Core Technology

1. Cloud-Native DRM Conversion

Overview

SHIELD DRM is a service that automatically applies DRM encryption to documents distributed in a cloud environment. It supports the seamless use of existing DRM encrypted documents by automatically converting them into Microsoft’s MIP (Microsoft Information Protection) labeled documents for the Microsoft 365 environment.

Operating Principle

Existing DRM Environment

1. Create DRM encrypted document on local PC  
2. Upload to cloud (OneDrive/SharePoint)  
3. Cannot view in Microsoft 365 (compatibility issue)  
└─ Issue: DRM documents have usage restrictions in cloud collaboration environments

SHIELD DRM Application Environment

1. Upload DRM encrypted documents to OneDrive/SharePoint/Teams  
2. SHIELD DRM detects the event  
3. Automatically convert DRM documents to MIP labeled documents  
4. View/edit/collaborate in Microsoft 365  
└─ Effect: Supports cloud collaboration while maintaining existing DRM security policies

Target of Transformation

DRM Encryption Types

• DAC (Document Access Control) — Fine-grained permission control by user
• MAC (Mandatory Access Control) — Document Classification Based Mandatory Access Control
• GRADE — Document access control based on classification (confidential, internal use, etc.)

Supported Storage

• OneDrive for Business
• SharePoint Online
• Microsoft Teams (Files Tab)

---

2. Event-Based Real-Time Detection

Overview

SHIELD DRM automatically applies encryption policies by detecting file events occurring in Microsoft 365 storage in real-time. Security policies are applied immediately as documents are uploaded without user intervention.

Event Reception Method

Event Receiver Method

1. File event occurs in SharePoint/OneDrive  
   (Creation, Modification, Move, Upload)  
   ↓  
2. Event Receiver detects the event  
   ↓  
3. Event is sent to SHIELD DRM server  
   ↓  
4. Conditional policy evaluation  
   ↓  
5. Execute DRM/AIP conversion according to policy

Event to be detected

Storage	Detection Event	Description
OneDrive	Add/Modify/Move File	Document Change Detection in Personal Cloud Storage
SharePoint	Document Library Change	Team site, communication site file events
Teams	File Tab Upload	File Sharing Events in Teams Channels

---

3. Conditional Policy

Overview

Conditional policies are the core policy engine of SHIELD DRM that automatically apply encryption based on various conditions such as user, location, time, and document type.

Policy Type

Endpoint Policy

Target: Document Security 6 on Local PC  
Control: Apply document encryption/decryption policies directly on the PC  
- DRM ↔ MIP conversion policy  
- Access control by document grade  
- Specify conversion targets by extension

Cloud Storage Policy

Target: OneDrive, SharePoint, Teams  
Control: Automatic policy application to documents uploaded to the cloud  
- Automatic encryption upon upload  
- Differential policies by storage  
- Separation of policies by user/group

SDF (Sensitive Docs Flow)

Target: All documents within the organization  
Control: Granular document security policy  
- Encryption / Decryption  
- Export control  
- Application of hidden information

Policy Condition Elements

condition	Description	example
User/Group	Applying policies to specific users or groups	Executive Group: Automatic Application of Confidentiality Level
IP Range	Network Location-Based Control	Company IP: Allow Decryption
Time Zone	Specific time condition	Outside of business hours: Export blocking
Document Type	Extension, Control by Encryption Type	.docx: AIP conversion, .pdf: DRM preservation
Policy Priorities	Determining Execution Order in Case of Multiple Policy Conflicts	High Priority Policy Applied First

---

4. DRM-MIP Permission Mapping

Overview

Automatically map the permission system of the existing DRM encryption document to Microsoft’s MIP label permissions, maintaining the same level of security after conversion.

Mapping Structure

DRM Permissions                    MIP Permissions
─────────                   ─────────
읽기 (Read)            →    View
편집 (Edit)            →    Edit
출력 (Print)           →    Print
반출 (Export)           →    Extract
해제 (Decrypt)         →    Full Control
권한 변경               →    Change Permissions
프린트마킹              →    Print (with watermark)
유효기간                →    Content Expiration

Key Management

Method	Description
BYOK (Bring Your Own Key)	Protecting documents by providing their own encryption keys.
HYOK (Hold Your Own Key)	Directly holding encryption keys on the customer's key management server
SCI Server Integration	Key management by integrating with the encryption key server of Document Security

---

5. High Availability and Stability

Overview

SHIELD DRM provides a high-availability architecture to reliably handle large volumes of document conversion requests.

Main Mechanism

Retry Logic

1. Document conversion request
   ↓
2. Temporary error occurred (network, API limits, etc.)
   ↓
3. Registered in retry queue
   ↓
4. Automatic retry according to backoff strategy
   ↓
5. Removed from queue on success / Admin notification on failure

MS Throttling Management

Microsoft Graph API applies throttling based on the request volume. SHIELD DRM detects this and automatically adjusts the request rate to ensure service stability.

status	Description	Response
normal	Normal processing of API requests	Immediate processing
Throttling Detection	Receiving 429 Response	Automatic Request Speed Adjustment
Retry-After	Specify Wait Time	Retry after specified time

Multi-Tenant Support

Minimize the impact between tenants through independent event handling and resource separation for each tenant.

---

6. Document Security 365 Integration

Overview

Document Security 365 is a client solution that supports bidirectional conversion between DRM documents and MIP documents in a local PC environment.

Main Features

DRM ↔ MIP bidirectional conversion

• Instant conversion through right-click shell menu
• Automatic Mapping Between DRM Policy and MIP Policy

Label Visualization

• Display of dedicated icons for MIP label application documents
• Check encryption status instantly with label color

Requirements

item	This is
Document Security	Version 6.0.3.24 or higher
Microsoft 365 Plan	Business Premium or E3 or higher
Sensitivity Label	Completion of label creation and publishing in Microsoft Compliance Center