Document watermark

更新时间:
复制 MD 格式

Document watermarks help you protect the copyright of your enterprise documents and prevent document leaks. To use this feature, embed the document watermark SDK from SASE into your business servers or deploy it as an API service for integration with your business applications. If a data leak occurs, you can use the watermark information for leaker tracing. This topic describes how to use the document watermark feature.

You can embed both visible and invisible watermarks in documents.

  • If you embed a visible watermark, you can see the watermark information directly in the document and identify the leaker.

  • If you embed an invisible watermark, the information is not visible to the naked eye. You must extract the invisible watermark information in the SASE console for leaker tracing.

Data leaks and copyright disputes most often involve documents protected by invisible watermarks.

Capabilities by document type

The following file types are supported: DOCX, PPTX, XLSX, PDF, DOC, PPT, and XLS. The supported capabilities are as follows:

  • Standard invisible watermark (Property): It resists document additions, deletions, modifications, and "Save As" operations (if the format is unchanged), but is vulnerable to format conversion attacks.

  • Standard invisible watermark (Zero-width): Adds watermark information to the document content. It is resistant to document additions, deletions, modifications, "Save As" operations (if the document format remains unchanged), and partial text copy-and-paste. It is not resistant to format conversion to PDF, but is resistant to format conversion to TXT.

  • Standard invisible watermark (Component): Is resistant to document additions, deletions, modifications, "Save As" operations (if the document format remains unchanged), and selecting all content from a DOCX file and pasting it into a new DOCX document. However, it is not resistant to format conversion attacks.

  • Background visible watermark: Is resistant to screenshot attacks and format conversion attacks. The content of a visible watermark is confirmed visually and does not require an extraction API.

  • Background invisible watermark: Is resistant to screenshot attacks and format conversion attacks. To extract the watermark from a document that has been converted to a different format, you must extract it from a screenshot.

File type

Standard invisible watermark

(Property)

Background visible watermark

Background invisible watermark

Standard invisible watermark

(Component)

Standard invisible watermark

(Zero-width)

DOCX

Supported

Supported

Supported

Supported

Supported

PPTX

Supported

Supported

Supported

Not supported

Not supported

XLSX

Supported

Supported

Supported

Not supported

Not supported

PDF

Supported

Supported

Supported

Not supported

Not supported

DOC

Supported

Not supported

Not supported

Not supported

Not supported

PPT

Supported

Not supported

Not supported

Not supported

Not supported

XLS

Supported

Not supported

Not supported

Not supported

Not supported

Workflow

image

Prerequisites

You have purchased the document watermark service. For more information, see Digital Watermark billing overview.

Embed watermarks in documents

Step 1: Download the SDK package

  1. Log on to the Workspace Security console.

  2. In the left-side navigation pane, choose Digital Watermarking > Embedding Service.

  3. On the Embedding Service page, click Download SDK in the Actions column for the document watermark feature to download the document watermark SDK package to your local computer. Save the AK and SK information.

    Currently, only the Java language is supported.

    Currently, only the Java language is supported.

    • watermark-normaldocument-v1.2.8.jar: The SDK package for watermarking. Add this package to the Maven repository.

    • normalDocumentDemo: A demo for document watermarking. Use this demo to try it out.

Step 2: Integrate the SDK

  1. Add the JAR package dependency (Maven).

    1. Add the dependency for watermark-normaldocument-v1.2.8.jar.

      mvn install:install-file  -Dfile=watermark-normaldocument-v1.2.8.jar  -DgroupId=com.aliyun.security.sase -DartifactId=watermark-normaldocument  -Dversion=v1.2.8  -Dpackaging=jar
    2. Add the following dependencies to the pom.xml file.

      <dependency>
          <groupId>com.aliyun.security.sase</groupId>
          <artifactId>watermark-normaldocument</artifactId>
          <version>v1.2.8</version>
      </dependency>
      <dependency>
          <groupId>net.java.dev.jna</groupId>
          <artifactId>jna</artifactId>
          <version>5.13.0</version>
      </dependency>
      <dependency>
          <groupId>org.apache.poi</groupId>
          <artifactId>poi</artifactId>
          <version>3.17</version>
      </dependency>
      <dependency>
          <groupId>org.apache.poi</groupId>
          <artifactId>poi-ooxml</artifactId>
          <version>3.17</version>
      </dependency>
      <dependency>
          <groupId>org.apache.poi</groupId>
          <artifactId>poi-ooxml-schemas</artifactId>
          <version>3.17</version>
      </dependency>
      <dependency>
          <groupId>org.apache.poi</groupId>
          <artifactId>poi-scratchpad</artifactId>
          <version>3.17</version>
      </dependency>
      <dependency>
          <groupId>org.apache.poi</groupId>
          <artifactId>poi-excelant</artifactId>
          <version>3.17</version>
      </dependency>
      <dependency>
          <groupId>org.apache.poi</groupId>
          <artifactId>ooxml-schemas</artifactId>
          <version>1.3</version>
          <exclusions>
              <exclusion>
                  <groupId>org.apache.xmlbeans</groupId>
                  <artifactId>xmlbeans</artifactId>
              </exclusion>
          </exclusions>
      </dependency>
  2. Call the document watermark API.

    1. Initialize the AccessKey ID and AccessKey secret.

        /**
         * Initializes the AccessKey ID and AccessKey secret.
         * @param appKey The application key.
         * @param secret The application secret.
         * @param useLocalConfig Specifies whether to use local configurations. 0: remote configuration (requires an internet connection); 1: local configuration.
         */
      WaterMarkUtils.init(appKey, secret, useLocalConfig);
    2. Embed a document watermark in a document.

      • Method 1: Generate a new document after embedding the watermark.

        ParamsFile paramsFile = new ParamsFile();
        // Visible watermark parameters (required): {"invisibleAntiTextCopy":"true","invisibleAntiAllCopy":"true","backgroundControl":{"bgAddVisible":"true","bgVisibleControl":{"visibleText":"Alibaba visible watermark TEST123","mode":"pos","fontSize":"30","fontColor":"0x000000","fontTransparent":"0.2","angle":"30","pos_x":"0.5","pos_y":"0.5","fontPath":"/tmp/AlibabaPuHuiTi-2-45-Light.ttf"},"bgAddInvisible":"true","bgInvisibleControl":{"invisibleTransparent":"0.03"}}}
        paramsFile.setVisibleParam(visibleParam);
        // Destination file path.
        paramsFile.setDestFilePath(dest);
        // Source file path.
        paramsFile.setSrcFilePath(src);
        // Watermark number. Range: 1 to 4294967295.
        paramsFile.setMsgNum(msgNum);
        /**
         * Embeds a watermark in a file.
         * @param baseParam
         * @return
         * @throws NormalDocumentException See Error Codes for the definitions of errorCode and errorMessage.
         * @throws IOException
         */
        WaterMarkUtils.WatermarkFile(paramsFile);
      • Method 2: Embed a watermark using a byte array and receive the output as a byte array.

        ParamsBytes paramsBytes = new ParamsBytes();
        // Set the source file byte array.
        paramsBytes.setSrcFileBytes(srcFileBytes);
        // File name. The file type is obtained from the file name.
        paramsBytes.setFileName("234.doc");
        // Visible watermark parameters: {"invisibleAntiTextCopy":"true","invisibleAntiAllCopy":"true","backgroundControl":{"bgAddVisible":"true","bgVisibleControl":{"visibleText":"Alibaba visible watermark TEST123","mode":"pos","fontSize":"30","fontColor":"0x000000","fontTransparent":"0.2","angle":"30","pos_x":"0.5","pos_y":"0.5","fontPath":"/tmp/AlibabaPuHuiTi-2-45-Light.ttf"},"bgAddInvisible":"true","bgInvisibleControl":{"invisibleTransparent":"0.03"}}}
        paramsBytes.setVisibleParam(visibleParam);
        // Watermark number. Range: 1 to 4294967295.
        paramsBytes.setMsgNum(msgNum);
        /**
         * Embeds a watermark and returns the destination file as a byte array.
         * @param baseParam
         * @return
         * @throws NormalDocumentException See Error Codes for the definitions of errorCode and errorMessage.
         * @throws IOException
         */
        byte[] destFileBytes = WaterMarkUtils.WatermarkFile(paramsBytes);

Parameters

visibleParam

This parameter controls watermark features. For example, you can use it to enable or disable invisible watermarks, configure the style of background visible watermarks, set the intensity of background invisible watermarks, and enable or disable background visible and invisible watermarks.

Note

Pass this parameter as a single-line JSON string without extra spaces. The keys and values in the JSON string must be of the string type and enclosed in double quotation marks. If a key or value in the JSON string corresponds to a feature not supported by the SDK, it is ignored.

For example, the invisibleAntiTextCopy and invisibleAntiAllCopy parameters are valid only for DOCX documents. If you pass these parameters for PPTX, XLSX, or PDF files, they are ignored and no error is reported.

{
  "invisibleAntiTextCopy": "true",
  "invisibleAntiAllCopy": "true",
  "backgroundControl": {
    "bgAddVisible":"true",
    "bgVisibleControl": {
      "visibleText":"Alibaba visible watermark TEST123",
      "mode":"pos",
      "fontSize":"30",
      "fontColor":"0x000000",
      "fontTransparent":"0.2",
      "angle":"30",
      "pos_x":"0.5",
      "pos_y":"0.5",
      "fontPath":"/tmp/AlibabaPuHuiTi-2-45-Light.ttf"
    },
    "bgAddInvisible":"true",
    "bgInvisibleControl": {
      "invisibleTransparent":"0.03"
    }
  }
}

The following table describes the parameters.

Parameter

Type

Required

Description

Example

invisibleAntiTextCopy

String

Yes

Specifies whether to enable the zero-width character invisible watermark. Valid values:

  • true: Enabled

  • false: Disabled

true

invisibleAntiAllCopy

String

Yes

Specifies whether to enable the component-based invisible watermark. Valid values:

  • true: Enabled

  • false: Disabled

true

backgroundControl

JSON

Yes

A JSON object that controls the background watermark. For more information, see the description of the bgVisibleControl parameter.

JSON object

bgAddVisible

String

Yes

Specifies whether to enable the background visible watermark. Valid values:

  • true: Enabled

  • false: Disabled

true

bgVisibleControl

String

Yes

Controls the background visible watermark.

The value is an object.

visibleText

String

Yes

The text content of the visible watermark.

Alibaba visible watermark TEST123

mode

String

Yes

The mode of the visible watermark. Valid values:

  • pos: The position mode, which embeds the watermark at a specific position in the background.

  • rep: The tiled mode, which tiles the visible watermark across the document page.

pos

fontSize

String

Yes

The font size of the visible watermark text. The larger the value, the larger the watermark text. This must be a positive integer.

30

fontColor

String

Yes

The color of the visible watermark text, specified as a hexadecimal pixel value in RGB order. For example, in 0xFF00F0, FF is the R (red) value, 00 is the G (green) value, and F0 is the B (blue) value.

0x000000

fontTransparent

String

Yes

The transparency of the visible watermark text. The value must be a floating-point number between 0 and 1.

0.2

angle

String

Yes

The counter-clockwise tilt angle of the visible watermark text. The value must be an integer from 0 to 360. A value of 0 means no tilt.

30

pos_x

String

Yes

A parameter specific to position mode that controls the horizontal position of the visible watermark. The origin is the lower-left corner. If the value is from 0 to 1, the position is relative (percentage). If the value is greater than 1, it is treated as an absolute pixel value.

0.5

pos_y

String

Yes

A parameter specific to position mode that controls the vertical position of the visible watermark. The origin is the lower-left corner. If the value is from 0 to 1, the position is relative (percentage). If the value is greater than 1, it is treated as an absolute pixel value.

0.5

fontPath

String

Yes

The font path for the background visible watermark, which controls the font style. Both relative and absolute paths are supported.

/tmp/AlibabaPuHuiTi-2-45-Light.ttf

bgAddInvisible

String

Yes

Specifies whether to enable the background invisible watermark.

  • true: Enabled

  • false: Disabled

true

bgInvisibleControl

String

Yes

The key that controls the background invisible watermark.

The value is an object.

invisibleTransparent

String

Yes

The intensity of the background invisible watermark. The value must be between 0 and 0.05.

If you specify a value outside this range, the system uses the default value of 0.02.

0.03

bgVisibleControl

Parameter

Type

Required

Description

Example

horizonNumber

String

Yes

Specific to tiled mode. Specifies the number of times the visible watermark repeats horizontally. This must be an integer.

2

verticalNumber

String

Yes

Specific to tiled mode. Specifies the number of times the visible watermark repeats vertically. This must be an integer.

2

Extract invisible watermark information

Before you begin, ensure you have the leaked document or a screenshot of it.

Step 1: Create an extraction task

  1. Log on to the Workspace Security console.

  2. In the left-side navigation pane, choose Digital Watermarking > Extraction Service.

  3. On the Extraction Service page, click Create Extraction Task to extract the invisible watermark content from the leaked document.

    For the Is Screenshot parameter, select Yes or No based on the file that you upload.

    Parameter

    Description

    Watermark version

    Select the watermark version to use. Valid values:

    • Normal: Supports extraction from standard files that are not generated by AI.

    • AIGC: Supports extraction from files generated by AI.

    Watermark type

    Select Document Watermark.

    Bit width of embedded watermark

    Specify the bit width of the embedded watermark. This value must match the bit width configured in the SDK (default is 32).

    Upload file for watermark extraction

    Upload the leaked file as prompted.

Step 2: View the extraction result

After the extraction task is created and successfully completed, view the result to obtain the invisible watermark plaintext.

  1. On the Extraction Service page, click Show in the Extracted Information column.

  2. In the expanded information, you can find the invisible watermark plaintext (a decimal number).

    The expanded information also shows the Watermark Content Type (for example, 64-bit uint information) and the Extraction Result status.

Leaker tracing

Correlate the extracted invisible watermark plaintext with your business's mapping service or a custom mapping table to trace the leaker.

For example, if the extracted invisible watermark plaintext is "123456" and "123456" maps to John Doe in your mapping table, the leaker is identified as the employee John Doe.

Related documents