Core Technology

1. Cloud-Native DRM Conversion

Overview

SHIELD DRM is a service that automatically applies conditional policies to documents distributed in a cloud environment. In the Microsoft 365 environment, it supports the seamless use of existing DRM encrypted documents by automatically converting them into Microsoft's MIP (Microsoft Information Protection) labeled documents, and in the Google Workspace environment, it detects changes in Google Drive and decrypts documents according to conditional policies.

Operating Principle

Existing DRM Environment

1. Create DRM encrypted document on local PC  
2. Upload to cloud storage  
3. Cannot be viewed in cloud collaboration tools (compatibility issue)  
└─ Issue: DRM documents have usage restrictions in cloud collaboration environments

SHIELD DRM Application Environment — Microsoft 365

1. Upload DRM encrypted documents to OneDrive/SharePoint/Teams  
2. SHIELD DRM detects the event  
3. Automatically convert DRM documents to MIP labeled documents  
4. View/edit/co-author in Microsoft 365  
└─ Effect: Supports cloud collaboration while maintaining existing DRM security policies

SHIELD DRM Application Environment — Google Workspace

1. Upload the DRM encrypted document to Google Drive (My Drive/Shared Drive)
2. SHIELD DRM detects drive change events
3. After conditional policy evaluation, lock document → decrypt → unlock
4. Can view/edit/collaborate in Google Workspace
5. At the point of downloading to a local PC, Document Security reapplies DRM protection
└─ Effect: Supports cloud collaboration while maintaining existing DRM security policies

Target of Transformation

DRM Encryption Types

• DAC (Document Access Control) — Fine-grained permission control by user
• MAC (Mandatory Access Control) — Mandatory Access Control Based on Document Classification
• GRADE — Document access control based on classification (confidential, internal use, etc.)

Supported Storage — Microsoft 365

• OneDrive for Business
• SharePoint Online
• Microsoft Teams (Files Tab)

Support Storage — Google Workspace

• Google Drive — My Drive
• Google Drive — Shared Drive
• Google Drive for desktop synchronization path included

2. Event-Based Real-Time Detection

Overview

SHIELD DRM automatically applies conditional policies by detecting file events occurring in cloud storage.

• Microsoft 365— Security policies are applied immediately when documents are uploaded without user intervention.
• Google Workspace— After detecting changes through the registered notification channel on the drive, policies are applied. Automatic encryption at the time of upload is not provided.

Event Reception Method

Event Receiver Method (Microsoft 365)

1. File event occurs in SharePoint/OneDrive  
   (Creation, Modification, Move, Upload)  
   ↓  
2. Event Receiver detects the event  
   ↓  
3. Event is sent to the SHIELD DRM server  
   ↓  
4. Conditional policy evaluation  
   ↓  
5. Execute DRM/MIP conversion according to the policy

Drive Event Channel Method (Google Workspace)

1. Install change notification channel by drive unit  
   ↓  
2. File change occurs in Google Drive  
   ↓  
3. Channel delivers change notification to SHIELD DRM server  
   ↓  
4. Retrieve change list and evaluate conditional policy  
   ↓  
5. Execute document decryption according to policy

Event to be detected

Microsoft 365

Storage	Detection Event	Explanation
OneDrive	Add/Modify/Move Files	Document Change Detection in Personal Cloud Storage
SharePoint	Document Library Change	Team site, communication site file events
Teams	File Tab Upload	File Sharing Events in Teams Channels

Google Workspace

Storage	Detection Event	Explanation
My Drive	File Change	Change Detection in Personal Drive Documents
Shared Drive	File Change	Document Change Detection in Team Shared Drive

Google Drive delivers changes as a single event without distinguishing between creation, modification, and movement. Drives that do not have the channel installed are excluded from detection, and newly created shared drives are not automatically detected. Files attached to Google Chat are currently not included in the supported scope.

3. Conditional Policy

Overview

Conditional policies are the core policy engine of SHIELD DRM that automatically apply security policies based on various conditions such as user, location, time, and document type. The policy engine is common to Microsoft 365 and Google Workspace, and only the enforcement actions differ by platform.

Policy Type

Endpoint Policy
Target: Document Security 6 on Local PC
Control: Apply document encryption and decryption policies directly on the PC

• DRM ↔ MIP Conversion Policy
• Access Control by Document Level
• Specify conversion targets by extension

Cloud Storage Policy
Target: OneDrive, SharePoint, Teams, Google Drive (My Drive · Shared Drive)
Control: Automatic Policy Application to Documents Distributed in the Cloud

• Microsoft 365 — Automatic encryption on upload, differential policies by storage, separation of policies by user/group
• Google Workspace — Drive Unit Policy Targeting, DRM Document Decryption

SDF (Sensitive Docs Flow)
Target: All documents within the organization
Control: Granular Document Security Policy

• Encryption / Decryption
• Export Control
• Application of Concealed Information

Policy Condition Elements

condition	Explanation	example
User/Group	Apply policies to specific users or groups	Executive Group: Automatic Application of Confidentiality Level
IP Range	Network Location-Based Control	Company IP: Allow decryption
Time Zone	Specific Time Condition	Outside of business hours: Export blocking
Document Type	Extension, Control by Encryption Type	.docx: MIP Conversion (Microsoft 365), .pdf: Maintain DRM
Policy Priorities	Determining Execution Order in Case of Multiple Policy Conflicts	High Priority Policy Applied First

The enforcement actions provided by Google Workspace policies are문서 암호화 해제It is one. MIP conversion and document deletion are only available in Microsoft 365 policies.

4. DRM-MIP Permission Mapping

This section is for Microsoft 365 environments only. Google Workspace does not have a permission system corresponding to MIP, and Google Drive labels provide only document classification information without including encryption and access enforcement.

Overview

Automatically map the permission system of the existing DRM encryption document to Microsoft’s MIP label permissions, maintaining the same level of security even after conversion.

Mapping Structure

DRM Permissions                    MIP Permissions
─────────                   ─────────
읽기 (Read)            →    View
편집 (Edit)            →    Edit
출력 (Print)           →    Print
반출 (Export)           →    Extract
해제 (Decrypt)         →    Full Control
권한 변경               →    Change Permissions
프린트마킹              →    Print (with watermark)
유효기간                →    Content Expiration

Key Management

Method	Explanation
BYOK (Bring Your Own Key)	Customer provides their encryption key to protect the document
HYOK (Hold Your Own Key)	Directly holding encryption keys on the customer's key management server
SCI Server Integration	Key management by integrating with the encryption key server of Document Security

5. High Availability and Stability

Overview

SHIELD DRM provides a high-availability architecture to reliably handle large volumes of document processing requests.

Main Mechanisms

Retry Logic

1. Document processing request  
   ↓  
2. Temporary error occurred (network, API limits, etc.)  
   ↓  
3. Registered in retry queue  
   ↓  
4. Automatic retry according to backoff strategy  
   ↓  
5. Removed from queue on success / Notification to administrator on failure

API Request Limit Management — Microsoft 365
Microsoft Graph API applies throttling based on the request volume. SHIELD DRM detects this and automatically adjusts the request rate to ensure service stability.

status	Explanation	Response
normal	Normal processing of API requests	Immediate processing
Throttling Detection	Receiving 429 Response	Automatic Request Speed Adjustment
Retry-After	Specify Wait Time	Retry after specified time

API Request Limit Management — Google Workspace
Google Drive API applies request quotas at the project and user level. SHIELD DRM detects quota exceeded responses and adjusts the request rate.

status	Explanation	Response
normal	Normal processing of API requests	Immediate processing
Quota exceeded	Receiving 429 or 403 rateLimitExceeded responses	Index Backoff Automatic Retry
Channel Expiration Imminent	Expiration of the notification channel (maximum 7 days)	Automatic Re-registration of Channels Before Expiration

Multi-Organization Support
Microsoft 365 separates event processing and resources at the tenant level, while Google Workspace does so at the domain level to minimize the impact between organizations.

6. Document Security 365 Integration

The DRM ↔ MIP conversion feature of this section is exclusive to the Microsoft 365 environment. In the Google Workspace environment, it is linked by reapplying DRM protection through Document Security on documents downloaded from Google Drive.

Overview

Document Security 365 is a client solution that supports bidirectional conversion between DRM documents and MIP documents in a local PC environment.

Main Features

• DRM ↔ MIP bidirectional conversion
• Instant conversion through the mouse right-click shell menu
• Automatic Mapping Between DRM Policy and MIP Policy
• Label Visualization
  • Display of dedicated icons for MIP label application documents
  • Instantly check encryption status with label color

Requirements

item	This is
Document Security Version	6.0.3.24 or higher
Microsoft 365 Plans	Business Premium or E3 or higher
Sensitivity Label	Completed creation and publication of labels in Microsoft Compliance Center