Enforcing Control Policies in an Information Management System with Two or More Interactive Enforcement Points

• US 20080083014A1
• Filed: 10/30/2007
• Published: 04/03/2008
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Blue Jungle
• Original Assignee: Blue Jungle
• Inventors: Lim, Keng
• Granted Patent: US 9,497,219 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A method and apparatus for controlling document access and application usage using centrally managed rules. The rules are stored and manipulated in a central rule database via a rule server. Policy enforcers are installed on client systems and/or on servers and perform document access and application usage control for both direct user document accesses and application usage, and application program document accesses by evaluating the rules sent to the policy enforcer. The rule server decides which rules are required by each policy enforcer. A policy enforcer can also perform obligation and remediation operations as a part of rule evaluation. Policy enforcers on client systems and servers can operate autonomously, evaluating policies that have been received, when communications have been discontinued with the rule server.

Claims

1. A method comprising:

evaluating a document access operation on a first computer,

wherein the evaluating step evaluates at least one rule pertaining to the document access operation,

wherein the at least one rule is among a plurality of rules stored on the first computer, and

wherein the at least one rule contains at least one expression used by the evaluating step to control document access operation;

communicating with a second computer as indicated by the at least one rule; and

confirming on the first computer that the second computer has an ability to interact with the evaluating step.

2. A method of claim 1 further comprising:

detecting document access operation within an application program.

3. A method of claim 1 further comprising:

detecting document access operation within the first computer'"'"'s operating system.

4. A method of claim 1 wherein the evaluating step evaluates rules using information based on any combination of:

type of document access operation, user, user group, role of a user, a user'"'"'s business function, host, type of computer, group of computers, application program, type of application program, application module, geographical location, access mechanism, connectivity, bandwidth, time of day, day of the week, file path, file name, document size, document time stamp, document owner, document properties, historical data from previous document access operations, document type, document format, document classification, document characteristics, document content, element in a database query, element in a database query result set, attribute of a database query result set, attribute of a database, or metadata.

5. A method of claim 1 wherein a rule applies to at least one particular operation within an application program.

6. A method of claim 1 wherein a rule applies to at least one particular operation within the first computer'"'"'s operating system.

7. A method of claim 1 wherein the evaluating step monitors operations of a plurality of application programs on the first computer.

8. A method of claim 1 wherein the evaluating step monitors operations of an operating system on the first computer.

9. A method of claim 1 wherein at least a subset of the plurality of rules stored on the first computer is preinstalled on the first computer.

10. A method of claim 1 wherein at least a subset of the plurality of rules stored on the first computer is dynamically updated from a central database.

11. A method of claim 1 wherein the communicating step further comprises wherein the indication is specified explicitly in the at least one rule using at least one of:

a keyword or directive.

12. A method of claim 1 wherein the communicating step further comprises wherein the indication is specified implicitly by the at least one rule.

13. A method of claim 1 wherein the second computer sends its rule evaluation capabilities to the first computer, and wherein the first computer verifies that the rule evaluation capabilities of the second computer meets requirements of the at least one rule.

14. A method of claim 1 wherein the first computer queries the second computer whether the second computer can enforce a specific rule.

15. A method of claim 1 wherein the first computer queries the second computer to verify that the second computer'"'"'s rule evaluation capabilities meets requirements of the at least one rule.

16. A method of claim 1 wherein the evaluation step obtains information from the second computer in order to evaluate the at least one rule.

17. A method of claim 1 wherein the evaluating step obtains information from a plurality of computers in order to evaluate the at least one rule.

18. A method of claim 1 wherein the evaluating step delegates evaluation of a rule to the second computer.

19. A method of claim 1 wherein the evaluating step delegates evaluation of a plurality of rules to the second computer.

20. A method of claim 1 wherein the evaluating step instructs the second computer to perform an action as specified in a rule.

21. A method of claim 1 wherein the evaluating step instructs a plurality of computers to perform an action as specified in a rule.

22. A method of claim 1 wherein the evaluating step posts an event to the second computer as specified in the evaluated at least one rule that causes the second computer to evaluate at least one rule.

23. A method of claim 1 wherein the evaluating step posts an event to a plurality of computers as specified in the evaluated at least one rule that causes each computer to evaluate at least one rule.

24. A method of claim 1 wherein the evaluating step posts an event to the second computer as specified in the evaluated at least one rule that causes the second computer to perform an action.

25. A method of claim 1 wherein the confirming step further comprises:

transmitting, at the second computer, additional information to the first computer in a request of the document access operation; and

obtaining, at the first computer, the additional information from the request and make the additional information available to the evaluating step.