Protecting Information Using Policies and Encryption

• US 20130097421A1
• Filed: 04/04/2012
• Published: 04/18/2013
• Est. Priority Date: 04/04/2011
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Nextlabs
• Inventors: Lim, Keng
• Granted Patent: US 8,843,734 B2
• Time in Patent Office: Days
• US Class Current: 713/167
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

A technique and system protects documents at rest and in motion using declarative policies and encryption. Encryption in the system is provided transparently and can work in conjunction with policy enforcers installed at a system. A system can protect information or documents from: (i) insider theft; (ii) ensure confidentiality; and (iii) prevent data loss, while enabling collaboration both inside and outside of a company.

Claims

1. A method comprising:

providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers;

at a first client, executing a first policy enforcer program;

at the first client, trapping by the first policy enforcer program a request by an e-mail application to send an e-mail with a document attachment, managed by the document management system, to a second client;

at the first policy enforcer program, evaluating at least one policy associated with document attachment;

as a result of the evaluating, determining that the send request is allowed, but before allowing to e-mail application to send the document attachment, encrypting the document attachment; and

allowing to e-mail application to send the encrypted document attachment to the second client.

2. The method of claim 1 wherein the document attachment is unencrypted.

3. The method of claim 1 wherein the at least one policy associated with document attachment is stored at the first client.

4. The method of claim 1 wherein the document attachment is encrypted by an encryption module executing on the first client, the encryption module is separate from the policy enforcer program.

5. The method of claim 1 comprising:

receiving the encrypted document attachment at the second client;

detecting an attempt to open the encrypted document attachment at the second client at a second policy enforcer program at the second client;

at the second policy enforcer program, evaluating at least one policy associated with encrypted document attachment;

as a result of the evaluating, determining that the open operation is allowed;

at an encryption module executing on the second client, determining the encrypted document attachment is encrypted;

at an encryption module, attempting to obtain a key for the encrypted document attachment by sending a key request to the second policy enforcer program including information comprising a process identifier;

at the second policy enforcer program, receiving the key request from the encryption module and evaluating the request based on the information comprising a process identifier;

when the process identifier matches a previously saved process identifier, at the second policy enforcer program, sending a request to a key server of the document management system;

after receiving a key from the key server at the second client, passing the key to the encryption module; and

at the encryption module, using the received key in unencrypting of the encrypted document attachment to obtain the unencrypted document attachment.