System and method for cross platform document sharing

• US 10,574,729 B2
• Filed: 12/15/2016
• Issued: 02/25/2020
• Est. Priority Date: 06/08/2011
• Status: Active Grant

• Current Assignee: Workshare Technology Incorporated
• Original Assignee: Workshare Technology Incorporated
• Inventors: Hadfield, Barrie, Preen, Richard, Tanner, Tim, Glover, Robin
• Primary Examiner(s): Bloomquist, Keith D
• Application Number:
  US15/380,695
• Publication Number:
  US 20170099344A1
• Time in Patent Office: 1,167 Days
• Field of Search: 715256
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

This invention discloses a novel system and method for automatically managing the movement of document files from a first document storage sub-system to a second document storage sub-system, tracking such movement and applying security policies before the movement is completed.

Claims

1. A computer executed method of securing a file access request between a device and an external file server with a corresponding location data, said device executing a program using a file location access protocol that is invoked by at least one object class and said external file server being accessible by the device as a wide area network protocol location, comprising:

Operating an intercept process where said intercept process is invoked as a subclass of one of the at least one invoked file location access protocol object classes, and said intercept process intercepts the request by the invoked object class to access the external file server, where the request designates the external file server location in accordance with a wide area network protocol;

Said invoked intercept process passing to a security inspection process the external file server location extracted from the data representing the intercepted request;

executing the security inspection process on the extracted data; and

in dependence on the result of the security inspection process, the intercept process either permitting or blocking the execution of the request.

2. The method of claim 1 where the program is an Internet browser program and the wide area network protocol is the HTTP or HTTPS protocol.

3. The method of claim 2 where the request by the browser is implemented by interpreting a script received by the device and passed to the browser program.

4. The method of claim 1 where the program is a dedicated application operating on the device that interprets a script transmitted to the application from the external file server.

5. The method of claim 3 or 4 where upon the security inspection protocol result being to permit the request, either the file or a pointer to the file being passed to the interpreted script process.

6. The method of claim 1 further comprising:

receiving as input into the file access protocol at least one parameter.

7. The method of claim 4 where the intercept process intercepts the file access request made by the program making the file access request and upon a determination by the security process that the request is permitted, delivering either the requested file or a pointer to the file requested by the program, where the intercept process is a separate program from the program making the file access request.

8. The method of claim 1 where the security inspection process is executed on the device.

9. The method of claim 1 further comprising:

receiving at least one parameter as input into the file access protocol;

transmitting the at least one parameter input into the file access protocol to a remote security server that executes the security inspection process; and

receiving data representing the security inspection process result.

10. The method of claim 1 further comprising:

on the device, installing computer code embodying the file access request intercept process; and

upon installation of the computer code, storing on the device a token data associated with the installed computer code.

11. The method of claim 10 further comprising:

receiving at the security server the stored token data; and

using the received token data as an input into the security inspection process.

12. The method of claim 1 further comprising:

storing in a data record the location data and at least one of the at least one parameters input into the intercepted file access request protocol.

13. The method of claim 12 where the storing step is performed on an external security server.

14. The method of claim 1 where the location data is at least part of a URL of the external file server.

15. The method of claim 6 where the at least one parameter is a user identifier associated with the device.

16. The method of claim 1 where the location data is a full URL of a browser application making the request.

17. The method of claim 6 where the at least one parameter is at least part of a metadata associated with the requested file.

18. The method of claim 6 where the at least one parameter is an at least part of the data comprising the requested file.

19. The method of claim 6 where the at least one parameter is a time and date of the request.

20. The method of claim 1 further comprising:

executing a security action in dependence on an output of the security inspection process.

21. The method of claim 20 where the security action is executed before transmitting the file and comprises one of:

converting the format of the requested file, removing metadata from the requested file, removing at least part of the data comprising the requested file, encrypting the requested file using a predetermined encryption key, transmitting a message from the security server comprising an alert that the request for the file was made, generating a data value representing a fingerprint of the requested file, generating a digital signature for the requested file, inserting steganographic data into the requested file.

22. A computer system for automatically managing the movement of document files from a first document storage sub-system to a second document storage sub-system comprising:

a module adapted by logic executing on a first computer comprising the system to execute a first file selection procedure using as input commands received from a user interacting with the first computer in order to select a document stored on the first sub-system;

a module adapted by logic to execute on the first computer a first application programming interface protocol associated with the first sub-system in order to use the output of the first file selection procedure to submit to the first sub-system a request to obtain the selected document from the first sub-system;

a module adapted by logic executing on the first computer to receive from the first sub-system the selected document and store the document;

a module adapted by logic executed by the first computer to execute a second destination selection procedure process using as input commands and data received from the user in order to select a destination comprised of the second sub-system; and

a module adapted by logic to invoke an object class as a second application programming interface associated with the second sub-system in order to use the output of the destination selection procedure and to transmit the selected document to the second sub-system; and

a module adapted by logic to invoke as a sub-class to the invoked object class an intercept process that intercepts the destination selection process where the invoked subclass passes data representing the output of the destination selection procedure to a security inspection process.

23. The system of claim 22:

where the module adapted by logic to execute a security inspection process is further adapted by logic to apply a security policy to a selected document and a selected destination and in dependence on the output of such security policy, permit or deny transmitting the selected document to the second sub-system.

24. The system of claim 22 further comprising:

a database adapted by logic to store a data record associated with the selected document comprised of data representing at least one of;

the identity of the user, the identity of the selected destination, a date and time of the receipt of the selected document, a date and time of the transmission of the selected document, the identity of the second sub-system.

25. The system of claim 22 further comprising:

a module adapted by logic to perform one of;

convert the format of the selected document file, remove hidden metadata, comments or confidential information from the selected document file, redact at least part of the selected document file.

26. The system of claim 22 further comprising:

a module that is adapted by logic to present to the user a user interface of an application program file selection process;

a module adapted by logic to intercept an executing file selection process of the application program file in order to determine a file selection designation input by the user;

a module adapted by logic to transform the determined file selection designation into a command to the first sub-system to obtain the file designated by the intercepted file selection designation and to receive the file;

a module adapted by logic that passes the received file or a pointer to the received file to the application.

27. The system of claim 22 further comprising:

a module adapted by logic to store a data structure associated with the received selected file that maps a first predetermined set of document file attributes associated with a first document management system further corresponding to the first sub-system to a second predetermined set of document file attributes associated with a second document management system corresponding to the second sub-system; and

data retrieved from the stored data structure to automatically generate the request to store the document on the second sub-system that conforms to the second application programming interface.