SYSTEMS, METHODS, AND APPARATUS FOR SECURING USER DOCUMENTS

• US 20110307960A1
• Filed: 06/08/2011
• Published: 12/15/2011
• Est. Priority Date: 06/11/2010
• Status: Active Grant

• Current Assignee: D2L Corporation
• Original Assignee: D2L Corporation
• Inventors: Cepuran, Brian John, McMillan, Daryl, Lockhart, David, Grabka, Dariusz
• Granted Patent: US 9,465,935 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The invention is directed to systems, methods and apparatus for securing documents. The system comprises a server having a processor and a data storage device for storing documents, at least one document provider connected to the server, the at least one document provider operable to provide user documents to the server for storage in the data storage device, the user documents containing at least one object of security concern, and at least one document consumer connected to the server, the at least one document consumer operable to receive the user documents containing the at least one object of security concern from the server. The processor in the server is operable to determine whether to provide the at least one object of security concern to the at least one document consumer based on at least one security setting, and based on the decision either provide the documents with the at least one object of security concern or provide a replacement documents without the security of concern and an indication on each replacement document that that the at least one object of security concern has been excluded.

Claims

1. A system for securing documents comprising:

a) a server having at least one processor and at least one data storage device for storing documents;

b) at least one document provider connected to the server, the at least one document provider operable to provide at least one user document to the server for storage in the at least one data storage device, the at least one user document containing at least one object of security concern; and

c) at least one document consumer connected to the server, the at least one document consumer operable to receive the at least one user document containing the at least one object of security concern from the server;

d) wherein the at least one processor in the server is operable to;

i) determine whether to provide the at least one object of security concern to the at least one document consumer based on at least one security setting;

ii) if it is determined that the at least one object of security concern should be provided, provide the at least one user document with the at least one object of security concern to the at least one document consumer, and

iii) if it is determined that the at least one object of security concern should not be provided, then;

(1) generate at least one replacement document containing the at least one user document without the at least one object of security concern and including an indication that the at least one object of security concern has been excluded, and

(2) provide the at least one replacement document to the at least one document consumer.

2. The system according to claim 1, wherein the at least one security setting includes at least one centralized list managed by the server.

3. The system according to claim 2, wherein the at least one centralized list comprises a black list indicative of a list of objects of security concern that should not be provided to the at least one document consumer.

4. The system according to claim 2, wherein the at least one centralized list comprises a white list indicative of a list of objects of security concern that should be provided to the at least one document consumer.

5. The system according to claim 2, wherein the at least one centralized list is applicable to all user documents provided by the at least one document provider.

6. The system according to claim 1, wherein the at least one processor in the server is further operable to provide a screening document containing information about the at least one object of security concern such that at least one user of the at least one document consumer is able to use that information to assess security risk associated with the object of security concern, and at least one option for the at least one user to provide preference information to the server indicative of whether to provide the object of security concern to the at least one document consumer.

7. The system according to claim 6, wherein the at least one data storage device in the server has at least one user profile associated with the at least one user and the at least one processor is further operable to:

a) associate the preference information provided by the at least one user to the server indicative of whether to provide the at least one object of security concern with the at least one user profile; and

b) store the preference information in the at least one data storage device.

8. The system according to claim 7, wherein the at least one security setting comprises at least one centralized list, and the at least one processor is further operable to:

a) modify the at least one centralized list for the at least one user based on the preference information provided by the at least one user in response to the screening document;

b) associate the modified centralized list with the at least one user profile; and

c) store the modified centralized list in the at least one storage device.

9. The system according to claim 6, wherein the information contained in the screening document comprises a non-executable rendering of the object of security concern.

10. The system according to claim 9, wherein the non-executable rendering of the object of security concern comprises at least one of:

a) an image representation of the object of security concern;

b) if the object of security concern comprises instructions executable by the at least one document consumer, then text of the instructions; and

c) information about the at least one document provider that provided the at least one user document containing the at least one object of security concern.

11. The system according to claim 6, wherein the screening document further comprises at least one other option for the at least one user to indicate a scope of applicability of the information provided to the server, the scope of applicability being indicative of when the server should apply the information provided by the at least one user to determine whether to provide the object of security concern.

12. The system according to claim 10, wherein the scope of applicability includes at least one of:

a) applicability for a current session;

b) applicability for the at least one document consumer from that point on;

c) applicability for a particular external domain referenced in the at least one user document;

d) applicability for a particular document provider; and

e) applicability for a particular type of object of security concern.

13. The system according to claim 10, wherein the data storage device in the server has at least one user profile associated with the at least one user, and the at least one processor is further operable to:

a) associate the scope of applicability provided by the at least one user with the at least one user profile; and

b) store the scope of applicability in the at least one data storage device.

14. The system according to claim 2, wherein the server manages information relating to the centralized list based on intrinsic information obtained by the at least one processor from the at least one user document provided.

15. The system according to claim 14, wherein the intrinsic information obtained by the at least one processor from the at least one user document comprises at least one of:

a) a source of the at least one user document;

b) a type of the at least one user document;

c) a type of the at least one object of security concern contained in the at least one user document; and

d) when the at least one object of security concern contains at least one reference to another document, then information about the document that is referenced.

16. The system according to claim 2, wherein the server centrally manages information relating to the centralized list based on location information indicative of the location in the server to which the at least one user document is provided.

17. The system according to claim 6, wherein the server centrally manages information relating to the centralized list based on extrinsic information provided by one or more users in response to one or more screening documents.

18. The system according to claim 1, wherein the at least one object of security concern comprises at least one of:

a) instructions executable by the at least one document consumer in JavaScript language;

b) instructions executable by the at least one document consumer to obtain information from an external domain.

19. A server for securing documents comprising:

a) at least data storage device for storing a plurality of user documents, at least one of the user documents containing at least one object of security concern;

b) at least one network device for connecting to at least one document provider and at least one document consumer, the at least one document provider operable to provide at least one of the user documents to the server, the at least one document consumer operable to receive at least one of the plurality of user documents from the server;

c) at least one processor coupled to the at least one data storage device and the at least one network device, the at least one processor in the server is operable to;

i) determine whether to provide the at least one object of security concern in the at least one of the user documents concern to the at least one document consumer based on at least one security setting;

ii) if it is determined that the at least one object of security concern should be provided, then provide the at least one user document with the at least one object of security concern to the at least one document consumer, and

iii) if it is determined that the at least one object of security concern should not be provided, then generate at least one replacement document containing the at least one user document without the at least one object of security concern and an indication that the at least one object of security concern has been excluded, and provide the at least one replacement document to the at least one document consumer.

20. A method for securing documents at a server having at least one server processor and at least one data storage device comprising:

a) receiving at least one document from at least one document containing at least one object of security concern;

b) storing the at least one document in at least one data storage device;

c) using the at least one server processor to determine whether to provide the at least one object of security concern to at least one document consumer based on at least one security setting;

d) if it is determined that the at least one object of security concern should be provided, then using the at least one server processor to provide the at least one document with the at least one object of security concern to the at least one document consumer; and

e) if it is determined that the at least one object of security concern should not be provided, then using the at least one server processor to generate at least one replacement document containing the at least one document without the at least one object of security concern and further containing an indication that the at least one object of security concern has been excluded, and providing the at least one replacement document to the at least one document consumer.

21. The method according to claim 20, wherein the at least one security setting includes at least one centralized list managed by the server, the at least one centralized list comprising a black list indicative of a list of objects of security concern that should not be provided to the at least one document consumer.

22. The method according to claim 20, wherein the at least one security setting includes at least one centralized list managed by the server, the at least one centralized list comprising a white list indicative of a list of objects of security concern that should be provided to the at least one document consumer.

23. A non-transitory computer readable medium comprising instructions executable by a processor to cause the processor to:

a) receive at least one document containing at least one object of security concern from at least one document provider;

b) store the at least one document in at least one storage device;

c) determine whether to provide the at least one object of security concern to at least one document consumer based on at least one security setting;

d) if it is determined that the at least one object of security concern should be provided, then provide the at least one document with the at least one object of security concern to the at least one document consumer; and

e) if it is determined that the at least one object of security concern should not be provided, then generate at least one replacement document containing the at least one document without the at least one object of security concern and an indication that the at least one object of security concern has been excluded, and provide the replacement document to the at least one document consumer.