System and method to access content of encrypted data items in unsupported digital environments
A method for accessing content of encrypted data item(s) by a terminal device operating in a digital environment, according to which before the data item is being accessed by the terminal device, it is modified after being intercepted if found to be encrypted. The wrapper of the data item is modified or replaced by embedding a URL with a unique identifier and a message into the wrapper of the data item. If a supported terminal device attempts to accesses the modified data item, the client application natively consumes the data from the modified data item and ignores its wrapper. If not, the message and the URL are displayed on the terminal device and the user browses the URL. Then after authentication, a web server locates the modified data item using the unique identifier, retrieves and decrypts the modified item and converts the decrypted modified data item to a format that can be consumed by the browser. Then, if the user has permission, he can view the data item by rendering it to the browser in his terminal device.
1. A method for providing a plurality of terminal devices, which have varying decryption capabilities, access to a data item, the method comprising:
intercepting the data item, which includes content;
determining that the content of the data item is encrypted content but that an encapsulation wrapper of the data item is unencrypted, wherein the unencrypted encapsulation wrapper encapsulates the data item from view to anyone other than an intended recipient;
in response to determining that the content of the data item is the encrypted content and irrespective of decryption capabilities of the plurality of terminal devices, modifying the unencrypted encapsulation wrapper of the data item by at least embedding (i) a uniform resource locator (URL) that has a unique identifier and (ii) an instruction message into the unencrypted encapsulation wrapper of the data item,
wherein the modified unencrypted encapsulation wrapper is viewable by the plurality of terminal devices without requiring decryption, and
wherein the instruction message includes at least an instruction for a user of a particular terminal device included among the plurality of terminal devices to navigate to the URL to view the encrypted content of the data item;
sending the data item with the modified unencrypted encapsulation wrapper toward the plurality of terminal devices;
in response to a first terminal device in the plurality of terminal devices attempting to display the data item with the modified unencrypted encapsulation wrapper, where the first terminal device has insufficient decryption capabilities:
displaying the instruction message and URL on the first terminal device;
identifying a web service used by the first terminal device, the web service being a selected service used to view data items;
transforming the URL from a current version to a version that is usable by the web service to retrieve the data item; and
using the transformed URL, which is now usable by the web service, to retrieve the data item;
in response to a second terminal device in the plurality of terminal devices attempting to display the data item with the modified unencrypted encapsulation wrapper, where the second terminal device has sufficient decryption capabilities, ignoring the URL, which has the unique identifier, and the instruction message, both of which are included within the modified unencrypted encapsulation wrapper of the data item, and decrypting and displaying the encrypted content of the data item on the second terminal device; and
after the encrypted content is decrypted such that decrypted content is available, determining that usage rights have been applied to the decrypted content to harden the decrypted content,
wherein the usage rights include a header field that has been added to a browser, which is available to display the decrypted content, to force the browser to not leave any traces of the decrypted content, and
wherein forcing the browser to not leave any traces of the decrypted content is performed as a result of the header field allowing only a fresh version of the decrypted content to be displayable.
2. The method according to claim 1 , wherein the data item is intercepted by a server.
3. The method according to claim 1 , wherein the data item is intercepted by a component that is integrated within an application.
4. The method according to claim 1 , wherein a plurality of data items are intercepted at different locations and during different time spans.
5. The method according to claim 4 , wherein:
a first encrypted data item is intercepted at a moment of its creation;
a second encrypted data item is intercepted at a moment of its transmission; and
a third encrypted data item is intercepted at a moment it is stored.
6. The method according to claim 1 , wherein the intercepted data item is determined to be encrypted when its extension is one of predetermined extensions.
7. The method according to claim 1 , wherein the intercepted data item is determined to be encrypted when it has a predetermined structure.
8. The method according to claim 1 , wherein the intercepted data item is determined to be encrypted when its content is found to contain unique strings that are indicative of encrypted content.
9. The method according to claim 1 , wherein a component for interception and modification of the data item is integrated with an application that is responsible to creation or delivery or storage of the data item.
10. The method according to claim 9 , wherein the component is a proxy between (i) the application, which sends the data item to a server, and (ii) the server, which manages the data item.
11. The method according to claim 1 , wherein modifying the unencrypted encapsulation wrapper is triggered by a batch process that scans data items located at different locations during predetermined time intervals, in order to identify encrypted data items.
12. The method according to claim 1 , wherein modifying the unencrypted encapsulation wrapper is triggered by a predetermined event in a running application, to identify encrypted data items.
13. The method according to claim 1 , wherein the unique ID is injected into an indexable property of a clear text section of the modified unencrypted encapsulation wrapper, to be used by a repository for retrieving the modified data item.
14. The method according to claim 13 , wherein the indexable property is an email header.
15. The method according to claim 1 , wherein the content of the data item is accessed after the user clicks on the URL link.
16. The method according to claim 1 , wherein the data item is rendered to the terminal device, said rendering being done by accessing a renderer component.
17. The method according to claim 16 , wherein the renderer component performs one or more of the following actions selected from a group of:
analyzing a user agent, authenticating the user, obtaining an identifier associated with the data item, retrieving the data item, decrypting the data item, converting the data item to a standard rendering format, adjusting the rendering format to a screen requestor, hardening functionalities of the data item, and responding to the screen requestor.
18. The method according to claim 16 , wherein the renderer component is a server.
19. The method according to claim 1 , wherein the terminal device is a tablet or a smartphone.
20. The method according to claim 1 , wherein a global unique identifier is transmitted to a central database and the modified data item is copied to a dedicated storage server.
21. The method according to claim 1 , wherein the terminal device is a mobile communication device.
22. A system for providing a plurality of terminal devices, which have varying decryption capabilities, access to content of an encrypted data item, the system comprising:
a plurality of terminal devices operable to receive and transmit data items over a network, each terminal device in the plurality of terminal devices having a browser or a web application client;
one or more software modules for performing the following steps before content of a particular data item is accessed by one of the plurality of terminal devices:
intercepting the particular data item containing the content;
determining that the content of the particular data item is encrypted but that an encapsulation wrapper of the particular data item is unencrypted, wherein the unencrypted encapsulation wrapper encapsulates the data item from view to anyone other than an intended recipient;
in response to determining that the content of the particular data item is encrypted and irrespective of decryption capabilities of the plurality of terminal devices, modifying the unencrypted encapsulation wrapper of the particular data item by at least embedding (i) a uniform resource locator (URL), which has a unique identifier, and (ii) an instruction message into the unencrypted encapsulation wrapper of the particular data item,
wherein the modified unencrypted encapsulation wrapper of the particular data item is viewable by a particular terminal device of the plurality of terminal devices, without decryption, and
wherein the instruction message includes at least an instruction for a user of the particular terminal device to navigate to the URL to view the encrypted content of the particular data item;
sending the particular data item with the modified unencrypted encapsulation wrapper toward the plurality of terminal devices;
in response to the particular terminal device of the plurality of terminal devices attempting to access the encrypted data item with the modified unencrypted encapsulation wrapper, where the particular terminal device has insufficient decryption capabilities:
displaying the instruction message and the URL on the first terminal device;
identifying a web service used by the first terminal device, the web service being a selected service used to view data items;
transforming the URL from a current version to a version that is usable by the web service to retrieve the data item; and
using the transformed URL, which is now usable by the web service, to retrieve the data item;
in response to a different terminal device of the plurality of terminal devices attempting to display the particular data item with the modified unencrypted encapsulation wrapper, where the different terminal device has sufficient decryption capabilities, ignoring the modified unencrypted encapsulation wrapper, including the instruction message and the URL, and decrypting and displaying the content of the particular data item on the different terminal device; and
after the encrypted content is decrypted such that decrypted content is available, determining that usage rights have been applied to the decrypted content to harden the decrypted content,
wherein the usage rights include a header field that has been added to a browser, which is available to display the decrypted content, to force the browser to not leave any traces of the decrypted content, and
wherein forcing the browser to not leave any traces of the decrypted content is performed as a result of the header field allowing only a fresh version of the decrypted content to be displayable.