POLICY ENFORCEMENT IN A SECURE DATA FILE DELIVERY SYSTEM

• US 20170230423A1
• Filed: 02/20/2017
• Published: 08/10/2017
• Est. Priority Date: 03/31/2000
• Status: Active Grant

• Current Assignee: Axway Incorporated (Axway Software SA)
• Original Assignee: Axway Incorporated (Axway Software SA)
• Inventors: Smith, Jeffrey C., Bandini, Jean-Christophe Denis
• Granted Patent: US 10,362,063 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/62 Establishing a time schedule for servicing the requests
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A server interacts with a sender to form a package which can include one or more attached data files to be sent to one or more recipients, and the server applies a policy established by a policy authority of the sender to the package. Since the server both forms the package through interaction with the sender and applies the policy, violations of the policy by the package can be brought to the sender'"'"'s attention during an interactive session with the sender and before encryption of all or part of the package. As a result, the sender is educated regarding the policy of the sender'"'"'s policy authority, and the sender can modify the package immediately to comport with the policy. The server delivers the package to intended recipients by sending a notification to each recipient and including package identification data, e.g., a URL by which the package can be retrieved.

Claims

1. (canceled)

2. A method for enforcing policy upon a package to be delivered from a sender to a set of recipients through a computer network, including:

receiving package data which is generated by the sender;

searching a database for a user record corresponding to the sender, the user record specifying a group to which the sender belongs, wherein a first rule applies to the package if the sender belongs to a first group of senders, but not to a second group of senders, and a second rule applies to the package if the sender belongs to the second group of senders, but not to the first group of senders;

applying the first rule to the package;

applying a third rule to the package, wherein the third rule applies to the package if a recipient of the package belongs to a first group of recipients, but not to a second group of recipients, and a fourth rule applies to the package if the recipient belongs to the second group of recipients, but not to the first group of recipients; and

upon a condition in which the policy permits delivery of the package, delivering the package to a recipient of the package.

3. The method of claim 2, wherein the database stores one or more entries, each entry including a mapping of an e-mail address to a user record.

4. The method of claim 2, wherein a policy is specified as a list of associations between one or more conditions and one or more actions to be carried out upon satisfaction of the associated conditions.

5. The method of claim 4, wherein a condition specifies one or more delivery attributes.

6. The method of claim 5, wherein a delivery attribute specifies a relative priority of the package.

7. The method of claim 5, wherein a delivery attribute specifies whether a recipient notification is to be sent to the sender.

8. The method of claim 5, wherein a delivery attribute specifies a time at which to deliver the package.

9. The method of claim 5, wherein a delivery attribute specifies a time at which package expires.

10. The method of claim 5, wherein a delivery attribute specifies whether a sender-specified password is required to retrieve the package.

11. The method of claim 5, wherein a delivery attribute specifies whether an account password is required to retrieve the package.

12. The method of claim 11, wherein the account password is specified in the database.

13. The method of claim 2, wherein the policy permits delivery of the package to a first group of recipients of the package, but not to a second group of recipients of the package.

14. The method of claim 13, including:

blocking delivery of the package for all recipients of the package if the package is blocked for at least one recipient of the package.

15. The method of claim 13, wherein the package is delivered to the first group of recipients, but not to the second group of recipients.

16. The method of claim 13, including:

bifurcating the package in accordance with the first and second groups of recipients.

17. The method of claim 16, wherein bifurcating the package includes duplicating the package and storing the first group of recipients in a recipients field of the package.

18. The method of claim 17, wherein bifurcating the package further includes storing the second group of recipients in a recipients field of the other package.

19. The method of claim 17, wherein a condition associated with the third rule is a recipient-specific rule.

20. A non-transitory computer program product encoded in one or more media, the computer program product including codes executable on one or more processors of a service platform to cause the service platform to perform a method including:

receiving package data which is generated by the sender;

searching a database for a user record corresponding to the sender, the user record specifying a group to which the sender belongs, wherein a first rule applies to the package if the sender belongs to a first group of senders, but not to a second group of senders, and a second rule applies to the package if the sender belongs to the second group of senders, but not to the first group of senders;

applying the first rule to the package;

applying a third rule to the package, wherein the third rule applies to the package if a recipient of the package belongs to a first group of recipients, but not to a second group of recipients, and a fourth rule applies to the package if the recipient belongs to the second group of recipients, but not to the first group of recipients; and

upon a condition in which the policy permits delivery of the package, delivering the package to a recipient of the package.