Document Protection SPI for Secure Exchange Without Recipient Software
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing document and file transfer methods require both sender and recipient to have compatible encryption software, leading to processing overhead and limitations in document accessibility when the recipient lacks matching software.
Innovation Solution
Implementing a document protection service provider interface (SPI) that allows for external encryption utilities to be used as a service, enabling secure document exchange without the need for matching software on both ends, by generating and sending encryption keys for decryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional encryption methods are used where both sender and recipient must have compatible software, then document security is improved, but software compatibility requirements increase and ease of operation deteriorates
Solution Approach 1:
The patent extracts the encryption functionality from the recipient's system and relocates it to the sender's system. The sender's computer performs both encryption and decryption operations locally, eliminating the need for the recipient to have compatible decryption software installed. This resolves the contradiction by maintaining security through local cryptographic operations while removing software compatibility barriers for the recipient.
Solution Approach 2:
The patent introduces an intermediary mechanism where the sender's system acts as both encryptor and decryptor. Instead of requiring direct compatibility between sender and recipient software, the sender's system intermediates the entire encryption-decryption process, then transmits only the decrypted document. This intermediary approach maintains security while eliminating recipient software requirements.
2Reliability
If the entire message including attachments is encrypted, then document security is improved, but processing overhead increases
Solution Approach 1:
The patent segments the document into distinct components: the cover sheet containing sensitive information requiring encryption, and the attachments that may not require the same level of protection. By applying encryption selectively to only the portions of the document that contain sensitive information, the system maintains security for critical data while reducing processing overhead by avoiding unnecessary encryption of entire documents and their attachments.
3Reliability
If DLP products provide encryption on documents, then document security is improved, but the requirement for equivalent software at the receiving end increases device complexity
Solution Approach 1:
The patent extracts the decryption functionality from the recipient's system and consolidates it within the sender's system. The sender's computer performs both encryption and decryption operations, then transmits only the decrypted document content. This extraction eliminates the need for the recipient to install or maintain DLP decryption software, reducing device complexity at the receiving end while maintaining document security through controlled local processing at the sender's end.
Data Source
AI summary
An application is instrumented with a document protection service provider interface (SPI). The interface is used to call an external function, e.g., an encryption utility, to facilitate secure document exchange between a sending entity and a receiving entity. When the application invokes the SPI, the user is provided with a display panel. The end user provides a password for encryption key generation, together with an indication of desired encryption strength. The service provider uses the password to generate an encryption key. In one embodiment, the service provider provides the key to the service provider interface, which then uses the key to encrypt the document and to complete the file transfer operation. In the alternative, the service provider itself performs encryption. The SPI generates and sends a message to the receiving entity that includes the key or a link to enable the receiving entity to retrieve the key.