System and method for dynamically enforcing security policies on electronic files

• US 20090300712A1
• Filed: 03/27/2009
• Published: 12/03/2009
• Est. Priority Date: 03/27/2008
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Covertix Ltd.
• Inventors: Kaufmann, Tzach, Samia, Alon
• Granted Patent: US 8,769,605 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS

Abstract

A system and method dynamically enforcing security policies on electronic files when the file is used. The system and method preferably delegates the file the ability to protect itself. The file automatically identifies its confidential information and applies them when needed.

Claims

1. A system for automatically enforcing security policies on an electronic file regardless of its physical or electronic location, comprising:

A plurality of files, each file containing a policy for enforcing rules on the behavior of the file;

A plurality of agents, each agent being installed on a computational device, each agent featuring at least one application component, each agent being responsible for enforcing said policy;

A policy builder console being responsible for generating the said policies; and

A policy distribution and enforcement server for distributing the policies to the files.

2. The system of claim 1, wherein said policy is a dynamic policy and wherein said policy builder console changes said policy after application to a file, such that said changed policy is distributed to said file and applied in place of a previous policy.

3. The system of claim 1, wherein each agent monitors behavior of said file, the system further comprising:

A logging and auditing server for collecting data from all the said agents into a repository.

4. The system of claim 3, wherein data regarding behavior of each file is reported by said logging and auditing server.

5. The system of claim 4, wherein an overall level of risk is determined for said behavior.

6. The system of claim 1, wherein each agent monitors behavior of said file and wherein said file stores data regarding behavior of said file.

7. The system of claim 1, further comprising:

A classification server being responsible for classifying the content of files.

8. The system of claim 7, further comprising:

A key management server for distributing encryption/decryption keys to said agent.

9. The system of claim 1, wherein said file is inaccessible if said agent is not present.

10. The system of any of claim 1 wherein said policy further comprises controlling of the number of times that a file can be accessed.

11. The system of claim 10 wherein said policy comprises managing of a concurrent license for the file.

12. The system of claim 11 wherein said policy comprises customization to reflect the special requirements of the organization to which the file belongs.

13. The system of claim 12 wherein said policy comprises multifactor authentication within the file.

14. The system of claim 13 wherein said policy comprises limiting the access and usage based on one or more system attributes.

15. The system of claim 14 wherein the said policy limits the access and usage of the file based on its physical location.

16. The system of claim 15 wherein said policy can automatically remove protection of a file after a predefined period.

17. A method for automatically enforcing security policies on an electronic file regardless of its physical or electronic location, comprising:

Providing a plurality of agents, each agent being installed on a computational device, each agent featuring at least one application component, each agent being responsible for enforcing said policy;

Generating a plurality of different policies for different files by a policy builder, wherein at least one policy is a default policy for maintaining at least a baseline type of policy implementation for an organization and wherein at least one policy is a non-default policy;

If available, automatically assigning said non-default policy to the file, without the awareness and the intervention of user; and

Otherwise applying said default policy to the file.

18. The method of claim 17, wherein said non-default policy is selected for a file according to one or more of content analysis, file attribute, group classification, status parameter, access control, location control, email recipient/sender, application file creator or user.