Document Encryption, Endpoint Management and Audit
Zhiyuan document-encryption management integrates encryption, endpoint controls and audit functions. The detailed modules below describe Tianrui GreenShield; separately purchased components are identified where applicable.
Solution overview
Encrypt documents without changing ordinary working habits. Platform options include 32-/64-bit Windows XP, Windows 2003/2008, Windows 7/8/10, Mac Office and Linux. Features include three-key management, application-server allowlists, workflow-based encryption/decryption approvals, automatic encrypted-file backups, multi-format document protection and configurable trusted programs, mobile reading of encrypted server files, and an integrated database for data management.
Application examples include Office, Photoshop, CorelDRAW, AutoCAD and UG. Foxmail/Outlook integration can automatically decrypt attachments to allowlisted recipients. Protection includes source-code files and large-file encryption.
The overview groups functions into transparent encryption/decryption, three-key management, offline policies, online/mobile decryption requests, outbound-file controls, groups, server/email allowlists; preventive and in-use controls for desktops, browsing, email, chat, devices, printers, shares, USB storage and applications; and after-the-event evidence through logs, browsing/chat records, screen recordings, email/print records, traffic and USB-transfer logs.
1. Data-leakage prevention module
| Area | Functions described in the original |
|---|---|
| Server platforms | Standard: Windows Server 2003/2008/2012, 32-/64-bit. Compatibility list: Windows 7/8/10, 32-/64-bit. |
| Client platforms | Standard: Windows XP/7/8/10, 32-/64-bit. Compatibility list: Windows Server 2003/2008/2012, 32-/64-bit, and Linux. |
| Antivirus compatibility | Standalone/network antivirus products listed for server and client environments include McAfee, Kaspersky, NOD32, Symantec/Norton/SEP, Trend Micro, Rising, Jiangmin and 360. |
| Console administrator | Change the console login password. |
| Endpoint administration | Upgrade/uninstall GreenShield clients, inspect details and installation status, configure functional modules and synchronize endpoint nicknames with computer names. |
| Admission and logs | When new-user admission requires approval, console staff decide whether to admit the endpoint. Log endpoint access and disable selected modules for particular users. |
| Endpoint settings | Configure idle-state changes when keyboard/mouse input stops, endpoint-icon/process visibility, operational logging and visibility of the authorization-code menu. These are descriptions of product options, not changes made to this website or computer. |
| System options | Server, console, endpoint and new-user-authentication parameters. Hotkeys for importing offline policies, maintenance, showing/hiding icons and screenshots. Additional administrators and delegated rights; console-operation audit queries by time, operator, type and result; product registration and registration details. |
| Policy/rule centre | Define operator types, permissions and classification levels; controlled-program policies, security options and outbound limits. Options include encryption type, clipboard, short-term offline operation, screenshots and endpoint icons. Copy/import/export policies. Configure controlled programs separately for Windows, Mac and Linux. |
| Enterprise key | Master, enterprise and file keys participate in encryption and all three are verified for decryption. Customers set and can change the enterprise key, including after an employee with key knowledge leaves. The customer-controlled enterprise key is not held by the developer. |
| Transparent encryption | Driver-level dynamic encryption protects confidential files from creation. Authorized users open and save normally while the background driver decrypts on opening and encrypts on saving. |
| Semi-transparent mode | Locally created files are not automatically encrypted, but internal encrypted files can be opened and remain encrypted when edited and saved. |
| Copy/paste and screenshots | Prevent copying encrypted content to uncontrolled applications. Block capture tools and Print Screen, or return black images, while optionally allowing specified capture tools. The bundled capture tool allows captured images to be pasted only into encrypted documents. |
| OLE, virtual printing and programs | Block OLE insertion; encrypt files produced by virtual printing; prevent controlled-program renaming or process impersonation and terminate detected impersonators. Endpoint process protection includes hiding the process in Task Manager. |
| Screen watermark | Custom text, font size, colour and transparency. |
| Reading permissions | Five classification levels for personnel/documents; lower-clearance users cannot open higher-classified files. Department-based reading isolation prevents unauthorized cross-department access. |
| Bulk and requested decryption | Highly privileged users can bulk-decrypt files for external release without approval. Ordinary endpoints request release from an online approver. |
| Controlled outbound files | Request packages with limits on opening count, lifetime, password verification, editing, screenshots and printing, including expiry/self-destruction options. Files cannot open outside the configured limits. |
| Outbound allowlist and records | Allowlist trusted external computers by machine code so packages can open without entering an authorization code. Record outbound activity and destinations. |
| Short-term offline use | Configure an unapproved short offline period, for example 72 hours, during which encrypted files remain usable and saved files remain encrypted. |
| Long-term/permanent offline use | Request longer travel authorization before departure; files become unavailable after authorization expires. Permanent offline authorization is described for branches/offices so encrypted documents can be exchanged with headquarters. Log offline requests for audit. |
| Approval workflows | Define and assign workflows for offline access, decryption, printing for external release and direct outbound release; retain approval logs. |
| Special directories | Automatically decrypt files when configured characters occur in a filename or directory. |
| Encryption/decryption records | Log operator, time, operation type, total files, successes and failures. |
| Classification changes | Authorized users can change document classifications only to levels below their own. Administrators can query change logs. |
| File backup | Choose file types for automatic backup after creation/editing and upload copies to the server to mitigate accidental or malicious deletion. Backup records include endpoint, operator, time, size in KB, filename and original path. |
| Server-policy backup | Manual policy-configuration backups and scheduled backups with configurable retention days and storage paths. |
| Email allowlist | For trusted recurring recipients, automatically decrypt encrypted attachments to plaintext without an approval request. |
| Server allowlist | Integrate with application servers to configure encryption/decryption on upload/download over HTTP/HTTPS. |
| Mac endpoints | Online endpoints communicate continuously with the server and support policies, bulk encryption/decryption and short-term offline rules. Permanently offline endpoints operate without server communication. Mac-kernel transparent encryption applies to configured document types in trusted processes; untrusted processes cannot operate on encrypted documents. Encryption preserves file formats and sizes and supports exchange with Windows-encrypted files. Selected file types back up automatically after creation/editing. Modes include transparent encryption/decryption and decrypt-only operation. |
| Linux endpoints | Manage permanently offline endpoints by adding/editing/deleting endpoint details and importing policies. Online endpoints support policy delivery, clipboard controls and short-term offline use. Linux-kernel transparent encryption protects configured documents used by trusted processes, preserves file formats and sizes, and supports Windows compatibility. Transparent and decrypt-only modes, copy/paste/screenshot controls between controlled and uncontrolled applications, and online upgrade/uninstallation are included. |
| Secure application access — separate purchase | A GreenShield application-server access component placed between core servers and users permits access only from endpoints with the encryption client. Combined with transparent encryption and server allowlists, it decrypts uploads and encrypts downloads. |
| Authorized decryption key — separate purchase | Allows designated people who do not install the endpoint program to view encrypted documents. |
2. Desktop-management system
| Area | Functions described |
|---|---|
| Web/network access | Restrict browsing with categorized URL libraries; restrict network ports; configure traffic limits. A configured network boundary can trigger a warning, disconnect the out-of-range connection or lock the screen. Define LAN ranges so port controls can distinguish local traffic and optionally exclude LAN traffic from statistics. |
| Printing | Printer permissions and custom print watermarks: content, font size/colour/type, position and layer. |
| Chat controls | QQ allowlists permit all, no, or specified QQ accounts. Restrict QQ file transfers by size or prohibit them. |
| USB authentication | Register and authenticate USB storage devices so only approved devices can be used. |
| Assets | Query endpoint hardware and installed software; log hardware/software changes. |
| Hardware/device controls | Allow, prohibit or make USB storage read-only. Control optical/floppy drives, serial/parallel ports, USB keyboards/mice, network cards and other interfaces. Inspect devices and enable/disable drivers. |
| Task delivery — separate purchase | Push file tasks so endpoints retrieve designated files from an FTP server; distribute software with optional automatic installation. Log uploads, task operations and distribution, query by time, and search file uploads by filename or username or send a specified file. |
| Endpoint information | Inspect operating system, startup time, logged-in user and disk utilization. |
| Applications and processes | Restrict applications or window titles. Inspect running processes and terminate suspicious ones. |
| File explorer | Browse target-endpoint disks, files and folders for administration. |
| Software management | Inspect installed software and distribution; create uninstall tasks for unauthorized or unsafe software; retain uninstall, operation and distribution records. |
| System services | Manage services, failure-recovery/restart actions and enable/disable settings for hardware profiles. |
| Shares | Apply sharing policies and inspect share names, paths and user counts. |
| Remote assistance | Remote Windows logoff, restart, shutdown and messages. |
| IP/MAC binding | Block network access after a bound IP is changed; MAC binding is intended to restrict unauthorized network-card changes or external computers. |
| ARP protection | Bind endpoint ARP information using IP and MAC addresses to help prevent ARP spoofing. |
3. Behavioural auditing
| Record | Details described |
|---|---|
| File operations | Record endpoint file-operation types and query by time period. |
| Window titles | Search window events by time or matching characters. |
| USB outbound copies | Query by time or filename, including source and destination paths. |
| Application use | Runtime, username, event title and event content, including errors, warnings and normal use. |
| Disc burning | Burn time, endpoint, file size, recorder and disc names. |
| Printing | Detailed print-operation records. |
| Screen tracking/recording | Live endpoint-screen viewing and periodic captures saved to the server for later review. |
| Browsing | Browse time, website address, page title and URL, searchable by period; open the recorded URL for review. |
| Forum posts | Post time, title and URL, searchable by period, with access to the recorded post. |
| Traffic | Current endpoint network traffic for resource-use analysis. |
| Chat content | Chat audit options include QQ/TM, MSN/Live Messenger, Skype, Yahoo Messenger, Alibaba TradeManager, AOL, Google Talk, Sina UC, E-Hua-Tong, ICQ, Taobao Wangwang, Fetion, UUCALL, IP Messenger and FeiQ. |
| QQ file transfers | Senders, recipients and transfer times. |
| Client and web email | Record email sent through Foxmail/Outlook and webmail, including correspondents, subjects and attachments for audit queries. |
| Alerts | Configurable alerts for prohibited programs, removable-disk insertion/removal, IP/MAC changes, computer-name changes and IP/MAC-binding violations. Administrators enable or disable the applicable rules. |
| Statistics | Reports on programs, browsing, chat and network traffic. |
