In the meantime a question came through on the grapevine regarding the status pages in Oracle IRM. These are HTML web pages that are displayed to an end user when they don't have access to sealed content or they are for some other reason unloading a sealed document. Our mantra that security is nothing without an adequate user experience and a manageable administrative model is reinforced by these very flexible status pages. So often a security product will deny you access to a file, directory or other resource and all you get is an "Access denied" error with an OK button. Oracle IRM however sends the client to a web page of your choice to display a more informative error message, like the example below.

Out of the box Oracle IRM gives you a set of standard pages which look like the above. These can be customized at three levels. Actually before I go into the customizations its worth knowing of a simple test page that allows you to look at all the possible status codes and pass in some data to see how they render. You can look at our evaluation server test page here.

Basic changes to status pages

Logging into the Oracle IRM Management website and clicking on "Settings" presents you with the dialog below. The first step here is that you can change the organization name that is displayed on the status pages. Not exactly the most uber of customizations, but you have to start somewhere right? You can also change the logo used on the pages to your own, simply replace the org_logo.gif in the folder \smweb\custom. More detail on this can be found in the Oracle IRM core customization guide.

Modifying the distributed web pages

• support_contact.htm This file, by default, contains a single line of HTML which is a HREF that contains two macros that are place holders for the system email address as per the settings dialog above. This line is then displayed on certain status pages. You can modify this line as you wish, just be careful to ensure whatever HTML you drop in plays safe with the rest of the page. You can see an example of where this would get used here.
• footer.htm and header.asp allow you to again modify the HTML that is displayed top and bottom of the status page.
• default.css means you can really go crazy with these status pages. There is a good set of style declarations already in this file so you've got a nice place to start from.
• Finally there are a set of folders for English, German, Spanish, French and Italian versions of the website homepage. Sometimes the Oracle IRM Desktop will instead of sending you to a status page will redirect you to the basic homepage of the website and depending on the language version of the IRM Desktop you'll see the relavent file from these folders. It is often a good idea to reinforce your corporate security policies on these home pages and maybe link to other resources that an end user would find useful. Remember making the end user experience as smooth as possible is crucial to your security strategy.

Creating your own status pages from scratch

• default URL. Every file that is sealed has embeded in it something called the default URL. This is the address which the Oracle IRM Desktop will redirect the end user to when they are unable to open a sealed document. The URL typically looks like this;
  http://irmweb.domain.com/status/default.asp?%%allparams%%&%%usefordefault%%
  
  There are two very important macro's that sit on the URL. These macros are replaced by data during runtime when the client decides to send the user to the website.
  • %%usefordefault%% means that the IRM Desktop will always send the user to the website. There are also some offline HTML pages that are displayed in place of the online website when the user is not connected to the internet. If you were to remove this macro, even when the user is online they would be shown the offline pages, something you'd not want and in all honestly I think even removing this line may have no effect! Much more interesting is the other macro...
  • %%allparams%% is replaced by a whole set of data which pertains to the user and activity at time of redirection. This data is placed directly onto the query string and is therefore available to the web page that the URL refers to. Here is a broken down example of what the URL would look like;

    
http://irmweb.domain.com/status/default.asp?
cntxt=nolic
&status=nolic
&clntver=5.5.8
&user=john.smith@domain.com
&lang=EN
&cat=Default
&cs=default
&item=2009_05_16%2001:10:36%20Finance%20report.sxls
&mime=application/vnd.sealed.xls
&srvurl=seal://irm.domain.com:80
&pub=Top%20Secret%20Financial%20Data
&vrsn=Default
&brand=0
&prod=Office%20Unsealer&src=2
&sealedby=fred.bloggs@domain.com
&cntschema=5.0.0.0.release&

    Lots and lots of very useful information. status contains the information of what actually happened such as "No License available" or "Not Logged In". The list of these is on the test page. The user field contains who the logged in user was that is being redirected, sealedby tells you who sealed the document that the user is accessing.
    

  Now imagine taking this information from the querystring into your ASP/PHP/JSP page and then pass some of the data to the Oracle IRM server via the API and you can do some very funky things. A good example that I helped a customer write was for handling users that accessed multiple computers. The logic went something like...
  1. User attempts to open a sealed document on a machine and has hit their device limit. The device limit stops a user opening the same document to a certain number of machines. They are redirected to the default URL and the status that is passed is licinuse which means all available rights are in use.
     
  2. A dynamic web page then takes this information, including the user, and queries the IRM server to see how many devices they have access to and what groups the user is a member of.
     
  3. If the user is a member of an executive group, then the code automatically increases the users device limit.
     
  4. An email is then generated in the dynamic web page and is sent to the owner of the IRM classification the content was sealed to informing them of the activity.
     
  5. The status page then informs the end user that they've had their ability to open content on multiple machines increased and tells them to retry opening the content.
     
  
  
• Each classification can have a different URL! This means two main things, if you want have the skills or the time to build a fancy dynamically driven status page application, you can set a different URL for each classification and point it to a static HTML page. Secondly from a dynamic perspective you now have even more flexibility. You can point different classifications to different applications, and have some simply point to static files. Some classifications could be forced to deliver these pages over SSL for instance whilst others not.
  

Sealing a folder with the Windows Explorer integration

Limitations of this method are being able to insert any form of logic in the process. Performance wise it should be just as quick via this method as any other. I tried this on my little laptop, I have a documents folder of about 600mb in size and made a copy. This folder contains all sorts of content, some already sealed and some in a format Oracle IRM doesn't support. I timed how long it took to seal 445 supported files by a right click and seal, it completed in about 45 seconds. Not a bad result on a little laptop hard disk (320GB, 5300RPM).

smBatch.exe


smBatch (DSE v5.5.9.95), Copyright (c) 1996, 2007, Oracle. All rights reserved.
use: smBatch
   -licserv <license server URL>
   -publisher <publisher ID>
   -aemail <administrator email>
   -apwd <administrator password>
   -contentset <content set name>
   -category <category>
   [-sealedfileschema <major.minor.revision>]
   [-dryrun <Run the program without sealing the files. For debug purpose>
   [-batch <Batch file for multiple sealing of i/o files, mime and item code>
   [-metadata <full path to metatdata file>]
   [-mime <sealed MIME type>]
   [-version <version code>]
   [-item <item code>]
   [-time <publication time in format 25 Aug 2000 16:30:00 EST>]
   [-cipherlen <number>]
   [-plainlen <number>]
   [-period <number>]
   [-streaming <on|off Disable chunking if switched to off; default is on.]
   [-semail <source email>]
   [-spwd <source password>]
   [-pxuser <proxy username>]
   [-pxpwd <proxy password>]
   [-pxhost <proxy host url>]
   [-pxport <proxy port number>]
   [-impersonate <login name of user to impersonate>]
   [-simpersonate <login name of source user to impersonate>]
   <infile> [<outfile>]

e.g. smBatch -lic seal://licence.www.oracle.com:80 -pub mypub-001
-aem myname@mydomain.com -apw topsecret -cont cs_1 -cat cat_1
-pxhost 10.2.3.54 -pxport 77 -stream off -pxuser mickey.mouse -pxpwd disney
-t "25 Aug 2000 16:30:00 EST" example.pdf


Calling the Dynamic Sealing Engine (DSE) API


function fnSealFileActiveX (strLicenseURL, strPublisher, strAdminAccount, strAdminPassword, strContentSet, strCategory, strItemCode, strFilePathname, strSealedFilePathname)
{
   try {
      var objSealer = new ActiveXObject ("SealedMedia.DynamicSealingEngine");
      objSealer.SetLicenceServerURL (strLicenseURL,30);
      objSealer.ItemCode = strItemCode;
      objSealer.username = strAdminAccount;
      objSealer.password = strAdminPassword;
      objSealer.publisherID = strPublisher;
      objSealer.contentSet = strContentSet;
      objSealer.category = strCategory;

      objSealer.SealFile (strFilePathname, strSealedFilePathname);
   }
   catch (e) {
      throw e.description + " " + e.number;
   }
return true
}


Using Web Services to seal files

So in summary, plenty of options to fine ways of sealing existing repositories of files using Oracle IRM.

Fundamental to the success of the Oracle IRM solution is that from day one Martin Lambert, Oracle IRM creator, decided to separate the information that describes who can access content and what they can do with it from the actual content itself. To demonstrate why this important consider the following.

1. You protect 10 documents which you distribute, via email, to 100 people in your company. Each person copies those 10 documents to their local computer from their inbox. 10 of these people are managers who are given rights to print the documents, the rest are prohibited and can only open the content.
2. A few weeks later the company hires another 20 people. 10 of the people from the original 100 are promoted to managers and 15 leave the company, taking the content with them.

Now imagine if those 10 documents, of which there are now thousands of copies, contained information about the 100 people that could initially open them. What happens a few weeks later? What do you do? Recall all the copies of those old documents and reissue new ones with updated lists of rights? How do you ensure users are then opening the right document with the correct rights? What about those who are promoted and have gained new rights to the same content? Do they have different versions of the same document, one they can print and one they cannot?

Many IRM solutions were born from Digital Rights Management (DRM) technologies which typically embed such rights information into the protected content. DRM technologies are commonly used to protect rich media such as music distributed by iTunes and movies by Amazon Unbox. In these environments the content is only designed to be read by the single consumer and the rights are typically distributed/embedded at the time of purchase/download. DRM used to be very restrictive and often received a lot of bad press about the unfair methods employed to restrict the use of content by the end user. Things are better these days and a more separated rights approach is being taken. Yet the technologies are still built on this limiting methodology.

When you take this approach from the consumer world into the enterprise, things suddenly become very difficult. Scalability becomes a large issue. Would you really store the rights of thousands of corporate users in each file you protect? Each time the rights to a specific document changes, do you redistribute those rights? Many IRM solutions in the market are born from such DRM systems and are struggling to scale into the enterprise.

This is where Oracle IRM is able to work so easily and allows the fast changing trust relationships in the enterprise to be reflected quickly. Oracle IRM sealed content only knows of a classification to which it belongs. It also knows on what server this classification resides. So when a user access content, two things happen.

1. A user when attempting to access content whilst online is authenticated against the IRM server.
2. If authentication is successful, the IRM server checks to see if they are authorized to access content with the classification matching the request. Is so, the rights are shipped and cached to the requesting machine and remain valid for a certain period of time. After which the user must again check with the IRM server to see if rights to the content have changed.

What this separation of rights means is that by making a single, simple change to a user rights on the Oracle IRM server, their access to thousands of documents can be affected when they next check with the server.

If you then consider how the Oracle IRM server can be hooked into your LDAP and Active Directory repositories and that groups can be assigned rights to these classifications. Then someone joining an organization can be added to one group in the corporate user repository and this one single act can give them instant access to hundreds and thousands of documents that are stored in a variety of places all over the organization.

Because this was a design feature from the very start, it means that we've been able to improve, learn through customer experience and fine tune this model. Our 11g release will be the best demonstration yet of how Oracle is leading the way when it comes to providing persistent, scalable and usable security to your sensitive enterprise information.

"In my demonstration, all of our customers asked me the same questions when I delivered the IRM demo: how can distribute the IRM server in multiple provices in Vietnam? Vietnam internet connection is very bad, therefore all distributed locations in Vietnam could not share the same central IRM server, then they are expected to deploy one central IRM Server on internet, and few other IRM servers on intranets of each location thru out Vietnam.

The requirement is how to synchronize all IRM data (security configuration, roles, rights...) between these IRM servers, so that when I assign for you a document in Hanoi IRM server, then I travel to Hochinhminh I can open the document with Hochiminh IRM server"

There are a number of ways to resolve this issue and not knowing the specifics of the infrastructure for these customers i'll outline all possible ways to solve the problem.

Oracle IRM is already very network resilient

• Network protocol was a cut down version of SSL designed for speed and low bandwidth use. It is also tunneled inside HTTP which gives it a stateless aspect that forces a system design which is efficient with network communication.
• As long as you are not assigning large amounts of rights to each user, the size of data to be transferred from server to client is small. Again due to the bandwidth limitations around when the system was initially designed, Oracle IRM is very efficient with the data that is sent server to client and back. For example as you access sealed content offline the client audits this activity. These logs are returned to the server in batches to conserve available network bandwidth.
• Offline caching has been in the core design of the system from day 1. This enables trusted users to travel with sensitive information without requiring to constantly connect with the network to validate rights. This of course needs to be balanced with the increased risk of extending that offline period, but in cases like this, just being able to deploy IRM brings a huge increase in security. This offline period can be taken to an extreme, some customers have given users a whole year of offline use. So they only need to access the IRM server once in an entire year! Of course this dramatically reduces the effectiveness of the security, but its demonstrative of the flexibility of the system.

Apart from taking advantage of the inbuilt functionality, it is possible to build a system which allows for a more balanced security approach. This does involve a little more work and complexity and requires good system design to avoid instability as more components are involved.

Multiple Oracle IRM servers can talk to one database

There are issues here. You need to figure out a smart way to do geographical DNS resolving which is hard if the end user is using public DNS servers and not ones on your own network. Also you might find that the connectivity from server to database also shares exactly the same issue you are trying to design around, that of a very poor network connection.

Using Oracle database in a distributed manner

This, whilst possible, is going to require some clever consulting to setup. Latency of changes to data needs to be taken into consideration across the entire system and also allowing those remote IRM and database systems to update information back to the "master" server. There is also still the issue of ensuring DNS points users to the right local server.

With 10g this would be a challenge, but he imminent release of 11g opens up the ability for the system architect to insert all sorts of logic right into the Oracle IRM server which would facilitate a design such as the one above. Of course when it comes to resolving distributed database issues then Oracle is already the master of that problem :)

Using the Oracle IRM API to manage the distribution of rights

Considerations also need to be taken about how to handle the audit logs from the separate IRM servers. These can be written to binary files, which are transferred back to a central location for processing into a complete audit of all activity. The Oracle IRM server also allows for these events to be placed onto a message queue which would provide a quicker method for amalgamating the records.