Enforcing Application and Access Control Policies in an Information Management System with Two or More Interactive Enforcement Points

• US 20080294586A1
• Filed: 10/30/2007
• Published: 11/27/2008
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Blue Jungle
• Original Assignee: Blue Jungle
• Inventors: Lim, Keng
• Granted Patent: US 8,407,345 B2
• Time in Patent Office: Days
• US Class Current: 706/47
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A method and apparatus for controlling document access and application usage using centrally managed rules. The rules are stored and manipulated in a central rule database via a rule server. Policy enforcers are installed on client systems and/or on servers and perform document access and application usage control for both direct user document accesses and application usage, and application program document accesses by evaluating the rules sent to the policy enforcer. The rule server decides which rules are required by each policy enforcer. A policy enforcer can also perform obligation and remediation operations as a part of rule evaluation. Policy enforcers on client systems and servers can operate autonomously, evaluating policies that have been received, when communications have been discontinued with the rule server.

Claims

1. A method of controlling application usage and document access in a plurality of computers the method comprising:

evaluating at least one rule pertaining to an occurrence of an event;

wherein the at least one rule is among a plurality of rules stored on a first computer;

wherein the at least one rule contains at least one expression used by the evaluating step to decide whether to perform an action;

communicating with a plurality of computers as indicated by the at least one rule; and

instructing the plurality of computers to perform an action as indicated by the at least one rule.

2. A method of controlling application usage and document access in a plurality of computers the method comprising:

evaluating at least one rule pertaining to an occurrence of an event,

wherein the at least one rule is among a plurality of rules stored on a first computer, and

wherein the at least one rule contains at least one expression used by the evaluating step to decide whether to perform an action;

communicating with a plurality of computers as indicated by the at least one rule; and

instructing the plurality of computers to evaluate at least one rule.

3. An apparatus for controlling application usage and document access in a plurality of computers comprising:

a module for evaluating at least one rule pertaining to an occurrence of an event,

wherein the at least one rule is among a plurality of rules stored on a first computer, and

wherein the at least one rule contains at least one expression used by the evaluating module to decide whether to perform an action;

a module for communicating with a plurality of computers as indicated by the at least one rule; and

a module for instructing the plurality of computers to perform an action as indicated by the at least one rule.

4. An apparatus for controlling application usage and document access in a plurality of computers comprising:

a module for evaluating at least one rule pertaining to an occurrence of an event,

wherein the at least one rule is among a plurality of rules stored on a first computer, and

wherein the at least one rule contains at least one expression used by the evaluating module to decide whether to perform an action;

a module for communicating with a plurality of computers as indicated by the at least one rule; and

a module for instructing the plurality of computers to evaluate at least one rule.