由于最新的 PDF 版本使用 AES-128 进行加密，我们只需设置一个合适的随机生成的 128 字符高熵密码 - 没有人会手动输入它，因此难以输入与我们无关，实际上更可取。主密码阻止最终用户对文档进行任何更改。各种无打印/无屏幕阅读选项实际上是由 PDF 阅读器强制执行的，因此可以绕过，但无论如何设置它们也没有什么坏处。
这样做的缺点是 PDFlib 的许可相当严格。我不知道是否有任何免费的 php PDF 库支持最新的 PDF 加密方案，尤其是主密码，但如果您的预算可以支持，那么 PDFlib 是安全文档生成的最佳选择。
I've done this for another project with PDFlib. We needed traceability for the generated PDFs in case the file was leaked. Basically:
Created a source template PDF with the content in place, set the document master password with the required options (no edit, no print, no screen-reader, etc...) set
At runtime, we applied a few watermarks (imposed page footer saying "This document checked out to user #12345", set a few of the metadata fields with user ID, download IP, download date/time, added a "this document copyright by..." cover page, etc...)
Optionally attach a user password to force a PW prompt when document is opened.
Since the latest PDF versions use AES-128 for their encryption, we just set a suitable randomly generated 128char high-entropy password - no one would ever be typing it in by hand so hard-to-typedness was irrelevant to us and actually preferable. The master password prevented end-users from making any changes to the document. The various noprint/no screen read options are actually enforced by the PDF reader and therefore bypassable, but can't hurt to set them anyways.
The downside to this is that PDFlib's licensing is fairly steep. I don't know if any of the free php PDF libraries support the latest PDF encryption schemes, especially the master password stuff, but if you budget can support it, PDFlib's the way to go for secure document production.
发布评论
评论（1）
我已经使用 PDFlib 为另一个项目完成了此操作。我们需要对生成的 PDF 进行追踪，以防文件泄露。基本上：
由于最新的 PDF 版本使用 AES-128 进行加密，我们只需设置一个合适的随机生成的 128 字符高熵密码 - 没有人会手动输入它，因此难以输入与我们无关，实际上更可取。主密码阻止最终用户对文档进行任何更改。各种无打印/无屏幕阅读选项实际上是由 PDF 阅读器强制执行的，因此可以绕过，但无论如何设置它们也没有什么坏处。
这样做的缺点是 PDFlib 的许可相当严格。我不知道是否有任何免费的 php PDF 库支持最新的 PDF 加密方案，尤其是主密码，但如果您的预算可以支持，那么 PDFlib 是安全文档生成的最佳选择。
I've done this for another project with PDFlib. We needed traceability for the generated PDFs in case the file was leaked. Basically:
Since the latest PDF versions use AES-128 for their encryption, we just set a suitable randomly generated 128char high-entropy password - no one would ever be typing it in by hand so hard-to-typedness was irrelevant to us and actually preferable. The master password prevented end-users from making any changes to the document. The various noprint/no screen read options are actually enforced by the PDF reader and therefore bypassable, but can't hurt to set them anyways.
The downside to this is that PDFlib's licensing is fairly steep. I don't know if any of the free php PDF libraries support the latest PDF encryption schemes, especially the master password stuff, but if you budget can support it, PDFlib's the way to go for secure document production.