E-Commerce Selling PDFs over the Web

Transcription

1 E-Commerce Selling PDFs over the Web Thomas Merz PDFlib GmbH München 1 Overview > Environment for e-commerce with PDF > Securing PDF with encryption > Adobe WebBuy and PDF Merchant > Other solutions for selling PDF over the Web > Electronic books with PDF 2

2 Platforms for using PDFs > Wide-spread distribution of Acrobat/PDF is a good basis for e-commerce > Acrobat Reader and Web browser: 200 million downloads of Acrobat Reader from according to StatMarket 36% of Netscape users have the Acrobat Plugin installed (rank 5 after AVI, QuickTime, Beatnik, RealPlayer) > Acrobat Viewer for Java: platform-independent Java implementation of Acrobat Reader interesting technology, but resource hog limited functionality because plugins are not available (e.g., forms) 3 PDF on Personal Digital Assistants (PDAs) > Ansyr Primer displays PDF documents on PDAs ( > Available for Windows CE and PocketPC (different version for PalmOS) > Limited due to the small display, but very interesting for specialized applications (medical, legal, etc.) > Primer license is US-$50 per device 4

3 Standard Encryption in Acrobat > Standard encryption in Acrobat protects a document with a password > Algorithm is RC4 with 40 bit key length:»weak«encryption on the Web OK for private information charge US-$40 for removing security options and US-$500 for encrypted documents sell software for cracking encrypted PDF documents expect future Acrobat versions to implement longer keys = better security > Conclusion: Acrobat s default encryption isn t strong enough to resist determined attackers 5 Security Options > Files with open password are encrypted, and can t be opened without the password > Security options can be set separately to allow or prevent any of the following:»printingchanging the DocumentSelecting Text and GraphicsAdding or Changing Annotations and Form Fields«> Disallowing document changes also prevents re-distilling in Acrobat 4.05 (if printing is allowed): Acrobat includes some magic PostScript code in the print output if the PostScript output is run through Distiller the document is rejected printing the document on a PostScript printer works fine disabling the magic PostScript requires decent PostScript knowledge protection may be disabled by using Acrobat versions prior to

4 How secure are the Security Options? > Files with security options, but without open password contain everything needed for opening the file they can t actually be secure! > The»protection«is rather a plea to Acrobat to disable some features > Using custom software instead of Acrobat it s possible to circumvent the security settings In plain words: it s possible to print»print-protected«files if they do not require a user password! the actual encryption must not be cracked in order to achieve this 7 Securely sending PDFs over the Web > PDF documents can be sent encrypted over the Web via SSL > Forms data sent from the client back to the server (FDF) can also be encrypted by supplying https as protocol in the submit button URL > SSL protects documents only during transmission: documents are saved on disk unencrypted redistribution cannot be controlled 8

5 Third-Party Products for PDF Protection > Like many other aspects of Acrobat, software developers can extend Acrobat s security features > Internal encryption is handled by the»standard«security handler > FileOpen ( time-bomb for documents limit number of printouts encryption algorithm not documented, may be insecure > PageVault ( RC4 with 128 bit keys keys for opening a document are stored on a secure server accessing a document requires online connection authentication by digital certificates, password, SecureID cards etc. 9 Adobe Web Buy and PDF Merchant > Securely sell PDFs over the Web with Acrobat 4.05 > Encrypt PDF files on the server with PDF Merchant, decrypt with Web Buy > Payment processing is not included in the system > PDF Merchant on the server side: strong encryption for customers in USA and Canada fees for Internet transactions: US-$5 000 per year (!) plus 2 percent transaction fee fees for Intranet use: US-$ for up to 100 users 10

6 Four steps of a Web Buy Transaction > 1- Prepare the document package (»Locked PDF«) on the server encrypt document with secret key create package with encrypted document, vendor name and URL send package to client > 2- Transmit client-specific data, e.g., CPU or disk ID client extracts vendor data and sends hardware info to the server client sends payment by some other method (e.g., credit card) > 3- Generate decryption key on the server encrypt decryption key with hardware info generate voucher with key and conditions for opening the document send voucher to the client > 4- Decrypt the document and open it check voucher conditions generate decryption key from voucher decrypt and open the PDF 11 vendor name and URL document ID security options private key PDF 1 extract URL from PDF collect hardware info encrypt PDF locked PDF vendor: Web server and PDF Merchant encrypt key with hardware info 3 2 hardware info and payment buyer: browser and Acrobat Web Buy generate voucher with conditions 4 voucher check voucher conditions generate key, decrypt PDF open file 12

7 Application Scenarios for Web Buy > Direct Distribution: publisher directly distributes content documents are encrypted individually > Superdistribution: encrypted documents can be freely copied, but opening requires a voucher the voucher is tied to the user s environment (CPU, hard disk, other media) > Buyer can transfer the purchased document to other media: IOmega Clik! Disk, Zip-Drive, Jaz-Disk Several people may use the document, but not at the same time > My take: expensive setup it s questionable whether hardware binding will be accepted, but publishers demand it seems well suited for short-lived information, e.g., business documents such as market research 13 Combining Web Buy with other PDF Features > Web Buy encryption can be combined with Acrobat s security options (functional restrictions,»don t print«etc.) > In addition to the Web Buy encryption a user password can be applied for confidential information > Using form fields a stamp can be applied to all pages which is visible on screen, on print, or both 14

8 Glassbook Reader > Software solution for e-books ( based on Acrobat Reader with integrated Web browser running on Windows; Mac and Windows CE announced double-page display reads content over the speakers currently available for Windows manages e-books, PDF, HTML Glassbook Plus version includes English dictionary, annotations lend books to other Glassbook users > Glassbook Content Server for encryption US-$900 per year plus 3% transaction fee EBX (Electronic Book Exchange) for secure voucher distribution ( > Weak encryption was cracked in April 2000 (Stephen Kings»Riding the Bullet«), and improved by Glassbook > Glassbook announced support for OEB (Open E-Book) ( 15 Glassbook Reader > Adobe acquired Glassbook in September 2000 > Glassbook UI features to be integrated in Acrobat Reader > EBX technology to be integrated into Acrobat Reader > PDF Merchant technology to be integrated in Glassbook server 16

9 Softlock.com > Technology for secure distribution over the Internet > Several file formats, including PDF > Available for Mac and Windows > Parts of the document can be freely accessible, remainder must be purchased > Purchased document is tied to a particular computer > Softlock.com as»e-market maker«: creates business opportunities through distribution partners 17

10 PDFlib runs on a wide variety of platforms: Mac, Windows, and many Unix platforms are supported. In addition, PDFlib s text and image handling has been carefully crafted to accommodate EBCDIC-based systems such as IBM AS/400 and S/390. The PDFlib core is written in the ANSI C language. In addition, we undertook great efforts to make the PDFlib API accessible from a variety of other programming environments by leveraging the extension mechanisms offered by most modern languages. The integrated support for several scripting languages makes PDFlib especially attractive for developers who want to concentrate on their actual problem instead of the programming environment. PDFlib supports the following language bindings: ÿ ActiveX/COM for use with Visual Basic, Active Server Pages, Delphi, Allaire ColdFusion, and many more ÿ ANSI C ÿ Class wrapper for ANSI C++ ÿ Java, including servlets ÿ Perl ÿ Python ÿ Tcl A library for generating PDF on the fly What is PDFlib? Want to spice up your generated documents with PDF? Tired of HTML formatting issues? PDFlib is a development tool for PDF-enabling your software, generating PDF on your server, or distributing dynamic PDF content over the Web. PDFlib frees you from the intricate details of PDF generation by offering a simple API for programmatically creating PDF files from within your own server- or client-side software. PDFlib doesn t require Adobe Acrobat nor any other third-party software. PDFlib everywhere! API PDFlib offers an easy-to-use programming interface for the application programmer. The PDFlib API shields the programmer from the technicalities of PDF generation. Any programmer with decent graphics or print output experience is able to use PDFlib quickly, and will be able to incorporate PDFlib into his application within a couple of hours. The PDFlib reference manual explains the basics of PDFlib programming, and provides a detailed reference to all API functions. Sample programs are provided for all supported environments. Web Server Deployment PDFlib is thread-safe, i.e. it can safely be used in multi-threaded server applications. The ActiveX edition is»both-threaded«for improved performance. C or C++ library clients can install their own memory management and error handling routines. PDFlib s memory management has been rigorously engineered and tested for memory leaks in order to guarantee 24 x 7 deployment without any shutdown periods. PDFlib is especially well suited for generating PDF on the Web server, and is tightly integrated into all major Web server environments. PDFlib can generate PDF data directly in memory (instead of on file), resulting in better performance and avoiding the need for temporary files. Coming soon ÿ Support for TrueType fonts ÿ Template feature for efficiently re-using page content ÿ Facility for processing existing PDF documents (PDF import)

11 PDF Features supported by PDFlib PDF Documents ÿ PDF documents of arbitrary length, directly in memory (for Web servers) or on disk file ÿ arbitrary page size each page may have a different size ÿ compression for text, vector graphics, image data, and attachments ÿ strict Acrobat 3 / PDF 1.2 mode optionally available Vector graphics ÿ common vector graphics primitives: lines, curves, arcs, rectangles, etc. ÿ vector paths for stroking, filling, and clipping ÿ RGB color for stroking and filling objects Fonts ÿ text output in different fonts ÿ text column formatting ÿ underlined, overlined, and strikeout text ÿ built-in font metrics for PDF s 14 base fonts ÿ PostScript font embedding (PFB and PFA file formats) with or without font embedding ÿ support for AFM and PFM font metrics files ÿ library clients can retrieve character metrics for exact formatting ÿ flexible font and metrics file configuration Hypertext ÿ page transition effects, such as shades and mosaic ÿ nested bookmarks ÿ PDF links, launch links (other document types), and Web links ÿ document information: four standard fields (Title, Subject, Author, Keywords) plus user-defined info field (e.g., part number) ÿ file attachments and note annotations Internationalization ÿ Unicode support (see below) ÿ support for a variety of encodings (both built-in and user-defined) ÿ CID font and CMap support for Chinese, Japanese, and Korean text ÿ support for the Euro character ÿ support for international standards, e.g., ISO Images ÿ embed images in GIF, PNG, TIFF (single- and multi-page), JPEG, and CCITT file formats ÿ image data can be passed directly in memory ÿ efficiently re-use image data, e.g., for repeated logos on each page ÿ transparent (masked) images Support for the Unicode Standard PDFlib supports the Unicode standard as far as PDF itself supports it. Unicode text can be used for hypertext features such as bookmarks (e.g., Greek or Russian), contents and title of text annotations, attachment description and author name. In addition, Unicode encoding (CMaps) can be used for Japanese, Chinese, and Korean text. PDFlib s Unicode handling is available for all supported client language bindings, and is transparently integrated in those language bindings which natively support Unicode themselves. Currently these are ActiveX, Java, and Tcl. Who uses it? Since PDFlib s inception in 1997, thousands of software developers have downloaded PDFlib over the Internet. PDFlib is very popular among Web developers, developers of financial and reporting software, in-house applications for banks and insurances, and end-user software. A list of reference customers can be found on our Web site. License Fees We offer two different licensing schemes: server licenses (mostly for Web use) and redistributable (runtime) licenses for product developers. All licenses include technical support. Details of maintenance contracts and OEM licenses (incl. source code license) are available on request. server license redistributable (runtime) license server CPUs license fee units distributed license fee 1-2 US-$ US-$ US-$ US-$ 1000 unlimited US-$ 2000 unlimited US-$ 4000 Contact Fully-functional versions of PDFlib can be obtained from our Web site. For further information regarding PDFlib licensing please contact: PDFlib GmbH, Tal 40, München, Germany phone sales@pdflib.com support@pdflib.com fax PDFlib 3.02 data sheet, October 2000