Enforcing compliance policies in a messaging system

• US 20060031351A1
• Filed: 05/12/2005
• Published: 02/09/2006
• Est. Priority Date: 05/12/2004
• Status: Active Grant

• Current Assignee: STERLING COMPUTERS CORPORATION
• Original Assignee: BLUESPACE SOFTWARE CORP. (STERLING COMPUTERS CORPORATION)
• Inventors: Marston, Justin, Hatch, Andrew Stuart
• Granted Patent: US 8,073,911 B2
• Time in Patent Office: Days
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A messaging system enforces compliance policies for the electronic messages. The messaging system treats a set of related messages, such as an email string between two or more people, as a message container (200) having relational references to one or more submessages (210, 212, 214). A messaging server (112) stores the messages and submessages as discrete message components within a message database (416). In addition, the messaging server (112) stores one or more compliance policies. A compliance policy describes the set of rules that apply to message components during their lifecycles and is defined in terms of a population structure, a set of rules, and a set of jobcodes. When an action occurs that involves a piece of content, the messaging system identifies the relevant compliance policy in the governance policy database (424) and applies any rules that are applicable given the population structure and jobcode.

Claims

1. A computerized messaging server in an electronic messaging system, comprising:

a messaging module adapted to control a message database storing messages exchanged in the messaging system, each message comprising one or more message components; and

a governance module adapted to control a governance policy database storing a compliance policy describing rules applicable to the message components, the governance module further adapted to apply the rules described by the compliance policy to the message components.

2. The messaging server of claim 1, wherein the compliance policy describes a population structure of end-users of the messaging system, a set of jobcodes with which the message components can be classified, and a set of rules applicable to the population structure, jobcodes, and message components.

3. The messaging server of claim 2, wherein a jobcode describes a set of jobcode rules applicable to all message components classified with the jobcode.

4. The messaging server of claim 1, wherein the messaging system is utilized by a set of entities in a population structure and wherein a rule of the compliance policy includes one or more rule elements describing whether a rule is applicable to a message component, the elements selected from the group consisting of:

a source element describing a population structure entity that is a source of the message component;

a target element describing a population structure entity that is a recipient of the message component; and

a rank describing a ranking of the rule relative to other rules in the compliance policy.

5. The messaging server of claim 1, wherein the messaging system is utilized by a set of entities in a population structure and wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

communication rules describing which population structure entities can communication with other population structure entities via the messaging system;

readership rules describing which population structure entities can read messages from other population structure entities via the messaging system;

action rules describing actions a population structure entity can perform on a message component in the messaging system; and

search rules describing which population structure entities can view which message components when searching the messaging components stored by the messaging system.

6. The messaging server of claim 1, wherein the messaging system is utilized by a set of entities in a population structure and wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

validity rules describing a time period for which a message component or entity in the population structure is useable; and

retention rules describing whether a message component or entity in the population structure should be deleted from the messaging system.

7. The messaging server of claim 1, wherein a message in the message database comprises:

a message container containing relational references to one or more submessages.

8. A computer program product having a computer-readable medium having embodied thereon program code for use in an electronic messaging system, the program code comprising:

a messaging module adapted to control a message database storing messages exchanged in the messaging system, each message comprising one or more message components; and

a governance module adapted to control a governance policy database storing a compliance policy describing rules applicable to the message components, the governance module further adapted to apply the rules described by the compliance policy to the message components in the message database.

9. The computer program product of claim 8, wherein the compliance policy describes a population structure of end-users of the messaging system, a set of jobcodes with which the message components can be classified, and a set of rules applicable to the population structure, jobcodes, and message components.

10. The computer program product of claim 9, wherein a jobcode describes a set of jobcode rules applicable to all message components classified with the jobcode.

11. The computer program product of claim 8, wherein the messaging system is utilized by a set of entities in a population structure and wherein a rule of the compliance policy includes one or more rule elements describing whether a rule is applicable to a message component, the elements selected from the group consisting of:

a source element describing a population structure entity that is a source of the message component;

a target element describing a population structure entity that is a recipient of the message component; and

a rank describing a ranking of the rule relative to other rules in the compliance policy.

12. The computer program product of claim 8, wherein the messaging system is utilized by a set of entities in a population structure and wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

communication rules describing which population structure entities can communication with other population structure entities via the messaging system;

readership rules describing which population structure entities can read messages from other population structure entities via the messaging system;

action rules describing actions a population structure entity can perform on a message component in the messaging system; and

search rules describing which population structure entities can view which message components when searching the messaging components stored by the messaging system.

13. The computer program product of claim 8, wherein the messaging system is utilized by a set of entities in a population structure and wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

validity rules describing a time period for which a message component or entity in the population structure is useable; and

retention rules describing whether a message component or entity in the population structure should be deleted from the messaging system.

14. The computer program product of claim 8, wherein a message in the message database comprises:

a message container containing relational references to one or more submessages.

15. A computer-implemented method of managing messages in an electronic messaging system, comprising:

defining a compliance policy describing rules applicable to message components in the electronic messaging system;

receiving a message component from a messaging client, the message component identified as a reference in a message container; and

applying the compliance policy to the message component received from the messaging client.

16. The computer-implemented method of claim 15, wherein the compliance policy describes a population structure of end-users using messaging clients of the messaging system, a set of jobcodes with which the message components can be classified, and a set of rules applicable to the population structure, jobcodes, and message components.

17. The computer-implemented method of claim 16, wherein a jobcode describes a set of jobcode rules applicable to all message components classified with the jobcode.

18. The computer-implemented method of claim 15, wherein the compliance policy describes a set of entities in a population structure, further comprising:

defining a team containing a set of entities of the population structure; and

reflecting an action of an entity on the team across all of the entities on the team.

19. The computer-implemented method of claim 15, wherein the compliance policy describes a set of entities in a hierarchical population structure, further comprising:

defining a group containing a set of entities, the entities in the group defined by their locations in the hierarchical population structure; and

defining a set of rules applicable to the entities in the group.

20. The computer-implemented method of claim 15, wherein the messaging system is utilized by a set of entities in a population structure and wherein a rule of the compliance policy includes one or more rule elements describing whether a rule is applicable to a message component, the elements selected from the group consisting of:

a source element describing a population structure entity that is a source of the message component;

a target element describing a population structure entity that is a recipient of the message component; and

a rank describing a ranking of the rule relative to other rules in the compliance policy.

21. The computer-implemented method of claim 15, wherein the messaging system is utilized by a set of entities in a population structure and wherein a rule of the compliance policy includes a rule element describing an action that is allowed or denied subject to approval by an entity in the population structure.

22. The computer-implemented method of claim 15, wherein defining the compliance policy comprises:

defining a set of rules describing digital rights management (DRM) actions that are allowed or denied on a message component.

23. The computer-implemented method of claim 15, wherein the messaging system is utilized by a set of entities in a population structure and wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

communication rules describing which population structure entities can communication with other population structure entities via the messaging system;

readership rules describing which population structure entities can read messages from other population structure entities via the messaging system;

action rules describing actions a population structure entity can perform on a message component in the messaging system; and

search rules describing which population structure entities can view which message components when searching the messaging components stored by the messaging system.

24. The computer-implemented method of claim 15, wherein the rules described by the compliance policy include encryption rules describing whether and/or how to encrypt message components.

25. The computer-implemented method of claim 15, wherein the rules described by the compliance policy include action rules describing actions an entity can perform on a message component in the messaging system, and wherein the action rules describe a number of times within a given time period that the entity can perform a specified action.

26. The computer-implemented method of claim 15, wherein the messaging system is utilized by a set of entities in a population structure, further comprising:

defining a group of entities in the population structure;

defining group rules applicable to message components related to the group of entities; and

applying the group rules to a message component related to the group of entities.

27. The computer-implemented method of claim 26, wherein the defined group includes geographically-related population structure entities.

28. The computer-implemented method of claim 15, wherein the messaging system is utilized by a set of entities in a population structure and wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

validity rules describing a time period for which a message component or entity in the population structure is useable; and

retention rules describing whether a message component or entity in the population structure should be deleted from the messaging system.

29. The computer-implemented method of claim 15, wherein applying the compliance policy to the message component comprises:

determining whether the compliance policy prohibits an attempted action on the message component; and

recording the attempted action in a compliance log.

30. The computer-implemented method of claim 15, further comprising:

logging interactions with the messaging client in an audit log.