NODE-BASED POLICY-ENFORCEMENT ACROSS MIXED MEDIA, MIXED-COMMUNICATIONS MODALITIES AND EXTENSIBLE TO CLOUD COMPUTING SUCH AS SOA

• US 20110209194A1
• Filed: 02/18/2011
• Published: 08/25/2011
• Est. Priority Date: 02/22/2010
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Incorporated
• Inventors: Kennedy, Kevin J.
• Granted Patent: US 10,015,169 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A system and method are provided to monitor and prevent potential enterprise policy and/or rule violations by subscribers.

Claims

1. A method, comprising:

analyzing, by a first policy agent corresponding to a first node and first subscriber and located in a driver, at least one of a selected communication and content to identify a behavioral instance potentially relevant to a policy and/or rule;

notifying, by the first policy agent, a policy enforcement server of the identified determined behavioral instance; and

receiving, by the first policy agent and from the policy enforcement server, a policy measure to be implemented; and

implementing, by the first policy agent, the received policy measure.

2. The method of claim 1, wherein the behavioral instance is the first subscriber intending to make the one or more of a selected communication and content accessible to one or more selected parties and wherein the receiving step comprises the sub-steps:

receiving, from the first policy agent and by the policy enforcement server, a policy tag respecting one or more of the selected communication and content and wherein the policy tag comprises one or more of the following;

a persona and/or role of the first subscriber,

a persona and/or role of the one or more selected parties,

a degree of trust of the enterprise network with the first subscriber and/or one or more selected parties,

a capability, provisioning, and/or preference of a communication device of the first subscriber and/or the one or more selected parties,

a context of the first subscriber and/or the one or more selected parties,

a context of the communication device of the first subscriber and/or the one or more selected parties,

an existing policy compliance measure selected by the first subscriber for the one or more of the selected communication and content,

a venue for the one or more of the selected communication and content to be made accessible to the one or more selected parties,

a description of the one or more of the selected communication and content,

a context of the selected communication and/or content, and

a policy and/or rule relevant to the one or more of the selected communication and content; and

determining, by the policy enforcement server and based on the policy tag, an applicable policy and/or rule; and

determining, by the policy enforcement server and based on the applicable policy and/or rule, a policy measure to be implemented.

3. The method of claim 2, wherein the first node is a first communication device, wherein the policy agent is in a class driver, wherein the policy tag comprises one or more of a persona and/or role of the one or more selected parties and a persona and/or role of the first subscriber, and wherein the persona and/or role is defined by one or more of the following:

employer name, user level, user organization, the subscriber'"'"'s business-related electronic addresses, satellite-based physical location coordinates associated with a business location, Web browsed URL'"'"'s corresponding with business interests, times-of-day associated with business time, days-of-week associated with business time, contact lists of business associates, client, supplier, customer, family member name, the first subscriber'"'"'s personal electronic addresses, satellite-based physical location coordinates associated with personal location, Web browsed URL'"'"'s corresponding with personal interests, times-of-day associated with personal time, days-of-week associated with personal time, contact list of friends, hobby supplier, charitable organization, and other volunteer activity.

4. The method of claim 2, wherein the first node is a first communication device, wherein the policy tag comprises a degree of trust of the enterprise network with the one or more selected parties, and wherein the one or more selected parties is no longer trusted upon occurrence of a determined event and/or passage of determined time.

5. The method of claim 2, wherein the first node is a first communication device, wherein the policy agent is in a class driver, and wherein the policy tag comprises one or more of a context of the first subscriber and/or the one or more selected parties and a context of the first communication device of the first subscriber and/or a communication device of the one or more selected parties.

6. The method of claim 2, wherein the first node is a first communication device, wherein the policy agent is in a class driver, and wherein the policy tag comprises one or more of a capability, provisioning, and/or preference of the first communication device of the first subscriber and/or a communication device of the one or more selected parties and an existing policy compliance measure selected by the first subscriber for the one or more of the selected communication and content.

7. The method of claim 2, wherein the first node is a first communication device, wherein the policy agent is in a class driver, wherein the policy tag comprises a venue for the one or more of the selected communication and content to be made accessible to the one or more selected parties, and wherein the venue comprises one of a blog, micro-blog, Really Simple Syndication (“

RSS”

) feed, chat room, social network posting, news aggregator, and private party.

8. The method of claim 2, wherein the policy measure to be implemented comprises one or more of the following:

modification of an existing security measure for the one or more of the selected communication and/or content,

implementation of a new and/or additional security measure for the one or more of the selected communication and/or content,

use of a different network path and/or channel than currently chosen to effect transmission or transfer of the one or more of the selected communication and/or content,

implementation of an action to remedy a prior policy or rule violation,

block, delay, and/or buffer the one or more of the selected communication and/or content,

mark or delete a portion of the one or more of the selected communication and/or content prior to access by one or more other parties,

send a notice of policy and/or rule violation to one or more selected destinations,

embed a flag indicating an area of redundant and processor intensive encryption or security transcoding,

prevent access of the one or more of the selected communication and/or content by the one or more selected parties,

prevent the first subscriber from selecting, such as by dragging and dropping, selected content into a communication,

provide read-only access to the one or more of the selected communication and/or content,

set a hop restriction on the one or more of the selected communication and/or content whereby, when the hop restriction is met or exceeded and/or a hop counter is incremented or decremented to a selected value, the one or more of the selected communication and/or content is dropped or otherwise prohibited from delivery to an intended recipient,

tear down a communication channel before transmission of the one or more of the selected communication and/or content,

redirect the one or more of the selected communication and/or content to a different destination, and

display different portions of the one or more of the selected communication and/or content to different ones of the one or more of the selected parties based on a respective degree of trust or privilege of each party.

9. A non-transitory computer readable medium comprising processor executable instructions to perform the determining, notifying and applying steps of claim 1.

10. A system, comprising:

a first policy agent, implemented in a driver and corresponding to a first node and first subscriber, operable to;

analyze at least one of a selected communication and content to identify a behavioral instance potentially relevant to a policy and/or rule;

notify a policy enforcement server of the identified determined behavioral instance; and

implement a policy measure received from the policy enforcement server in response to the notification.

11. The system of claim 10, wherein the behavioral instance is the first subscriber intending to make the one or more of a selected communication and content accessible to one or more selected parties and wherein the policy enforcement server performs the following operations:

receiving, from the first policy agent, a policy tag respecting one or more of the selected communication and content and wherein the policy tag comprises one or more of the following;

a persona and/or role of the first subscriber,

a persona and/or role of the one or more selected parties,

a degree of trust of the enterprise network with the first subscriber and/or one or more selected parties,

a capability, provisioning, and/or preference of a communication device of the first subscriber and/or the one or more selected parties,

a context of the first subscriber and/or the one or more selected parties,

a context of the communication device of the first subscriber and/or the one or more selected parties,

an existing policy compliance measure selected by the first subscriber for the one or more of the selected communication and content,

a venue for the one or more of the selected communication and content to be made accessible to the one or more selected parties,

a description of the one or more of the selected communication and content,

a context of the selected communication and/or content, and

a policy and/or rule relevant to the one or more of the selected communication and content; and

determine, based on the policy tag, an applicable policy and/or rule; and

determine, based on the applicable policy and/or rule, a policy measure to be implemented.

12. The system of claim 11, wherein the first node is a first communication device, wherein the policy agent is in a class driver, wherein the policy tag comprises one or more of a persona and/or role of the one or more selected parties and a persona and/or role of the first subscriber, and wherein the persona and/or role is defined by one or more of the following:

employer name, user level, user organization, the subscriber'"'"'s business-related electronic addresses, satellite-based physical location coordinates associated with a business location, Web browsed URL'"'"'s corresponding with business interests, times-of-day associated with business time, days-of-week associated with business time, contact lists of business associates, client, supplier, customer, family member name, the first subscriber'"'"'s personal electronic addresses, satellite-based physical location coordinates associated with personal location, Web browsed URL'"'"'s corresponding with personal interests, times-of-day associated with personal time, days-of-week associated with personal time, contact list of friends, hobby supplier, charitable organization, and other volunteer activity.

13. The system of claim 11, wherein the first node is a first communication device, wherein the policy tag comprises a degree of trust of the enterprise network with the one or more selected parties, and wherein the one or more selected parties is no longer trusted upon occurrence of a determined event and/or passage of determined time.

14. The system of claim 11, wherein the first node is a first communication device, wherein the policy agent is in a class driver, and wherein the policy tag comprises one or more of a context of the first subscriber and/or the one or more selected parties and a context of the first communication device of the first subscriber and/or a communication device of the one or more selected parties.

15. The system of claim 11, wherein the first node is a first communication device, wherein the policy agent is in a class driver, and wherein the policy tag comprises one or more of a capability, provisioning, and/or preference of the first communication device of the first subscriber and/or a communication device of the one or more selected parties and an existing policy compliance measure selected by the first subscriber for the one or more of the selected communication and content.

16. The system of claim 11, wherein the first node is a first communication device, wherein the policy agent is in a class driver, wherein the policy tag comprises a venue for the one or more of the selected communication and content to be made accessible to the one or more selected parties, and wherein the venue comprises one of a blog, micro-blog, Really Simple Syndication (“

RSS”

) feed, chat room, social network posting, news aggregator, and private party.

17. The system of claim 11, wherein the policy measure to be implemented comprises one or more of the following:

modification of an existing security measure for the one or more of the selected communication and/or content,

implementation of a new and/or additional security measure for the one or more of the selected communication and/or content,

use of a different network path and/or channel than currently chosen to effect transmission or transfer of the one or more of the selected communication and/or content,

implementation of an action to remedy a prior policy or rule violation,

block, delay, and/or buffer the one or more of the selected communication and/or content,

mark or delete a portion of the one or more of the selected communication and/or content prior to access by one or more other parties,

send a notice of policy and/or rule violation to one or more selected destinations,

embed a flag indicating an area of redundant and processor intensive encryption or security transcoding,

prevent access of the one or more of the selected communication and/or content by the one or more selected parties,

prevent the first subscriber from selecting, such as by dragging and dropping, selected content into a communication,

provide read-only access to the one or more of the selected communication and/or content,

set a hop restriction on the one or more of the selected communication and/or content whereby, when the hop restriction is met or exceeded and/or a hop counter is incremented or decremented to a selected value, the one or more of the selected communication and/or content is dropped or otherwise prohibited from delivery to an intended recipient,

tear down a communication channel before transmission of the one or more of the selected communication and/or content,

redirect the one or more of the selected communication and/or content to a different destination, and

display different portions of the one or more of the selected communication and/or content to different ones of the one or more of the selected parties based on a respective degree of trust or privilege of each party.

18. A communication node, comprising:

a policy agent, in a class driver, to search, analyze, and/or tag at least one of a selected communication and content to identify an actual and/or potential policy and/or rule violation and report the actual and/or potential policy and/or rule violation to a policy enforcement server.

19. The node of claim 18, wherein the policy agent inspects a plurality of emails, instant messages, live voice communications, voice messages, electronic documents, and Web browsing sessions and wherein the policy agent generates a policy tag associated with the at least one of a selected communication and content, the policy tag comprising information relevant to a potential policy and/or rule violation.

20. The node of claim 18, wherein the policy agent further implements a policy measure to address an actual or potential policy or rule violation and wherein the policy measure comprises at least one of the following:

modification of an existing security measure for the one or more of the selected communication and/or content,

implementation of a new and/or additional security measure for the one or more of the selected communication and/or content,

use of a different network path and/or channel than currently chosen to effect transmission or transfer of the one or more of the selected communication and/or content ,

block, delay, and/or buffer the one or more of the selected communication and/or content,

embed a flag indicating an area of redundant and processor intensive encryption or security transcoding,

prevent access of the one or more of the selected communication and/or content by one or more selected parties,

prevent a subscriber from selecting the one or more of the selected content into a communication,

provide read-only access to the one or more of the selected communication and/or content,

set a hop restriction on the one or more of the selected communication and/or content whereby, when the hop restriction is met or exceeded and/or a hop counter is incremented or decremented to a selected value, the one or more of the selected communication and/or content is dropped or otherwise prohibited from delivery to an intended recipient,

tear down a communication channel before transmission of the one or more of the selected communication and/or content,

redirect the one or more of the selected communication and/or content to a different destination, and

display different portions of the one or more of the selected communication and/or content to different selected parties based on a respective degree of trust or privilege of each party.