User-controlled document processing

[0002] The present invention relates to document processing generally and more particularly to document processing which is protected against unauthorized access.

[0003] Problems of security in information transmission have been addressed in various ways in the prior art. Various types of encryption techniques are presently used to provide desired levels of security for information transmission and to prevent unauthorized access thereto or modification thereof

[0004] Protecting the security of documents at the time and location of their creation has not been addressed in the same manner. Generally, security of documents generated using electronic apparatus is ensured by physical security of the electronic apparatus. Thus computers or the storage media thereof are maintained in physically secure installations.

[0005] Ensuring the security of documents in environments wherein maintenance of the computers or the storage media in physically secure installations is impractical appears to be a problem still awaiting a solution.

[0006] Various techniques are known for protection of communications against unauthorized access. Scrambling and various other forms of encryption are commonly employed for this purpose. Generally, an entire file is protected in this way.

[0007] There is described in applicant/inventor's pending PCT patent application, PCT/US94/08684 an apparatus and method for creating and transmitting confidential documents, the disclosure of which is hereby incorporated by reference. Disclosed inter alia in this document is the encryption of only part of a document, wherein the header of the document is left unencrypted.

[0008] In computer operating systems and methods it is common for a user carrying out a first process to trigger the operation of a second process. The trigger is typically the entry of a predetermined command which can be achieved using a conventional keyboard or mouse.

[0009] Designing the trigger is relatively straightforward when the programmer has access to the first process and is allowed to make changes thereto in order to accommodate the predetermined command.

[0010] Increasingly, there are operating environments which are in extremely widespread use, but whose operating commands cannot be accessed and modified in practice by designers of such second processes. Such operating environments may include operating systems, such as WINDOWS, a trademark of Microsoft Corporation, and operating processes, such as WORD 2.0 FOR WINDOWS, a trademark of Microsoft Corporation.

[0011] Even when the operating commands can be accessed and modified by designers of such second processes, it is often impractical or uneconomical to do so, since such modifications would require changes such as the creation of new “macros” for each application. There may exist therefore many “non-modified” operating environments for which the present invention is particularly suited.

[0012] The present invention concerns triggers operating in non-modified operating environments for enabling a user carrying out a first process to trigger the operation of a second process.

[0013] The present invention seeks to provide a secure document processing system, which preserves the security of documents processed thereby even in the absence of physical security at the location of the system.

[0014] There is thus provided in accordance with a preferred embodiment of the present invention, a secure document processing system including a document processor having an input device for inputting information in a non-secure form, an information storage medium associated with the document processor, and encryption apparatus associated with the document processor and with the information storage medium and being operative to encrypt all information received from the document processor prior to storage thereof by the information storage medium in a secure form.

[0015] In accordance with a preferred embodiment of the present invention, the system includes automatic encryption and storage apparatus which automatically encrypts and then stores information inputted by the input device periodically in order not to lose said information upon cessation of the supply of electrical power to the document processor. This cessation may be intentional or unintentional.

[0016] Additionally in accordance with a preferred embodiment of the present invention, the system includes automatic encryption and storage apparatus which automatically encrypts and then stores information inputted by the input device upon interruption of information input for at least a predetermined time. Such interruption is normally indicative of the possible absence or lack of attention of the user.

[0017] There is also provided in accordance with a preferred embodiment of the present invention a secure document processing system including a document processor having an input device for inputting information in a non-secure form, an information output device associated with the document processor, and encryption apparatus associated with the document processor and with the information output device and being operative to encrypt all information received from the document processor prior to output thereof by the information output device in a secure form.

[0018] In accordance with a preferred embodiment of the present invention, the system includes automatic encryption and output apparatus which automatically encrypts and then outputs information inputted by the input device periodically in order not to lose said information upon cessation of the supply of electrical power to the document processor.

[0019] Additionally in accordance with a preferred embodiment of the present invention, the system includes automatic encryption and output apparatus which automatically encrypts and then outputs information inputted by the input device upon interruption of information input for at least a predetermined time.

[0020] Preferably, the document processor is incapable of storing information in a non-secure form.

[0021] The information storage medium may be any suitable information storage medium, such as a magnetic medium. The information output device may be a printer or information transmitter.

[0022] There is additionally provided in accordance with a preferred embodiment of the present invention a secure document processing method including generating a document in a non-secure form on a document processor using an input device for inputting information, encrypting all information received from the document processor prior to storage thereof, and storing of the information following encryption thereof on an information storage medium.

[0023] In accordance with a preferred embodiment of the present invention, the method includes automatic encryption and storage of information inputted by the input device periodically in order not to lose said information upon cessation of the supply of electrical power to the document processor.

[0024] Additionally in accordance with a preferred embodiment of the present invention, the method includes automatic encryption and storage of information inputted by the input device upon interruption of information input for at least a predetermined time.

[0025] There is further provided in accordance with a preferred embodiment of the present invention a secure document processing method including generating a document in a non-secure form on a document processor using an input device for inputting information, encrypting all information received from the document processor prior to output thereof, and outputting of the information following encryption thereof on an information storage medium.

[0026] In accordance with a preferred embodiment of the present invention, the method includes automatic encryption and outputting of information inputted by the input device periodically in order not to lose said information upon cessation of the supply of electrical power to the document processor.

[0027] Additionally in accordance with a preferred embodiment of the present invention, the method includes automatic encryption and outputting of information inputted by the input device upon interruption of information input for at least a predetermined time.

[0028] In such cases, no information is retained in a non-secure form at the document processor.

[0029] Preferably, the method includes prevention of storage of information in a non-secure form.

[0030] The document processor may be a computer, such as a personal computer, equipped with a word and/or graphics processing program.

[0031] The present invention also seeks to provide an improved apparatus and method for protecting documents which, it is believed, will have broad application.

[0032] There is thus provided in accordance with a preferred embodiment of the present invention a system for selectable encryption of documents including a document generator and a user-controlled document encryptor operative to encrypt user-selected portions of a document generated on the document generator.

[0033] In accordance with a preferred embodiment of the invention, the document generator comprises a computer having a word processing functionality and the user-controlled document encryptor comprises a hardware and/or software embodied functionality which enables the user to select portions of the document to be encrypted.

[0034] There is also provided in accordance with a preferred embodiment of the present invention a method for selectable encryption of documents including generating a document and encrypting user-selected portions of the document.

[0035] There is additionally provided in accordance with a preferred embodiment of the present invention a partially encrypted document produced using the method or the apparatus of the present invention.

[0036] In accordance with one embodiment of the present invention, a cut and paste functionality is employed for selecting portions of the document to be encrypted. Alternatively, text delimiters may be employed for selecting portions of the document to be encrypted.

[0037] Selection of the portions of the document to be encrypted may be carried out concurrently with generation of the document or after generation thereof. The encryption can take place either on-line or off-line.

[0038] In accordance with a preferred embodiment of the present invention, the control characters employed in word processing are not encrypted. Accordingly, the selectably encrypted document may retain the format of the corresponding unencrypted document.

[0039] The document may include both text and graphics. The graphics may be encrypted in a bit-map format.

[0040] It is appreciated that the present invention is equally applicable to decryption of documents.

[0041] The present invention also seeks to provide a mechanism and technique useful in a non-modified operating environment for enabling a user carrying out a first process to trigger the operation of a second process.

[0042] There is thus provided in accordance with a preferred embodiment of the present invention a computer system including a first operating process operating in a non-modified operating environment and having at least one operating command which is normally employed only in a given mode in the first operating process, and at least one second operating process, the improvement comprising a trigger for enabling a user operating the first operating process to initiate the second operating process, the trigger comprising said at least one operating command used in a mode other than said given mode.

[0043] There is also provided in accordance with a preferred embodiment of the present invention for use in a computer system including a first operating process operating in a non-modified operating environment and having at least one operating command which is normally employed only in a given mode in the first operating process, and at least one second operating process, a method for enabling a user operating the first operating process to initiate the second operating process, the method comprising entering said at least one operating command in a mode other than said given mode.

[0044] The invention is particularly suitable for situations wherein the first operating process operates in a non-modified operating environment.

[0045] In accordance with a preferred embodiment of the present invention, the first operating process is a text editing process.

[0046] Additionally in accordance with a preferred embodiment of the present invention, the given mode is a single, non-repeated entry. Preferably the mode other than the given mode is a sequential repeated entry.

[0047] In accordance with a preferred embodiment of the present invention, the at least one operating command is a copy command.

[0048] Further in accordance with a preferred embodiment of the present invention the non-modified operating environment is a WINDOWS environment.

[0049] The second operating process may be any suitable process, such as a text encryption process described hereinabove. Another suitable second operating process is a spell checking process. The second operating process also could be, for example, a language translation process, a text capitalizing process, a text to speech conversion process or a decryption process.

[0050] The present invention will be understood and appreciated more fully from the following detailed description, taken in conjunction with the drawings in which:

[0051] FIG. 1 is a simplified block diagram of a secure document processing system constructed and operative in accordance with a preferred embodiment of the present invention;

[0052] FIGS. 2A and 2B illustrate a document produced in accordance with the present invention in respective non-encrypted and selectably encrypted form;

[0053] FIGS. 3A, 3B & 3C illustrate part of a document produced in accordance with one preferred embodiment of the present invention in non-encrypted form and two different selectably encrypted forms respectively;

[0054] FIGS. 4A, 4B & 4C illustrate part of a document produced in accordance with another preferred embodiment of the present invention in non-encrypted form and two different selectably encrypted forms respectively;

[0055] FIGS. 5A and 5B illustrate a document containing text and graphics produced in accordance with the present invention in respective non-encrypted and selectably encrypted form;

[0056] FIGS. 6A, 6B, 6C and 6D illustrate selectable encryption of a document text that contains control characters;

[0057] FIGS. 7 and 8 are simplified block diagram illustrations of user selectable encryption and decryption systems constructed and operative in accordance with a preferred embodiment of the present invention;

[0058] FIG. 9 is a simplified flow chart illustration of the invention;

[0059] FIG. 10 is a simplified block diagram illustration of the invention; and

[0060] FIG. 11 is a simplified flow chart illustration of a preferred embodiment of the invention.

[0061] Reference is now made to FIG. 1, which is a simplified block diagram of a secure document processing system constructed and operative in accordance with a preferred embodiment of the present invention. An input device 10, such as a keyboard or graphics input device, is employed by an operator to generate a document on a document processor 12 in a non-secure form, such as a human-readable form used in conventional word processors. The document processor may be any suitable computer equipped for word processing.

[0062] It is a particular feature of the present invention that the document processor 12 is incapable of preserving the contents of the document in non-secure form beyond the time period when it is actually being generated.

[0063] The only information output facility or port of the document processor 12, here indicated by reference numeral 14, is non-removably connected to an encryption mechanism 16 which is operative to encrypt the contents of every document generated on the document processor 12. The encryption mechanism 16 may be any suitable type of encryption mechanism known in the art and commercially available and may provide encryption at any suitable level. A preferred encryption device may be that incorporated in the PrivaSoft (trademark) encryption system commercially available from Aliroo Ltd. of Israel, the present assignee.

[0064] The output 14 of the encryption mechanism 16 is connected to a storage medium, typically including a disk drive 20 and magnetic storage apparatus 22. Alternatively or additionally, the output of the encryption mechanism 16 may be supplied to an output device, such as a printer 24 which produces a paper or other hard copy print out 26. The output device may alternatively include an information transmitter, such as fax modem.

[0065] It is a particular feature of the present invention that information cannot be transferred from the document processor 12 to the storage media or the output device without first being encrypted.

[0066] It is additionally a particular feature of the present invention that the operation of the document processor and the encryption mechanism are such that once their operation is completed, no information in non-secure form remains therein or thereat.

[0067] In order to ensure that information in non-secure form is not inadvertently exposed when document processing operation is paused and the document processor is left unattended, the document processor may be programmed so as to provide automatic encryption and subsequent storage and/or outputting of information inputted by the input device upon interruption of information input for at least a predetermined time or upon cessation of the supply of electrical power to the document processor.

[0068] In such cases, all the information in non-secure form is eliminated from the document processor and the encryption mechanism. The automatic encryption may employ a key which is provided by the user during document processing. In the absence of such key, the document processor irrevocably erases all information in non-secure form.

[0069] The encrypted information which was generated in the document processor may be downloaded from a storage medium such as magnetic storage apparatus 22 using the same or a different disk drive 44. If the encrypted information is in hard copy form, it may be scanned by a scanner 48. In either case, such information can be decrypted at any location by the use of a suitable decryption mechanism 52 and supplied to a document viewer 54 in non-secure, human readable form. Preferably, the decryption mechanism 52 and the document viewer 54 have no information storage or hard copy output capability and are operative only when attended by an authorized user.

[0070] Reference is now made to FIGS. 2A and 2B, which illustrate a document produced in accordance with the present invention in respective non-encrypted and selectably encrypted form, indicated by respective reference numerals 110 and 122. The document may be any suitable document and may be generated in any suitable manner, such as on a conventional PC based word processor.

[0071] In accordance with a preferred embodiment of the present invention, a user may select portions of the document which are to be encrypted. For example, paragraph 112 of the document is unencrypted, as indicated at reference numeral 124 in FIG. 2B. Paragraph 114 is encrypted, as indicated at reference numeral 126 in FIG. 2B, with the exception of one word “Friendship”, indicated by reference numeral 116 in both FIGS. 2A and 2B.

[0072] Paragraph 118 is seen to be unencrypted, as indicated at reference numeral 128 in FIG. 2B, with the exception of one phrase “Top Secret”, indicated by reference numeral 120 in FIG. 2A and in its encrypted form in FIG. 2B, by reference numeral 130.

[0073] Reference is now made to FIGS. 3A, 3B and 3C, which illustrate part of a document 200 produced in accordance with one preferred embodiment of the present invention in non-encrypted form and two different selectably encrypted forms respectively. Here the segments to be encrypted are selected using a conventional “cut and paste” function which is available in most word processors.

[0074] The advantage of this functionality is that the user need not modify the original text and that the segments may be selected for encryption after the document is finished. A disadvantage is that encryption has to be done in real time, segment by segment, because in most word processors only one continuous segment may be “cut” at a time.

[0075] FIG. 3A shows a passage with a segment 140 marked for encryption. FIG. 3B shows the same passage with segment 140 encrypted. FIG. 3C shows the identical passage with segment 140 encrypted with the addition of a label section 144 which contains service information such as encryption key identification information or other information which is useful in decrypting the segment or encryptor identification information operative to identify the serial number of the individual encryptor employed to encrypt the segment. Additionally text delimiters 146 and 148 and character data 149 may be provided in the encrypted text to enable automatic decryption.

[0076] Character data 149, also referred to as a key extension, is employed in a conventional manner to enhance the robustness of the encryption. It is know that when multiple segments or pages of data are encrypted with the same key, cracking the encryption is made easier. In order to prevent this phenomenon but still require the user to enter only one key per document for decryption, the encryption program generates random characters which constitute a key extension, which characters are employed together with the user-defined encryption key to create a new key which is the actual one used for the encryption. The key extension is inserted in the encrypted document so that the decrypter uses it together with the user defined decryption key in order to reconstruct the key which is used for decrypting the document. The key extension can be recognized automatically or may be inserted manually since it is formed of printable characters inserted into the encrypted document.

[0077] Reference is now made to FIGS. 4A, 4B and 4C, which illustrate part of a document produced in accordance with another preferred embodiment of the present invention in non-encrypted form and two different selectably encrypted forms respectively. Here the segments to be encrypted are selected using text delimiters, also known as control strings.

[0078] The advantage of this functionality is that the user can easily instruct the encryptor where to start and where to finish as he writes. Using this functionality, the user can save the file and have it encrypted off-line inasmuch as the text delimiters are part of the saved file.

[0079] FIG. 4A shows a passage with a segment 150 marked for encryption by text delimiters 152 and 154. FIG. 4B shows the same passage with segment 150 encrypted. FIG. 4C shows the identical passage with segment 150 encrypted with the addition of a label section 164 which contains service information such as encryption key identification information or other information which is useful in decrypting the segment or encryptor identification information operative to identify the serial number of the individual encryptor employed to encrypt the segment.

[0080] Additional text delimiters 166 and 168 and character data 169 may be provided in the encrypted text to enable automatic decryption.

[0081] Reference is now made to FIGS. 5A and 5B, which illustrate a document containing text and graphics produced in accordance with the present invention in respective non-encrypted and selectably encrypted form. It is a particular feature of the invention that the overall layout of the document is preserved even when parts thereof are encrypted. It is also a particular feature of the invention that selectable parts of the graphics contained therein can be encrypted by bit map encryption techniques.

[0082] Reference is now made to FIGS. 6A, 6B, 6C and 6D illustrate selectable encryption of a document text that contains control characters. In this embodiment, the encryptor recognizes control characters used by a word processor and does not encrypt them. Only the data, i.e. the text typed by the user which is visible on the screen and hard copy, is encrypted. As a result the encrypted document looks exactly like the original. Boldface remains boldface, underlining is unchanged and line justification is intact. The same font and line spacing may be used notwithstanding that the document is wholly or partially encrypted.

[0083] FIG. 6A shows the unencrypted document including boldface characters indicated at reference numeral 190 and underlining, indicated at reference numeral 192. FIG. 6B shows the unencrypted document of FIG. 6A together with the control characters which are not normally displayed. FIG. 6C corresponds to FIG. 6B except that the document is encrypted. It is seen that the control characters are not affected by the encryption. FIG. 6D illustrates the encrypted document. It is seen from FIG. 6D that the encrypted document looks exactly like the original. Boldface remains boldface, underlining is unchanged and line justification is intact. The same font and line spacing may be used notwithstanding that the document is wholly or partially encrypted.

[0084] Reference is now made to FIGS. 7 and 8, which are simplified block diagram illustrations of user selectable encryption and decryption systems constructed and operative in accordance with a preferred embodiment of the present invention. As seen in FIG. 7, an unencrypted document 200 is supplied to an encryptor 202 having associated therewith an input device 204 and a viewing device 206. It is appreciated that elements 202, 204 and 206 may all be embodied in a suitably programmed personal computer having conventional word processing functionality. The output of encryptor 202 when the functionality described hereinabove is carried out is a user selected partially encrypted document 208 having encrypted portions 210.

[0085] Referring to FIG. 8, it is seen that an encrypted document 220, having user selected encrypted portions 222, is supplied to a decrypter 224 having associated therewith an input device 226 and a viewing device 228. It is appreciated that elements 224, 226 and 228 may all be embodied in a suitably programmed personal computer having conventional word processing functionality. The output of decrypter 224, when the functionality described hereinabove is carried out, is a decrypted document 230.

[0086] Further embodiments of the present invention will be described in the context of a text-editing program, such as WORD 2.0 FOR WINDOWS, operating in a WINDOWS operating environment. It is to be appreciated that the invention is not limited to text-editing nor to the WINDOWS operating environment.

[0087] The method of the invention will now be described with reference to FIG. 9, which illustrates at block 312, definition of a given area of a text and copying thereof into a temporary storage facility, termed a “Clipboard” in WINDOWS, by means of a Copy command.

[0088] As indicated at block 314, upon entry of the Copy command, the contents of the Clipboard are compared with the previous contents of the Clipboard, stored in a copy buffer, which were entered by the previous Copy command in order to determine whether two repeated sequential Copy commands were entered without altering the contents of the Clipboard.

[0089] As indicated at blocks 316 and 322, if the current contents of the Clipboard are not identical to the previous Clipboard contents, indicating that two repeated sequential Copy commands were not entered, no trigger is recognized and no second process is initiated and the current contents of the Clipboard are copied into the copy buffer.

[0090] If the current contents of the Clipboard are identical to the previous Clipboard contents, indicating that two repeated sequential Copy commands were entered, a trigger is recognized, as indicated at block 320, producing a special operation, i.e. a second process.

[0091] Referring now to the simplified block diagram of FIG. 10, it is seen that text, indicated by reference numeral 330 is stored in a Clipboard 332. The current contents of the Clipboard 332 are compared by a comparator 334 with the previous contents of the Clipboard, which are stored in a copy buffer 336 under the control of control apparatus 338. The comparator 334, upon sensing a sequential repeat Copy command entry provides an output 340 which initiates a special operation. It is appreciated that the structure of FIG. 10 is normally embodied in software or a combination of hardware and software.

[0092] It is to be appreciated that although the invention has been described hereinabove in the context of the use of repeated Copy commands, the invention is not limited to such use and may be applicable to commands other than Copy commands, which may be independent of the Clipboard. Furthermore, although the invention as described hereinabove identifies the trigger by sensing identical Clipboard contents, this criteria need not be the only criteria and may be replaced by any other suitable criteria.

[0093] Reference is now made to FIG. 11, which illustrates the invention in the specific context of a WINDOWS text editing program having “Select”, “Copy” and “Paste” commands. Descriptions of the structure of WINDOWS are in the public domain. One useful guide is The Microsoft guide to writing applications for Windows 3.1 by Charles Petzold, 3rd Edition, Published by Microsoft Press, Copyright 1992, the disclosure of which is hereby incorporated by reference.

[0094] The “Select” command enables the user to mark a segment of a document. The “Copy” command enables the user to copy the selected segment of the document into the Clipboard, which makes it accessible by another process or program. The “Paste” command enables the user to paste the contents of the Clipboard into any desired place in the document.

[0095] In most operating systems, such as WINDOWS, any suitable process can be programmed to be aware of changes made to the contents of the Clipboard by being made a part of a “notification chain” invoked by the operating system each time such a change occurs. Additionally, in most operating systems, such as WINDOWS, any process may access the contents of the Clipboard for reading and/or modifying the contents.

[0096] In accordance with a preferred embodiment of the present invention the existing tools of a text editing process, such as that in WINDOWS are employed to initiate another process, such as, for example, text encryption, text translation, text capitalization or text decryption, and to feed a desired segment of text into that second process. In accordance with the preferred embodiment of the present invention, and as described with reference to FIG. 11, the foregoing is accomplished by inspecting and storing the contents of the Clipboard whenever it is updated. If the contents of the Clipboard are found to be related in a predefined manner, such as being identical, to the contents of the Clipboard found upon the previous update, it is determined that the user intended to initiate the second process and the second process is operated.

[0097] Further in accordance with a preferred embodiment of the present invention, the contents of the updated Clipboard are employed as input data for the second process.

[0098] Additionally in accordance with a preferred embodiment of the present invention, the contents of the Clipboard, following operation of the second process thereon, constitute the output data of the second process.

[0099] The preferred embodiment of the invention assumes that inasmuch as it is totally useless for a user, working in the text editing operation, to execute the Copy command twice sequentially on the same portion of the text, it can be safely assumed that by executing the Copy command twice sequentially on the same portion of the text, the user expressed his intention that a second process be initiated.

[0100] Additional protection against unintended initiation of the second process can be achieved by limiting actuation of the second process to occurrences where the time duration between two consecutive Copy commands is less than a predetermined time.

[0101] Referring now specifically to FIG. 11, it is seen that the trigger operation begins by subscribing to the Clipboard changes notification chain, which is inherent in the WINDOWS chain, as indicated in block 350. Upon being informed of a change in Clipboard contents (block 352), the mechanism and method of the invention compares (block 354) typically the first 128 bytes of data in the Clipboard with those in the copy buffer 336 (FIG. 10). If the contents are not identical, the first typically 128 bytes of data from the new Clipboard are stored in buffer 336 (Blocks 356 and 358). A further Clipboard change notification is awaited.

[0102] Preferably, if the contents of the Clipboard are identical to those in buffer 336, a time duration determination is made. If the two sequential Copy commands were given within a given maximum time duration (Block 360), typically one second, the second process is initiated (Block 362). Otherwise, a further Clipboard change notification is awaited.

[0103] Following completion of the second process on the text in the Clipboard, a paste operation may be carried out within the first process wherein the modified text from the Clipboard, upon which the second process has operated, is replaced into the text being edited in the first, text editing process.

[0104] It is to be appreciated that the second process typically operates automatically but may be interactive and may involve parameter inputs, such as, for example, an encryption key, from the user.

[0105] The second process in the above example is a single process. Alternatively it can be multiple processes and include a menu that allows a user to choose between a variety of second processes, such as encryption, decryption, spell checking, translation to other languages and text to speech conversion.

[0106] Appended hereto as Appendix A is a program listing of a source code, written in C language, for carrying out the preferred embodiment of the invention described hereinabove.

[0107] It will be appreciated by persons skilled in the art that the present invention is not limited by what has been particularly shown and described hereinabove. Rather the scope of the present invention is defined only by the claims which follow: