By F. Scott Deaver Chief Technical Officer/Founder/Inventor July 23, 2017

(1)

Certitude Digital’s AMULET Cloak™

file enciphering and packaging utility

--- I NSTALLATION AND USAGE

Version 0.05 (Alpha)

By F. Scott Deaver

Chief Technical Officer/Founder/Inventor July 23, 2017

(2)

Purpose

Certitude Digital’s AMULET Cloak™ File Enciphering and Packaging Utility is useful when you want to AMULET™-protect an individual file (or small set of files having a similar purpose) so it can be safely sent to, or be accessed by, someone else.

Certitude Digital provides several other utilities, notably the AMULET Guardian™ utility, for easily and efficiently protecting large collections of files, but the AMULET Cloak™ file packaging utility is perfect when you need to quickly send a file or small set of unprotected files to a co-worker via e-mail, for example.

The AMULET Cloak™ file packaging utility is specifically designed for the following scenarios, where you would like to send, or grant access to, a:

• single file which you would like to protect with one or more AMULET™ criteria sets, and may also want to cover with some low-resolution, summary, or demo content of the same file type that unauthorized users can see even though they will not otherwise have access to your file;

• collection, or album, of files of the same file type, which you would like to protect with one or more AMULET™ criteria sets, and may also want to cover with some low-resolution, summary, or demo content of the same file type that unauthorized users can see even though they will not otherwise have access to your files;

• set of files related to an application, where one of the files is the primary executable file and the others are files of various types that support the executable file in some way. You would like to protect that set of files with one or more AMULET™ criteria sets, and may also want to cover with some low-resolution, summary, or demo content of the same file type as the executable file in the set, one that unauthorized users can see even though they will not otherwise have access to your files; or

• collection of files that are not necessarily of the same file type, which you would like to protect with one or more AMULET™ criteria sets, and which you want zipped together and compressed before protection, with the resulting file to be a *.zip file. You do not want a low-resolution, summary, or demo cover file associated with the *.zip file.

Number of Files

to be Packaged File Types

Low Res / Demo Option Included?

Single Any Yes

Multiple All files in the group must be of

the same type

Yes

Multiple Different types, but all related to an executable app

Yes

Multiple – zipped together

Files in the group may be of different types

No

(4)

Installation

To install the AMULET Cloak™ File Enciphering and Packaging Utility, simply download the file from the Certitude website, and save it to your desired folder location. If the download package is provided to you as a zip file package, then unzip the package in the desired folder. Depending on the source, the zip package you download may also contain the AMULET Criteria Editor™ and other supporting files, all of which should be saved together in the same desired folder. The AMULET Cloak™ file packaging utility provides, within it, a means to launch the AMULET Criteria Editor™, as you’ll read below in the user interface section.

For more information regarding using the AMULET Criteria Editor™, please refer to the separate https://certitudedigital.com/public_docs/InstructionsForCertitudeAMULETEditor.pdf document.

Caveats

This is an “alpha” demo – alpha is the earliest stage at which a piece of software will ever be viewed by an external audience - see https://en.wikipedia.org/wiki/Software_release_life_cycle. There will be bugs, and some may crash the host device. There will not be any support from us, other than frequent and regular releases of improved replacement modules. We do welcome bug reports sent us by e-mail via the Certitude Digital website.

Known issues

All Certitude Digital AMULET™ products and components are in their early pre-release stages – this means that certain features which will be present in their final release versions are not yet present in the alpha or beta releases.

One feature that is not yet present is the ability to detect the previous installation of a different version of the same component (or one installed at a different location on the device) when a component is asked to install itself. This is especially problematic for the AMULET™ framework – only one instance of the framework can be present or installed on a device’s operating system at any one point in time.

Before installing the framework on a device (or in the case of AMULET Decloak™, installing a product which automatically installs the framework in the background itself), you’ll need to make sure all previous installations of the framework have been removed from disk and from memory. You’ll need to check memory first. In Windows, press the CTRL-ALT-DEL key combination and select Task Manager.

Depending upon what version of Windows you may be running, the Task Manager window may appear differently from what is shown here (the Windows 10 Enterprise version is shown in the image below):

(5)

“CertitudeFrameworkU32U.exe” (or something similar to them) may appear in the Task Manager

“Process” tab, under either the “Apps” or “Background processes” headings. You’ will need to select each in turn, if it appears, and then click the “End task” button.

You can then remove any current framework installations from the disk at the locations where you previously installed them – but before you do, make copies of any AMULET™ config files you have stored into the docking directory of that AMULET™ framework installation and wish to keep! To find out where the docking directory is for the most recent AMULET™ framework installation that has been run at least once, search for and use the RegEdt32.exe Windows Registry utility (using “Run as administrator”) to find and locate the entry “OnHostDeviceAMULETManager”, usually at the path

“Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Certitude\OnHostDeviceAMULETMan ager” or “Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Certitude\OnHostDeviceAMULETManager”:

(6)

CAUTION: Be VERY careful when editing the contents of the Windows Registry! Errors made here can cause your entire Windows operating system to become non-functional.

Clicking the “OnHostDeviceAMULETManager” Windows Registry folder will reveal the current AMULET™

framework docking directory path under one of two keys: “ConfigFileDir32Bit” or “ConfigFileDir64Bit”.

Go to that location, and make copies of any AMULET™ config files you find there and want to save into another directory that is not part of the AMULET™ framework installation. Once you have done that, return to the Regedt32.exe application and delete the OnHostDeviceAMULETManager registry folder, including the AMULET™ framework docking directory keys (these will be replaced with new values when the new AMULET™ framework is installed).

Now close the Regedt32.exe application.

Once all memory instances of any old AMULET™ framework installations have been removed, any old AMULET™ config files you want to save copied elsewhere, and any old AMULET™ framework

installations on disk have been deleted, go ahead and install the new AMULET™ framework. Once installed, if there were any old AMULET™ config files you saved that are version-compatible with the new AMULET™ framework which you would like to use with the new framework, copy them into the new AMULET™ framework’s AMULET™ config file docking directory. To get the locations of the new AMULET™ framework docking directory, use the RedEdt32.exe application as described above.

A second feature that will be in the release versions of both the AMULET™ Editor and the AMULET™

framework, but which is currently missing from both, is the ability for the AMULET™ Editor to tell the AMULET™ framework where the AMULET™ Editor has written its output AMULET™ config files. This is important in the case an AMULET™-aware application is not able to dock those AMULET™-Editor-

(7)

Copyright 2016-2017 Certitude Digital, Incorporated – All rights reserved. Page 7 created AMULET™ config files into the AMULET™ framework on its own. The release version of the AMULET™ framework will be able to query the AMULET™ Editor, if present, for the locations of any AMULET™ config files it may have created, in the event the AMULET™ framework needs them and they haven’t yet been docked.

Until that feature has been written, you may have to manually place copies of AMULET™ config files into the AMULET™ framework docking directory yourself if you get errors indicating the AMULET™

framework cannot find them. To get the location where the AMULET™ config files need to be docked, follow the instructions for looking up the docking directory from the Windows Registry using the RegEdt32.exe application as described above.

However, by far the single biggest trouble users seem to have is remembering to run all components using “Run as administrator”. Later versions of the software will not be subject to this restriction, but for now we required administrative rights in all components in order to access the Windows registry and privileged services. If you do run into an issue, please try closing down the running processes (as described in the Appendix) and then start the application up again – this will usually resolve any issues.

Operating systems supported

Older versions of the software were written and tested on Windows 8 and 8.1 versions, and those versions should still be supported. Most recent development and testing has been on Windows 10. The software has not yet been tested or run on Windows 7, Windows Vista, or Windows XP, and we suspect that the older and less-well-maintained the Windows O/S is, the worse the software will perform on it.

Though we do not know of any specific issues, it may be that older systems like Windows XP do not supply all of the necessary security support, and may not have such support available. Our software relies to some degree on system-supplied security components (though these dependencies will decrease as the products mature), so it is important that security updates be religiously applied as they become available.

The main user interface

Though ultimately the AMULET Cloak™ file packaging utility will also be provided as an online utility, the first release is a Windows application. The graphical user interface (GUI) for the application is relatively simple and straightforward:

(8)

1. Choose an output file folder to receive the protected file when generated;

2. Provide a unique name for the generated protected file within the folder given above;

3. Select the file(s) to be protected and included in the generated output file;

4. Choose the type of generated output file you would like, and provide any additional information required for that output type if necessary;

5. Select the AMULET™ criteria sets you would like to use to protect your generated output file and optionally, the order in which you would like the AMULET™ criteria sets processed; and

6. Click the OK button to generate the protected output file.

(9)

Main GUI user controls

Enter the destination folder here for receiving the generated file name, or use the browse button to the right of this field to populate the folder path. [Note: If this destination folder path is different than the source folder path and there are no other conflicts with the destination file name, you are allowed to use the same destination file name as one of the source file names, if you wish. In other words, in our example above you could have named the destination file “Notepad.exe” because the source folder for

(10)

the original Notepad.exe (C:\Windows\) is different than the destination folder, so the generated output file would not overwrite the source file.]

This button mounts the standard windows browse dialog for seeking a destination output file folder – the results of the search, if not canceled, will automatically populate the text field to the left of this button.

Use this text box to enter the name of the output protected file to be generated into the

destination folder provided above. Each protected file output type has some rules which govern the file extension that can be used for the destination file name:

• If the generated protected file type is for a single source file, the file extension in the destination file name must match the file extension of the source file (as well as the file extension of any preview/summary/demo cover file provided for any unauthorized persons accessing the protected file);

• If the generated protected file type is for a collection of album of source files all having the same file extension, the file extension in the destination file name must also match the file extensions of the source files (as well as the file extension of any preview/summary/demo cover file provided for any unauthorized persons accessing the protected file);

• If the generated protected file type is for an application and its supporting files, the file

extension in the destination file name must match the file extension of the primary executable file in the group of files (as well as the file extension of any preview/summary/demo cover file provided for any unauthorized persons accessing the protected file); and

• If the generated protected file type is for a loose collection of unrelated files to be zipped together before being protected, the file extension of the destination file name must be “.zip”.

[Note: If this destination folder path is different than the source folder path and there are no other conflicts with the destination file name, you are allowed to use the same destination file name as one of the source file names, if you wish. In other words, in our example above you could have named the destination file “Notepad.exe” because the source folder for the original Notepad.exe (C:\Windows\) is different than the destination folder, so the generated output file would not overwrite the source file.]

For single source files, collection or album source files, or source files associated with an application, you can elect to include in the protected generated output file an optional unprotected section unauthorized users can see, which consists of a single file and usually contains a low-resolution, preview, summary, or demo version of the main files. The permitted file types that can be used for this purpose must have file extensions that follow these rules:

• If the generated protected file type is for a single source file, the file extension of any preview/summary/demo cover file provided for any unauthorized persons accessing the protected file must match the source file;

• If the generated protected file type is for a collection of album of source files all having the same file extension, the file extension of any preview/summary/demo cover file provided for any

(11)

• If the generated protected file type is for an application and its supporting files, the file extension of any preview/summary/demo cover file provided for any unauthorized persons accessing the protected file must match the file extension of the primary executable file in the group of files.

Enter the full path and filename of the desired preview/summary/demo cover file (if any) here. Use the browse button to the right of this field to search for a file to populate this text field.

This button mounts the standard windows browse dialog for seeking a preview/summary/demo cover file – the results of the search, if not canceled, will automatically populate the text field to the left of this button.

This list box stores the list of files to be included in the output generated protected file.

Use the “Add” button to search for and add full file paths and filenames to the list box above.

When clicked, the button launches a simple dialog box:

Enter the full path and file name for a source file in the text box of the dialog, and click the “Add file path to list below” to insert the full file path into the list. You can use the browse button to its right to

(12)

mount a standards Windows multi-file search dialog to select one-to-many files to populate the list box below. Click the “OK” button to accept a file for addition to the main source files list box, or click the

“Cancel” button to close the dialog without adding to the main source files list box.

When a file has been selected in the list box above, this button becomes active and allows you to delete that file from the list.

When this radio button is selected, the output generated protected file type is set to single source file (only one file can be present in the main source files list box, and any unprotected preview file as well as the output generated protected file must have the same file extension as the source file).

When this radio button is selected, the output generated protected file type is set to collection or album (more than one file is shown in the main list box, the files present in the main source files list box all have the same file extension, as does any unprotected preview file as well as the output generated protected file).

When this radio button is selected, the output generated protected file type is set to application (more than one file is shown in the main list box, one of those files is the primary executable file, and any unprotected preview file as well as the output generated protected file must have the same file extension as the primary executable file).

When the output generated protected file type is set to application by the radio button above, this dropdown combo box becomes active and is used to tell the utility which of the files in the main files list box is the primary executable file.

When this radio button is selected, the output generated protected file type is set to multiple unrelated source files to be zipped together prior to being processed for protection (more than one file must be present in the main source files list box, no unprotected preview file is permitted, and the output generated protected file must have the “.zip” file extension).

This list box displays one or more AMULET™ criteria sets to be used to protect the generated output file.

Because AMULET™ criteria sets can vary greatly in their complexity and demand for processing power, when more than one AMULET™ criteria set is used to protect a file it can be helpful in certain situations to change the order in which the AMULET™ criteria set references appear in the protected file. When the intention is to tightly restrict the authorized audience for a digital asset and the result of an access request is often likely to be rejection, it can speed processing to place the AMULET criteria set that gets you to a rejection the fastest and with the least processing first in the reference order. This will

(13)

largely be determined by experimentation on a case by case basis, and we provide this option to support such experimentation in the unusual case where there is a performance issue of some kind. These buttons allow you to place a selected AMULET™ criteria set master list item higher or lower in the reference order.

This button allows you to add one or more AMULET™ criteria sets to the master list for protecting the generated output file. When clicked, it brings up the dialog for adding AMULET™ criteria sets to the main GUI master AMULET™ list box (described in the section below).

When an AMULET™ criteria set has been selected in the master list box above, this button becomes active and allows deleting the selected criteria set from the list.

This button launches the AMULET Criteria Editor™, for modifying and creating AMULET™ criteria sets and AMULET™ config files on the fly. See the full description of the AMULET Criteria Editor™ at https://certitudedigital.com/public_docs/InstructionsForCertitudeAMULETEditor.pdf.

The application can recycle memory on smaller devices to compress and store very large collections if necessary (though in that situation processor speed will play an important role in

determining how satisfying the results will be). Use this set of controls to set the maximum number of device memory bytes to be allocated to the compression/enciphering task (in groups of 50,000 bytes each). An algorithm in the applications will determine the amount of memory to use between this value and the minimum value set below in order to produce the output in the shortest amount of time without errors.

Use this set of controls to set the minimum number of device memory bytes to be allocated to the compression/enciphering task (in groups of 50,000 bytes each).

This checkbox can be used to turn off compression. Compression helps reduce the size of the enciphered output file and can also help increase security to a small degree. However, compression processing does consume some additional time for larger files on small-capacity devices, and if necessary can be turned off.

Click this button to view the context-sensitive help file for the utility.

If sufficient resources have been gathered and input into the controls above, this button will be enabled, and when clicked will produce the generated AMULET™-protected output file according to the selections provided and information entered, report any errors experienced, and exit the utility.

(14)

Note: In the case where you have selected a foreign AMULET™ criteria set and not selected one to which you have access rights to go with it, you will be required to provide credentials to an AMULET™ config file you have access to which contains at least one AMULET™ criteria set in order to authenticate yourself. This is necessary to prevent someone from wrapping a third party’s digital assets with foreign AMULET™ criteria sets for the purpose of harassment or ransomware.

This button can be clicked at any time to exit the utility without generating an AMULET™- protected output file.

Dialog for adding AMULET™s to the main GUI master AMULET™ list box

This section describes the dialog box used to add user-selected AMULET™ criteria sets to the main GUI master AMULET™ list box. The dialog dox generally looks like this:

(15)

The workflow for the dialog includes these steps, repeated in order for as many AMULET™ criteria sets as you wish to gather together from as many AMULET™ config files as are available to you and to which you have access:

1. Select an AMULET™ config file to which you have been granted access rights, and from which you wish to select AMULET™ criteria sets to protect a digital asset;

2. Login to the selected AMULET™ configuration file using your access credentials;

3. Add one or more AMULET™ criteria sets from that config file to add to this dialog box’s copy of the master list of AMULET™ criteria sets you want to use to protect your digital asset;

4. Repeat from step 1. for each of the AMULET™ config files whose AMULET™ criteria sets you want to use to protect your digital asset; and

(16)

5. Click the ‘OK’ button to copy your selected AMULET™ criteria sets back to the main GUI’s master list and exit this dialog box.

Alternatively, instead of steps 1. and 2. above, you can also select an AMULET™ criteria set from an AMULET™ config file you do not own if you either have added, or will add, a criteria set you do own, or have access to your own AMULET™ config file containing at least one AMULET™ criteria set.

A detailed explanation of each dialog box control for implementing this workflow follows in the section below.

Adding AMULET™s dialog box control details

(17)

To add an AMULET™ criteria set from an AMULET™ config file you already own (or to which you have been given access), click this radio button on, and all of the controls related to adding your own AMULET™ criteria set will be enabled below.

Enter the full file path and name of the AMULET™ config file here, or use the browse button to the right of this field to populate the AMULET™ config file path.

This button mounts the standard windows browse dialog for seeking the full file path and name of an AMULET™ config file – the results of the search, if not canceled, will automatically populate the text field to the left of this button.

Once the full file path and name of an AMULET™ config file has been entered above, this button becomes active and allows you to login to the AMULET™ config file using the AMULET™ config file ID and your login credentials. The following dialog box will appear:

Enter the AMULET™ config file’s ID here into the five edit fields provided and click the OK button (possession of the valid ID begins the process of ensuring you are the rightful owner or administrator of the AMULET™ config file). Now, a dialog box will appear allowing you to enter your login credentials for the AMULET™ config file:

(18)

Copyright 2016-2017 Certitude Digital, Incorporated – All rights reserved. Page 18 Enter the login name and password you were assigned for logging into this AMULET™ config file, and click the OK button to return to the add AMULET™ dialog box.

Once you are successfully logged in a valid AMULET™ config file, the item AMULET™ criteria set(s) available in the AMULET™ config file will be displayed in this list box.

When the available item AMULET™ criteria set list box above has been populated and one of the list items selected, this button will allow you to add that item to the dialog box’s copy of the master AMULET™ criteria sets list for the digital asset, show below.

Clicking this radio button allows you to protect a digital asset using an AMULET™ criteria set that you cannot read and do not have access to. This is useful when you need to send a digital asset to a specific individual or company and need to identify the recipient without requiring the recipient provide you with specific identifying information. It can be useful when submitting resumes in response to an e- mail from a recruiter, or a mortgage app in response to an e-mail from a lender, or financial information in response to an e-mail form the IRS. In those cases, the sender provides you their AMULET™ criteria set as a means of allowing your returned e-mail through their e-mail server (as an anti-SPAM measure).

For more detailed examples and explanations of why you might want to protect a digital assert with an AMULET™ criteria set belonging to someone else (usually in combination with an AMULET™ criteria set of your own), see the article entitled “Certitude Digital AMULET™s: The E-mail Use Case” at

https://www.linkedin.com/pulse/certitude-digital-amulets-e-mail-use-case-f-scott-deaver.

When this radio button is clicked on, the pushbutton below it is enabled so that you can select and add an AMULET™ criteria set belonging to someone else.

Click this button to select and add an AMULET™ criteria sets belonging to someone else. The following dialog will appear:

(19)

Enter the full path to the foreign AMULET™ config file that contains the AMULET™ criteria set you want to use, or use the browse button on the right in the dialog to select a file. When the “OK” button to the dialog box above is clicked after an AMULET™ config file has been selected, the following dialog will appear to allow you to identify the specific AMULET™ criteria set within that config file that you want to use:

Enter the AMULET™ ID for the AMULET™ criteria set you want to use to protect the digital asset, and click OK. The dialog box above will go away and you will be returned to the previous dialog for adding AMULET™ criteria sets to protect a digital asset. In that previous dialog, you will see a new item has been added to the list box at the bottom – that new list item will have the prefix label “[FOREIGN AMULET CONFIG FILE]” in the place where the AMULET™ config file would normally be.

This list box displays this dialog box’s copy of the master AMULET™ criteria sets list for the digital asset, originating at dialog box startup from the main GUI master list and to which additional criteria sets have been or will be added.

Click this button to view the context-sensitive help file for this dialog box.

This button launches the AMULET™ Criteria Editor™ for modifying and creating AMULET™ criteria sets and AMULET™ config files on the fly. See the full description of the AMULET™ Criteria Editor™ at https://certitudedigital.com/public_docs/InstructionsForCertitudeAMULETEditor.pdf.

(20)

If AMULET™ criteria sets have been added to the dialog box’s copy of the master list for the digital asset, this button will be enabled, and when clicked will copy the added AMULET™ criteria sets to the main GUI master list, and then exit this dialog.

This button will exit the dialog at any time without adding pending AMULET™ criteria sets not yet committed to the dialog box’s main GUI master list.

(21)

Appendix

Creating a “Run as administrator” shortcut

It may be of benefit to create a shortcut to use in launching the demonstration application if you intend to test it out thoroughly, as it’s easy to forget to launch the application in “Run as administrator” mode.

Below are the steps to creating such a shortcut.

First you’ll need to navigate to where the demo application was installed, which depends on the choices made when installing the application - the filename you’re looking for is “AMULETCloak32U.exe”.

Once you’ve located the file, you will want to right-mouse-click on the file name, and then select “Create shortcut” as shown in the image on the right.

Depending on your Windows security settings, you may receive a message stating

“Windows can’t create a shortcut here” and asking if you’d like to create the shortcut on the desktop instead. This is because with our demo we are working within the Program Files system-managed directories, and access to this area is usually limited.

For our demo, go ahead and select “Yes”, and then navigate to your desktop area to locate the shortcut. You can either leave the shortcut on your desktop, or drag it over into the desired location.

If you’d prefer to have the shortcut located in the same area as the demonstration file, you’ll likely see an Access Denied popup, but clicking on the Continue button will force the shortcut to be moved here. You may at this point want to rename the shortcut so as to differentiate it from the application itself.

(22)

It will have the same name as the file, but will end with “ – Shortcut”.

Right-mouse-click on the shortcut, and select

“Properties” from the popup menu (it should be at the very bottom of the popup menu).

In the Properties dialog, click the button labeled “Advanced…”, to display the Advanced Properties dialog.

In the Advanced Properties dialog, select the checkbox labeled as “Run as administrator”, and then click the OK button for this

Advanced Properties dialog, and then the OK button Shortcut Properties dialog.

Now, each time you launch the application by clicking on this shortcut, it will be run using the “Run as administrator”.

Fresh Restart of the Application

During the demo, you may find the application isn’t working as expected. Either you see an error continue to popup, or a file may not be accessible due to being in use by another process, or similar issues. The best option is to close the demo application and start again.

Shutdown the framework from the App Icon Tray

In the lower right of your computer, click on the caret “^” symbol (the circled 1 in the image below is pointing to it) – this will display all the icons in the app tray. Next, right-mouse-click on the “I” icon (the circled 2 is pointing to this icon in the image below) and then select “Exit” from the menu that pops up – this will exit the Certitude Digital AMULET™ framework management and control applet.

(23)

Launch the Task Manager (you can use Alt+Ctl+Del to display a selection of options, one of which is the

“Task Manager”. Within the Task Manager, scroll down the list of processes until you find the Certitude DigitalFramework32U.exe (as shown in the image below). Select that process, then click on the “End task” button.

You should now be ready to restart the demo application – when you do, remember to right-mouse- click the demo executable file and run it from the “Run as administrator” popup menu item if you did not create a “run as administrator” shortcut as described above.