Document Security in Enterprise Content Management Systems

• US 20150220743A1
• Filed: 02/04/2014
• Published: 08/06/2015
• Est. Priority Date: 02/04/2014
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Avery, Kenytt D., Costecalde, Jean-Marc, Harnick-Shapiro, David B.
• Granted Patent: US 10,380,352 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/21 Design, administration or maintenance of databases
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Methods and apparatus, including computer program products, implementing and using techniques for enhancing the security of content in a records management system. A document is received to be stored as a record in the records management system. A unique combination of an encryption key and encryption parameters is selected for the document. The encryption key and encryption parameters are stored on a server that is different from a server upon which the document is to be stored in the records management system. The document is encrypted using the selected unique combination of encryption key and encryption parameters. The encrypted document is stored in the records management system.

Claims

1-7. -7. (canceled)

8. A computer program product for enhancing the security of content in a records management system, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code being executable by a processor to perform a method comprising:

receiving a document to be stored as a record in the records management system;

selecting a unique combination of an encryption key and encryption parameters for the document, the encryption key and encryption parameters being stored on a server that is different from a server upon which the document is to be stored in the records management system;

encrypting the document using the selected unique combination of encryption key and encryption parameters; and

storing the encrypted document in the records management system.

9. The computer program product of claim 8, wherein the server storing the encryption key and encryption parameters is located in a different physical location from the server upon which the document is stored in the records management system.

10. The computer program product of claim 8, wherein the server on which the document is stored and the server on which the encryption key and encryption parameters is stored use different security settings.

11. The computer program product of claim 8, further comprising program code executable by the processor to perform a the following operations:

receiving a user request to view the contents of a record;

determining whether the document corresponding to the record is encrypted; and

in response to determining that the requested document is encrypted;

retrieving the encryption key and the encryption parameters for the record;

using the retrieved encryption key and encryption parameters to decrypt the document; and

displaying the document.

12. The computer program product of claim 8, wherein the encryption parameters include one or more of:

an encryption algorithm, a block cipher mode, and a key length.

13. The computer program product of claim 8, wherein the encryption parameters are based on a specified classification level for the document.

14. The computer program product of claim 11, further comprising program code executable by the processor to perform a the following operations:

encrypting the document using a different unique combination of encryption key and encryption parameters; and

storing the encrypted document in the records management system.

15. A records management system, comprising:

a first server, the first server including one or more documents and a record corresponding to each document;

a second server, the second server including one or more encryption keys and one or more encryption parameters for the one or more documents that are stored on the first server;

a processor; and

a memory storing instructions that when executed by the processor causes the processor to;

receive a document to be stored as a record in the records management system;

select a unique combination of an encryption key and encryption parameters for the document from the second server;

encrypt the document using the selected unique combination of encryption key and encryption parameters; and

store the encrypted document on the first server.

16. The system of claim 15, wherein the first server and the second server are located in different physical locations.

17. The system of claim 15, wherein the first server and the second server use different security settings.

18. The method of claim 15, wherein the encryption parameters include one or more of:

an encryption algorithm, a block cipher mode, and a key length.

19. The method of claim 15, wherein the encryption parameters are based on a specified classification level for the document.