Policy enforcement in a secure data file delivery system

• US 10,362,063 B2
• Filed: 02/20/2017
• Issued: 07/23/2019
• Est. Priority Date: 03/31/2000
• Status: Expired due to Term

• Current Assignee: Axway Incorporated (Axway Software SA)
• Original Assignee: Axway Incorporated (Axway Software SA)
• Inventors: Smith, Jeffrey C., Bandini, Jean-Christophe Denis
• Primary Examiner(s): Schmidt, Kari L
• Application Number:
  US15/437,093
• Publication Number:
  US 20170230423A1
• Time in Patent Office: 883 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A server interacts with a sender to form a package which can include one or more attached data files to be sent to one or more recipients, and the server applies a policy established by a policy authority of the sender to the package. Since the server both forms the package through interaction with the sender and applies the policy, violations of the policy by the package can be brought to the sender'"'"'s attention during an interactive session with the sender and before encryption of all or part of the package. As a result, the sender is educated regarding the policy of the sender'"'"'s policy authority, and the sender can modify the package immediately to comport with the policy. The server delivers the package to intended recipients by sending a notification to each recipient and including package identification data, e.g., a URL by which the package can be retrieved.

Claims

1. A method for enforcing policy upon a package to be delivered from a sender to a plurality of recipients through a computer network, including:

receiving package data which is generated by the sender;

applying, by a server, a policy to the package, wherein the policy is specified by policy data received from a policy authority of the sender, and the policy specifies a set of actions to be carried out upon satisfaction of a set of conditions, wherein one or more actions interrupts delivery of the package, logs handling of the package, or modifies the package;

responsive to a determination at the server, that the set of conditions is satisfied by one or more attributes of a first set of recipients, but not a second set of recipients, duplicating the package to provide two instances thereof;

storing the first set of recipients in a recipients field of the first instance of the package;

storing the set of actions in an action record of the first instance of the package;

storing the second set of recipients in a recipients field of the second instance of the package, wherein the action record of the second instance of the package is different from the action record of the first instance of the package;

delivering the first instance of the package to the first set of recipients, but not to the second set of recipients, upon satisfaction of the set of actions in the action record of the first instance of the package; and

delaying delivery of the second instance of the package to the second set of recipients upon, at least one action of the set of actions in the of the action record of the second instance of the package, that indicates delayed delivery to the second set of recipients.

2. The method of claim 1, wherein the policy includes one or more recipient-specific rules.

3. The method of claim 1, wherein delaying delivery includes waiting for a delay period to elapse.

4. The method of claim 1, wherein delaying delivery includes blocking delivery of the second instance of the package.

5. The method of claim 1, wherein delivering the first instance of the package to the first set of recipients includes sending a notification message including package retrieval data to the first set of recipients.

6. The method of claim 1, wherein a condition specifies one or more delivery attributes.

7. The method of claim 6, wherein a delivery attribute specifies that a sender-specified password is required to retrieve the respective package.

8. The method of claim 1, wherein an action of the set of actions modifies a body of a message of the respective package.

9. The method of claim 1, wherein an action of the first instance of the package is associated with a first delivery priority and an action of the second instance of the package is associated with a second delivery priority having a lower priority than the first priority, and wherein the delaying delivery is in accordance with the respective priorities of the first and second sets of recipients.

10. A computer program product encoded in one or more non-transitory media, the computer program product including codes executable on one or more processors of a service platform to cause the service platform to perform a method including:

receiving package data which is generated by the sender;

applying, by a server, a policy to the package, wherein the policy is specified by policy data received from a policy authority of the sender, and the policy specifies a set of actions to be carried out upon satisfaction of a set of conditions, wherein one or more actions interrupts delivery of the package, logs handling of the package, or modifies the package;

responsive to a determination at the server, that the set of conditions is satisfied by one or more attributes of a first set of recipients, but not a second set of recipients, duplicating the package to provide two instances thereof;

storing the first set of recipients in a recipients field of the first instance of the package;

storing the set of actions in an action record of the first instance of the package;

storing the second set of recipients in a recipients field of the second instance of the package, wherein the action record of the second instance of the package is different from the action record of the first instance of the package;

delivering the first instance of the package to the first set of recipients, but not to the second set of recipients, upon satisfaction of the set of actions in the action record of the first instance of the package; and

delaying delivery of the second instance of the package to the second set of recipients upon, at least one action of the set of actions in the of the action record of the second instance of the package, that indicates delayed delivery to the second set of recipients.

11. The computer program product of claim 10, wherein the policy includes one or more recipient-specific rules.

12. The computer program product of claim 10, wherein delaying delivery includes waiting for a delay period to elapse.

13. The computer program product of claim 10, wherein delaying delivery includes blocking delivery of the second instance of the package.

14. The computer program product of claim 10, wherein delivering the first instance of the package to the first set of recipients includes sending a notification message including package retrieval data to the first set of recipients.

15. The computer program product of claim 10, wherein a condition specifies one or more delivery attributes.

16. The computer program product of claim 15, wherein a delivery attribute specifies that a sender-specified password is required to retrieve the respective package.

17. The computer program product of claim 15, wherein a delivery attribute specifies whether an account password is required to retrieve the respective package.