Glossary
Product-related terms
| Terminology | Explanation |
|---|---|
| SHIELD DRM | Cloud-native DRM service that provides document security in Microsoft 365 and Google Workspace environments. In Microsoft 365, DRM documents are automatically converted to MIP documents, and in Google Workspace, document encryption is lifted according to conditional policies. |
| Document Security (DS) | Solution for managing and protecting DRM encrypted documents on local PC. Based on DS6 (version 6) |
| Document Security 365 (DS365) | A service that integrates Document Security with the Microsoft 365 environment. DRM ↔ MIP bidirectional conversion is a feature exclusive to the Microsoft 365 environment. |
| Security365 Portal | Integrated Management Portal for SHIELD DRM Usage |
| SHIELDrive | Service that supports file upload/download related to SHIELD DRM |
Terms related to Microsoft 365
| Terminology | Explanation |
|---|---|
| MIP (Microsoft Information Protection) | Microsoft's information protection solution. Protect organizational data through labels, classification, and security policies. SHIELD DRM automatically converts DRM documents to MIP documents. |
| Sensitivity Label (Sensitivity Label) | Information classification and protection labels created in Microsoft Compliance Center |
| Microsoft Entra ID | Old Azure AD. SHIELD DRM is the authentication system used in the MSAL authentication flow. |
| Compliance Center | Microsoft 365 Information Protection and Label Management Center |
| Tenant | Unique identifier unit of a Microsoft 365 organization..onmicrosoft.comDomain Criteria |
| Multi-GEO | Multi-region configuration of SharePoint supports site management for each region. |
| Microsoft Graph | Microsoft 365 Data Access API. Throttling limits applied to API requests |
| E3, E5 | Types of Microsoft 365 Subscription Licenses. E3 or higher is recommended when using SHIELD DRM. |
Terms related to Google Workspace
| Terminology | Explanation |
|---|---|
| Google Workspace (GWS) | A collection of Google’s cloud collaboration services. SHIELD DRM supports integration with Google Drive. |
| Domain | Unique identifier unit of a Google Workspace organization. Corresponds to a tenant in Microsoft 365. |
| Super Admin | The super administrator of a Google Workspace domain. Corresponds to the global administrator of Microsoft 365. |
| Service Account | Application-specific account that calls Google APIs on behalf of the user |
| Domain-Wide Delegation (DWD, Domain-Wide Delegation) | A setting that allows a service account to call the API with user permissions within the domain, approved by a super administrator. |
| Drive Label | Google Drive's document classification metadata. It does not correspond 1:1 with MIP labels as it does not include encryption and access enforcement. |
| CSE (Client-side Encryption) | Client-side encryption of Google Workspace. It is only for browser environments and cannot be used for server-side document conversion. |
Authentication and Authorization Terms
| Terminology | Explanation |
|---|---|
| Global Administrator | Microsoft 365— Tenant's highest authority administrator |
| Compliance Manager | Microsoft 365— Role with MIP label creation and publishing permissions |
| MSAL (Microsoft Authentication Library) | Microsoft 365— Microsoft Entra ID-based authentication library |
| Client Credential Flow | Microsoft 365— Authentication method to obtain a token using the app's Client ID/Client Secret |
| App ID / App Secret | Microsoft 365— SHIELD DRM service authentication security token pair |
| ACS (Azure Access Control Service) | Microsoft 365— Legacy app authentication service. Ending April 2026 |
| Impersonation (Delegated Call) | Google Workspace— A service account calling the API with specific user permissions through domain-wide delegation |
Terms Related to DRM Encryption
| Terminology | Explanation |
|---|---|
| DAC (Document Access Control) | DRM Document Permission Control Method. Fine-grained control of permissions by user. |
| MAC (Mandatory Access Control) | Document Classification-Based Mandatory Access Control Method |
| GRADE (Grade) | Access control methods based on document classification (confidential, internal use, etc.) |
| BYOK (Bring Your Own Key) | The method by which the client provides its own encryption key to protect the document. |
| HYOK (Hold Your Own Key) | How the customer’s key management server holds encryption keys |
| SCI Server | External server managing encryption keys and permission policies |
| DRM Document Conversion | Microsoft 365— Process of converting DRM encrypted documents to MIP labeled documents |
| Document Decryption | Google Workspace— Processing to decrypt DRM encrypted documents according to conditional policies. The only enforcement action provided by the cloud, and re-protection is performed by Document Security at the time of downloading to the local PC. |
Policy-related Terms
| Terminology | Explanation |
|---|---|
| Conditional Policy | A policy engine that automatically applies security policies based on conditions such as user, location, time, and document type. Common to Microsoft 365 and Google Workspace. |
| Endpoint Policy | Conditional policies set in Document Security of Local PC |
| Cloud Storage Policy | Conditional policies applied to documents distributed in OneDrive, SharePoint, Teams, and Google Drive (My Drive · Shared Drive) |
| SDF (Sensitive Docs Flow) | A framework that provides fine-grained control for document security (encryption, decryption, export, and application of hidden information) |
| Policy Priorities | Determine the execution order when multiple policies conflict. Higher priority policies are executed first. |
| Non-Retry Keywords | Microsoft 365— Specific keywords and phrases that are exceptions during MIP conversion/release |
Event Handling and Synchronization Terms
| Terminology | Explanation |
|---|---|
| Event Receiver | Microsoft 365— A mechanism for detecting and receiving file events in SharePoint/OneDrive. Replaces the existing Add-In method. |
| Add-In | Microsoft 365— Individual installation required for each site with the existing SharePoint integration method. Discontinued with the end of ACS. |
| Webhook | Microsoft 365— SharePoint sends an HTTP POST request to the server endpoint asynchronously when an event occurs. |
| Subscription (Subscription) | Registering a Webhook or Event Receiver to a specific resource |
| Drive Event Channel | Google Workspace— Change notification channel registered by drive unit. Corresponds to the event receiver and has a maximum validity period of 7 days, so re-registration is required before expiration. |
| Change Log 조회 | Google Workspace— A method to view only the changes made after the last confirmation point following a change notification. |
Performance-related terms
| Terminology | Explanation |
|---|---|
| Throttling | Microsoft 365— Mechanism by which Microsoft applies rate limiting to API requests |
| API Quota | Google Workspace— Google Drive API applies request limits at the project · user level. If exceeded, a 429 or 403 rateLimitExceeded response is returned. |
| Rate Limiting | Technology for limiting the number of API requests within a specific time frame |
| Token Bucket | Rate Limiting method that issues tokens at a fixed rate and consumes tokens during request processing. |
| Retry Logic | A mechanism that automatically retries the operation in case of a temporary error. |
| Queue | A structure that manages documents waiting for processing in order. |
Storage-related terms
| Terminology | Explanation |
|---|---|
| OneDrive | Microsoft 365— Personal cloud storage. SHIELD DRM event detection target |
| SharePoint | Microsoft 365— Document library and collaboration platform. Event Receiver installation target |
| Teams | Microsoft 365— Team collaboration platform. Supports document upload in the file tab. |
| Site Collection (Site Collection) | Microsoft 365— A top-level unit of SharePoint that includes multiple sites. There is no corresponding concept in Google Workspace. |
| Document Library | Microsoft 365— Library for managing my documents in SharePoint |
| Google Drive | Google Workspace— Cloud Storage. It is divided into My Drive and Shared Drive, and is a target for SHIELD DRM event detection. |
| My Drive | Google Workspace— User-owned drive area |
| Shared Drive | Google Workspace— Drive area owned and managed by the team. To apply policies, the service account must be added as a member with at least participant privileges. |
Log and Monitoring Terms
| Terminology | Explanation |
|---|---|
| Dashboard | Admin screen for monitoring the status of conditional policy operations and document status. The displayed items vary depending on the cloud service in use. |
| User Log | User's document conversion status record |
| Admin Log | Action Log in the Admin Page |
| Audit Log | Detailed Activity Logs for Security Auditing |
| Integrated Log | Integrate and manage logs for file conversion, decryption, and blocking of senders. |
Infrastructure Terms
| Terminology | Explanation |
|---|---|
| Kubernetes (K8s) | Container orchestration platform. SHIELD DRM deployment environment |
| RabbitMQ | Message Broker. Used for event reception and asynchronous processing. |
| ConfigMap | Object that manages application configuration in Kubernetes |
| Event Hub | Central Receiving and Processing System of Event-Driven Architecture |
Security-related terms
| Terminology | Explanation |
|---|---|
| Document-Centric Security | Document-centric security approach that applies encryption and policies to the document itself |
| Permission Rights (Rights) | Access permissions for the document. Reading, editing, output, export, release, permission changes, print marking, validity period, etc. |
| Print Marking | A security feature that marks specific marks on the document during printing to ensure traceability. |
| DLP (Data Loss Prevention) | Policy to Prevent Sensitive Data from Leaking Outside the Organization |