Core Technology

1. Cloud-Native DRM Conversion

Overview

SHIELD DRM is a service that automatically applies DRM encryption to documents distributed in a cloud environment. It supports the seamless use of existing DRM encrypted documents by automatically converting them into Microsoft’s MIP (Microsoft Information Protection) labeled documents for the Microsoft 365 environment.

Operating Principle

Existing DRM Environment

1. Create DRM encrypted document on local PC  
2. Upload to cloud (OneDrive/SharePoint)  
3. Cannot view in Microsoft 365 (compatibility issue)  
└─ Issue: DRM documents have usage restrictions in cloud collaboration environments

SHIELD DRM Application Environment

1. Upload DRM encrypted documents to OneDrive/SharePoint/Teams  
2. SHIELD DRM detects the event  
3. Automatically convert DRM documents to MIP labeled documents  
4. View/Edit/Co-authoring available in Microsoft 365  
└─ Effect: Supports cloud collaboration while maintaining existing DRM security policies

Target of Transformation

DRM Encryption Types

• DAC (Document Access Control) — Fine-grained permission control by user
• MAC (Mandatory Access Control) — Document Classification Based Mandatory Access Control
• GRADE — Access control based on document classification (confidential, internal use, etc.)

Supported Storage

• OneDrive for Business
• SharePoint Online
• Microsoft Teams (Files Tab)

2. Event-Based Real-Time Detection

Overview

SHIELD DRM automatically applies encryption policies by detecting file events occurring in Microsoft 365 storage in real time. Security policies are applied immediately as documents are uploaded without user intervention.

Event Reception Method

Event Receiver Method

1. File event occurs in SharePoint/OneDrive  
   (Creation, Modification, Move, Upload)  
   ↓  
2. Event Receiver detects the event  
   ↓  
3. Event is sent to SHIELD DRM server  
   ↓  
4. Conditional policy evaluation  
   ↓  
5. Execute DRM/MIP conversion according to policy

Event to be detected

Storage	Detection Event	Explanation
OneDrive	Add/Modify/Move File	Document Change Detection in Personal Cloud Storage
SharePoint	Document Library Change	Team site, communication site file events
Teams	File Tab Upload	File Sharing Events in Teams Channels

3. Conditional Policy

Overview

Conditional policies are the core policy engine of SHIELD DRM that automatically apply encryption based on various conditions such as user, location, time, and document type.

Policy Type

Endpoint Policy
Target: Document Security 6 on Local PC
Control: Direct application of document encryption and decryption policies on PC

• DRM ↔ MIP Conversion Policy
• Document Access Control by Level
• Specify conversion targets by extension

Cloud Storage Policy
Target: OneDrive, SharePoint, Teams
Control: Automatic policy application to documents uploaded to the cloud

• Automatic Encryption on Upload
• Differentiated Policies by Storage
• Separation of Policies by User/Group

SDF (Sensitive Docs Flow)
Target: All documents within the organization
Control: Detailed Document Security Policy

• Encryption / Decryption
• Export Control
• Application of concealed information

Policy Condition Elements

condition	Explanation	example
User/Group	Applying policies to specific users or groups	Executive Group: Automatic Application of Confidentiality Level
IP Range	Network Location-Based Control	Company IP: Allow Decryption
time zone	Specific Time Condition	Outside of business hours: Export blocking
Document Type	Extension, Control by Encryption Type	.docx: MIP conversion, .pdf: DRM preservation
Policy Priorities	Determining Execution Order in Case of Multiple Policy Conflicts	High Priority Policy Applied First

4. DRM-MIP Permission Mapping

Overview

Automatically map the permission system of the existing DRM encryption document to Microsoft’s MIP label permissions, maintaining the same level of security even after conversion.

Mapping Structure

DRM Permissions                    MIP Permissions
─────────                   ─────────
읽기 (Read)            →    View
편집 (Edit)            →    Edit
출력 (Print)           →    Print
반출 (Export)           →    Extract
해제 (Decrypt)         →    Full Control
권한 변경               →    Change Permissions
프린트마킹              →    Print (with watermark)
유효기간                →    Content Expiration

Key Management

method	Explanation
BYOK (Bring Your Own Key)	Document protection by the customer providing their encryption key
HYOK (Hold Your Own Key)	Directly holding encryption keys in the customer's key management server
SCI Server Integration	Key management in conjunction with the encryption key server of Document Security

5. High Availability and Stability

Overview

SHIELD DRM provides a high-availability architecture to reliably handle large volumes of document conversion requests.

Main Mechanism

Retry Logic

1. Document conversion request
   ↓
2. Temporary error occurred (network, API limits, etc.)
   ↓
3. Registered in retry queue
   ↓
4. Automatic retry according to backoff strategy
   ↓
5. Removed from queue on success / Notification to administrator on failure

MS Throttling Management
Microsoft Graph API applies throttling based on the request volume. SHIELD DRM detects this and automatically adjusts the request rate to ensure service stability.

status	Explanation	Response
normal	Normal processing of API requests	Immediate processing
Throttling Detection	Receiving 429 Response	Automatic Request Speed Adjustment
Retry-After	Specify Wait Time	Retry after specified time

Multi-Tenant Support
Minimize the impact between tenants through independent event handling and resource separation for each tenant.

6. Document Security 365 Integration

Overview

Document Security 365 is a client solution that supports bidirectional conversion between DRM documents and MIP documents in a local PC environment.

Main Features

• DRM ↔ MIP bidirectional conversion
• Instant conversion through right-click shell menu
• Automatic Mapping Between DRM Policy and MIP Policy
• Label Visualization
  • Display of dedicated icons for MIP label application documents
  • Check encryption status instantly with label color

Requirements

item	This is
Document Security Version	6.0.3.24 or higher
Microsoft 365 Plan	Business Premium or E3 or higher
Sensitivity Label	Completion of label creation and publishing in Microsoft Compliance Center