Systems and methods for controlling email access

• US 10,243,932 B2
• Filed: 07/31/2017
• Issued: 03/26/2019
• Est. Priority Date: 12/06/2012
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Dabbiere, Alan, Stuntebeck, Erich, Brannon, Jonathan Blake
• Primary Examiner(s): Eskandarnia, Arvin
• Application Number:
  US15/664,279
• Publication Number:
  US 20170331797A1
• Time in Patent Office: 603 Days
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Embodiments of the disclosure relate to proxying one or more email resources in transit to the client devices from the email services, removing one or more email attachments from the email resources, and encoding the stripped email attachments based at least in part on one or more cryptographic keys.

Claims

1. A method for controlling access to email attachments, comprising:

providing a graphical user interface (GUI) that enables selection of at least one rule to govern email access for a plurality of users;

receiving, through the GUI, a selection of an encryption rule that requires encrypting at least one attachment to an email; and

enforcing the selected encryption rule by encrypting the at least one email attachment, without interaction by a user sending the email.

2. The method of claim 1, further comprising:

receiving, through the GUI, a selection of a removal rule that requires removing at least one attachment to an email; and

enforcing the selected removal rule by removing the at least one email attachment, without interaction by a user sending the email.

3. The method of claim 1, wherein enforcing the selected encryption rule comprises encrypting the at least one email attachment with a cryptographic key accessible to a secure container application separate from an email application used to send or retrieve the email.

4. The method of claim 3, wherein enforcing the selected encryption rule comprises providing a key used to decrypt the encrypted email attachment only to the secure container application.

5. The method of claim 1, further comprising:

enabling selection of a user group at the GUI, wherein the user group is a subset of the plurality of users;

receiving, through the GUI, a selection of the user group associated with the encryption rule; and

enforcing the selected encryption rule on the selected user group.

6. The method of claim 1, wherein the GUI enables selection of a storage location for the at least one rule.

7. The method of claim 1, wherein the GUI enables selection of an effective date or an expiration date for the at least one rule.

8. A non-transitory, computer-readable medium embodying a program executable in at least one computing device, comprising code that, when executed by the computing device, performs stages for controlling access to email attachments, the stages comprising:

providing a graphical user interface (GUI) that enables selection of at least one rule to govern email access for a plurality of users;

receiving, through the GUI, a selection of a removal rule that requires encrypting at least one attachment to an email; and

enforcing the selected encryption rule by encrypting the at least one email attachment, without interaction by a user sending the email.

9. The non-transitory, computer-readable medium of claim 8, the stages further comprising:

receiving, through the GUI, a selection of a removal rule that requires removing at least one attachment to an email; and

enforcing the selected removal rule by removing the at least one email attachment, without interaction by a user sending the email.

10. The non-transitory, computer-readable medium of claim 8, wherein enforcing the selected encryption rule comprises encrypting the at least one email attachment with a cryptographic key accessible to a secure container application separate from an email application used to send or retrieve the email.

11. The non-transitory, computer-readable medium of claim 10, wherein enforcing the selected encryption rule comprises providing a key used to decrypt the encrypted email attachment only to the secure container application.

12. The non-transitory, computer-readable medium of claim 8, the stages further comprising:

enabling selection of a user group at the GUI, wherein the user group is a subset of the plurality of users;

receiving, through the GUI, a selection of the user group associated with the encryption rule; and

enforcing the selected encryption rule on the selected user group.

13. The non-transitory, computer-readable medium of claim 8, wherein the GUI enables selection of a storage location for the at least one rule.

14. The non-transitory, computer-readable medium of claim 8, wherein the GUI enables selection of an effective date or an expiration date for the at least one rule.

15. A system for controlling access to email attachments, comprising:

a processor that generates a graphical user interface (GUI) that enables selection of at least one rule to govern email access for a plurality of users; and

an access control server communicatively coupled to the processor and configured to receive selections provided through the GUI,

wherein the GUI receives a selection of an encryption rule that requires encrypting at least one attachment to an email, and

wherein the access control server enforces the selected encryption rules by encrypting the at least one email attachment, without interaction by a user sending the email.

16. The method of claim 15, wherein the GUI receives a selection of a removal rule that requires removing at least one attachment to an email, and wherein the access control server enforces the selected removal rule by removing the at least one email attachment, without interaction by a user sending the email.

17. The method of claim 15, wherein enforcing the selected encryption rule comprises encrypting the at least one email attachment with a cryptographic key accessible to a secure container application separate from an email application used to send or retrieve the email.

18. The method of claim 17, wherein enforcing the selected encryption rule comprises providing a key used to decrypt the encrypted email attachment only to the secure container application.

19. The method of claim 15, wherein the GUI enables and receives selection of a user group that is a subset of the plurality of users, and wherein the access control server enforces the selected encryption rules on the selected user group.

20. The method of claim 15, wherein the GUI enables selection of at least one of a storage location, effective dates, and an expiration date for the at least one rule.