PDF Security
PDF files are not encrypted or otherwise protected by default - their content can be copied, printed, amended and distributed to third parties at will. Whilst this provides for an extremely accessible form of electronic document, it can create significant issues for publishers. There are two main approaches to adding security (usage restrictions and/or copyright protection) to PDF files:
- Standard PDF Security
- Digital Rights Management Security
Both topics are discussed below
Standard PDF Security
As a simple example, take the version 1.7 (ISO 32000-1 2008) PDF document itself. The Document Properties "security settings" tab for this file are shown below.
As can be seen, the author of this document (Adobe) have specified that the document cannot be changed, nor can its contents be copied or pages extracted. Other options, such as printing and commenting (annotating) are permitted.
There are several key points to note about these settings:
- no matter what the settings are, there are no controls on distribution of the entire document in its current form (no "digital rights management" or DRM)
- the security settings assume that the software used to view the file will respect these settings rather than ignore some or all of them - if the latter is the case the file may not be protected in the manner intended by the publisher. Indeed, when setting such security Adobe Acrobat displays a message confirming that these will not generally apply for third-party PDF readers, so is of limited value
- the security settings in this example are implemented using a private password and encryption level specified by the publisher - in most cases this security can be removed using readily available software tools and online services, so the "standard" encryption mechanism provides only limited protection
- the PDF 1.7 standards document referred to above is only encrypted with a 40-bit RC4 method, which can be easily removed. Stronger encryption options are available, notably AES with 128-bit or 256 keys, although some PDF reader software may not support the strongest level of encryption (Adobe Acrobat/Reader 9.0 or later is required in order to view AES-256 encrypted files - and in more recent versions of Adobe Acrobat/Reader the AES256 encryption method has been amended and no longer support the prior AES256 form of encryption). Even with this level of encryption the files can be relatively rapidly decrypted, rendering the protection of limited use. Companies like Elcomsoft provide low-cost software to decrypt all Adobe PDF security levels, including the AES 128- and 256-bit encryption levels. Elcomsoft do state that third-party add-in encryption utilities and/or proprietary DRM encryption systems (such as those offered by FileOpen and Drumlin Security) are not supported (i.e. cannot be decrypted using their software tools). In fact Elcomsoft used to provide software to remove the security provided by the FileOpen plugin but it is believed that they had to remove the facility following legal action.
Setting Standard Security
Many software packages that generate PDF files from source document editors provide the option to add basic security to exported PDF files. Once an unprotected PDF is generated, however, standard security settings can be added using a number of software packages. In most cases this will be Adobe's Acrobat software, where the options for defining security settings are shown in the image below:
Digital Rights Management (DRM) Security
Digital Rights Management (or DRM for short) is the term applied to the protection of digital assets using a centralized rights management service. It uses the combination of several distinct elements to provide the strongest possible protection of PDF documents, i.e. protection against copyright theft, amendment, forwarding files and much more. DRM services not only protect documents at the point of viewing, but also provide facilities to track access and in some instances, withdraw access permission from the end user.
For more details on DRM Security please see the Digital Rights Management article