Systems and methods for secure data exchange in a distributed collaborative application

• US 10,110,527 B1
• Filed: 11/20/2017
• Issued: 10/23/2018
• Est. Priority Date: 07/26/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: Open Invention Network LLC
• Inventors: Wanek, Charles, Jones, Dan, Vernon, Todd
• Primary Examiner(s): Baturay, Alicia
• Application Number:
  US15/818,066
• Time in Patent Office: 337 Days
• Field of Search: 709227
• CPC Class Codes: H04L 12/1822 Conducting the conference, e.g. admission, detection, selection or grouping of participants, correlating users to one or more conference sessions, prioritising transmission
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/066 Format adaptation, e.g. format conversion or compression
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08

Abstract

A collaborative communication system that includes a plurality of endpoints and interconnecting nodes configured to communicate via messages over interconnecting channels. Each of the plurality of endpoints and/or interconnecting nodes can determine whether to apply protection to the messages on a per message basis and/or base on the interconnecting channel being used. Thus, a balance between adequate protection and use of system resources and bandwidth can be maintained.

Claims

1. A system, comprising:

at least one of a plurality of endpoints configured to apply protection to messages sent to other endpoints on a per message basis and based on system variables, the plurality of endpoints configured to identify a dynamic change in message properties, connection properties, properties of a channel producing the message or a combination of the message, connection and channel properties and apply the protection as needed to each message without a change to a predefined connection, wherein to apply protection to the messages sent comprises applying protection to at least one message among the messages to be transmitted across the predefined connection prior to transmitting the at least one message across the predefined connection, wherein levels are determined for degree of trust and degree of sensitivity associated with content of the at least one message and provided to a function to provide a required degree of protection for the at least one message.

2. The system of claim 1, wherein the at least one of the plurality of endpoints is further configured to selectively apply the protection to the messages sent to the other endpoints.

3. The system of claim 1, wherein the system variables include properties related to an interconnecting channel used by the endpoint to send messages.

4. The system of claim 1, wherein the system variables include properties related to each message sent by the endpoint.

5. The system of claim 1, wherein the system variables include properties related to a connection used to support the interconnecting channel used by the endpoint to send messages.

6. The system of claim 1, wherein the system variables are dynamic.

7. The system of claim 1, wherein the system variables include interconnecting channel trustworthiness.

8. The system of claim 1, wherein the system variables include message sensitivity.

9. The system of claim 1, wherein the system variables include whether a message has previously been encrypted.

10. The system of claim 1, wherein each of the plurality of endpoints is configured to apply a decision criteria to the system variables in order to determine whether to apply protection to a message.

11. The system of claim 10, wherein the at least one of the plurality of endpoints is configured to use different decision criteria relative to other of the plurality of endpoints.

12. The system of claim 10, wherein the system variables can be assigned a plurality of values, and wherein the decision criteria uses the values to determine whether protection should be applied.

13. The system of claim 12, wherein the at least one of the plurality of endpoints is configured to assign a different value or weight to the system variables relative to other of the plurality of endpoints.

14. The system of claim 1, wherein the at least one of the plurality of endpoints is configured to consider different system variables relative to other of the plurality of endpoints.

15. The system of claim 1, wherein the plurality of endpoints are configured to apply protection by encrypting the messages.

16. The system of claim 1, wherein a degree of trust placed in a connection is relative to a sending device.

17. The system of claim 1, further comprising a plurality of contexts, and wherein the plurality of endpoints are configured to join one or more of the plurality of contexts.

18. The system of claim 17, wherein each endpoint is configured to apply protection based system variables, and wherein the system variables are different for different contexts of the plurality of contexts.

19. The system of claim 17, wherein each endpoint is configured to apply protection based on decision criteria, and wherein the decision criteria are different for different contexts of the plurality of contexts.

20. A system, comprising:

at least one of a plurality of endpoints configured to apply protection to messages sent to other endpoints based on an interconnecting channel used to send the messages and the at least one of the plurality of endpoints further configured to apply protection to messages sent to other endpoints on a per message basis and based on dynamic system variables, the plurality of endpoints configured to identify a change in message properties, connection properties, properties of a channel producing the message or a combination of the message, connection and channel properties and selectively apply the protection as needed to each message without a change to a predefined connection, wherein to apply protection to the messages sent comprises applying protection to at least one message among the messages to be transmitted across the predefined connection prior to transmitting the at least one message across the predefined connection, wherein levels are determined for degree of trust and degree of sensitivity associated with content of the at least one message and provided to a function to provide a required degree of protection for the at least one message.

21. The system of claim 20, wherein the at least one of the plurality of endpoints is further configured to selectively apply the protection to the messages sent to the other endpoints.

22. The system of claim 20, wherein the system variables include properties related to an interconnecting channel used by the endpoint to send messages.

23. The system of claim 20, wherein the system variables include properties related to each message sent by the endpoint.

24. The system of claim 20, wherein the identified change is dynamic.

25. The system of claim 20, wherein the system variables include interconnecting channel trustworthiness.

26. The system of claim 20, wherein the system variables include message sensitivity.

27. The system of claim 20, wherein the system variables include whether a message has previously been encrypted.

28. The system of claim 20, wherein the at least one of the plurality of endpoints is configured to apply a decision criteria to the system variables in order to determine whether to apply protection to a message.

29. The system of claim 28, wherein the at least one of the plurality of endpoints is configured to use different decision criteria relative to other of the plurality of endpoints.

30. The system of claim 28, wherein the system variables can be assigned a plurality of values, and wherein the decision criteria uses the values to determine whether protection should be applied.

31. The system of claim 30, wherein the at least one of the plurality of endpoints is configured to assign a different value or weight to the system variables relative to other of the plurality of endpoints.

32. The system of claim 20, wherein the at least one of the plurality of endpoints is configured to consider different system variables relative to other of the plurality of endpoints.

33. The system of claim 20, wherein the plurality of endpoints are configured to apply protection by encrypting the messages.

34. The system of claim 20, wherein a degree of trust placed in a connection is relative to a sending device.

35. The system of claim 20, further comprising a plurality of contexts, and wherein the plurality of endpoints are configured to join one or more of the plurality of contexts.

36. The system of claim 35, wherein the at least one of the plurality of endpoints is configured to apply protection based on system variables, and wherein the system variables are different for different contexts of the plurality of contexts.

37. The system of claim 35, wherein the at least one of the plurality of endpoints is configured to apply protection based decision criteria, and wherein the decision criteria are different for different contexts of the plurality of contexts.