Content-Based Policy Compliance Systems and Methods

• US 20070195779A1
• Filed: 05/15/2006
• Published: 08/23/2007
• Est. Priority Date: 03/08/2002
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: Ciphertrust, Incorporated (McAfee, LLC)
• Inventors: Yang, Weilai, Judge, Paul, Zdziarski, Jonathan, Schneck, Phyllis
• Granted Patent: US 7,903,549 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

Methods and systems for operation upon one or more data processors to filter communications of users in accordance with content-based policy.

Claims

1. A method for operation upon one or more data processors to filter communications based upon content based policy compliance, comprising:

defining a classification to be associated with a set of files, the classification generally classifying content of the set of documents as being associated with one of a plurality of business activities;

receiving a set of known identifying characteristics with respect to the classification;

wherein the set of known identifying characteristics has been derived based upon the set of files;

receiving a rule specifying treatment of content identified as associated with the set of known identifying characteristics;

wherein the rule defines whether to forward a communication including content to a recipient based upon the classification of the content and at least one of the recipient and the sender.

2. The method of claim 1, wherein the received set of known identifying characteristics associated with the set of files are generated by examining the content of the set of files for triggering characteristics included in the files.

3. The method of claim 2, wherein the examination of the files includes at least one of a fingerprinting analysis, a cluster analysis, a contextual analysis, and an adaptive lexical analysis.

4. The method of claim 1, wherein the rule is generated according to access control rights associated with at least one of the sender or the recipient, wherein the access control rights are derived from access control rights associated with the set of files.

5. The method of claim 1, wherein the rule is generated based upon access control rights associated with at least one of the sender or the recipient, content contained in a communication, usage of the content contained in a communication, or combinations thereof.

6. The method of claim 5, wherein access control rights are provided to group of users, wherein the sender and the recipient are included in at least one group of users.

7. The method of claim 1, further comprising the steps of:

receiving a communication from an originating system;

extracting identifying characteristics associated with the communication;

comparing the communication'"'"'s identifying characteristics with the set of known identifying characteristic to identify a determined classification to be associated with the communication;

applying a rule associated with the determined classification, the rule specifying whether the communication should be forwarded to its intended recipient.

8. The method of claim 7, further comprising the step of forwarding the communication based upon application of the rule.

9. The method of claim 7, further comprising the step of forwarding the communication responsive to the communication not being associated with any known identifying, characteristics.

10. The method of claim 7, further comprising the step of automatically generating a rule responsive to learning communications patterns associated with groups of users and based on types of content being distributed among the groups of users.

11. The method of claim 7, further comprising delaying delivery of the communication based upon application of the rule.

12. The method of claim 11, further comprising notifying an originator of the communication responsive to delivery of the communication being delayed.

13. The method of claim 12, wherein the delay is at least one of storing the communication in a quarantine folder, dropping the communication, temporarily rejecting the communication, storing the communication until approval is received from an administrator to forward the communication, automatically encrypting the communication, notifying an administrator, notifying a recipient, or combinations thereof.

14. The method of claim 7, further comprising converting a communication from one of a plurality of mismatched formats to a comparison format prior to extracting identifying characteristics from the communication.

15. The method of claim 7, further comprising translating a file or communication into a common language or format prior to extracting identifying characteristics or generating the known identifying characteristics.

16. The method of claim 15, wherein the translating step creates metadata to be used in extracting identifying characteristics.

17. The method of claim 7, further comprising the steps of:

observing communication traffic;

identifying one or more patterns exhibited by observed communication traffic;

generating a rule based upon the identified one or more patterns.

18. The method of claim 17, wherein a communication falling outside of one or more identified traffic patterns is sent to a quarantine folder, dropped, temporarily rejected, stored until approval is received from an administrator to forward the communication, automatically encrypted, a recipient is notified, a sender is notified, or combinations thereof.

19. The method of claim 1, wherein the defined classifications are at least one of:

management files, legal files, technical files, marketing files, financial files, information technology files, proprietary files, strategy files, sensitive files, or government classified files.

20. The method of claim 1, wherein a system administrator specifies the rule by selecting a classification of files for application of the rule, selecting a class of users who are permitted to send the selected classification of files, and selecting a class of users who are permitted to receive the selected classification of files.

21. The method of claim 1, wherein the steps of selecting a class of users comprises selecting individual users who have permission to send or receive the selected classification of files.

22. A content-based policy compliance system configured to filter messages based upon content and at least one of senders or recipients associated with the messages, the system comprising:

a messaging content classifier configured to receive a message and classify the message as associated with at least one of a plurality of content classification based upon the content of the message and upon known identifying characteristic of the plurality of content classifications;

a messaging filter configured to receive the at least one content classification from the messaging content classifier and to apply a rule to the message based upon the at least one content classification and upon at least one of a sender or recipient of the message; and

forwarding logic configured to transmit the message responsive to output from the messaging filter.

23. The system of claim 22, wherein the messaging content classifier is further configured to receive a plurality of files associated with a specified class, and extract any identifying characteristics from the messages to generate the known identifying characteristics and associate the known identifying characteristics with the specified class of the plurality of content classifications.

24. The system of claim 23, further comprising a user interface configured to receive the plurality of files and the specified class from a user and provide the plurality of files and the specified class to the messaging content classifier.

25. The system of claim 24, wherein the user interface is further configured to allow a user to specify rules for the messaging filter.

26. The system of claim 25, wherein the rules specify which classes of individuals are permitted to send and receive a specified content class associated with the rule.

27. The system of claim 26, wherein the messaging content classifier is configured to use one or more of the following identification techniques to identify commonalities between the plurality of files as well as to classify messages with one of the plurality of classes:

a fingerprinting analysis, a cluster analysis, a contextual analysis, and an adaptive lexical analysis.

28. The system of claim 22, wherein the forwarding logic is operable to forward the message to a recipient, quarantine the message, drop the message, or encrypt the message before forwarding the message to a recipient.

29. The system of claim 22, wherein the system in a messaging client, wherein the messaging client periodically receives updates from a messaging server comprising at least one of update rules, updated content classifications, or updated identifying characteristics for the content classifications.

30. The system of claim 22, wherein the message comprises an e-mail communication, an instant messaging communication, an HTTP communication, an FTP communication, a WAIS communication, a telnet communication, a Gopher communication, or a voice over internet protocol communication.

31. Computer readable storage media storing instructions that upon execution by a system processor cause the system processor to filter communication transmitted over a communication network based upon the content of a communication and upon the sender and recipient(s) of the communication, the media having stored instruction that cause the system processor to perform the steps comprising:

receiving sets of known identifying characteristics with respect to a plurality of content classifications from a message content classifier;

wherein the set of known identifying characteristics for the plurality of content classifications has been derived based upon sets of files provided to the message content classifier;

receiving a set of rules specifying treatment of content identified as associated with the sets of known identifying characteristics from a system administrator;

wherein the rules define whether to forward a communication to a recipient based upon the classification of the communication content and at least one of the recipient and the sender;

receiving a communication from a user, the communication containing an originating address, a receiving address or plurality of receiving address and content;

determining whether the content of the communication substantially matches any of the plurality of content classifications based upon the sets of known identifying characteristics associated with the content classifications, respectively;

forwarding the communication responsive to the rule associated with the substantially matched content classification, wherein the rule specifies an action to perform on the communication based upon the content classification of the communication and upon the originating address and the receiving address of the communication.