Abstract: The present disclosure includes systems and techniques relating to document access auditing. According to an aspect, the invention involves receiving a request relating to an electronic document associated with a document tracking system; retrieving actions-taken information associated with the electronic document and maintained by the document tracking system; combining and signing the electronic document and the actions-taken information to form a signed document that includes the actions-taken information; and providing the signed document to enable access to the actions-taken information independent of the document tracking system.

Abstract: Systems and techniques to provide distributed document version control. In general, in one implementation, the technique includes: receiving a request to take an action with respect to a distributed electronic document, identifying, in response to the request, information associated with the distributed electronic document, the associated information indicating a second electronic document different from the distributed electronic document, and imparting information concerning the second electronic document to force the action to be taken with respect to the second electronic document. Receiving the request can occur at a server, and the request can be from a client to take the action with respect to the distributed electronic document, retained locally at the client. The associated information can be retained at the server, and imparting the second document information can involve relating the second document information (e.g., the second document or a link to it) from the server to the client.

Abstract: Systems and techniques to provide transparent authentication integration. In general, in one implementation, the technique includes: receiving a request from a client to take an action with respect to an electronic document, in response to the request, obtaining an authentication process, and sending the authentication process to the client for use in identifying a current user and controlling the action with respect to the electronic document based on the current user and document-permissions information associated with the electronic document. Obtaining the authentication process can involve requesting and receiving the authentication process from a second server. The authentication process can use an existing interface provided by the client to communicate authentication information to the server.

Abstract: The present disclosure includes systems and techniques relating to document access auditing. According to an aspect, the invention involves receiving a request relating to an electronic document associated with a document tracking system; retrieving actions-taken information associated with the electronic document and maintained by the document tracking system; combining and signing the electronic document and the actions-taken information to form a signed document that includes the actions-taken information; and providing the signed document to enable access to the actions-taken information independent of the document tracking system.

Abstract: Systems and techniques to provide a document control system. In general, in one implementation, the technique includes: receiving, at a permissions-broker server, a request from a client to take an action with respect to an electronic document, identifying, at the permissions-broker server and in response to the request, first document-permissions information associated with the electronic document, the first document-permissions information being in a first permissions-definition format, translating, at the permissions-broker server, the identified first document-permissions information into second document-permissions information in a second permissions-definition format, and sending the second document-permissions information to the client to govern the action with respect to the electronic document at the client.

Abstract: Systems and techniques to provide transparent authentication integration. In general, in one implementation, the technique includes: receiving a request from a client to take an action with respect to an electronic document, in response to the request, obtaining an authentication process, and sending the authentication process to the client for use in identifying a current user and controlling the action with respect to the electronic document based on the current user and document-permissions information associated with the electronic document. Obtaining the authentication process can involve requesting and receiving the authentication process from a second server. The authentication process can use an existing interface provided by the client to communicate authentication information to the server.

Abstract: Systems and techniques to provide offline access in a document control system. In general, in one implementation, the technique includes: receiving a request from a client, and pre-authorizing the client, in response to the request, to allow actions by a user as a member of a group of users by sending to the client offline access information including a first key associated with the group, the first key being useable at the client to access an electronic document by decrypting a second key in the electronic document. Receiving a request can involve receiving a request from the client to take an action with respect to a second document. The technique can also include verifying the user at the client as an authenticated user, and the offline access information can include user-specific keys, group-specific keys, a policy, and a document revocation list.

Abstract: One embodiment of the present invention provides a system that improves security of a file control system. During operation the system receives a request from a user to decrypt a file. The system then decrypts the file. Next, the system adds a watermark to the decrypted file which allows the decrypted file to be subsequently traced back to the origin of the decrypted file, thereby improving security of the file control system. Note that the watermark can include a user identifier, an Internet Protocol (IP) address associated with the user, a hardware address or identifier associated with the user, a timestamp, or any other information that can be used to identify the origin of the decrypted file.

Abstract: The present disclosure includes systems and techniques relating to document access auditing. According to an aspect, the invention involves receiving a request relating to an electronic document associated with a document tracking system; retrieving actions-taken information associated with the electronic document and maintained by the document tracking system; combining and signing the electronic document and the actions-taken information to form a signed document that includes the actions-taken information; and providing the signed document to enable access to the actions-taken information independent of the document tracking system.

Abstract: Systems and techniques to provide transparent authentication integration. In general, in one implementation, the technique includes: receiving a request from a client to take an action with respect to an electronic document, in response to the request, obtaining an authentication process, and sending the authentication process to the client for use in identifying a current user and controlling the action with respect to the electronic document based on the current user and document-permissions information associated with the electronic document. Obtaining the authentication process can involve requesting and receiving the authentication process from a second server. The authentication process can use an existing interface provided by the client to communicate authentication information to the server.

Abstract: Systems and techniques relating to cryptographic keys include, in one implementation, a technique involving: generating a symmetric encryption key; and generating from the symmetric encryption key a family of symmetric encryption keys having a relationship such that a descendent key of the family is derivable from each key that is an ancestor of the descendent key in the family. Generating the family of symmetric encryption keys can involve cryptographically hashing the original symmetric encryption key and resulting hashed encryption keys. The technique can further include rolling over a key used in securing information by providing a next symmetric encryption key of the family in an order opposite that of an order of key generation; and a client can cryptographically hash a first symmetric encryption key to produce a second symmetric encryption key of the family and decrypt information associated with an electronic document with the key thus produced.

Abstract: Systems and techniques to provide offline access in a document control system. In general, in one implementation, the technique includes: receiving a request from a client, and pre-authorizing the client, in response to the request, to allow actions by a user as a member of a group of users by sending to the client offline access information including a first key associated with the group, the first key being useable at the client to access an electronic document by decrypting a second key in the electronic document. Receiving a request can involve receiving a request from the client to take an action with respect to a second document. The technique can also include verifying the user at the client as an authenticated user, and the offline access information can include user-specific keys, group-specific keys, a policy, and a document revocation list.

Abstract: Systems and techniques to provide offline access in a document control system. In general, in one implementation, the technique includes: receiving a request from a client, and pre-authorizing the client, in response to the request, to allow actions by a user as a member of a group of users by sending to the client offline access information including a first key associated with the group, the first key being useable at the client to access an electronic document by decrypting a second key in the electronic document. Receiving a request can involve receiving a request from the client to take an action with respect to a second document. The technique can also include verifying the user at the client as an authenticated user, and the offline access information can include user-specific keys, group-specific keys, a policy, and a document revocation list.

Abstract: Methods and apparatus, including computer program products, for controlling access to an electronic document. A document management system receives a request from a first user at a first user location for an electronic document. The first user is authenticated using a set of access policies for the electronic document, to verify that the first user is authorized to obtain the electronic document. If so, an encrypted rendition is passed to the first user. A request for access to the encrypted rendition from a second user is then received. The second user is authenticated, using the set of access policies, to establish which operations the second user may perform on the encrypted rendition. A voucher including an electronic key for decrypting the encrypted rendition and the set of access policies is created at the document management system. The voucher is passed to the second user location.

Abstract: The present disclosure includes systems and techniques relating to document access auditing. According to an aspect, the invention involves receiving a request relating to an electronic document associated with a document tracking system; retrieving actions-taken information associated with the electronic document and maintained by the document tracking system; combining and signing the electronic document and the actions-taken information to form a signed document that includes the actions-taken information; and providing the signed document to enable access to the actions-taken information independent of the document tracking system.

Abstract: Methods and apparatus, including computer systems and program products, that relate to a security policy user interface. The methods feature a machine-implemented method that includes presenting labels of multiple security policies, receiving input specifying a selected security policy, and securing a first document according to the selected security policy. In that method, each security policy specifies criteria that governs use of an electronic document and has an associated security mechanism. Moreover, security mechanisms of a number of the multiple security policies distinctly enforce security of a document, and presenting labels of multiple security policies includes presenting at least two labels of two respective security policies such that a detailed description of a respective, associated security mechanism is left out. The security policies can be declarative security policies. At least one of the labels can include an abstract of a corresponding security mechanism.