects, generating an encryption content request may include assigning each text and image portion to one or more attribute authorities based on the content type and sensitivity. This assignment may enable a decentralized management of the encryption policy where different authorities are responsible for different types of sensitive information. For example, a personnel authority may manage attributes related to employee information, while another security authority may handle attributes related to confidential documents.

[0206] The system may generate separate encryption policies for each assigned authority. These policies may be tailored to the specific requirements and regulations associated with each type of sensitive information. For example, an encryption policy for medical records may incorporate HIPAA compliance requirements, while a policy for financial data may address SEC regulations.

[0207] In some cases, the encryption content request may include an authority identifier and the corresponding encryption policy. This inclusion may enable the encryption engine to apply the appropriate encryption method based on the specific authority and policy associated with each part of the document. The authority identifier may function as a reference to a specific set of attributes and policies to be applied during the encryption process.

[0208] The integrated ABAC policy manager may perform real-time policy evaluation and enforcement. When a user attempts to access a resource, the manager may examine the relevant policies from each store, combine them as necessary, and make an access decision based on the user's attributes and the current context. This dynamic approach may enable flexible and responsive access control that adapts to changing organizational needs and security requirements.

[0209] Referring to FIG. 16, the sequence diagram shows a document generation flow that includes four main components: a web browser, an attribute-based access control application, a document security manager, and a cryptographic engine. In some embodiments, the process may begin with the web browser authenticating to the attribute-based access control application using a username and password. This authentication step may include the secure transmission of certificates and may support various authentication methods such as multi-factor authentication or integration with an enterprise single sign-on system.

[0210] Following successful authentication, the web browser may send a request to the document security manager to generate a document report. In some cases, this request may include parameters that specify the type of report, the desired content, or other relevant information. The document security manager may then search for application data based on the user's permissions and the requested report content. This step may include querying various data sources, applying access control policies, and aggregating information to compile the requested document.

[0211] Upon receiving the necessary data, the document security manager may send an encrypted file content request to the cryptographic engine. This request may include the document content along with metadata that specifies the security level or attributes of different parts of the text. In some embodiments, the metadata may be derived from the data source, the access control policy, or user-specified parameters.

[0212] The encryption engine may process this request and apply attribute - based encryption to the specified portion of the text. In some cases, the encryption process may include generating ciphertext that can only be decrypted by a user who possesses the required attributes. The encryption engine may use advanced encryption algorithms and key management techniques to ensure the security and efficiency of the encryption process.

[0213] After completing the encryption operation, the encryption engine may reply to the document security manager with an encrypted file content response. This response may include the encrypted portion of the text corresponding to the mapped security level or attribute, along with any necessary metadata for later decryption.

[0214] Upon receiving the encrypted content, the document security manager may construct a document that has edits in the visible area and the ciphertext in the metadata custom property area. In some aspects, this process may include replacing the original sensitive text portion with masking symbols or edit markers. The document security manager may adjust the width of these masking symbols to approximate the width of the original text, helping to preserve the visual layout and structure of the document.

[0215] The encrypted portion of the text may be stored as metadata within the document structure, such as in a custom property of a Microsoft Office document or a similar field of another file format. This approach may allow the encrypted content to be hidden from unauthorized viewers while remaining associated with the document.

[0216] Finally, the document security manager may return the encrypted document response to the web browser to complete the document generation process. In some cases, this response may include a visually formatted document along with the encrypted content stored in its metadata. The web browser may then display the document to the user, showing only the unencrypted portions and the masking symbols for the encrypted sections.

[0217] This document generation flow may illustrate how an attribute-based encryption system can create a securely and selectively encrypted document based on user authentication and authorization. This process may ensure that sensitive information is protected while allowing authorized users to still access the portions of the document relevant to their role and clearance level.

[0218] Referring to FIG. 17, the sequence diagram shows the process of converting a DoD marked classified information document into an ABE encrypted document. This process may include four main components, namely, a web browser, an attribute-based access control application, a document security manager, and a cryptographic engine.

[0219] In some embodiments, the sequence may begin with the web browser authenticating to the attribute-based access control application using a username and password. This authentication step may use various security protocols to ensure the confidentiality and integrity of the user's certificate during transmission.

[0220] Once authenticated, the web browser may upload the DoD marked classified document to the document security manager for encryption. In some cases, this document may be represented by an icon within the system interface indicating its confidential nature. The document may include traditional Department of Defense (DoD) classification markings such as "TOP SECRET", "SECRET", or "CONFIDENTIAL", along with other sensitive information indicators.

[0221] Upon receiving the document, the document security manager may convert.docx and.xlsx files with DoD classification markings into ABE policies. This conversion step can be important for converting traditional classification markings into attribute - based encryption policies. In some aspects, the conversion process may include parsing the document to identify and interpret the DoD classification markings. The document security manager may use natural language processing techniques or pattern - matching algorithms to recognize and classify different types of classification markings within the document.

[0222] The document security manager may maintain a mapping between traditional DoD classification levels and corresponding ABE policies. For example, the "TOP SECRET" marking may be mapped to an ABE policy that requires multiple high - level security attributes for access. In some cases, the system may allow administrators to customize these mappings to meet specific organizational security requirements.

[0223] Following the conversion, the document security manager may send an encrypted file content request to the encryption engine. This request may include the converted ABE policy and the document content to be encrypted. This request may be sent via a secure communication channel to prevent eavesdropping or tampering.

[0224] The encryption engine may process this request and apply ABE encryption to the document content. In some embodiments, the encryption process may include generating a complex cryptographic structure that binds the encrypted content to specified attributes, ensuring that only users who possess the required attributes can decrypt the information.

[0225] Once encryption is complete, the encryption engine may reply to the document security manager with an encrypted file content response. This response may include the encrypted portion of the document, along with any metadata necessary to manage the encrypted content.

[0226] Upon receiving the encrypted content, the document security manager may construct a.docx file that has edits in the visible region and the ciphertext in the metadata custom properties region. This step may ensure that sensitive information is obscured within the visible document while being securely stored in encrypted form within the document's metadata. In some cases, the document security manager may replace sensitive text with edit markers or placeholder text, while the actual encrypted content is stored within the document's metadata or custom properties, invisible to casual inspection but accessible to the ABE system for authorized decryption.

[0227] Finally, the document security manager may reply to the web browser with an encrypted.docx response, completing the document encryption process. This encrypted document may here contain sensitive information in a secure attribute-based encryption format that allows for fine-grained access control based on user attributes.

[0228] In some embodiments, the system may maintain detailed logs of each step in this conversion and encryption process. These logs may record information such as the classification level of the original document, the generated ABE policy, and the sections of the encrypted document. Such a logging mechanism can be important for auditing purposes and for ensuring the proper handling of sensitive information.

[0229] The process of converting a DoD marked classified information document to an ABE encrypted document may provide a bridge between traditional classification systems and a more flexible attribute-based access control mechanism. This approach may leverage the advanced security features of attribute-based encryption while allowing organizations to maintain compatibility with existing classified document workflows.

[0230] Referring to FIG. 18, the sequence diagram shows the process of decrypting a document encrypted with attribute-based encryption (ABE) using a commercial product with an add-in function. This process may include three main components: a commercial product with an add-in function, a document security manager, and a cryptographic engine.

[0231] In some embodiments, the sequence may begin with the commercial product authenticating to the document security manager using a username and password. This authentication step may use various security protocols to ensure the confidentiality and integrity of the user's certificate during transmission. The authentication process may support multiple factors, potentially incorporating biometric data or a hardware token to enhance security.

[0232] Once authenticated, a commercial product that may have an ABE-encrypted document may send a decryption key blob request to the document security manager. In some cases, this request may include information about the identifier or metadata, as well as the encrypted document such as the user's context and attributes. The decryption key blob request is designed to operate within the constraints of the commercial product's add-in architecture and may enable seamless integration with existing document workflows.

[0233] Upon receiving the decryption key blob request, the document security manager may forward the decryption key request to the encryption engine. This request may include the user's attributes, the document's encryption policy, and any other relevant information necessary for key generation. In some aspects, the document security manager may function as an intermediary that converts between the commercial product's add-in interface and a specialized encryption service.

[0234] The encryption engine may process the decryption key request and evaluate the user's attributes against the document's encryption policy. In some implementations, this evaluation may include complex policy calculations that potentially satisfy a boolean expression or use techniques such as linear secret sharing. The encryption engine may generate one or more decryption keys based on the result of this evaluation.

[0235] After generating the required keys, the encryption engine may reply with a decryption key response to the document security manager. This response may include multiple keys if different parts of the document require separate decryption keys based on different access policies. In some cases, the keys may be time-limited or incorporate usage restrictions to enhance security.

[0236] Next, the document security manager may return the decryption key response to the off-the-shelf product. This response may be formatted in a way that is compatible with the off-the-shelf product's add-in architecture, potentially including serialization or encoding of the key data. In some embodiments, the decryption key response may include additional metadata or instructions for guiding the off-the-shelf product in correctly applying the decryption key to different parts of the document.

[0237] Finally, the off-the-shelf product may use the received key to decrypt the authorized portions of the document. This decryption process occurs within the context of the off-the-shelf product and may utilize the add-in functionality to seamlessly integrate the ABE decryption functionality with the native functionality of the product. In some cases, the decryption process may include the following.

[0238] 1. Analyze the encrypted document to identify the encrypted sections.

[0239] 2. Match the received decryption key with the appropriate encrypted section.

[0240] 3. Apply a decryption algorithm to reveal the authorized content.

[0241] 4. Maintain editing or masking of sections for which the user lacks the required attributes.

[0242] In some embodiments, the off-the-shelf product may implement additional security measures during and after decryption, such as the following.

[0243] 1. Prevent copy-pasting or screen capture of the decrypted content.

[0244] 2. Apply a dynamic watermark to the decrypted section.

[0245] 3. Implement time-limited access to the decrypted content.

[0246] 4. Log all decryption and access events for auditing purposes.

[0247] This approach to decryption using a commercially available product with an add-in function may offer several advantages, including the following.

[0248] 1. Integrate with widely used document editing and viewing software.

[0249] 2. Leverage existing user interfaces and workflows.

[0250] 3. Reduce the need for dedicated software to process encrypted documents.

[0251] 4. Enable an offline decryption function as needed.

[0252] By supporting decryption through an add-in for a commercially available product, the system may provide a flexible and user-friendly approach to accessing ABE-encrypted documents while maintaining the security and access control features of attribute-based encryption.

[0253] Referring to Figure 19, the sequence diagram shows the process of decrypting a document encrypted with attribute-based encryption (ABE). This process may include four main components: a web browser, an attribute-based access control application, a document security manager, and a cryptographic engine.

[0254] In some embodiments, the sequence may begin with the web browser authenticating to the attribute-based access control application using a username and password. This authentication step may use various security protocols to ensure the confidentiality and integrity of the user's credentials during transmission. The authentication process may support multiple factors, potentially incorporating biometric data or a hardware token to enhance security.

[0255] Once authenticated, the web browser may upload the ABE encrypted document, labeled as an "outflow prevention document" in the drawings, to the document security manager for decryption. In some cases, this upload process may include a secure file transfer protocol to protect the encrypted document during transmission.

[0256] Upon receiving the encrypted document, the document security manager may send a decryption key generation request to the encryption engine. This request may include information about the user's attributes and the document's encryption policy. In some embodiments, the document security manager may perform a preliminary check to ensure that the user has the necessary attributes to potentially access at least some portions of the document before initiating the key generation process.

[0257] The encryption engine may process this request and return the decryption key to the document security manager. The generation of this decryption key may involve complex cryptographic operations that combine the user's attributes with the master secret key of the ABE system. In some cases, the decryption key may be a composite key that enables selective decryption of different portions of the document based on the user's specific attributes.

[0258] Upon receiving the decryption key, the document security manager may send a decrypted file content request with the decryption key to the encryption engine. This request may include the document content encrypted with the generated decryption key. In some embodiments, the document security manager may segment the document and send multiple decryption requests for different parts of the document to enable parallel processing and performance improvement for large documents.

[0259] The encryption engine may process this request and return a decrypted file content response to the document security manager. During this step, the encryption engine may apply the ABE decryption algorithm to selectively decrypt parts of the document based on the user attributes encoded in the decryption key. In some cases, the decryption process may include evaluating a complex access structure associated with each encrypted section of the document.

[0260] After receiving the decrypted content, the document security manager may construct a.docx file that has the editing of unauthorized parts and has clear original content in the visible area of the document or spreadsheet. This process may include the following.

[0261] 1. Reconstruct the document structure.

[0262] 2. Insert the decrypted content into the appropriate section.

[0263] 3. Apply visual editing techniques to parts that the user is not permitted to view.

[0264] 4. Preserve the original format and layout of the document.

[0265] In some embodiments, the document security manager may use advanced document processing techniques to ensure that the edited document maintains its visual integrity and usability. This may include adjusting page breaks, recalculating table layouts, or resizing images to accommodate the organized sections.

[0266] Finally, the document security manager may complete the document decryption process by returning a decrypted document file response with the unauthorized edits to the web browser. In some cases, this response may include additional metadata or instructions for the web browser on how to securely render the partially decrypted document.

[0267] The web browser may then display the decrypted document to the user, showing only the portions that have the attributes necessary for the user to access. In some embodiments, the web browser may implement additional security measures to prevent unauthorized copying or distribution of the decrypted content, such as disabling the printing function or applying a dynamic watermark.

[0268] This decryption process provides a flexible and secure way to access ABE-encrypted documents, allowing users to view only the portions of the document that they have the necessary attributes or clearance levels for. The use of edits for unauthorized portions may maintain the overall structure and context of the document while protecting sensitive information from unauthorized access.

[0269] Referring to FIG. 20, an orthographic front view of a document titled "Original" from the Department of Defense in Washington, D.C. is shown. In some embodiments, the document may be marked with a top secret header 1 in red text at the top. This document may be addressed to DASD(I&S) as of June 15, 2024. In some cases, the subject line may be written as "Security Awareness of Classification Markings" in red text.

[0270] The body of the document may include four numbered paragraphs, each indicating a different classification level. In some embodiments, these paragraphs may be marked as follows.

[0271] 1. Marked with "(TS)" for top secret information.

[0272] 2. Marked with "(S)" for secret information.

[0273] 3. Marked with "(C)" for confidential information.

[0274] 4. Marked with "(U)" for unclassified information.

[0275] At the bottom of the document, the classification marker C31 may be displayed as "ASD(C31)" in red text. In some cases, additional classification information such as "Classified by: Multiple Sources Declassify On: OADR" may be provided below.

[0276] On the right side of the document, a red arrow pointing to the right may be present. In some embodiments, this arrow may indicate further processing or the next step when handling this document.

[0277] Document layout may show how different sections within a single document can be marked with various levels of classification. This approach may enable selective access based on security clearance levels. In some cases, the use of different colors and markings for classification levels may provide visual cues for quickly identifying the sensitivity of different parts of the document.

[0278] A document security manager may process such documents by identifying classification markings and associating them with appropriate encryption attributes. For example, a top secret header 1 may be associated with the highest level of encryption that requires the most stringent set of user attributes for decryption. Paragraph 2 marked as secret, paragraph 3 marked as confidential, and paragraph 4 marked as non - confidential may be assigned gradually lower levels of encryption attributes corresponding to their respective classification levels.

[0279] In some aspects, a document security manager may use optical character recognition (OCR) technology to automatically detect and interpret classification markings within a document. This automated process may enable the efficient application of attribute - based encryption to different sections of the document based on the identified classification levels.

[0280] The classification marker C31 at the bottom of the document may be treated as metadata associated with the entire document. In some cases, this metadata may be encrypted separately from the document content using its own set of access control attributes. This approach may enable fine - grained control over who can view the overall classification - level document even when access to its content is not possible.

[0281] Referring to FIG. 21, an orthographic front view of the outflow prevention document is shown. In some embodiments, the document may appear to be a memo from the Department of Defense in Washington, D.C. There may be a "TOP SECRET" classification marking at the top of the document. The memo may be dated June 15, 2024 and addressed to DASD(I&S). In some cases, the subject line may read "Security Awareness of Classification Markings".

[0282] The body of the document may include four numbered paragraphs, each of which may be redacted and represented by a black rectangular block. This redaction may indicate the outflow prevention of the document, where sensitive information is obscured from unauthorized viewers. In some embodiments, the document security manager may adjust the width of the masking symbol to be approximately the same as the width of the original text. This adjustment helps to preserve the visual layout and structure of the document and may make it easier for the user to understand the context and flow of the content even when parts are redacted.

[0283] In some cases, the process of adjusting the width of the masking symbol may include calculating the width of each part of the original text to be encrypted. This calculation may take into account factors such as font size, font style, and letter spacing. The system may then determine the number and type of masking symbols required to approximate the calculated width. The document security manager may use a combination of different symbols (e.g., ■, ●, or ★) to achieve an exact match with the original text width.

[0284] At the bottom of the document, there may be a classification marker "ASD(C3I)". Further classification information such as "Classified by: Multiple Sources Declassify On: OADR" may be provided. In some embodiments, this classification information may be encrypted separately from the main document content using its own set of access control attributes.

[0285] On the right side of the document, there may be a blue arrow pointing to the right, and in some cases, this arrow may indicate further processing or the next step when handling this anti-disclosure document.

[0286] Document layout and editing may present a method for protecting sensitive information while preserving the overall structure of the memo and non-sensitive information elements. This approach may enable authorized users to understand the general context and structure of the document even when they do not have access to all of its content.

[0287] In some embodiments, the system may support different masking symbols or styles for different security levels or attributes. For example, top-secret information may be masked with a black solid-line rectangle, while secret information may use a diagonal pattern. This visual distinction may provide authorized users with additional context regarding the nature of the redacted information without revealing its content.

[0288] The anti-disclosure document approach can be particularly useful in scenarios where the document needs to be shared across different security domains or with individuals having various levels of clearance. By maintaining the document's structure and using width-adjusted masking symbols, the system may still enforce strict access control over sensitive information while enabling more effective communication and collaboration.

[0289] Referring to FIG. 22, an orthographic front view of a decrypted document from the Department of Defense in Washington, D.C. is shown. The document includes several components indicating different classification levels, and may show how these can be selectively revealed based on the user's attributes and permissions.

[0290] At the top of the document, a top secret header 1 may be displayed in red text. In some embodiments, the use of color for classification markings may provide a clear visual indicator of the document's highest level of sensitivity. The system may use different colors or text styles for different classification levels to emphasize the visual distinction of the document. For example, red text may be used for top secret markings, while other colors may be utilized for lower classification levels.

[0291] The document may include four numbered paragraphs, each having a different classification level. In some cases, the first paragraph may be redacted and represented by a black rectangular block. This redaction may indicate that the user does not have the necessary attributes or clearance to view this particular section. The masking symbol used for redaction may include at least one of ■, ●, or ★. In some embodiments, the system may use different symbols or patterns to represent different security levels or attributes to provide additional context to authorized users regarding the nature of the redacted information.

[0292] The secret paragraph 2 may be marked with "(S)" and may include information designated as "Secret". The confidential paragraph 3 may be marked with "(C)" and may include information designated as "Classified". The unclassified paragraph 4 may be marked with "(U)" and may include information designated as "Unclassified". This fine-grained approach to classification within a single document may demonstrate the ability of a system to apply attribute-based encryption even at the paragraph level or even at the document level.

[0293] In some implementations, the document security manager may adjust the width of the masking symbol to be within 10% of the width of the original text. This precise adjustment helps maintain the original layout and structure of the document and may make it easier for authorized users to understand the context and flow of the content even when parts are being edited.

[0294] At the bottom of the document, the classification marker C31 is displayed as "ASD (C31)" in red text. Additional classification information such as "Classified by: Multiple Sources Declassify On: OADR" may be provided below. This metadata can be important for managing the document's life cycle and ensuring appropriate handling according to security protocols.

[0295] Selective decryption and display of document sections based on user attributes can demonstrate the system's ability to provide fine-grained access control. In some aspects, the system may dynamically reveal or obfuscate parts of the document in real time as the user's attributes or clearance level changes, without requiring re-encryption of the entire document.

[0296] Using well-known classification markings (e.g., "TOP SECRET", "SECRET") with an attribute-based encryption system may provide a bridge between traditional security practices and a more advanced and flexible access control mechanism. This approach may enable the adoption of new systems while maintaining compatibility with existing document processing procedures and user expectations.

[0297] In some embodiments, the digital document may include a video file. When processing the original image content of the video file, the document security manager may use additional techniques to handle the temporal nature of the data. The processing may further include extracting individual frames from the video file. In some cases, this extraction may be performed at regular intervals or at key points determined by a scene change detection algorithm.

[0298] The document security manager may analyze the extracted frames to identify sensitive objects or regions. This analysis may utilize techniques similar to those applied to still images, such as using a convolutional neural network to segment the frame into multiple regions. In some embodiments, feature vectors may be extracted for each segmented region using a pre-trained deep learning model. The system may then classify the sensitivity level of each region based on the extracted features.

[0299] To account for the dynamic nature of video content, the document security manager may generate temporal bounding boxes to track sensitive objects or regions identified across multiple frames. These temporal bounding boxes may be represented as a series of spatial coordinates coupled with frame numbers or timestamps. In some cases, this approach may enable consistent tracking of sensitive content throughout the video even when objects move or change position.

[0300] The system may incorporate time information to improve the accuracy of sensitive object or area identification. In some aspects, this may involve using a recurrent neural network or a 3D convolutional network that can capture motion and time-dependence over multiple frames. The document security manager may analyze the patterns of object motion and changes in object appearance over time to improve the identification and tracking of sensitive content.

[0301] When confidential objects or areas are identified and tracked across frames, the document security manager may apply visual obfuscation techniques to these elements within each affected frame. Obfuscation techniques may include blurring, pixelation, or replacement with solid colors or patterns. In some cases, the level and type of obfuscation applied may vary based on the sensitivity classification of each area.

[0302] The document security manager may reconstruct a video file with obfuscated frames while maintaining the original video format and playback characteristics. This process may involve careful handling of video codec parameters, frame rate, and metadata to ensure that the obfuscated video is compatible with standard video players and streaming protocols. In some aspects, the system may also process audio content associated with the video and potentially detect and obfuscate sensitive audio information using techniques such as audio editing or replacement with a neutral tone.

[0303] Attribute-based encryption schemes may be applied to the processed video content to enable fine-grained access control based on the sensitivity of different parts of user attributes and visual data. In some cases, encryption may be applied to individual frames or time segments of the video content. This approach may allow for selective decryption of specific parts of the video based on the user's attributes and clearance level.

[0304] When sensitive objects or regions are identified and tracked across frames, the document security manager may apply visual obfuscation techniques to these elements within each affected frame. In some embodiments, the obfuscation techniques may include blurring, pixelation, or replacement with a solid color or pattern. The level and type of obfuscation applied may vary based on the sensitivity classification of each region. For example, highly sensitive content may be replaced entirely with a solid color, while less sensitive information may be blurred to the extent that details are obscured but general shapes are maintained.

[0305] In some cases, the document security manager may use adaptive obfuscation techniques that adjust based on the movement and context of sensitive content. For example, moving objects may require dynamic blurring that follows their trajectory across frames, while stationary sensitive regions may use static obfuscation methods. The system may also ensure that obfuscated regions blend seamlessly with the rest of the frame, minimizing visual disruption, by considering the surrounding visual context.

[0306] The document security manager may reconstruct a video file with obfuscated frames while maintaining the original video format and playback characteristics. This process may involve careful handling of video codec parameters, frame rate, and metadata to ensure that the obfuscated video is compatible with standard video players and streaming protocols. In some embodiments, the system may preserve the original video container format and codec and modify only the frame data to which obfuscation has been applied.

[0307] During reconstruction, the document security manager may need to address potential artifacts or discontinuities introduced by the obfuscation process. In some cases, this may involve applying a smoothing algorithm at the boundaries of the obfuscated regions to ensure a natural transition between the obfuscated and non-obfuscated regions of the video. The system may also adjust frame timing and synchronization to compensate for any processing delays introduced by the obfuscation techniques.

[0308] In some aspects, the document security manager may implement a hierarchical approach to video reconstruction, where the obfuscated content is stored as separate overlays that can be dynamically applied or removed based on user attributes. This approach may enable more efficient storage and transmission of protected video content and may allow for real-time adjustment of visible content based on changing user permissions.

[0309] The system may process audio content associated with the video during the reconstruction process. In some cases, techniques such as audio editing, frequency filtering, or replacement with neutral tones may be used to detect and obfuscate sensitive audio information. The document security manager may ensure that the audio obfuscation is precisely synchronized with the visual obfuscation to maintain consistency between the audio and video streams.

[0310] To preserve the original playback characteristics, the document security manager may maintain control over the frame rate, aspect ratio, and resolution of the video. In some aspects, the system may generate multiple versions of the obfuscated video at different quality levels or resolutions to support adaptive streaming scenarios while ensuring that the obfuscation remains effective across all versions.

[0311] The reconstructed video file may include embedded metadata that describes the applied obfuscation technique and the attribute-based encryption policy associated with different segments of the video. This metadata may be encrypted and accessible only to authorized systems or users having appropriate attributes. In some cases, this approach may enable dynamic content filtering and access control during playback without requiring reprocessing of the entire video file.

[0312] Throughout this disclosure, various terms and phrases are used to describe the features of the disclosed technology. It should be understood that these terms and phrases may encompass various meanings and definitions as are common in the technical field and patent law. The definitions of these terms may vary depending on the context in which they are used, the particular embodiments described, or the interpretation of the technology by one of ordinary skill in the art.

[0313] Some of the exemplary embodiments disclosed herein operate on documents that include both image content and text content, but the invention may also be applied to files that contain only text or only images. In some aspects, the system may process a pure text document, such as a plain text file, a word processing document, or a source code file, and apply an attribute-based encryption scheme to selected portions of the text based on content analysis, annotation, or user-defined selection. Similarly, the system may process an image-only file, such as a photograph, a drawing, or a scanned document, using techniques such as object detection, segmentation, and classification to identify sensitive regions for encryption. In some cases, the document security manager may adapt its processing pipeline based on the content type of the input file and activate only the relevant modules for text or image processing as needed. This flexibility enables the system to provide comprehensive security solutions across a wide range of file types and formats.

[0314] The exemplary attribute-based encryption scheme described in this disclosure utilizes a ciphertext-policy attribute-based encryption (CP-ABE) algorithm, but it is important to note that other forms of attribute-based encryption may be used in various implementations of the system. These alternative forms of ABE may include key-policy attribute-based encryption (KP-ABE), multi-authority attribute-based encryption (MA-ABE), hierarchical attribute-based encryption (HABE), and fuzzy attribute-based encryption (Fuzzy-ABE). In some cases, KP-ABE is used when the access policy needs to be associated with the user's secret key rather than the ciphertext, and may potentially provide more flexibility when managing user permissions. MA-ABE may be used in scenarios where multiple independent authorities are responsible for issuing attributes, which can be beneficial in large organizations with distributed security management. HABE is utilized when a hierarchical structure of attributes is required and may enable more granular access control based on the organizational hierarchy. Fuzzy-ABE is implemented when approximate matching of attributes is desired and may potentially provide higher resilience to small variations in attribute values. The choice of ABE scheme may depend on specific security requirements, organizational structure, and the nature of the documents and images being protected. In some aspects, the system may be designed to support multiple ABE schemes simultaneously, allowing for flexible adaptation to different use cases within the same organization.

[0315] In various embodiments, certain variable names, symbols, or labels may be used in the claims to represent the various elements, components, or steps of the described methods, systems, and apparatuses. These variable names, symbols, or labels are provided for convenience and clarity in describing the claimed subject matter. However, it should be understood that the use of such variable names, symbols, or labels in the claims does not necessarily limit these elements, components, or steps to the same specific entities described in the specification or other parts of this disclosure. The variable names, symbols, or labels used in the claims should be construed broadly and, unless otherwise explicitly stated or clearly limited by the context of the claims, may encompass various implementations, variations, or equivalents of the recited elements, components, or steps. Accordingly, the claims are not limited to the specific examples or embodiments described herein, but rather extend to the full scope of the inventive concept disclosed herein.

[0316] For example, terms such as "computing device", "processor", "memory", and "network" may refer to a wide range of devices, components, systems, and configurations known in the art, and their specific definitions may vary based on the implementation or design of the system. Similarly, phrases such as "store securely", "calculate a vector", and "generate a message" may include various methods, techniques, and processes that achieve the same or similar results but may be performed in different ways.

[0317] It is also understood that the use of singular or plural terms is not intended to limit the claims. For example, a reference to "a computing device" does not exclude the presence of multiple computing devices within a system. Similarly, a reference to "a network" may include various interconnected networks or a single network that includes multiple segments or layers.

[0318] Furthermore, the use of the term "may" in relation to an operation or feature indicates that the operation or feature is possible but not necessarily essential. This term is used to describe optional or alternative aspects of the disclosed technology that provide flexibility in how the technology may be implemented or utilized.

[0319] The definitions provided herein are intended to serve as examples and are not exhaustive. One of ordinary skill in the art may assign different meanings to these terms based on the context, the particular technology being described, or advancements in the field. Accordingly, the definitions of terms and phrases used in this disclosure and the claims should be interpreted broadly and in accordance with the understanding of one of ordinary skill in the art.

[0320] When used in conjunction with the claims of this specification, the use of the singular should be construed to include one or more of the elements it introduces. Similarly, the use of the term "or" is intended to be inclusive, such that the phrase "A or B" is intended to include A, B, or both A and B, unless otherwise specified.

[0321] Throughout this specification, references to "one embodiment," "another embodiment," "an embodiment," etc. mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the disclosure, and may not necessarily be present in all embodiments. Further, the particular features, structures, or characteristics may be combined in any suitable manner in one or more embodiments without limitation.

[0322] The use of terms such as "first," "second," etc. does not imply any order or sequence, but is used to distinguish one element from another, and terms such as "top," "bottom," "front," "rear," "beginning," "end," etc. are used for purposes of explanation and should not necessarily be construed as limiting.

[0323] As used herein, the term "processor" refers to any computing entity capable of executing instructions for performing a set of specific operations, whether implemented in hardware, firmware, software, or any combination thereof. This definition includes, but is not limited to, the following types of processors: central processing unit (CPU), graphics processing unit (GPU), digital signal processor (DSP), field-programmable gate array (FPGA), application-specific integrated circuit (ASIC), microcontroller, system on chip (SoC), neural processing unit (NPU), quantum processor, cloud-based processor and distributed processor, multi-core processor and parallel processor, and virtual processor. The term "processor" also encompasses the associated memory hierarchy, including primary memory (such as RAM), secondary storage (such as hard drives and SSDs), and cache memory, which operate with the processor to store and retrieve the data necessary for executing instructions. In this patent application, any reference to a "processor" should be broadly construed to include any type of processing unit capable of performing the described functions, regardless of its specific implementation, architecture, or physical form.

[0324] As used herein, the term "message" may refer to data or information in any form that can be processed, transmitted, or stored in digital format. Messages may include, but are not limited to, plain text messages of any length, pre-hashed messages, concatenated messages, binary data, network protocol messages, database records, and timestamped messages. A message may be composed of characters, symbols, or binary data and may represent various forms of content such as text, numbers, multimedia, executable code, or any other data that can be digitally encoded. A message may be used as an input to a cryptographic function such as a keyed hash function, where the message is transformed into a fixed-size hash value that is affected by a secret cryptographic key. The term "message" encompasses a wide range of data types and structures, from simple text strings to complex structured data, and may include metadata, headers, footers, or other information that enables the processing, transmission, or interpretation of content. Messages may be generated by users, systems, or processes and may be intended for various purposes, including any other function that involves communication, authentication, verification, logging, or the use of digital data.

[0325] The term "database" should be interpreted to mean a blockchain, distributed ledger technology, key-value store, document-oriented database, graph database, time-series database, in-memory database, columnar database, object-oriented database, hierarchical database, network database, or any other structured data storage system capable of storing and retrieving information. This may include a conventional relational database management system (RDBMS), a NoSQL database, a NewSQL database, or a hybrid database system that combines multiple database paradigms. The database may be centralized, distributed, or decentralized and may use various data models, indexing strategies, and query languages to organize and access the stored information. It may also incorporate features such as ACID (Atomicity, Consistency, Isolation, Durability) compliance, eventual consistency, sharding, replication, or partitioning to ensure data integrity, availability, and scalability. The database may be hosted on-premises, in the cloud, or in a hybrid environment and may support various access methods, including direct query, API calls, or event-driven architectures.

[0326] The terms "connected", "coupled", or any variations thereof mean any direct or indirect connection or coupling between two or more elements and may include the presence of one or more intermediate elements between two elements that are connected or coupled to each other.

[0327] The description of embodiments of the present disclosure is intended to be exemplary and not intended to limit the scope of the claims. Many alternatives, modifications, and variations will be apparent to those skilled in the art. Multiple embodiments are described. Nevertheless, it is understood that various modifications may be made without departing from the spirit and scope of the present disclosure. Accordingly, other embodiments are within the scope of the following claims.

Claims

1. 1. A method for protecting document content, comprising: receiving, by a document security manager implemented on a computing device, a digital document including original text content and original image content; Analyze the document to locate inline text annotations; Analyzing the neighborhood text to determine the extent of each annotation; Extracting textual content within the determined range; determining encryption attributes for an attribute-based encryption scheme based on the in-line text annotations; processing the original textual content to identify textual content portions; by detecting a user-defined selection of an image region through a graphical interface; or By automatically identifying and classifying sensitive objects in images using trained neural networks, processing the original image content to identify image portions; generating one or more requests for encrypted content, said one or more requests comprising: the identified text portion having an associated encryption attribute; and the identified image portion having corresponding bounding box coordinates; Metadata specifying the encryption method to be applied, and sending the encrypted content request to a cryptographic engine over a secure communications channel; receiving from the cryptographic engine encrypted text content of the text portion and encrypted image content of the image portion, the cryptographic engine applying an attribute-based encryption scheme to the text portion and the image portion; Replace the original text content with masking symbols, Programmatically adjust masking symbol widths to maintain document layout and formatting; applying a visual obfuscation technique to the original image content based on a sensitivity level; embedding said encrypted text and image content as metadata within a document structure; By updating the document properties to indicate the presence of encrypted content. constructing a partially encrypted document; The method includes:

2. The attribute-based encryption scheme uses a ciphertext policy attribute-based encryption (CP-ABE) algorithm, The encryption attribute of the text portion is: an access policy expression that defines a combination of user attributes required for decryption; a time-based constraint specifying a period during which the decryption key is valid; and A hierarchical attribute structure that represents organizational roles and clearance levels The method of claim 1 , comprising:

3. Processing the original image content includes: Segmenting the image into regions using a convolutional neural network; Extract feature vectors for each segmented region using a pre-trained deep learning model; classifying the sensitivity level of each region based on the extracted features; The method of claim 1 , further comprising generating an encryption attribute for each region based on the classified sensitivity level and content type.

4. generating a decryption key request based on authenticated user attributes; sending the decryption key request to a key management server; receiving a decryption key from the key management server, the decryption key being derived from a user's attribute set and a master private key; selectively decrypting portions of the document using the received decryption key; rendering a partially decrypted version of the document with authorized content visible and unauthorized content remaining obfuscated; The method of claim 1 further comprising:

5. the encryption engine implements a multi-authority attribute-based encryption scheme; generating the encrypted content request, assigning each text and image portion to one or more attribution authorities based on content type and sensitivity; Generate a separate encryption policy for each assigned authority, The method of claim 1 , further comprising including an authority identifier and a corresponding encryption policy in the encrypted content request.

6. Constructing the partially encrypted document comprises: Generate a document-specific symmetric key; encrypting the symmetric key using the attribute-based encryption scheme with a master public key; encrypting the text and image portions using the symmetric key; Embedding the encrypted symmetric key and the encrypted content within the document structure; 10. The method of claim 1, further comprising including key recovery information that enables an authorized user to reconstruct the decryption key using the attribute certificate and a subset of the master private key shares.

7. the digital document includes a video file; Processing the original image content includes: Extracting individual frames from the video file; Analyzing the extracted frames to identify sensitive objects or regions; generating a temporal bounding box to track the identified sensitive object or region across multiple frames; applying the visual obfuscation technique to the sensitive objects or regions in each affected frame; 10. The method of claim 1, further comprising reconstructing the video file using obfuscated frames while preserving original video format and playback characteristics.

8. Processing the original text content includes: Identifying text decorations within the document, including bold, italics, underline, strikethrough, or color formatting; Associating the identified text decoration with a corresponding sensitivity level or encryption attribute; The method of claim 1 , further comprising adjusting encryption attributes of the text portion based on the associated text decoration.

9. 1. A system for protecting document content, comprising: a document security manager implemented on a computing device; The document security manager includes: receiving a digital document including original text content and original image content; Analyze the document to locate inline text annotations; Analyzing the neighborhood text to determine the extent of each annotation; Extracting textual content within the determined range; determining encryption attributes for an attribute-based encryption scheme based on the in-line text annotations; processing the original textual content to identify textual content portions; by detecting a user-defined selection of an image region through a graphical interface; or By automatically identifying and classifying sensitive objects in images using trained neural networks, processing the original image content to identify image portions; generating one or more requests for encrypted content, wherein the one or more requests comprise: the identified text portion having an associated encryption attribute; and the identified image portion having corresponding bounding box coordinates; Metadata specifying the encryption method to be applied, Including, Sending the encrypted content request to a cryptographic engine over a secure communications channel; receiving from the cryptographic engine encrypted text content of the text portion and encrypted image content of the image portion, where the cryptographic engine applies an attribute-based encryption scheme to the text portion and the image portion; Replace the original text content with masking symbols, Programmatically adjust masking symbol widths to maintain document layout and formatting; applying a visual obfuscation technique to the original image content based on a sensitivity level; embedding said encrypted text and image content as metadata within a document structure; By updating the document properties to indicate the presence of encrypted content. Constructing a Partially Encrypted Document The system is configured as follows.

10. The attribute-based encryption scheme uses a ciphertext policy attribute-based encryption (CP-ABE) algorithm, The encryption attribute of the text portion is: an access policy expression that defines a combination of user attributes required for decryption; a time-based constraint specifying a period during which the decryption key is valid; and A hierarchical attribute structure that represents organizational roles and clearance levels The system of claim 9 , comprising:

11. Processing the original image content includes: Segmenting the image into regions using a convolutional neural network; Extract feature vectors for each segmented region using a pre-trained deep learning model; classifying the sensitivity level of each region based on the extracted features; The system of claim 9 , further comprising generating encryption attributes for each region based on the classified sensitivity level and content type.

12. The document security manager includes: generating a decryption key request based on authenticated user attributes; sending the decryption key request to a key management server; receiving a decryption key from the key management server, where the decryption key is derived from a user's attribute set and a master private key; Selectively decrypting portions of the document using the received decryption key; Rendering a partially decrypted version of the document with authorized content visible and unauthorized content remaining obfuscated. The system of claim 9 further configured to:

13. the encryption engine implements a multi-authority attribute-based encryption scheme; generating the encrypted content request, assigning each text and image portion to one or more attribution authorities based on content type and sensitivity; Generate a separate encryption policy for each assigned authority, The system of claim 9 , further comprising including an authority identifier and a corresponding encryption policy in the encrypted content request.

14. Constructing the partially encrypted document comprises: Generate a document-specific symmetric key; encrypting the symmetric key using the attribute-based encryption scheme with a master public key; encrypting the text and image portions using the symmetric key; Embedding the encrypted symmetric key and the encrypted content within the document structure; 10. The system of claim 9, further comprising including key recovery information that enables an authorized user to reconstruct the decryption key using the attribute certificate and a subset of the master private key shares.

15. the digital document includes a video file; Processing the original image content includes: Extracting individual frames from the video file; Analyzing the extracted frames to identify sensitive objects or regions; generating a temporal bounding box to track the identified sensitive object or region across multiple frames; applying the visual obfuscation technique to the sensitive objects or regions in each affected frame; 10. The system of claim 9, further comprising reconstructing the video file using obfuscated frames while preserving original video format and playback characteristics.

16. 1. A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method for protecting document content, the method comprising: The method comprises: receiving a digital document including original text content and original image content; Analyze the document to locate inline text annotations; Analyzing the neighborhood text to determine the extent of each annotation; Extracting textual content within the determined range; determining encryption attributes for an attribute-based encryption scheme based on the in-line text annotations; processing the original textual content to identify textual content portions; by detecting a user-defined selection of an image region through a graphical interface; or By automatically identifying and classifying sensitive objects in images using trained neural networks, processing the original image content to identify image portions; generating one or more requests for encrypted content, said one or more requests comprising: the identified text portion having an associated encryption attribute; and the identified image portion having corresponding bounding box coordinates; Metadata specifying the encryption method to be applied, and sending the encrypted content request to a cryptographic engine over a secure communications channel; receiving from the cryptographic engine encrypted text content of the text portion and encrypted image content of the image portion, the cryptographic engine applying an attribute-based encryption scheme to the text portion and the image portion; Replace the original text content with masking symbols, Programmatically adjust masking symbol widths to maintain document layout and formatting; applying a visual obfuscation technique to the original image content based on a sensitivity level; embedding said encrypted text and image content as metadata within a document structure; By updating the document properties to indicate the presence of encrypted content. constructing a partially encrypted document; A non-transitory computer readable medium comprising:

17. The attribute-based encryption scheme uses a ciphertext policy attribute-based encryption (CP-ABE) algorithm, The encryption attribute of the text portion is: an access policy expression that defines a combination of user attributes required for decryption; a time-based constraint specifying a period during which the decryption key is valid; and A hierarchical attribute structure that represents organizational roles and clearance levels 20. The non-transitory computer readable medium of claim 16, comprising:

18. Processing the original image content includes: Segmenting the image into regions using a convolutional neural network; Extract feature vectors for each segmented region using a pre-trained deep learning model; classifying the sensitivity level of each region based on the extracted features; 20. The non-transitory computer-readable medium of claim 16, further comprising generating an encryption attribute for each region based on the classified sensitivity level and content type.

19. The method comprises: generating a decryption key request based on authenticated user attributes; sending the decryption key request to a key management server; receiving a decryption key from the key management server, the decryption key being derived from a user's attribute set and a master private key; selectively decrypting portions of the document using the received decryption key; rendering a partially decrypted version of the document with authorized content visible and unauthorized content remaining obfuscated; 20. The non-transitory computer readable medium of claim 16, further comprising:

20. the encryption engine implements a multi-authority attribute-based encryption scheme; generating the encrypted content request, assigning each text and image portion to one or more attribution authorities based on content type and sensitivity; Generate a separate encryption policy for each assigned authority, 20. The non-transitory computer-readable medium of claim 16, further comprising including an authority identifier and a corresponding encryption policy in the encrypted content request.

Images