Aloaha Secure PDF Viewer

PDF Documents can be restriced in printing, content extraction, etc. The problem is that those restrictions are just flags in the PDF document itself. Any viewer Software which does not respect those flags will still allow the user to access the restricted features. This renders PDF permissions as Digital Rights Management (DRM) useless. Additional to that there is no easy way to restrict the user of leaking the document to a non authorized person.

 

With Aloaha it is possible to encrypt a document in such a way that only the two above mentioned products are able to load those documents. When Aloaha detects such a document it will NOT allow saving, printing, signing etc. and renders itself into a powerfull DRM Viewer!

 

 

 

The PDF Document we are going to use in our demonstration is located at http://www.aloaha.com/testdocuments/form.pdf. If you click on that link the document will be loaded in your default PDF Viewer.

 

To convert that document into the sPDF (secure PDF) format the Aloaha PDF SDK contains the functions Stream_SecureFile and Stream_SecureFileSTR.

 

The URL http://www.aloaha.com/testdocuments/spdf.asp will on the fly convert form.pdf into a secure format and launch the Aloaha Viewer. The Web Browser will download the secure PDF into the local temp folder and display it in Aloaha. Like this it is not possible to print or modify the document. Obviously it is still possible to grab the document from the temp directory and pass it to a non authorized persion to view it with Aloaha.

 

A much more secure way is to launch the Aloaha Secure Viewer via command line parameter. For example:

 

When launched via command line parameter the Webrowser is not involved and the PDF is loaded directly into the computer memory thus avoiding the file in the temp folder. Obviously it is possible to use a client side script in the webpage to automatically launch Aloaha with a command line parameter. If now the link supplied is a one time link the only way of grabbing the document would be a network Sniff. Such a Sniff can be avoided if HTTPS is used!