Glossary

This glossary is organized to help easily understand the key terms frequently encountered when using Document Security products.

Quick Navigation

Quickly find key terms.

Category	Key Terms
Basic Concepts	Document Security, Endpoint, Orchestration
Document Security	Security Document, DRM, MIP, Encryption, Decryption
Grade/Label	C/S/O grade, label, security label
Permissions/Policies	Permissions, ZTCAP, category-based permissions, grade-based permissions
Authentication	SSO, SHIELD ID, unified login, MFA
Document Conversion	DRM↔MIP conversion, bidirectional automatic conversion, batch conversion
Cloud	Microsoft 365, OneDrive, SharePoint, Google Drive
Document Control	Access control, copy/paste control, screen capture control
Document Management	Batch encryption, secure document destruction, secure files for external transmission
Logs and Monitoring	Integrated logs, document logs, document visibility
Other Terms	Offline login, token, app permissions, user token

Basic Concepts

Document Security (Document Security)
An endpoint document security orchestration solution that encrypts electronic documents generated within enterprises and organizations to prevent the leakage of important information to the outside.

Main Features:

• Document Encryption and Access Control
• Integration with cloud environments such as Microsoft 365, Azure AD
• Automatic Document Conversion and Security Policy Application

Endpoint
The term refers to end-user devices such as personal computers or laptops where users actually create, edit, and view documents. Document Security encrypts documents and manages security on these endpoints.

• Protected targets: PC, laptops, and other user devices
• Protection methods: document encryption, access control, process protection

Orchestration
It means to harmoniously integrate and manage various security solutions and systems in a unified manner. Document Security provides orchestration capabilities to use internal DRM and cloud security together.

Main Role:

• Support for the Coexistence of Internal DRM and Cloud Security
• Integrated management of document conversion, permission management, and policy application

Document Security Core Security Technologies

Secure Document
Document Security refers to encrypted documents. Secure documents can only be viewed, edited, and printed by authorized users, preventing unauthorized copying or leakage.

DRM (Digital Rights Management, Digital Rights Management)
It is a technology that controls access and usage rights for documents. It refers to the internal document encryption method used in Document Security, allowing for fine-grained control of permissions such as reading, editing, and printing on a per-user or per-group basis.

MIP (Microsoft Information Protection)
A unified information protection platform provided by Microsoft, encompassing all of Microsoft's information protection technologies including MIP. Document Security works in conjunction with MIP to provide document security in the Microsoft 365 environment.

Term Relationship: MIP ⊃ Label

• MIP is Microsoft's comprehensive information protection platform.
• A label is a security classification mark assigned to a document in MIP.

Encryption Method

Document Security supports various encryption methods:

• Selective encryption: A method where users directly select the type of secure document (personal secure document, access target/permission setting secure document, regulatory secure document, classified secure document) to encrypt.
• Automatic (Forced) Encryption: This is a method that automatically encrypts documents under specific conditions according to the security policy set by the administrator. It is automatically applied at the time of SAVE, SAVE AS, and exit.
• Simple Encryption: A basic encryption method applied to files of applications that Document Security does not natively support. Basic encryption can be performed regardless of the file extension.

Encryption/Decryption

• Encryption: The process of converting the content of a document into an unreadable form using a specific algorithm. Document Security encrypts documents so that unauthorized users cannot access the content.
• Decryption: The process of reverting an encrypted document back to its original readable form. Only authorized users can decrypt and access the document.

Document Grade and Label

C/S/O grade system

Document Security supports three security levels:

Grade	Abbreviation	Security Level	Explanation
C grade	Classified	high	The highest security level with a confidentiality rating
S grade	Sensitive	middle	Medium security level for sensitive classification
O grade	Open	low	Low security level for public grade

Rating Assignment Method: Users can assign ratings to documents through the right-click menu. Ratings can be assigned manually according to the ZTCAP policy.

Terms Related to Labels

• Security Level: A classification system that indicates the security level of a document. It is a concept used in Document Security.
• Label: A security classification mark assigned to a document. Microsoft MIP uses labels to indicate the sensitivity and protection level of a document, and Document Security manages documents in conjunction with these labels.
• Security Label: A label that indicates the security level and protection level of a document. It visually represents the security status of the document, including classification (Label) and protection (Protect) information.

Permissions and Policies

Permission Type

Document Security can grant permissions in various ways:

• Category-based permissions: This is a method of classifying documents into categories and granting permissions based on those categories. Security policies can be established for the entire organization or for specific categories through the enterprise category and mandatory category.
• Grade-based permissions: This is a method of granting permissions based on the security grade of the document (C/S/O grade). Security policies can be set by grade through enterprise grade and enforced grade.
• Group/User-Based Permissions: This is a method of granting permissions directly to specific groups or users. You can set individual permissions on a document basis or grant enforced permissions.

Types of Permissions

User access and usage rights for security documents are categorized as follows:

• Reading: Document Viewing Permissions
• Edit: Document Edit Permissions
• Output: Document Print Permission
• Decryption: Document Decryption Permission
• Export: Permission for External Transmission of Documents
• Permission Change: Document Permission Modification Permission

Each permission can be finely controlled by user/group/category/level.

Policy

• ZTCAP (Zero Trust Conditional Access Policy): A conditional access policy based on Zero Trust. It is a system that automatically applies security policies based on various conditions such as the status of the document, user, location, and time. In Document Security, document conversion, encryption timing, etc. are managed under the ZTCAP policy.

Note: The ZTCAP policy is a core feature of Document Security 6, which automatically applies security policies based on various conditions such as document status, user, location, time, etc. Careful configuration is required when setting up the policy.

• Custom Policy: A user-defined policy set by the administrator to control the operation of Document Security. Policies such as DS_MIP_INIT, DS_MIP_SHELL_MENU, etc. are available.
• Execution Policy: Refers to the security policy to be applied when converting documents in ZTCAP. It determines what form (DRM/MIP) the document will be converted into, what grade/label will be applied, etc.
• Conditional Policy: A policy that is applied only when specific conditions are met. In ZTCAP, different policies can be applied based on conditions such as the status of the document, user, and path.

Authentication and Login

Authentication Method

• SSO (Single Sign-On, Single Login): An authentication method that allows automatic access to multiple systems with a single login. Document Security supports SSO with Microsoft 365, Azure AD, etc., providing user convenience.
• SHIELD ID: It is an integrated authentication service provided by the Security365 platform. It supports single sign-on for various systems such as Document Security, Azure Active Directory, and SCI servers.
• Single Sign-On: A feature that allows access to Security365, Azure Active Directory (MS365), and SCI servers with a single login through SHIELD ID.

Authentication Service

• Azure AD / Entra ID: A cloud-based directory and authentication service provided by Microsoft. Document Security performs user authentication in conjunction with Azure AD/Entra ID.

Document Conversion

Conversion Type

• DRM → MIP Conversion: The process of converting internal DRM encrypted documents to Microsoft MIP documents. This conversion is necessary for use in a cloud environment.
• MIP → DRM Conversion: The process of converting Microsoft MIP documents into internal DRM encrypted documents. This conversion is necessary for use in an internal security environment.
• Bidirectional Automatic Conversion: Refers to the automatic conversion between MIP documents and DRM encrypted documents. It is automatically converted according to the ZTCAP policy to fit the document's usage environment (local/cloud).

Conversion Method

Document Security can convert documents in various ways:

• Right-click conversion: This feature allows you to manually convert documents through the mouse right-click menu. It supports mutual conversion between DRM documents, MIP documents, and regular documents.
• Batch Conversion: This is a feature that allows you to convert multiple documents at once. Batch conversion is possible on a folder basis, and you can save and view conversion logs.
• Automatic Conversion: This is an automatic conversion according to the policy. It is automatically converted according to the ZTCAP policy at the time of upload/download.

Transformation Flow:

General Document ↔ DRM Document ↔ MIP Document
     ↑           ↑           ↑
  Manual Selection   Automatic Conversion   Cloud Integration

Cloud

Cloud Service

• OneDrive: A cloud file storage and sharing service provided by Microsoft. Document Security automatically converts documents uploaded to OneDrive into MIP or DRM documents according to policy.
• SharePoint: A collaboration and document management platform provided by Microsoft. Document Security supports security controls for documents in the SharePoint path.
• Google Drive: A cloud file storage service provided by Google. Document Security automatically converts documents according to policies during upload and download for Google Drive mounted in virtual drive (streaming) mode. Mirroring (local sync) mode is not supported.

Automatic Conversion Feature

• Automatic conversion during cloud upload: This feature automatically converts documents from the local path to MIP or DRM documents according to security policies when uploading to cloud storage such as OneDrive, SharePoint, or Google Drive.
• Automatic conversion during cloud download: This is a feature that automatically converts documents to the appropriate format according to security policies when downloading from cloud storage such as OneDrive/SharePoint/Google Drive to a local path.

Cloud Integration Flow:

Local DRM Document → [Upload] → OneDrive/SharePoint/Google Drive MIP Document  
OneDrive/SharePoint/Google Drive MIP Document → [Download] → Local DRM Document

Document Control and Protection

Control Function

• Document Permission Control: A feature that controls user access and usage rights for secure documents. Permissions such as reading, editing, printing, and decryption can be finely configured.
• Copy/Paste Control: A feature that prevents the copying or pasting of content from secure documents to regular documents. Depending on permissions, copying/pasting can be allowed or blocked.
• Screen Capture Control: A feature that prevents the contents of secure documents from being captured. An alert or warning window will be displayed when a capture attempt is made.
• Output Permission Control: This is a feature that controls the permission to print secure documents to a printer. You can set printing permissions based on users, groups, categories, and classifications.
• Virtual Printer Output Blocking: This feature prevents unauthorized output using a virtual printer when printing files.

Protection Function

• Usage period and frequency limit: This is a feature that restricts the number of times a secure document can be viewed/printed and its validity period. If the limit is exceeded, the document will be automatically destroyed.
• Print Marking: A feature that inserts tracking information such as user/group information, print time, ownership, etc., into the output document. It allows for tracking in case of document leakage.

Document Management

Encryption Management

• Batch Encryption: This is a feature that searches for regular documents on the local PC and encrypts them in bulk. Encryption policies can be set by user/department.
• Selective encryption: This is a method where the user directly selects the type of secure document to encrypt. You can choose from personal secure documents, access target/permission setting secure documents, regulatory secure documents, and classification secure documents.

Document Destruction

• Security Document Destruction: This is a function that completely deletes security documents to make them irretrievable.
• Automatic Destruction: This is a feature that automatically destroys security documents according to the set policy. It is executed automatically under conditions such as expiration of validity period or exceeding usage limits.

External Transmission

• Creating a secure file for external transmission: This is a function that generates a simple encrypted secure file (EXE) that can be executed without installing a client program. It is used when transmitting documents externally.

Logs and Monitoring

Log Types

• Integrated Log: An integrated log system that records all activities of Document Security. It logs events such as document creation, viewing, editing, printing, and conversion.
• Document log: A log that records all activities related to security documents. It includes events such as document creation, release, permission changes, conversion, viewing, editing, printing, and destruction.
• User Log: A log that records the user's product usage activities. It includes events such as product installation, login, and logout.

Monitoring Function

• Document Visibility: A feature that visualizes the entire lifecycle of a document from creation to distribution and usage by tracking the document flow. It graphically displays the document distribution path to enhance security management.

Other Terms

Authentication Related

• Offline Login: This is a feature that allows you to log in to Document Security and use secure documents even when there is no internet connection. Offline permissions can be set for each user/department.
• Token: A temporary certificate that contains user authentication information. Document Security performs user authentication through the token, and re-authentication is required when the token expires.
• Application Permission: The permission that the application uses to access Microsoft services. Document Security uses app permissions when releasing MIP documents.
• User Token: An authentication token issued to a specific user to access Microsoft services. Document Security uses the user token when creating MIP documents.