Intelligent secure data manipulation apparatus and method

• US 20020184527A1
• Filed: 09/19/2001
• Published: 12/05/2002
• Est. Priority Date: 06/01/2001
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Chun, Jon Andre, Hormuzdiar, James Noshir, Hui Hsu, Stephen Dao
• Granted Patent: US 7,730,528 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion

Abstract

A data manipulation appliance can be installed or plugged into a computer network between business partners, and can perform many of the difficult and tedious data manipulation operations in a substantially automated manner. Examples of operations that can be performed by an embodiment of the apparatus include, but are not limited to, encryption, authentication, auditing, shaping data to a common intermediate format for exchange between partners, other auditing of data exchanges in transaction logs, filtering data for privacy compliance and risk management, error detection and correction, mapping internal non-standard data elements to external standard code sets, proxy and protocol re-writing, and so on. The appliance can be embedded with various tools to perform these operations, and therefore appears to be “intelligent.”

Claims

1. An apparatus through which to exchange electronic data over a network between remote machines, the apparatus comprising:

a security module to secure an exchange of electronic data between the remote machines;

a secure portal capable to reformat the electronic data, to be exchanged over the network, from a first protocol to a second protocol;

a data shaping module to manipulate the electronic data that is to be exchanged over the network, from a first format to a second format; and

a management module to enable configuration of the security module, the secure portal, and the data shaping module.

2. The apparatus of claim 1, further comprising:

a first network connection device coupled to the security module to receive the electronic data from one of the remote machines; and

an additional network connection device capable of being coupled to the secure portal to provide dedicated links for (a) the manipulated electronic data to another one of the remote machines, or (b) to provide data from a data store.

3. The apparatus of claim 2 wherein the first network connection device and the second network connection device comprise a same device.

4. The apparatus of claim 1 wherein the electronic data includes programs.

5. The apparatus of claim 2, further comprising:

a first storage device coupled to the first network connection device to store the received electronic data; and

a second storage device coupled to the second network connection device to store the manipulated electronic data.

6. The apparatus of claim 5 wherein the first and second storage devices comprise a same storage device.

7. The apparatus of claim 1 wherein the security module comprises:

an authentication module to encrypt electronic data transmitted over the network from one of the remote machines and to authenticate remote machines prior to establishment of a network communication; and

an authorization module to authorize requests by remote machines to access specific electronic data resources.

8. The apparatus of claim 7 wherein the authorization module is capable to authorize a request to access the electronic data that comprises a request to access the management module to configure any one of the modules.

9. The apparatus of claim 1 wherein the management module is capable to enable at least one of:

remote local or remote configuration and management of any one of the modules;

local or remote management of any one of the modules;

or

local or remote programming of data manipulation rules for the data shaping module.

10. The apparatus of claim 1 wherein the data shaping module includes machine-readable instructions to perform at least one of:

transform the electronic data according to fixed data manipulation rules;

transform the electronic data according to programmable data manipulation rules;

transform the electronic data according to historical information in a multi-part transaction over time;

or

record the electronic data or derivatives thereof.

11. The apparatus of claim 1 wherein the data shaping module includes machine-readable instructions to perform at least one of:

audit high and low level portions of the electronic data;

audit transactional data;

re-format the electronic data to an intermediate format prior to providing the electronic data to one of the remote machines;

or

analyze the electronic data and transactional data.

12. The apparatus of claim 11 wherein the instructions to re-format the electronic data to an intermediate format include instructions to re-format the electronic data based on one of a fixed text position technique, variable text position technique, markup tag technique, technique for unstructured data, or technique for transactional history.

13. The apparatus of claim 11 wherein the instructions to analyze the data include instructions to perform at least one of statistical analysis, error detection and correction, or application of logic rules on the electronic data.

14. The apparatus of claim 11 wherein the data shaping module further includes machine-readable instructions to filter the electronic data.

15. The apparatus of claim 7, further comprising:

a user map store communicatively coupled to the authentication module and to the authorization module to store information indicative of users authorized to access the electronic data; and

a resource map store communicatively coupled to the authorization module to store information indicative of electronic data, including resources of the network accessible by any one of the remote machines, and which users and groups have certain specific access privileges.

16. The apparatus of claim 15 wherein the user map and resource map stores are based on a network directory service.

17. The apparatus of claim 2 wherein the first network connection device and the additional network connection device comprise a same device.

18. The apparatus of claim 2 wherein the same device includes multiple network cards.

19. The apparatus of claim 1, further comprising a local or remote storage unit to store state information indicative of parts of a multi-part transaction set involving the electronic data.

20. The apparatus of claim 1 wherein the secure portal is capable to cause the electronic data to be routed through the security module via a rewrite of at least one address included with the electronic data.

21. The apparatus of claim 1 wherein the secure portal is further capable to rewrite a protocol, corresponding to a protocol level of the electronic data, into a web-based protocol.

22. The apparatus of claim 1 wherein the secure portal is further capable to rewrite a protocol, corresponding to the electronic data, into a lower packet level protocol.

23. The apparatus of claim 1, further comprising:

an auditing module, communicatively coupled to an audit logs data store, to obtain audit information corresponding to the electronic data to be exchanged and to store the obtain audit information in the audit logs data store;

a reports module, communicatively coupled to an audit logs data store, to provide report information based on the audit information stored in the audit logs data store; and

an agent data store to hold various scripts that can be scheduled to automate various tasks to be executed, the scripts capable to be read in by a parsing module that translates the scripts into commands that the other modules can understand and act upon.

24. The apparatus of claim 1, further comprising a parsing module to parse the data manipulation rules and translate them into commands other modules can execute.

25. The apparatus of claim 1, further comprising an agents module communicatively coupled to the other modules to combine, automate, and schedule multiple operation commands.

26. The apparatus of claim 1 wherein the management module is capable to enable flexible extensions of new functions.

28. The method of claim 27 wherein securing the exchange of the electronic data includes:

encrypting electronic data transmitted over the network from one of the remote machines and authenticating remote machines prior to establishment of a network communication; and

authorizing requests by remote machines to access specific electronic data resources.

29. The method of claim 28 wherein authorizing requests by remote machines to access the electronic data include authorizing a request to configure the securing, the routing, or the manipulation of the electronic data.

30. The method of claim 27 wherein manipulating the electronic data includes at least one of:

transforming the electronic data according to fixed data manipulation rules;

transforming the electronic data according to programmable data manipulation rules;

transforming the electronic data according to historical information in a multi-part transaction over time;

or

recording the electronic data or derivatives thereof.

31. The method of claim 27 wherein manipulating the electronic data includes at least one of:

auditing high and low level portions of the electronic data;

auditing transactional data;

re-formatting the electronic data to an intermediate format prior to providing the electronic data to one of the remote machines;

or

analyzing the electronic data and transactional data.

32. The method of claim 31 wherein re-formatting the electronic data to the intermediate format includes reformatting the electronic data based on one of a fixed text position technique, variable text position technique, markup tag technique, technique for unstructured data, or technique for transactional history.

33. The method of claim 31 wherein analyzing the electronic data includes performing at least one of statistical analysis, error detection and correction, or application of logic rules on the electronic data.

34. The method of claim 27 wherein manipulating the electronic data includes filtering the electronic data.

35. The method of claim 27, further comprising storing state information indicative of parts of a multi-part transaction set involving the electronic data over time.

36. The method of claim 27 wherein routing the electronic data to be exchanged includes rewriting at least one address included with the electronic data.

37. The method of claim 27, further comp rising:

rewriting a protocol, corresponding to a protocol level of the electronic data, into a web-based protocol; and

rewriting a protocol, corresponding to the electronic data, into a lower packet level protocol.

38. The method of claim 27, further comprising:

obtaining audit information corresponding to the electronic data to be exchanged and storing the obtain audit information in the audit logs data store; and

providing report information based on the stored audit information.

40. The article of manufacture of claim 39 wherein the instructions to secure the exchange of the electronic data include instructions to:

encrypt electronic data transmitted over the network from one of the remote machines and authenticate remote machines prior to establishment of a network communication; and

authorize requests by remote machines to access specific electronic data resources.

41. The article of manufacture of claim 39 wherein the instructions to manipulate the electronic data include instructions to perform at least one of:

transform the electronic data according to fixed data manipulation rules;

transform the electronic data according to programmable data manipulation rules;

transform the electronic data according to historical information in a multi-part transaction over time;

or

record the electronic data or derivatives thereof.

42. The article of manufacture of claim 39 wherein the instructions to manipulate the electronic data include instructions to perform at least one of:

audit high and low level portions of the electronic data;

audit transactional data;

re-format the electronic data to an intermediate format prior to providing the electronic data to one of the remote machines;

or

analyze the electronic data and transactional data.

43. The article of manufacture of claim 42 wherein the instructions to analyze the electronic data include instructions to perform at least one of statistical analysis, error detection and correction, application of logic rules on the electronic data, a technique for unstructured data, or a technique for transactional history.

44. The article of manufacture of claim 42 wherein the instructions to manipulate the electronic data include instructions to filter the electronic data.

45. The article of manufacture of claim 39 wherein the machine-readable medium further includes instructions stored thereon to store state information indicative of parts of a multi-part transaction set involving the electronic data over time.

46. The article of manufacture of claim 39 wherein the instructions to route the electronic data to be exchanged include instructions to rewrite at least one address included with the electronic data.

47. The article of manufacture of claim 39 wherein the machine-readable medium further includes instructions stored thereon to:

rewrite a protocol, corresponding to a protocol level of the electronic data, into a web-based protocol; and

rewrite a protocol, corresponding to the electronic data, into a lower packet level protocol.

48. The article of manufacture of claim 39 wherein the machine-readable medium further includes instructions stored thereon to:

obtain audit information corresponding to the electronic data to be exchanged and store the obtained audit information; and

provide report information based on the stored audit information.

49. The article of manufacture of claim 39 wherein the machine-readable medium further includes instructions stored thereon to perform a single sign-on authentication.

27. A method to facilitate an exchange of electronic data over a network between remote machines, the method comprising:

securing an exchange of electronic data between the remote machines;

if needed, re-formatting the electronic data to be exchanged over the network from a first protocol to a second protocol;

manipulating the electronic data that is to be exchanged over the network from a first format to a second format; and

enabling remote configuration of the securing, routing, or manipulation of the electronic data.

39. An article of manufacture, comprising:

a machine-readable medium having instructions stored thereon to;

secure an exchange of electronic data between the remote machines;

if needed, re-format the electronic data to be exchanged over the network from a first protocol to a second protocol;

manipulate the electronic data that is to be exchanged over the network from a first format to a second format; and

enable remote configuration of the securing, routing, or manipulation of the electronic data.