Control
Feature Details
Please be informed that there are some restrictions on data access.
Detailed information about the file control feature isnextYou can check it at.
Overview
Automatically perform encryption and security processing on documents at the time of upload and download to external storage (OneDrive, SharePoint, Google Drive, etc.) to comply with the organization's information security policies. The scope of support and determination method for Google Drive has different constraints compared to other storage. Please refer to item 9 together.
1. Document Status Display
The security status of the document is visually indicated through the file icon. The organization that issued the label is also distinguished, allowing documents managed by its own policies and documents issued by other organizations (affiliates, partners, etc.) to be concealed by the icon alone.
| User Screen | content | Note |
|---|---|---|
| Classification(Label) + Protection(Protect) | PowerPoint documents are marked as preview. | |
| Classification (Label) | The PowerPoint document is marked as a preview. | |
| Other Organization Issuance Classification (Label) + Protection (Protect) | Documents not managed by company policy | |
| Other Organization Issued Classification (Label) | It is distinguished only by icons, and processing such as viewing and conversion is the same as regular documents. |
1.1 Constraints
The MIP label (security) icon is not displayed at a specific icon size.: If you set the icon view of Windows Explorer to "Medium Icons" or larger, the MIP label icons specified by document security may not be displayed in some MIP documents. (They are displayed normally in Small Icons, List, and Details views.) In this size, a preview of the first page of the document is drawn instead of the icon.
Cause (Outside Document Security Control): Windows Explorer displays the preview image stored in the document before the icon if the icon is larger than a certain size. For three-digit extension formats (e.g., .ppt) where the preview image is stored, even if MIP protection is applied, the preview image remains in plaintext within the document, so at this size, Explorer can render the preview and the MIP label icon of document security cannot be displayed. Even for the same Microsoft Office document format, in the case of password encryption, the preview is encrypted and removed, but MIP/IRM protection is specified to only encrypt the document body, leaving the preview in plaintext. Document security only specifies the file icon, and this preview display behavior is due to the characteristics of Microsoft Office document formats and Windows Explorer, which is an area that document security cannot control.
Scope of Application: It has been confirmed in the three-character extension format .ppt where the preview image is saved, and the same three-character extension formats .doc and .xls may also appear the same when the preview is saved. Four-character extension formats (.pptx, .docx, .xlsx) have the entire document encrypted, so no preview remains, and the MIP label icon is displayed normally.
Icons issued by other organizations are the same: The preview-related restrictions mentioned above also apply to the icons of documents issued by other organizations.
Reference (Technical Specifications)
- Windows Explorer Thumbnail Handling — Icon Size Priority (Microsoft Learn)
- MS-OFFCRYPTO §1.3.2: IRM Data Space — Protection is defined only for encrypting the document content (Microsoft Learn)
- MS-OFFCRYPTO §2.3.5.4: (Comparison) Password (RC4) encryption encrypts/removes document properties and previews (Microsoft Learn)
2. When uploading to external storage
2.1 Overview
When uploading documents from a local path to external storage such as OneDrive/SharePoint/Google Drive, the system automatically applies security policies to encrypt and process the documents.
2.2 Security Processing Procedure
- Upload Detection: Detecting File Move/Copy Events
- Policy Check: Check ZTCAP policy for the original file
- Document Conversion: Convert to a secure document according to policy (Apply MIP label or DRM conversion)
- Upload Execution: Upload the converted document to external storage
- Backup Storage: (When setting policies) Backup storage of the original document
2.3 Support Scenarios
| division | Document Security 6 | Note |
|---|---|---|
| General Path → OneDrive/SharePoint | Upload after conversion | ZTCAP fileEvent - CopyFileTo_OneDrive - CopyFileTo_Sharepoint |
| General Path → Google Drive | Upload after conversion | ZTCAP fileEvent - CopyFileTo_GoogleDrive |
| General Path → General Path | Not supported | Since it is an internal transfer, control does not apply. |
| Moving within the same repository | Not supported | If the source and destination are the same repository, control does not apply. The same applies to internal movement within Google Drive. |
Storage determination order: The source and target paths are evaluated in the order of OneDrive → Google Drive → SharePoint, and the event of the first matching storage is used. Therefore, movements and copies between OneDrive and Google Drive are classified as OneDrive events (CopyFileFrom_OneDrive or CopyFileTo_OneDrive).
2.4 Actions by Authentication Status
- DS6 Login Status: Upload the converted file according to the ZTCAP policy for the original file.
- DS6 Logout Status: File uploads to external storage are blocked.
The integrated login status and SHIELD credentials must both be verified for the upload to proceed, and if either is not met, a login prompt will be displayed and copying/moving will be halted. The above action applies equally to OneDrive, SharePoint, and Google Drive. Authentication verification is performed immediately after determining the storage, so there is no difference based on the type of storage.
3. Upload Warning Dialog Function
3.1 Feature Overview
When uploading files or folders to external storage (OneDrive·SharePoint·Google Drive), a notification window will be displayed to inform you that the document conversion process is in progress.
3.2 Resource Application Information
Resource key: ① Title ② MainMsg ③ SubMsg1 ④ SubMsg2 ⑤ HelpUrl
Resource file information:c:\Windows\softcamp\sdk\Res\DS\ResUIKOR.rc, version 6.0.0.13
....
[CloudCopyMoveWarning]
Title = OneDrive Moving / Copying in Progress
MainMsg = Please do not use the target file (or folder) until the operation is complete.\r\n
SubMsg1 = *Large amounts of files may take a long time.
SubMsg2 = *Opening or modifying files before the move / copy is complete may\r\nresult in errors.
HelpUrl = (Help site address)
....
Notification window text and storage name: The above Title value refers to OneDrive, but the same notification window is also used for SharePoint and Google Drive uploads. The notification window text is not a fixed value in the program, but rather a value read from the above resource file, so it can be changed to a storage-neutral expression simply by replacing the resource text without modifying the product.
3.4 Limitations
- If you start another copy before the current copy is finished, duplicate windows will occur. (Up to 10 windows)
- Basically, the window will automatically close once the copy is complete, but the user can also close the window by pressing confirm.
- If you are moving or copying files only within Google Drive, it is not subject to control, so no notification will be displayed.
4. Backup File Storage Function During Upload
4.1 Feature Overview
This is a feature that backs up and stores the original document uploaded to an external repository.
4.2 Constraints
The backup path is designated by the policy, or the default path (My Documents) where a "CloudDrv_Backup" folder is created, and under that, folders are created by date, after which the backup files are stored in those folders. When copying folders, the folder structure is not maintained, and all converted files are stored under the date folder.
5. When downloading from external storage
5.1 Overview
When downloading documents from external storage such as OneDrive/SharePoint/Google Drive to a local path, the system automatically applies security policies to process the documents.
5.2 Security Processing Procedure
- Download Detection: File Move/Copy Event Detection
- Policy Check: Verify the Security Status of the Download Target File
- Document Conversion: Convert to appropriate security documents according to policy
- Download execution: Save the converted document to the local path
5.3 Support Scenarios
| division | Document Security 6 | Note |
|---|---|---|
| OneDrive/SharePoint → General Path | Download after conversion | ZTCAP fileEvent - CopyFileFrom_OneDrive - CopyFileFrom_Sharepoint |
| Google Drive → General Path | Download after conversion | ZTCAP fileEvent - CopyFileFrom_GoogleDrive |
| OneDrive/SharePoint → OneDrive/SharePoint | Not supported | Since it is a migration between clouds, control is not applied. |
| Google Drive → Google Drive | Not supported | Since it is an internal move within the same repository, control is not applied. |
The storage determination order in this section is the same as in section 2.3. The transfer and copy between OneDrive and Google Drive are classified as OneDrive events.
5.4 Actions by Authentication Status
- DS6 Login Status: Converted files are saved according to policy when downloading files from external storage.
- DS6 Logout Status: File downloads from external storage are blocked.
2.4 The integrated login status and SHIELD credentials must be verified in the same way, and this applies equally to OneDrive, SharePoint, and Google Drive.
6. Security Control When Viewing Documents
6.1 Overview
When opening a document, the system automatically checks the security policy and, if necessary, converts the document to ensure it can be viewed safely.
6.2 Security Processing Procedure
- Access Request Detection: Document Access Event Detection
- Policy Check: Policy Check Based on Document Path and Security Status
- Document Conversion: Convert to secure document according to policy (if necessary)
- Access Allowed: Safely View the Converted Document
6.3 Access Policy by Path
| division | Document Security 6 | Note |
|---|---|---|
| General Path Document | View After Conversion | ZTCAP fileEvent - ApplicationFileOpen, Custom Policy - DS_MIP_SHELL : open |
| OneDrive Path Document | General Document: Not Supported / Security Document: Access Blocked / MIP Document: Not Supported | Security documents need to be accessed after MIP conversion. |
| SharePoint Path Document | General Document: View After Conversion / Security Document: View After Conversion / MIP Document: View After Conversion | Support for all document type conversions |
6.4 Policy Application Mechanism
- Document Viewing Point ZTCAP Policy Application: Document Event - Designated as a transformation policy for document viewing, supporting conversion to documents registered in the enforcement policy at the time of viewing.
- Access restriction for security documents: Viewing security documents (DRM) in the OneDrive path is possible after conversion to MIP documents in the SHILDRM service (or by viewing after converting to MIP/general documents via the user right-click menu).
Cases where conversion is not supported during document viewing
- Before Integrated Login
- Local OneDrive path document files
- File with a size of 0 bytes
- If the MIP supported extension is not an Office extension
7. Document Conversion and Security Label Management
7.1 Overview
This is a feature that allows users to manually change the security level of the document or manage MIP labels.
7.2 Supported Features
- General Document → Create MIP Label
- Convert Security Document (DRM) to MIP Document
- MIP Document → Delete MIP, Convert to DRM Document
7.3 Support Features by Path
| division | Document Security 6 | Note |
|---|---|---|
| General Path Document | General Document: Create MIP Label / Security Document: Convert to MIP Document / MIP Document: Delete MIP, Convert to DRM Document | Multi-file/folder support, custom policy - DS_MIP_SHELL_MENU, DS6: Convert to ZTCAP policy |
| OneDrive Path Document | General Document: Create MIP Label / Secure Document: Convert to MIP Document / MIP Document: Delete MIP | Multi-file/folder support, DRM conversion limitations due to OneDrive path characteristics |
| SharePoint Path Document | General Document: Create MIP Label / Security Document: Convert to MIP Document / MIP Document: Delete MIP, Convert to DRM Document | Multi-file/folder support, all conversion features supported |
8. External Storage Upload Block (Selective Block · Notice Replacement)
8.1 Overview
When uploading documents to cloud storage such as OneDrive, SharePoint, or Google Drive (copying or moving), documents classified under the company's security policy as "prohibited from export" will be replaced with a notification file instead of the original, preventing sensitive documents from leaving the cloud. Documents with an allowed classification will be uploaded as is. Even if blocked, the operation will finish as "successful," so there will be no interruption or error messages when uploading multiple files at once.
Summary: Quietly selectively block cloud uploads of sensitive grade documents and upload a notice instead of the original. Once the task is complete, notify the results per file (move/block/error) in a single window.
The reason this feature is needed: Previously, when uploading documents to the cloud, only conversion (encryption, security level application) was performed according to policy, and there were no means to "completely prevent certain levels from being uploaded." As a result, there was a risk that sensitive documents such as confidential and proprietary documents could be exported to the cloud. This feature fills that gap by selectively blocking uploads based on document classification.
Operation Method (Single Line Mechanism): Documents identified as blocked by the server policy are uploaded to the cloud as a notice (original_name_blocked.txt) instead of the original (silent blocking), while allowed documents are uploaded normally. Once the task is complete, the results for each file are displayed in one window (only when there is at least one block or error — no notification if everything is normal).
8.2 Scope / Entry Point
| Entry Point | Support Status |
|---|---|
| Local Explorer → Copy to OneDrive/SharePoint (Ctrl+C/V) | support |
| Local Explorer → Move/Drag to OneDrive/SharePoint | support |
| Local Explorer → Copy to Google Drive (Ctrl+C/V) | support |
| Local Explorer → Move/Drag to Google Drive | support |
| Folder-level movement | Support (also replaces blocked documents in the folder) |
| Teams Copilot Upload | Outside the scope of this document due to different integration methods |
| Cloud → Cloud Migration, Download | non-target |
8.3 User Scenario
| What the user does | What happens? |
|---|---|
| Copy/Move General (Allowed) Documents to OneDrive/SharePoint/Google Drive | It will be uploaded normally as usual. |
| Copy/Move Restricted Level (e.g., Confidential) Documents | The original file will not be uploaded, and a guide file named original_name_blocked.txt will be uploaded instead. |
| Uploading multiple documents at once | Only the blocked targets will be changed to the guidance file, and the rest will be uploaded normally. Once the work is finished, it will be displayed at a glance in the results window. |
| Upload (Move) Folder | Only the blocked documents in the folder will be changed to the guide file, and the original folder will remain on my PC as it is. |
| No blocked documents (all allowed) | It completes quietly without displaying the result window. |
8.4 Constraints
- Folder Move Block: When moving a folder that contains a blocked document, the entire original folder is preserved locally. At this time, allowed documents exist both locally and in the cloud (duplicate) — this is an intended behavior to prevent data loss.
- Supported file extensions limited: Cloud upload restrictions apply to Office (docx/xlsx/pptx, etc.) and PDF. HWP/HWPX, etc. are not restricted, and if blocking is necessary, a separate extension for supported file types is required.
- Notice Protection Level: The notice is plaintext without a security label. It does not contain sensitive information, and the security objective (non-exfiltration of sensitive originals to the cloud) is achieved by not uploading the original.
- Server policy dependency: The block level determination depends on the server conditional policy. If the policy is not registered, the existing transformation and upload flow will remain unchanged.
- Excluding appAuth mode: The appAuth mode does not use conditional policies, so it is not a subject of this block.
- Teams Copilot Upload: The integration method with Explorer is different, so this feature is out of scope.
- Legacy file copy method via upload: Uploads through the outdated file copy method (SHFileOperation) used by some applications only recognize the OneDrive path. When uploading to Google Drive using this path, upload blocking is not applied. This does not apply to copy, move, or drag in Windows Explorer.
8.5 User Interface (UX)
When the task is complete, the results window will appear (only in case of blocking or errors).
┌──────────────────────────────────────────────┐
│ Document Security │
│ Upload Blocked │
│ ┌────────────────────────────────────────┐ │
│ │ Target Files │ │
│ │ report.docx ✓ Moved │ │
│ │ confidential_document.docx ! Blocked │ │
│ │ revenue.xlsx ! Blocked │ │
│ └────────────────────────────────────────┘ │
│ [ Confirm ] │
└──────────────────────────────────────────────┘
The blocked document will be uploaded to the cloud as original_name_blocked.txt (notification). The results window shows all files of that task along with their status (moved/blocked/error). Tasks that are all uploaded normally do not display the results window (to prevent unnecessary notifications).
8.6 Policy / Settings
The blocking status is controlled by the "uploadBlock" enforcement card of the server conditional policy (ZTCAP). Which grades to block (e.g., C·S grades) is specified in the policy's "target document security label condition." The client only checks whether there is a blocking card in the response.
8.7 Supported Scope (Extension)
Supported: Microsoft Office (docx/xlsx/pptx, etc.) · PDF. Not supported: HWP/HWPX, etc. Other extensions are not subject to upload restrictions (8.4 constraints).
8.8 Main Flow
- Administrator: Conditional Policy Registration (Upload Block Card ON + Block Level Designation).
- User: Copy/Move document to OneDrive/SharePoint/Google Drive → Replace notice (Blocked Level) / (Allowed) Normal Upload → Result window at the end of the task.
9. Google Drive Support Scope and Limitations
Google Drive uses a control flow similar to OneDrive and SharePoint, but the way it recognizes paths is different, and the following constraints apply.
⚠️ Policy server pre-registration required (prerequisite): Google Drive support is on the policy server (ZTCAP)
CopyFileTo_GoogleDrive·CopyFileFrom_GoogleDriveevent,DrmRemoveExecution Attributes,%GOOGLEDRIVE%The four path reserved words must be pre-registered to function. If not registered, the client log appears normal, but no transformation occurs, resulting in a non-functional state. For detailed registration methods, refer to "Google Drive Document Security Control — Application Guide" §4-1.
9.1 Support Mode — Virtual Drive (Streaming) Only
Supports only the virtual drive (streaming) mode of Google Drive for Desktop. It identifies drives as Google Drive if the file system is DriveFS or if the volume name contains Google Drive among the volumes mounted with drive letters.
Mirroring (local folder synchronization) mode is out of scope. This mode is not assigned a drive letter, so it does not become a subject of judgment and is treated as a regular local folder.
9.2 Mount Timing Constraints
The drive list is queried only once when the program starts. Therefore, if Google Drive is newly connected while the explorer or agent is already running, it will not be recognized until it is restarted. The same restriction applies to OneDrive.
9.3 How to Specify Conditional Policies
Conditional policies targeting Google Drive are specified in the admin console under "Conditional Policies › Endpoint" with the following items.
| designated item | value |
|---|---|
| Document Event (Upload) | Moving/Copying Files to Google Drive |
| Document Events (Download) | Moving/Copying Files in Google Drive |
| Document Path Specification | Designated path › %GOOGLEDRIVE% |
The drive letter of Google Drive is recognized differently on each PC, so the path is specified using the reserved word %GOOGLEDRIVE% instead of the drive letter. The reserved word is a single value that does not distinguish between My Drive and Shared Drives.
9.4 Repository Judgment Priority
The original and target paths are evaluated in the order of OneDrive → Google Drive → SharePoint, and the events of the first matching storage are used. Due to this order, transfers and copies between OneDrive and Google Drive are classified as OneDrive events rather than Google Drive events. Care should be taken when configuring policies in an environment that operates both storages.