System and method for controlling access to documents stored on an internal network

• US 6,640,307 B2
• Filed: 12/01/2000
• Issued: 10/28/2003
• Est. Priority Date: 02/17/1998
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Greve, Paula Budig, Herberg, Wayne W., Motes, David G., Viets, Richard R.
• Primary Examiner(s): Gaffin, Jeffrey
• Assistant Examiner(s): Nguyen, Tanh Q
• Application Number:
  US09/728,775
• Publication Number:
  US 20020091532A1
• Time in Patent Office: 1,061 Days
• Field of Search: 713/201, 713/200, 709/225
• US Class Current: 726/15
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method of limiting access from an external network to documents stored on an internal network. A client list is built in which each client is assigned to one or more roles. Each role has access to one or more documents as defined on a document list. A request from an external network is reviewed and, if possible, the request is associated with a client on the client list. The requested document is then compared to the document list associated with the client'"'"'s role and, if the requested document is in the list of documents available to a client in the client'"'"'s role, the requested document is fetched, cleaned and sent to the client.

Claims

1. A method of limiting access from an external network to documents stored on an internal network, the method comprising the steps of:

building a client list, wherein the step of building a client list includes the step of assigning each client to a role;

building a document list naming documents available to clients assigned to the client'"'"'s role;

receiving a request for a document stored on the internal network;

associating the request with a client;

comparing the requested document to the documents available on the document list; and

if the requested document is in the list of documents available to a client in the client'"'"'s role, fetching the requested document as a proxy and sending the requested document to the client.

2. The method according to claim 1, wherein each document has a unique URL and wherein the document list includes the URL of each available document, wherein the step of comparing includes the step of determining if the URL of the requested document is included in the document list.

3. The method according to claim 2, wherein the step of building the document list includes the step of displaying available documents in a tree structure within a graphical user interface, wherein the step of displaying includes the step of querying a document control server to obtain a current version of the document list.

4. The method according to claim 1, wherein the step of associating the request with a client includes the step of authenticating the client.

5. The method according to claim 4, wherein each document has a unique URL and wherein the document list includes the URL of each available document, wherein the step of comparing includes the step of determining if the URL of the requested document is included in the document list.

6. The method according to claim 5, wherein the step of building the document list includes the step of displaying available documents in a tree structure within a graphical user interface, wherein the step of displaying includes the step of querying a document control server to obtain a current version of the document list.

7. A document control system, including:

an internal network;

an external interface;

a document server connected to the internal network, wherein the document server controls access to a plurality of documents, including a first document; and

a document control server connected to the internal network and to the external interface, wherein the document control server receives a document request from the external interface for the first document, determines a user associated with the document request and authenticates the user, wherein the document control server includes a go list processor for determining if the user has authorization to access said first document and a document processor for reading the first document from the document server, cleaning the first document and forwarding a clean version of said first document to the user.

8. The document control system according to claim 7, wherein the external interface includes a firewall connected to an external network.

9. The document control system according to claim 7, wherein the document processor acts as a proxy to hide access to the first document.

10. The document control system according to claim 7, wherein the external interface includes a telephone interface into which a business partner can dial to gain access to the document control server.

11. A document control system, including:

an internal network;

an external interface;

a document server connected to the internal network, wherein the document server controls access to a plurality of documents, including a first document;

a document control server connected to the internal network and to the external interface; and

a data owner interface for building a document list of available documents;

wherein the document control server receives a document request from the external interface for the first document, determines a user associated with the document request and authenticates the user; and

wherein the document control server includes a go list processor for determining, based on the document list, if the user has authorization to access said first document.

12. The document control system according to claim 11, wherein the data owner interface includes a graphical user interface which displays the document list in a tree structure, wherein the graphical user interface queries the document control server to obtain a current version of the document list.

13. The document control system according to claim 11, wherein the document control server further includes a document processor for reading the first document from the document server, cleaning the first document and forwarding a clean version of said first document to the user.

14. The document control system according to claim 13, wherein the document processor acts as a proxy to hide access to the first document.

15. The document control system according to claim 14, wherein the data owner interface includes a graphical user interface which displays the document list in a tree structure, wherein the graphical user interface queries the document control server to obtain a current version of the document list.

16. The document control system according to claim 11, wherein the external interface includes a firewall connected to an external network.

17. The document control system according to claim 11, wherein the external interface includes a telephone interface into which a business partner can dial to gain access to the document control server.