Adobe Developer Workshop Series

Agenda Introduction Overview of Intelligent Document Platform Security integration points Desktop Solutions Adobe Acrobat Adobe Reader Server Solutions Adobe Policy Server Adobe Document Security Q&A 2005 Adobe Systems Incorporated. All Rights Reserved. 2

Presenters Lori DeFurio Developer Evangelist, Adobe PDF ldefurio@adobe.com Bill Shapiro Computer Scientist, Solutions Engineering Designed & Implemented Policy Server 2005 Adobe Systems Incorporated. All Rights Reserved. 3

Adobe Document Services Extensible and modular Document generation PDF file creation from desktop, or server, in batch or real time Print formats Output management Capture Archiving Collaboration Document sharing Review and markup Approvals Attachments Document control and security Document rights management Authenticity, integrity, and confidentiality Client/server signing and verification Entitlement revocation Process management Online and offline form processing Local saving of form data Form management Simple access point Dynamic form filling Central form mgmt Workflow Barcoded paper forms 2005 Adobe Systems Incorporated. All Rights Reserved. 7

Document Control & Security Certifying and encrypting documents Manage document control policies Document Security Server Adobe Policy Server End users digitally sign/encrypt documents & forms Design XML form templates Generate dynamic forms & extract data Generate dynamic documents to be certified Enable digital signatures in Adobe Reader Adobe Acrobat/Reader Adobe Designer Adobe LiveCycle Forms Adobe Document Server LiveCycle Reader Extensions 2005 Adobe Systems Incorporated. All Rights Reserved. 9

The Evolution of Effective Electronic Document Protection Document Control Since Adobe Acrobat 2.0-1994 Digital Signatures Since Adobe Acrobat 4.0-1999 Confidentiality Rights Management Access Control Authenticity Integrity Non-repudiation 2005 Adobe Systems Incorporated. All Rights Reserved. 11

Digital Signatures Security equal to or better than paper Author-certified document validates Authenticity Unaltered state Recipient signature confirms Acknowledgment Approval 2005 Adobe Systems Incorporated. All Rights Reserved. 12

Round Trip Signatures Author Recipient Author should always sign forms requiring recipient signatures Recipient can verify that form is authentic Author can then verify that their original form has not been modified and that recipient signed form with their supplied data important when submitting data to enterprise systems! Documents can be routed for multiple recipient signatures 2005 Adobe Systems Incorporated. All Rights Reserved. 13

Form Signing With In-line Signatures Unlike other formats and applications, signatures are applied inline just like paper No user retraining required to find signature Appearance supports text and images, e.g. handwritten signature, photo, etc. Audit history also contained within document Most other approaches require users to sign a wrapper in an external window 2005 Adobe Systems Incorporated. All Rights Reserved. 14

Adobe Acrobat Document authors can: Create PDF files Apply encryption, permissions, and digital signatures Document control and digital signatures capabilities are built into into Acrobat interface Ease of use encourages people to apply security rules that keep information private and confidential 2005 Adobe Systems Incorporated. All Rights Reserved. 15

Adobe Reader Provides cross-platform access to Adobe PDF files Share secured documents with people outside the firewall Reach broad audience of people with free Adobe Reader, downloaded more than 500 million times People with Reader can: View protected documents Validate digital signatures Verify document certification Digitally sign PDF files 2005 Adobe Systems Incorporated. All Rights Reserved. 16

Securing PDFs 3 built-in document control security handlers Password Accessible using C/C++ plug-ins Certificates Accessible using JavaScript Extensible using C/C++ plug-ins Custom CAs, directories, UIs, etc. Adobe Policy Server Accessible using JavaScript 2005 Adobe Systems Incorporated. All Rights Reserved. 17

Shortcomings of Current Document Control Approaches Lack persistent access controls to prevent information re-distribution Cannot dynamically change rights/access after distribution Unauthorized Users Author Recipient File System Secure Pipe Approach Access Control Approach 2005 Adobe Systems Incorporated. All Rights Reserved. 20

Adobe LiveCycle Policy Server Dynamic, persistent document control Who can open the document? What can they do with the document?..with accountability What has been done to the document?..for everyone Employees, customers, partners Anywhere. Dynamically change policies after distribution Set expiration dates or instantaneously revoke documents Know when documents have been opened, printed, modified and more Enforce version control on distributed documents Leverage existing group and authentication information Online, offline, in the office, at home, on the road, etc. 2005 Adobe Systems Incorporated. All Rights Reserved. 21

LiveCycle Policy Server SDKs Server SDK automates administrative capabilities Java Server SDK Create & manage policies Revoke / unrevoke documents Create & manage watermarks Supports both EJB and SOAP communication with server WebServices API Allows Server SDK functionality to be accessed using other languages (.NET languages, perl, etc) Java Service Provider Interfaces Write custom authentication & group providers Write custom event notification handlers 2005 Adobe Systems Incorporated. All Rights Reserved. 24

LiveCycle Policy Server Client SDK Client SDK used to secure other formats using Policy Server. C++ Client SDK (Summer 2005) Allows securing (encrypting) and opening (decrypting) other formats. Client SDK handles communication with server, manages cryptographic keys & authentication, provides offline access support and more. 2005 Adobe Systems Incorporated. All Rights Reserved. 25

LiveCycle Policy Server SDK Sample Workflow: free trial report Write a custom app ( Trial Report ) that allows sales reps to send out free trial reports that expire Administrator creates two policies: expires in 2 weeks and expires in 1 day Sales rep secures sample reports using the expires in 2 weeks policy createpolicy() LiveCycle Policy Server When report is one day from expiring, Trial Report program switches the policy to have an expires in 1 day watermark. 2005 Adobe Systems Incorporated. All Rights Reserved. 26 Policy Server Java SDK or Web Services switchpolicy() LiveCycle Policy Server

LiveCycle Policy Server Client SDK Sample Workflow: securing.bob files.bob Viewer Application Policy Server Client SDK LiveCycle Policy Server 1. SDK retrieves list of policies from server that user can apply 2. App displays list of policies to user. User selects policy to apply 3. SDK requests a license from server for selected policy 4. App embeds license in file, encrypt with provided key 2005 Adobe Systems Incorporated. All Rights Reserved. 27

LiveCycle Policy Server Client SDK Sample Workflow: opening secured.bob files.bob Viewer Application Policy Server Client SDK 1. User attempts to open a.bob file in App 2. App extracts license from.bob file, provides it to SDK 3. SDK authenticates the user, possibly calling App to display dialog LiveCycle Policy Server 4. SDK requests access to.bob file from server. Server returns key and permissions to App, if user is permitted access 5. App decrypts document and enforces permissions 2005 Adobe Systems Incorporated. All Rights Reserved. 28

Adobe LiveCycle Document Security Digital signatures and encryption in a server environment Generates signed and certified PDF documents Encrypts and decrypts PDF documents Validates digital signatures Applications Integrates with LiveCycle Reader Extensions and LiveCycle Forms to validate digital signatures Integrates with LiveCycle Document Server or Output Server to generate certified documents Integrates with LiveCycle Policy Server to add security to PDF documents. 2005 Adobe Systems Incorporated. All Rights Reserved. 29

Adobe LiveCycle Document Security Capabilities Generate certified Adobe PDF files Monitor document integrity throughout complex processes Validate digital signatures Know whether a document has been altered Validate the identity of the apparent sender Digitally sign PDF files Sign in both server and client environments Specify and monitor changes to content Integrate with hardware security modules Take advantage of pervasive format and viewer Adobe PDF and Adobe Reader Apply levels of security that are built into the PDF file specification Enjoy widely deployed document-based system for access control Incorporate people using different platforms and releases: Windows, Mac, Linux 2005 Adobe Systems Incorporated. All Rights Reserved. 30

Adobe LiveCycle Document Security Sample Workflows Document Generation Workflows Certify Encrypt Central Pro Output Server Process Management Workflows Certify Encrypt 2005 Adobe Systems Incorporated. All Rights Reserved. 31

Policy Server + Document Security Sample Workflow: drop folders Associate a policy with a folder and automatically secure documents that are dropped in that folder Create a Policy Administrator Monitor Folder Policy Server Java SDK or Web Services Or LiveCycle Policy Server When a file is added, secure it with policy, and write secured file to output folder. Doc. Security Java API LiveCycle Document Security Output Folder 2005 Adobe Systems Incorporated. All Rights Reserved. 32