Document integrity through mediated interfaces

End-to-end integrity for documents is provided by wrapping the tools that manipulate those documents and mediating their operation to cryptographically integrity mark those documents as they are being saved, to check those cryptographic integrity marks as those documents are loaded, and to record an application-level history of the changes to the document. Corrupted documents (those failing to match their crytographic integrity mark) are automatically repaired by replaying the recorded history of the application-level changes to the document. That recorded history is also used to identify all modifications (including date and author) to any selected portion of the document. A document integrity manager embodying these capabilities has been developed for Microsoft Word.