Document watermarks help you protect the copyright of your enterprise documents and prevent document leaks. To use this feature, embed the document watermark SDK from SASE into your business servers or deploy it as an API service for integration with your business applications. If a data leak occurs, you can use the watermark information for leaker tracing. This topic describes how to use the document watermark feature.
You can embed both visible and invisible watermarks in documents.
-
If you embed a visible watermark, you can see the watermark information directly in the document and identify the leaker.
-
If you embed an invisible watermark, the information is not visible to the naked eye. You must extract the invisible watermark information in the SASE console for leaker tracing.
Data leaks and copyright disputes most often involve documents protected by invisible watermarks.
Capabilities by document type
The following file types are supported: DOCX, PPTX, XLSX, PDF, DOC, PPT, and XLS. The supported capabilities are as follows:
-
Standard invisible watermark (Property): It resists document additions, deletions, modifications, and "Save As" operations (if the format is unchanged), but is vulnerable to format conversion attacks.
-
Standard invisible watermark (Zero-width): Adds watermark information to the document content. It is resistant to document additions, deletions, modifications, "Save As" operations (if the document format remains unchanged), and partial text copy-and-paste. It is not resistant to format conversion to PDF, but is resistant to format conversion to TXT.
-
Standard invisible watermark (Component): Is resistant to document additions, deletions, modifications, "Save As" operations (if the document format remains unchanged), and selecting all content from a DOCX file and pasting it into a new DOCX document. However, it is not resistant to format conversion attacks.
-
Background visible watermark: Is resistant to screenshot attacks and format conversion attacks. The content of a visible watermark is confirmed visually and does not require an extraction API.
-
Background invisible watermark: Is resistant to screenshot attacks and format conversion attacks. To extract the watermark from a document that has been converted to a different format, you must extract it from a screenshot.
|
File type |
Standard invisible watermark (Property) |
Background visible watermark |
Background invisible watermark |
Standard invisible watermark (Component) |
Standard invisible watermark (Zero-width) |
|
DOCX |
Supported |
Supported |
Supported |
Supported |
Supported |
|
PPTX |
Supported |
Supported |
Supported |
Not supported |
Not supported |
|
XLSX |
Supported |
Supported |
Supported |
Not supported |
Not supported |
|
|
Supported |
Supported |
Supported |
Not supported |
Not supported |
|
DOC |
Supported |
Not supported |
Not supported |
Not supported |
Not supported |
|
PPT |
Supported |
Not supported |
Not supported |
Not supported |
Not supported |
|
XLS |
Supported |
Not supported |
Not supported |
Not supported |
Not supported |
Workflow
Prerequisites
You have purchased the document watermark service. For more information, see Digital Watermark billing overview.
Embed watermarks in documents
Step 1: Download the SDK package
-
Log on to the Workspace Security console.
-
In the left-side navigation pane, choose .
-
On the Embedding Service page, click Download SDK in the Actions column for the document watermark feature to download the document watermark SDK package to your local computer. Save the AK and SK information.
Currently, only the Java language is supported.
Currently, only the Java language is supported.
-
watermark-normaldocument-v1.2.8.jar: The SDK package for watermarking. Add this package to the Maven repository.
-
normalDocumentDemo: A demo for document watermarking. Use this demo to try it out.
-
Step 2: Integrate the SDK
-
Add the JAR package dependency (Maven).
-
Add the dependency for
watermark-normaldocument-v1.2.8.jar.mvn install:install-file -Dfile=watermark-normaldocument-v1.2.8.jar -DgroupId=com.aliyun.security.sase -DartifactId=watermark-normaldocument -Dversion=v1.2.8 -Dpackaging=jar -
Add the following dependencies to the
pom.xmlfile.<dependency> <groupId>com.aliyun.security.sase</groupId> <artifactId>watermark-normaldocument</artifactId> <version>v1.2.8</version> </dependency> <dependency> <groupId>net.java.dev.jna</groupId> <artifactId>jna</artifactId> <version>5.13.0</version> </dependency> <dependency> <groupId>org.apache.poi</groupId> <artifactId>poi</artifactId> <version>3.17</version> </dependency> <dependency> <groupId>org.apache.poi</groupId> <artifactId>poi-ooxml</artifactId> <version>3.17</version> </dependency> <dependency> <groupId>org.apache.poi</groupId> <artifactId>poi-ooxml-schemas</artifactId> <version>3.17</version> </dependency> <dependency> <groupId>org.apache.poi</groupId> <artifactId>poi-scratchpad</artifactId> <version>3.17</version> </dependency> <dependency> <groupId>org.apache.poi</groupId> <artifactId>poi-excelant</artifactId> <version>3.17</version> </dependency> <dependency> <groupId>org.apache.poi</groupId> <artifactId>ooxml-schemas</artifactId> <version>1.3</version> <exclusions> <exclusion> <groupId>org.apache.xmlbeans</groupId> <artifactId>xmlbeans</artifactId> </exclusion> </exclusions> </dependency>
-
-
Call the document watermark API.
-
Initialize the AccessKey ID and AccessKey secret.
/** * Initializes the AccessKey ID and AccessKey secret. * @param appKey The application key. * @param secret The application secret. * @param useLocalConfig Specifies whether to use local configurations. 0: remote configuration (requires an internet connection); 1: local configuration. */ WaterMarkUtils.init(appKey, secret, useLocalConfig); -
Embed a document watermark in a document.
-
Method 1: Generate a new document after embedding the watermark.
ParamsFile paramsFile = new ParamsFile(); // Visible watermark parameters (required): {"invisibleAntiTextCopy":"true","invisibleAntiAllCopy":"true","backgroundControl":{"bgAddVisible":"true","bgVisibleControl":{"visibleText":"Alibaba visible watermark TEST123","mode":"pos","fontSize":"30","fontColor":"0x000000","fontTransparent":"0.2","angle":"30","pos_x":"0.5","pos_y":"0.5","fontPath":"/tmp/AlibabaPuHuiTi-2-45-Light.ttf"},"bgAddInvisible":"true","bgInvisibleControl":{"invisibleTransparent":"0.03"}}} paramsFile.setVisibleParam(visibleParam); // Destination file path. paramsFile.setDestFilePath(dest); // Source file path. paramsFile.setSrcFilePath(src); // Watermark number. Range: 1 to 4294967295. paramsFile.setMsgNum(msgNum); /** * Embeds a watermark in a file. * @param baseParam * @return * @throws NormalDocumentException See Error Codes for the definitions of errorCode and errorMessage. * @throws IOException */ WaterMarkUtils.WatermarkFile(paramsFile); -
Method 2: Embed a watermark using a byte array and receive the output as a byte array.
ParamsBytes paramsBytes = new ParamsBytes(); // Set the source file byte array. paramsBytes.setSrcFileBytes(srcFileBytes); // File name. The file type is obtained from the file name. paramsBytes.setFileName("234.doc"); // Visible watermark parameters: {"invisibleAntiTextCopy":"true","invisibleAntiAllCopy":"true","backgroundControl":{"bgAddVisible":"true","bgVisibleControl":{"visibleText":"Alibaba visible watermark TEST123","mode":"pos","fontSize":"30","fontColor":"0x000000","fontTransparent":"0.2","angle":"30","pos_x":"0.5","pos_y":"0.5","fontPath":"/tmp/AlibabaPuHuiTi-2-45-Light.ttf"},"bgAddInvisible":"true","bgInvisibleControl":{"invisibleTransparent":"0.03"}}} paramsBytes.setVisibleParam(visibleParam); // Watermark number. Range: 1 to 4294967295. paramsBytes.setMsgNum(msgNum); /** * Embeds a watermark and returns the destination file as a byte array. * @param baseParam * @return * @throws NormalDocumentException See Error Codes for the definitions of errorCode and errorMessage. * @throws IOException */ byte[] destFileBytes = WaterMarkUtils.WatermarkFile(paramsBytes);
-
-
Parameters
visibleParam
This parameter controls watermark features. For example, you can use it to enable or disable invisible watermarks, configure the style of background visible watermarks, set the intensity of background invisible watermarks, and enable or disable background visible and invisible watermarks.
Pass this parameter as a single-line JSON string without extra spaces. The keys and values in the JSON string must be of the string type and enclosed in double quotation marks. If a key or value in the JSON string corresponds to a feature not supported by the SDK, it is ignored.
For example, the invisibleAntiTextCopy and invisibleAntiAllCopy parameters are valid only for DOCX documents. If you pass these parameters for PPTX, XLSX, or PDF files, they are ignored and no error is reported.
{
"invisibleAntiTextCopy": "true",
"invisibleAntiAllCopy": "true",
"backgroundControl": {
"bgAddVisible":"true",
"bgVisibleControl": {
"visibleText":"Alibaba visible watermark TEST123",
"mode":"pos",
"fontSize":"30",
"fontColor":"0x000000",
"fontTransparent":"0.2",
"angle":"30",
"pos_x":"0.5",
"pos_y":"0.5",
"fontPath":"/tmp/AlibabaPuHuiTi-2-45-Light.ttf"
},
"bgAddInvisible":"true",
"bgInvisibleControl": {
"invisibleTransparent":"0.03"
}
}
}
The following table describes the parameters.
|
Parameter |
Type |
Required |
Description |
Example |
|
invisibleAntiTextCopy |
String |
Yes |
Specifies whether to enable the zero-width character invisible watermark. Valid values:
|
true |
|
invisibleAntiAllCopy |
String |
Yes |
Specifies whether to enable the component-based invisible watermark. Valid values:
|
true |
|
backgroundControl |
JSON |
Yes |
A JSON object that controls the background watermark. For more information, see the description of the bgVisibleControl parameter. |
JSON object |
|
bgAddVisible |
String |
Yes |
Specifies whether to enable the background visible watermark. Valid values:
|
true |
|
bgVisibleControl |
String |
Yes |
Controls the background visible watermark. |
The value is an object. |
|
visibleText |
String |
Yes |
The text content of the visible watermark. |
Alibaba visible watermark TEST123 |
|
mode |
String |
Yes |
The mode of the visible watermark. Valid values:
|
pos |
|
fontSize |
String |
Yes |
The font size of the visible watermark text. The larger the value, the larger the watermark text. This must be a positive integer. |
30 |
|
fontColor |
String |
Yes |
The color of the visible watermark text, specified as a hexadecimal pixel value in RGB order. For example, in |
0x000000 |
|
fontTransparent |
String |
Yes |
The transparency of the visible watermark text. The value must be a floating-point number between 0 and 1. |
0.2 |
|
angle |
String |
Yes |
The counter-clockwise tilt angle of the visible watermark text. The value must be an integer from 0 to 360. A value of 0 means no tilt. |
30 |
|
pos_x |
String |
Yes |
A parameter specific to position mode that controls the horizontal position of the visible watermark. The origin is the lower-left corner. If the value is from 0 to 1, the position is relative (percentage). If the value is greater than 1, it is treated as an absolute pixel value. |
0.5 |
|
pos_y |
String |
Yes |
A parameter specific to position mode that controls the vertical position of the visible watermark. The origin is the lower-left corner. If the value is from 0 to 1, the position is relative (percentage). If the value is greater than 1, it is treated as an absolute pixel value. |
0.5 |
|
fontPath |
String |
Yes |
The font path for the background visible watermark, which controls the font style. Both relative and absolute paths are supported. |
/tmp/AlibabaPuHuiTi-2-45-Light.ttf |
|
bgAddInvisible |
String |
Yes |
Specifies whether to enable the background invisible watermark.
|
true |
|
bgInvisibleControl |
String |
Yes |
The key that controls the background invisible watermark. |
The value is an object. |
|
invisibleTransparent |
String |
Yes |
The intensity of the background invisible watermark. The value must be between 0 and 0.05. If you specify a value outside this range, the system uses the default value of 0.02. |
0.03 |
bgVisibleControl
|
Parameter |
Type |
Required |
Description |
Example |
|
horizonNumber |
String |
Yes |
Specific to tiled mode. Specifies the number of times the visible watermark repeats horizontally. This must be an integer. |
2 |
|
verticalNumber |
String |
Yes |
Specific to tiled mode. Specifies the number of times the visible watermark repeats vertically. This must be an integer. |
2 |
Extract invisible watermark information
Before you begin, ensure you have the leaked document or a screenshot of it.
Step 1: Create an extraction task
-
Log on to the Workspace Security console.
-
In the left-side navigation pane, choose .
-
On the Extraction Service page, click Create Extraction Task to extract the invisible watermark content from the leaked document.
For the Is Screenshot parameter, select Yes or No based on the file that you upload.
Parameter
Description
Watermark version
Select the watermark version to use. Valid values:
-
Normal: Supports extraction from standard files that are not generated by AI.
-
AIGC: Supports extraction from files generated by AI.
Watermark type
Select Document Watermark.
Bit width of embedded watermark
Specify the bit width of the embedded watermark. This value must match the bit width configured in the SDK (default is 32).
Upload file for watermark extraction
Upload the leaked file as prompted.
-
Step 2: View the extraction result
After the extraction task is created and successfully completed, view the result to obtain the invisible watermark plaintext.
-
On the Extraction Service page, click Show in the Extracted Information column.
-
In the expanded information, you can find the invisible watermark plaintext (a decimal number).
The expanded information also shows the Watermark Content Type (for example, 64-bit uint information) and the Extraction Result status.
Leaker tracing
Correlate the extracted invisible watermark plaintext with your business's mapping service or a custom mapping table to trace the leaker.
For example, if the extracted invisible watermark plaintext is "123456" and "123456" maps to John Doe in your mapping table, the leaker is identified as the employee John Doe.
Related documents
-
For more information about the use cases, capabilities, architecture, and purchasing channels of Digital Watermark, see What is Digital Watermark?.
-
If you need to use other types of watermark services, see the following topics: