DYNAMICALLY UPDATED SECURE HANDLING OF DOCUMENTS CONTAINING RESTRICTED INFORMATION

• US 20120047552A1
• Filed: 07/25/2011
• Published: 02/23/2012
• Est. Priority Date: 11/23/2005
• Status: Abandoned Application

• Current Assignee: Beyondcore Holdings, Llc
• Original Assignee: BeyondCore, Inc. (Salesforce.com, Inc.)
• Inventors: Sengupta, Arijit, Stronger, Brad A.
• Application Number:
  US13/190,372
• Publication Number:
  US 20120047552A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method, system and computer program product for processing documents containing restricted information. One aspect concerns updating the relevant information security rules applicable to the documents.

Claims

1. A computer-implemented method for securely handling one or more documents, the method comprising software executing on a computer system to execute the steps of:

segmenting the documents into critical sections, sub-critical sections and/or non-critical sections;

each critical section containing data that is defined by initial information security rules as individually corresponding to restricted information, each sub-critical section containing data that is defined by initial information security rules as individually not corresponding to restricted information but collectively with other sub-critical sections as corresponding to restricted information, each non-critical section containing data that is defined by initial information security rules as not corresponding to restricted information, the initial information security rules determined according to an initial set of relevant jurisdictions;

handling the critical sections at secure location(s);

handling the sub-critical and/or non-critical sections at minimally secure location(s);

when a new jurisdiction becomes relevant, updating the information security rules according to the new jurisdiction; and

adjusting handling of the sections according to the updated information security rules.

2. The method of claim 1 wherein the initial information security rules are determined at least in part according to where the sections are initially processed and stored.

3. The method of claim 1 wherein the initial information security rules are determined at least in part according to where the sections were originated and where they are stored.

4. The method of claim 1 wherein the initial information security rules are determined at least in part according to a citizenship and/or nationality of individuals originating the sections.

5. The method of claim 1 wherein the initial information security rules are determined at least in part according to a citizenship and/or nationality of individuals processing the sections.

6. The method of claim 1 wherein the initial information security rules are determined at least in part according to a citizenship and/or nationality of individuals whose restricted information is contained in the sections.

7. The method of claim 1 wherein the sections are accessed from the new jurisdiction, where the new jurisdiction is different from where the sections originated and where the sections are stored.

8. The method of claim 7 wherein the step of adjusting handling of the sections comprises preventing access to restricted information from the new jurisdiction according to the updated information security rules.

9. The method of claim 7 wherein the step of adjusting handling of the sections comprises modifying the request for access according to the updated information security rules.

10. The method of claim 1 further comprising:

tracking access to sub-critical sections; and

preventing access to sub-critical sections in a manner that would allow recombination of the accessed sub-critical sections into a critical section.

11. A system implemented on a computer for securely handling one or more documents, the system comprising:

a document-dividing module, for segmenting the documents into critical sections, sub-critical sections and/or non-critical sections;

each critical section containing data that is defined by initial information security rules as individually corresponding to restricted information, each sub-critical section containing data that is defined by initial information security rules as individually not corresponding to restricted information but collectively with other sub-critical sections as corresponding to restricted information, each non-critical section containing data that is defined by initial information security rules as not corresponding to restricted information, the initial information security rules determined according to an initial set of relevant jurisdictions;

wherein the critical sections are handled at secure location(s), and the sub-critical and/or non-critical sections are handled at minimally secure location(s); and

a rules determination module for, when a new jurisdiction becomes relevant, updating the information security rules according to the new jurisdiction;

wherein handling of the sections is adjusted according to the updated information security rules.

12. A computer program product for use with a computer, the computer program product comprising a tangible computer usable medium having a computer program code embodied therein for securely handling one or more documents, the computer program code performing the steps of:

segmenting the documents into critical sections, sub-critical sections and/or non-critical sections;

each critical section containing data that is defined by initial information security rules as individually corresponding to restricted information, each sub-critical section containing data that is defined by initial information security rules as individually not corresponding to restricted information but collectively with other sub-critical sections as corresponding to restricted information, each non-critical section containing data that is defined by initial information security rules as not corresponding to restricted information, the initial information security rules determined according to an initial set of relevant jurisdictions;

handling the critical sections at secure location(s);

handling the sub-critical and/or non-critical sections at minimally secure location(s);

when a new jurisdiction becomes relevant, updating the information security rules according to the new jurisdiction; and

adjusting handling of the sections according to the updated information security rules.