Apparatus and method for assuring compliance with distribution and usage policy

• US 20040255147A1
• Filed: 05/06/2004
• Published: 12/16/2004
• Est. Priority Date: 05/06/2003
• Status: Active Grant

• Current Assignee: Forcepoint LLC (Francisco Partners Management LLC)
• Original Assignee: Vidius, Inc. (Francisco Partners Management LLC)
• Inventors: Troyansky, Lidror, Peled, Ariel, Lupo, Guy
• Granted Patent: US 7,669,225 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]

Abstract

A method and apparatus for providing multi-domain control over a digital data item via a first domain security policy assigned to the digital data item at a first domain, the data item being transferred from the first domain to a second domain, the second domain being autonomous from the first domain in respect of security policies. The method comprises assigning the security policy to the digital item within the first domain; transferring the digital items to the second domain together with data defining the first domain security policy; analyzing the first domain security policy within the second domain; and distributing and/or allowing usage of the digital items within the second domain in accordance with analyzed first domain security policy, and/or reporting breaches or attempted breaches of the policy.

Claims

1. A method for providing multi-domain control over a digital data item via a first domain security policy assigned to said digital data item at a first domain, said data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, the method comprising:

a) assigning said security policy to said digital item within said first domain;

b) transferring said digital items to said second domain together with data defining said first domain security policy;

c) analyzing said first domain security policy within said second domain;

d) distributing or allowing usage of said digital items within said second domain in accordance with said analyzed first domain security policy.

2. A method according to claim 1 wherein said analyzing said policy comprises assurance of the integrity of the policy and the content.

3. A method according to claim 1, wherein assigning said first domain security policy to said at least one digital item within said first domain comprises determining a legitimacy of at least one of the following:

a set of authorized recipients;

a set of authorized usages;

a set of allowed formats;

a set of allowed distribution channels, and

a required action.

4. A method according to claim 3, wherein said required action comprises at least one of the following:

preventing distribution of said digital item;

preventing storage of said digital item;

preventing usage of said digital item;

reporting distribution of said digital item;

reporting storage of said digital item;

reporting usage of said digital item;

reporting;

alerting about distribution of said digital item;

alerting storage of said digital item;

alerting usage of said digital item;

alerting;

logging distribution of said digital item;

logging storage of said digital item;

logging usage of said digital item;

logging;

notifying about distribution of said digital item;

notifying about storage of said digital item;

notifying about usage of said digital item;

notifying;

notifying to an administrator;

notifying to a manager;

notifying to a recipient;

notifying to a sender;

notifying to an owner of said digital item;

quarantine;

alerting an administrator;

alerting a manager;

alerting a recipient;

alerting a sender;

alerting an owner of said digital item;

reporting to an administrator;

reporting to a manager;

reporting to a recipient;

reporting to a sender;

reporting to an owner of said digital item;

encrypting said digital item;

changing said digital item;

replacing an information object with said digital data item; and

utilizing digital rights management technology on said digital item.

5. A method according to claim 4, wherein said applying said required action comprises blocking the transmission to unauthorized recipients.

6. A method according to claim 1 further comprising sending to said first domain a notification regarding the distribution of said digital item within said second domain.

7. A method according to claim 1, wherein said analyzing said policy within said second domain comprises comparing said policy assigned to said digital item within said first domain to the policy applied within said second domain.

8. A method according to claim 7, wherein applying said policy within said second domain comprises either of a distribution policy and a usage policy.

9. A method according to claim 1 further comprising assigning said policy based on information content of said digital item.

10. A method according to claim 8 further comprising monitoring the distribution or usage of the information content of said digital item within said second domain.

11. A method according to claim 8 further comprising enforcing a distribution or usage policy on the information content of said digital item within said second domain.

12. A method according to claim 11, wherein said enforcing a distribution policy on the information content of said digital item within said second domain comprises enforcing a distribution policy with respect to said second domain email traffic.

13. A method according to claim 7, further comprising providing a negotiation stage of negotiating between said first domain and said second domain in case said first domain security policy assigned to said digital item at said first domain does not comply with policy rules that apply within said second domain.

14. A method according to claim 1, further comprising reporting of attempts of breaches of any of said policies.

15. A method according to claim 1, further comprising utilizing an arbitrator for resolutions of conflicts, said arbitrator being independent of both said first domain and said second domain.

16. A method according to claim 14, wherein said arbitrator utilizes accumulated results of similar negotiations from the same or similar organizations as precedents and resolves said conflicts based on such precedents.

17. A method according to claim 1, further comprising utilizing an assurance authority for assuring the execution of said distribution policy, said assurance authority being independent of said first domain and said second domain and comprising assurance functionality to render trust at both said first and said second domain.

18. A method according to claim 17, wherein said assurance functionality establishes trust between said first and second domain using a shared secret.

19. A method according to claim 17, wherein the trust between said first and second domain is established using public-key infrastructure.

20. A method according to claim 1, further comprising utilizing a trustee for auditing compliance of said second domain with said first domain security policy at said first domain.

25. A method according to claim 7, wherein, in a case in which said second domain does not accept said policy of said first domain, said distribution or usage of said digital within said second domain is prohibited.

26. A method according to claim 7, wherein in case in which said second domain does not accept said a policy of said first domain, said distribution or usage of said digital within said second domain is restricted.

27. A method according to claim 3 wherein said usage comprise comprises at least one of the following:

Storage;

Copying a file;

copying an excerpt;

editing;

copying to clipboard;

copying an excerpt to clipboard;

changing format;

changing encoding;

renaming a file;

encryption;

decryption;

changing digital management;

opening by an application; and

printing.

28. A method according to claim 1, wherein said policy comprises placing a substantially imperceptible marking in said digital item, said marking comprising information content, and said method comprising placing said marking, when indicated by said policy, before allowing at least one of the following:

storage of said digital item;

usage of said digital item; and

distribution of said digital item.

29. A method according to claim 1, wherein said policy comprises distribution regulation, said distribution regulation being for regulating at least one of the following:

sending said digital item via mail;

sending said digital item via web mail;

uploading said digital item to a web server;

uploading said digital item to a FTP server;

sending said digital item via a file transfer application;

sending said digital item via an instant messaging application;

sending said digital item via a file transfer protocol; and

sending said digital item via an instant messaging protocol.

30. A method according to claim 1, wherein said policy is dependent on at least one of the following:

the domain of a respective digital item;

the identity of a system;

the identity of a user;

the identity level of a user authorizing an action;

the identity of a user requesting an action;

the identity of a user involved in an action;

the identity of a user receiving an digital item;

authentication level of a system;

authentication level of a user;

authentication level of a user requesting an action;

authentication level of a user authorizing an action;

authentication level of a user involved in an action;

authentication level of a user receiving said digital item;

authentication level of a user sending said digital item;

the format of an digital item instance;

an interface being used;

an application being used;

encryption being used;

digital rights management technology being used;

detection of transformation, wherein said transformation is operable to reduce ability to identify said transformed digital item;

digital item integrity;

regular usage pattern;

regular distribution pattern;

regular storage pattern;

information path;

consistency of an action with usage pattern;

the identity of a user overriding policy and authorizing action in respect to said digital item;

authentication level of a user overriding policy and authorizing action in respect to said digital item;

the identity of a user sending digital item;

information property of said digital item;

language of said digital item;

representation of said digital item;

operations done on of said digital item;

identity of users involved along the life cycle of said digital item;

application used on of said digital item;

transition channel of said digital item;

participant agents;

virtual location of a computer;

logical location of a computer;

physical location of a computer;

type of a computer;

type of a laptop computer;

type of a desktop computer;

type of a server computer; and

owner identity.

31. A method according to claim 1, wherein said analyzing comprises modifying said first domain security policy to encompass security policy rules of said second domain.

21. A method for providing multi-domain monitoring over a digital data item, said data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, said security policy comprises requirements for breach reports, the method comprising:

a) assigning said security policy to said digital item within said first domain;

b) transferring said digital items to said second domain together with data defining said first domain security policy;

a) analyzing said first domain security policy within said second domain;

b) reporting about breaches or breach attempts within said second domain in accordance with said analyzed first domain security policy and said breach report requirements.

22. A method according to claim 21, wherein, in a case in which said second domain does not accept a breach reporting requirements of said first domain, said distribution or usage of said digital within said second domain is prohibited.

23. A method according to claim 21, wherein in a case in which said second domain does not accept a breach reporting requirements of said first domain, said distribution or usage of said digital within said second domain is restricted.

24. A method according to claim 21, further comprising negotiation between said first domain and said second domain in a case in which said breach reporting requirements assigned to said digital item at said first domain does not comply with said breach reporting requirements applied within said second domain.

32. Apparatus for providing multi-domain control over a digital data item via a first domain security policy assigned to said digital data item at a first domain, said data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, apparatus comprising:

a) a policy reference monitor, for assigning said security policy to said digital item within said first domain;

b) an assurance reference monitor for;

i. receiving said digital items sent to said second domain together with data defining said first domain security policy;

ii. analyzing said data defining said first domain security policy,

iii. distributing or allowing usage of said digital items within said second domain in accordance with said analyzed first domain security policy, and

iv. communicating with said policy reference monitor;

33. Apparatus of claim 32, further comprising an intra-organization reference monitor, and wherein policy reference monitor connects to said intra-organization reference monitor and checks whether said security policy assigned to said digital item complies with the policy applied within said second domain.

34. Apparatus of claim 32, further comprising an audit database for recording details of events in which a digital item, to which a distribution policy was assigned, was received by said assurance reference monitor.

35. Apparatus of claim 32, further comprising an identification module, said identification module is operable to identify the information content of said digital item received by said assurance reference monitor.

36. Apparatus of claim 32, further comprising an arbitrator, said arbitrator is operable to resolve conflicts between said assigned policy and the policy applied within said second domain.

37. Apparatus of claim 32, further comprising an assurance entity, said assurance entity is operable to assures or certifies the execution of said security policy assigned to said digital item.