System and method for electronic document security

• US 20040237035A1
• Filed: 05/21/2003
• Published: 11/25/2004
• Est. Priority Date: 05/21/2003
• Status: Active Grant

• Current Assignee: Ent Services Development Corporation LP (DXC Technology Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Cummins, Fred A.
• Granted Patent: US 7,562,215 B2
• Time in Patent Office: Days
• US Class Current: 715/513
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A method for providing document-level security for electronic documents comprises identifying a plurality of roles for the electronic document, the plurality of roles comprising at least one role associated with a first participant ID of a first client. The roles are dynamically stored in the electronic document. One or more participant IDs are dynamically stored in the electronic document, including at least the first participant ID, wherein each participant ID is associated with at least one role. A second participant ID of a second client is determined and the second client'"'"'s ability to access the electronic document is automatically determined based, at least in part, on the second participant ID and the stored roles and participant IDs.

Claims

1. A method for providing document-level security for electronic documents comprising:

identifying a plurality of roles for the electronic document, the plurality of roles comprising at least one role associated with a first participant ID of a first client;

storing the roles in the electronic document;

storing one or more participant IDs in the electronic document, including at least the first participant ID, wherein each participant ID is associated with at least one role;

determining a second participant ID of a second client; and

determining the second client'"'"'s ability to access the electronic document based, at least in part, on the second participant ID and the stored roles and participant IDs.

2. The method of claim 1, the electronic document comprising an XML document.

3. The method of claim 1, wherein determining the second client'"'"'s ability to access the electronic document comprises:

comparing the second participant ID to the participant IDs stored in the electronic document; and

in response to one of the participant IDs and the second participant ID being identical, allowing the second client to access the electronic document.

4. The method of claim 1, the electronic document comprising a compound document, the compound document comprising at least a first stage and a second stage with each stage comprising at least one contribution, and the method further comprising:

associating a first subset of the plurality of roles with the first stage; and

associating a second subset of the plurality of roles with the second stage.

5. The method of claim 4, the first subset of the roles comprising the first and second participant IDs, the method further comprising:

receiving a first contribution for the first stage, the first contribution associated with the first client; and

receiving a second contribution for the first stage, the second contribution associated with the second client.

6. The method of claim 5 further comprising occluding the first contribution from the second client based, at least in part, on the second participant ID.

7. The method of claim 5 further comprising:

modifying the first contribution; and

automatically invalidating the second contribution, wherein content of the second contribution is based in part on the first contribution.

8. The method of claim 5 further comprising associating an electronic signature with the first contribution, the electronic signature identifying a unique client associated with a role identical to the first role of the first participant ID.

9. The method of claim 4, the second subset of roles comprising the second participant ID and the method further comprising:

receiving a request to access the electronic document from the first client; and

denying the first client access to the second stage based, at least in part, on the first participant ID.

10. The method of claim 1 further comprising communicating the electronic document to the second client prior to identifying the second participant ID.

11. The method of claim 1 further comprising storing the electronic document in an electronic document repository.

12. Software for providing document-level security for electronic documents, the software operable to:

identify a plurality of roles for the electronic document, the plurality of roles comprising at least one role associated with a first participant ID of a first client;

store the roles in the electronic document;

store one or more participant IDs in the electronic document, including at least the first participant ID, wherein each participant ID is associated with at least one role;

determine a second participant ID of a second client; and

determine the second client'"'"'s ability to access the electronic document based, at least in part, on the second participant ID and the stored roles and participant IDs.

13. The software of claim 12, the electronic document comprising an XML document.

14. The software of claim 12, wherein the software operable to automatically determine the second client'"'"'s ability to access the electronic document comprises the software operable to:

compare the second participant ID to the participant IDs stored in the electronic document; and

in response to one of the participant IDs and the second participant ID being identical, allow the second client to access at least a portion of the electronic document.

15. The software of claim 12, the electronic document comprising a compound document, the compound document comprising at least a first stage and a second stage with each stage comprising at least one contribution, and the software further operable to:

associate a first subset of the plurality of roles with the first stage; and

associate a second subset of the plurality of roles with the second stage.

16. The software of claim 15, the first subset of the roles comprising the first and second participant IDs, the software further operable to:

receive a first contribution to the first stage, the first contribution associated with the first client; and

receive a second contribution to the first stage, the second contribution associated with the second client.

17. The software of claim 16 further operable to occlude the first contribution from the second client based, at least in part, on the second participant ID.

18. The software of claim 16 further operable to:

modify the first contribution; and

automatically invalidate the second contribution.

19. The software of claim 16 further operable to associate an electronic signature with the first contribution, the electronic signature identifying a unique client associated with a participant ID identical to the first participant ID.

20. The software of claim 15, the second subset of roles comprising the second participant ID and the software further operable to:

receive a request to access the electronic document from the first client; and

deny the first client access to the second stage based, at least in part, on the first participant ID and the associated roles.

21. The software of claim 12 further operable to communicate the electronic document to the second client prior to identifying the second participant ID.

22. The software of claim 12 further operable to store the electronic document in an electronic document repository.

23. A system for providing document-level security for electronic documents comprising:

at least one memory operable to store a plurality of electronic documents, each electronic document including at least one stored role; and

one or more processors, in response to receiving a request to access one of the electronic documents from a client, collectively operable to;

determine a participant ID of the requesting client; and

automatically determine the requesting client'"'"'s ability to access the electronic document based, at least in part, on the participant ID of the requesting client and the stored roles.