Secure Document Sharing

• US 20160070812A1
• Filed: 09/05/2014
• Published: 03/10/2016
• Est. Priority Date: 09/05/2014
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Murphy, Gerard, Mendez, Marcos, McElrath, Jason
• Granted Patent: US 11,061,991 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/986 Document structures and storage, e.g. HTML extensions
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 40/106 Display of layout of documents; Previewing
• CPC Class Codes: G06F 40/154 Tree transformation for tree-structured or markup documents, e.g. XSLT, XSL-FO or stylesheets
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Disclosed are various embodiments for sharing documents among users of an enterprise as well as with users external to an enterprise. A document is identified and document components extracted from the document. A browser representation is generated that, when rendered or interpreted by a browser, causes the browser to generate a user interface that presents at least a portion of the document as the document would be viewed by a native viewer.

Claims

7-1. The method of claim 15, wherein the document representation comprises at least one of:

a plain text version of the document, a browser specific version of the document, or an extensible markup language (XML) document object model (DOM) representing the content of the document.

15. A method, comprising:

obtaining, in at least one computing device, a request to share a document initiated on behalf of a user corresponding to a user account in an enterprise, the document being stored in a document file format;

extracting, by the at least one computing device, a platform-independent representation of the document defining a visual layout of content of the document and a logical structure of the content of the document;

identifying, by the at least one computing device, a compliance rule associated with the request to share the document;

generating, by the at least one computing device, a document representation of the document based at least in part upon the compliance rule and platform-independent representation of the document, the document representation further comprising a security restriction restricting use of content of the at least a portion of the document represented in the document representation specified by the compliance rule; and

transmit, from the at least one computing device, a reference to the document representation of the document to a destination specified by the request to share the document.

1. A non-transitory computer-readable medium embodying a program executable in a computing device, the program, when executed by the computing device, being configured to cause the computing device to at least:

obtain a request to share a document initiated on behalf of a user corresponding to a user account in an enterprise, the document being stored in a document file format;

identify a compliance rule associated with at least one of the user or the document;

determine whether the compliance rule specifies that the document must be converted from document file format into a another format before the requests permitted;

in response to a determination that the compliance rule specifies that the document must be converted from the document file format into another format;

extract a document layout and a document structure from the document, the document layout defining a visual layout of content of the document and the document structure defining a logical structure of the content of the document;

generate a document representation of the document based at least in part upon the compliance rule, the document layout and the document structure, the document representation comprising at least one of;

at least one image representing the document or hypertext markup language (HTML) elements configured to cause a browser to draw a representation of the document;

identify a destination associated with the request to share the document, the destination comprising at least one of a particular device to which the document is shared, an email address or a user identifier associated with another user in the enterprise; and

transmit a reference to the document representation of the document to the destination.

2. The non-transitory computer-readable medium of claim 1, wherein the program inserts at least one security restriction configured to cause the computing device to at least:

associate the browser representation with a cascading style sheet, the cascading style sheet having a print layout varying from a screen layout that restricts printing of the content of the document.

3. The non-transitory computer-readable medium of claim 2, wherein the print layout hides or obfuscates textual content associated with the content of the document.

4. The non-transitory computer-readable medium of claim 1, wherein the program inserts at least one security restriction configured to cause the computing device to at least:

insert client-side code executed by a browser configured to restrict a copy or a cut capability of a browser.

5. The non-transitory computer-readable medium of claim 4, wherein the client-side code comprises a scripting language interpreted by the browser.

6. The non-transitory computer-readable medium of claim 1, wherein the program code inserts at least one security restriction configured to cause the computing device to at least generate a watermark layer that is overlaid onto the content of the document in the browser representation.

7. A system, comprising:

at least one computing device;

programming code executable in the at least one computing device, the programming code comprising;

logic that obtains a request to share a document initiated on behalf of a user corresponding to a user account in an enterprise, the document being stored a document file format;

logic that identifies a document layout and a document structure from the document, the document layout defining a visual layout of content of the document and the document structure defining a logical structure of the content of the document;

logic that identifies at least one compliance rule associated with the request to share the document on behalf of the user;

logic that generates a document representation of the document in response to determining that the at least one compliance rule specifies that the request requires generation of the document representation, the document representation based at least in part upon the document layout and the document structure, the document representation comprising at least one of at least one image representing at least a portion of the document or hypertext markup language (HTML) elements configured to cause a browser to draw a representation of the at least a portion of the document, the document representation further comprising a security restriction restricting use of the content of the at least a portion of the document represented in the document representation, wherein a reference to the document representation is transmitted to a destination specified by the request; and

logic that transmits a copy of the document to the destination associated with the request in response to determining that the at least one compliance rule specifies that the copy of the document can be transmitted to the destination.

8. The system of claim 7, wherein the document representation further comprises client-side code configured to transmit to the at least one computing device a request indicating a requested portion of the document to be placed within the document representation.

9. The system of claim 8, wherein the logic that generates the document representation further comprises:

logic that identifies the at least a portion of the document;

logic that generates the at least one image representing a requested page of a body of the document;

logic that generates at least one other image corresponding to a header of the document and a footer of the document; and

wherein the client-side code is configured to request another image corresponding to another requested page of the body of the document in response to a user navigation to another page of the document.

10. The system of claim 7, wherein the HTML elements facilitate rendering of two-dimensional graphics within a user interface of a client device rendering the document representation.

11. The system of claim 10, wherein the HTML elements comprise at least one canvas element and client-side code accompanying the at least one canvas element configured to draw the representation of the at least a portion of the document based at least in part upon the document layout and the document structure.

17. The system of claim 11, wherein the at least one canvas element specifies at least one font associated with the document.

13. The system of claim 7, wherein the security restriction comprises client-side code restricting a copy function or a cut function of a browser rendering the document representation.

14. The system of claim 7, wherein the security restriction comprises a watermark overlaid onto the content of the at least a portion of the document in the document representation.

16. The method of claim 15, wherein the security restriction comprises a watermark layer overlaid onto the content of the at least a portion of the document in the document representation of the document, the watermark layer being unique with respect to other watermarks.

18. The method of claim 15, wherein the document representation comprises client-side code configured to request a portion of the document being displayed by an application rendering the document representation, wherein a remainder of the document is stored remote from the application rendering the document representation.

19. The method of claim 15, wherein generating the document representation further comprises redacting, by the at least one computing device, certain content in the document.

20. The method of claim 15, wherein redacting certain content comprises redacting text matching a particular regular expression.