System and method for controlling access to documents stored on an internal network

• US 20040003293A1
• Filed: 06/30/2003
• Published: 01/01/2004
• Est. Priority Date: 02/17/1998
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Greve, Paula Budig, Herberg, Wayne W., Motes, David G., Viets, Richard R.
• Granted Patent: US 7,543,329 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method of limiting access from an external network to documents stored on an internal network. A client list is built in which each client is assigned to one or more roles. Each role has access to one or more documents as defined on a document list. A request from an external network is reviewed and, if possible, the request is associated with a client on the client list. The requested document is then compared to the document list associated with the client'"'"'s role and, if the requested document is in the list of documents available to a client in the client'"'"'s role, the requested document is fetched, cleaned and sent to the client.

Claims

1. In a document control system including an internal network, an external interface, and a document server connected to the internal network and to the external interface, wherein the document server contains a plurality of go lists, wherein each go list is associated with a role and wherein each go list indicates if a client assigned to that role has access to a document in a document list, a method of modifying a go list, the method comprising:

defining client roles, wherein the client roles include a first client role and a second client role;

defining a plurality of Data Owners, wherein each Data Owner sets access rights for one or more client roles, wherein the plurality of Data Owners include a first Data Owner, wherein the first Data Owner sets access rights for the first client role and not for the second client role;

accessing a go list for a client role associated with the first Data Owner;

displaying the go list as a directory tree;

modifying the directory tree;

mapping the modified directory tree into a revised go list; and

saving the revised go list to the document server.

2. The method according to claim 1, wherein modifying includes adding a document.

3. The method according to claim 1, wherein modifying includes adding a directory.

4. The method according to claim 1, wherein modifying includes marking the directory tree to prevent access to a portion of the directory tree.

6. The method according to claim 1, wherein displaying includes displaying the directory tree within a Graphical User Interface (GUI).

7. The method according to claim 1, wherein mapping a directory into a go list includes requesting a URL associated with the go list from the document server.

8. The method according to claim 1, wherein mapping a directory into a go list includes parsing a requested URL associated with the go list.

5. The method according to claim l, wherein modifying includes marking the directory tree to allow access to a portion of the directory tree.