Overview of SDF Functionality
**SDF(SensitiveDocsFlow)**applies security policies throughout the entire process from the creation to distribution and storage of documents and can track them.Document-Centric Security Platformis.
It can integrate document encryption and policy management features without changing the existing workflow, linked with the client’s business system and API.
1. Document Encryption / Decryption
Performs encryption and decryption based on the access control policy for the document.
| Support Method | Explanation |
|---|---|
| DAC(Arbitrary Access Control) | The document owner directly assigns permissions for encryption |
| MAC(Mandatory Access Control) | Automatically apply encryption according to the organization's security level policy. |
| GRADE | Perform encryption based on document security classification (confidential, restricted, etc.) |
- Customer's business systemREST API callIt is possible to perform encryption and decryption in one go.
- During encryption, security headers are automatically inserted, allowing you to check the document's protection status at any time.
2. Document Header Information Management
The encrypted document containsSecurity Policy Metadatais inserted as a header.
- Insertion Information: Permission level, encryption method, policy ID, processing date and time, etc.
- Query API: The current security status of the document can be checked in real-time from external systems.
- Usage Example: Pre-check security level before document access, policy violation document detection
3. Sensitive Information (SFI) Management
inside the office documentSteganographic File Information for Source TrackingInserts.
- Insertable Information: TxID(Transaction ID), system name, processing date and time, user information, etc.
- Query / Delete: You can check or remove hidden information through a dedicated API.
- Purpose: Trace the original source to identify the leak path in case of document leakage.
4. Document Lineage Tracking (InfoLineage)
When the document is copied or derivedParentDoc IDautomatically inserting it to track the relationship between the original and derivative documents.
Original Document (DocID: A)
├── Copy 1 (DocID: B, ParentDoc: A)
│ └── Revision (DocID: D, ParentDoc: B)
└── Copy 2 (DocID: C, ParentDoc: A)
- The entire distribution flow of the document can be understood in a tree structure.
- Utilization for Security Audits and Compliance Responses
5. API Integration
SDF provides two API frameworks that flexibly integrate with business systems in various environments.
| API Type | Target | Main Features |
|---|---|---|
| Customer-specific API | In-house Work System | Encryption/Decryption, Header Retrieval, Hidden Information Insertion/Retrieval/Deletion, Label Management |
| Security365 Integration API | Security365 Service | Same functionality + authentication check, security level management, and other additional features |
- Designed in a RESTful manner, callable regardless of language/platform.
- Detailed API specifications areAPI GuidePlease refer to the document.
6. Installation and Configuration Method
SDF is tailored to the customer's environment.Two Deployment Methodssupports.
| Configuration Method | form | Suitable Environment |
|---|---|---|
| [SDF Container](./What is SDF Container.md) | Sidecar Container | Kubernetes/POD based cloud environment |
| [SDF App](./What is SDF APP.md) | JAR-based application | Existing on-premises or VM-based server environment |
- SDF Container: Deployed as a sidecar within the business system POD, operating independently.
- SDF App: Compatible with existing Java library (SCSL.jar) — Maintain existing integration structure without code modification
7. Logs and Monitoring
All security processing procedures of SDF areEvent LogIt is recorded and used for operational monitoring and security auditing.
| Log Target | Record content |
|---|---|
| EKMS | Key issuance/viewing, authentication processing history |
| SKMS | Encryption and Decryption Request/Response, Header Processing History |
| SDF Container | API call, file processing, hidden information insertion history |
- Support for real-time metric collection through Prometheus integration
- Provides a systematic log classification system based on event codes