Apparatus and method for assuring compliance with distribution and usage policy

• US 7,669,225 B2
• Filed: 05/06/2004
• Issued: 02/23/2010
• Est. Priority Date: 05/06/2003
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: PortAuthority Technologies, Inc. (Forcepoint LLC)
• Inventors: Troyansky, Lidror, Peled, Ariel, Lupo, Guy
• Primary Examiner(s): Kim; Jung
• Assistant Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US10/839,147
• Publication Number:
  US 20040255147A1
• Time in Patent Office: 2,119 Days
• Field of Search: 726/1, 726/26, 726/30, 726/21, 708/132, 708/135, 705/18, 705/21, 705/39, 705/57, 709231-232
• US Class Current: 726/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]

Abstract

A method and apparatus for providing multi-domain control over a digital data item via a first domain security policy assigned to the digital data item at a first domain, the data item being transferred from the first domain to a second domain, the second domain being autonomous from the first domain in respect of security policies. The method comprises assigning the security policy to the digital item within the first domain; transferring the digital items to the second domain together with data defining the first domain security policy; analyzing the first domain security policy within the second domain; and distributing and/or allowing usage of the digital items within the second domain in accordance with analyzed first domain security policy, and/or reporting breaches or attempted breaches of the policy.

Claims

1. A method for providing multi-domain control over a digital data item via a first domain data item specific security policy assigned to said digital data item at a first domain, said digital data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, the method comprising:

assigning a digital data item specific security policy to said digital data item within said first domain, said digital data item specific security policy being applied in accordance with a first domain security policy operational within said first domain;

transferring said digital items to said second domain together with additional data defining said digital data item specific first domain security policy, said second domain having a second domain security policy operational within said second domain, said first and second domain security policies being autonomously defined;

analyzing said first digital data item specific first domain security policy within said second domain in respect of said digital data item; and

performing at least one of distributing and allowing usage of said digital item within said second domain in accordance with said analyzed digital data item specific first domain security policy, so as to provide control of said digital data item in said autonomous second domain in accordance with said digital data item specific security policy of said first domain.

2. A method according to claim 1 wherein said analyzing said policy comprises assurance of the integrity of the policy and the content.

3. A method according to claim 1, wherein assigning said first domain security policy to said digital item within said first domain comprises determining a legitimacy of at least one of the following:

a set of authorized recipients;

a set of authorized usages;

a set of allowed formats;

a set of allowed distribution channels, and

a required action.

4. A method according to claim 3, wherein said required action comprises at least one of the following:

preventing distribution of said digital item;

preventing storage of said digital item;

preventing usage of said digital item;

reporting distribution of said digital item;

reporting storage of said digital item;

reporting usage of said digital item;

reporting;

alerting about distribution of said digital item;

alerting storage of said digital item;

alerting usage of said digital item;

alerting;

logging distribution of said digital item;

logging storage of said digital item;

logging usage of said digital item;

logging;

notifying about distribution of said digital item;

notifying about storage of said digital item;

notifying about usage of said digital item;

notifying;

notifying to an administrator;

notifying to a manager;

notifying to a recipient;

notifying to a sender;

notifying to an owner of said digital item;

quarantine;

alerting an administrator;

alerting a manager;

alerting a recipient;

alerting a sender;

alerting an owner of said digital item;

reporting to an administrator;

reporting to a manager;

reporting to a recipient;

reporting to a sender;

reporting to an owner of said digital item;

encrypting said digital item;

changing said digital item;

replacing an information object with said digital data item; and

utilizing digital rights management technology on said digital item.

5. A method according to claim 3, wherein applying said required action comprises blocking the transmission of the respective item to unauthorized recipients.

6. A method according to claim 1 further comprising sending to said first domain a notification regarding the distribution of said digital item within said second domain.

7. A method according to claim 1, wherein said analyzing said digital data item specific policy within said second domain comprises comparing said digital data item specific policy assigned to said digital item within said first domain to said second domain security policy, so as to obtain a resulting policy for application to said digital item within said second domain.

8. A method according to claim 7, wherein applying said resulting policy within said second domain comprises controlling at least one of a distribution of said item and a usage of said item.

9. A method according to claim 1 further comprising assigning said first domain digital data item specific policy based on information content of said digital item.

10. A method according to claim 8 further comprising monitoring at least one of the distribution and usage of the information content of said digital item within said second domain.

11. A method according to claim 8 further comprising enforcing a at least one of a distribution and a usage policy on the information content of said digital item within said second domain.

12. A method according to claim 11, wherein said enforcing a distribution policy on the information content of said digital item within said second domain comprises enforcing a distribution policy with respect to said second domain email traffic.

13. A method according to claim 7, further comprising providing a negotiation stage of negotiating between said first domain and said second domain in case said first domain security policy assigned to said digital item at said first domain does not comply with policy rules that apply within said second domain.

14. A method according to claim 1, further comprising reporting of attempts of breaches of any of said policies.

15. A method according to claim 1, further comprising utilizing an arbitrator for resolutions of conflicts, said arbitrator being independent of both said first domain and said second domain.

16. A method according to claim 15, wherein said arbitrator utilizes accumulated results of similar negotiations from the same or similar organizations as precedents and resolves said conflicts based on such precedents.

17. A method according to claim 1, further comprising utilizing an assurance authority for assuring the execution of said distribution policy, said assurance authority being independent of said first domain and said second domain and comprising assurance functionality to render trust at both said first and said second domain.

18. A method according to claim 17, wherein said assurance functionality establishes trust between said first and second domain using a shared secret.

19. A method according to claim 17, wherein the trust between said first and second domain is established using public-key infrastructure.

20. A method according to claim 1, further comprising utilizing a trustee for auditing compliance of said second domain with said first domain security policy at said first domain.

25. A method according to claim 7, wherein, in a case in which said second domain does not accept said policy of said first domain, said distribution or usage of said digital within said second domain is prohibited.

26. A method according to claim 7, wherein in case in which said second domain does not accept said a policy of said first domain, said distribution or usage of said digital item within said second domain is restricted.

27. A method according to claim 3 wherein said usage comprise comprises at least one of the following:

Storage;

Copying a file;

copying an excerpt;

editing;

copying to clipboard;

copying an excerpt to clipboard;

changing format;

changing encoding;

renaming a file;

encryption;

decryption;

changing digital management;

opening by an application; and

printing.

28. A method according to claim 7, wherein said policy comprises placing a substantially imperceptible marking in said digital item, said marking comprising information content, and said method further comprising placing said marking, when indicated by said policy, before allowing at least one of the following:

storage of said digital item;

usage of said digital item; and

distribution of said digital item.

29. A method according to claim 1, wherein said policy comprises distribution regulation, said distribution regulation being for regulating at least one of the following:

sending said digital item via mail;

sending said digital item via web mail;

uploading said digital item to a web server;

uploading said digital item to a FTP server;

sending said digital item via a file transfer application;

sending said digital item via an instant messaging application;

sending said digital item via a file transfer protocol; and

sending said digital item via an instant messaging protocol.

30. A method according to claim 1, wherein said policy is dependent on at least one of the following:

the domain of a respective digital item;

the identity of a system;

the identity of a user;

the identity level of a user authorizing an action;

the identity of a user requesting an action;

the identity of a user involved in an action;

the identity of a user receiving an digital item;

authentication level of a system;

authentication level of a user;

authentication level of a user requesting an action;

authentication level of a user authorizing an action;

authentication level of a user involved in an action;

authentication level of a user receiving said digital item;

authentication level of a user sending said digital item;

the format of an digital item instance;

an interface being used;

an application being used;

encryption being used;

digital rights management technology being used;

detection of transformation, wherein said transformation is operable to reduce ability to identify said transformed digital item;

digital item integrity;

regular usage pattern;

regular distribution pattern;

regular storage pattern;

information path;

consistency of an action with usage pattern;

the identity of a user overriding policy and authorizing action in respect to said digital item;

authentication level of a user overriding policy and authorizing action in respect to said digital item;

the identity of a user sending digital item;

information property of said digital item;

language of said digital item;

representation of said digital item;

operations done on of said digital item;

identity of users involved along the life cycle of said digital item;

application used on of said digital item;

transition channel of said digital item;

participant agents;

virtual location of a computer;

logical location of a computer;

physical location of a computer;

type of a computer;

type of a laptop computer;

type of a desktop computer;

type of a server computer; and

owner identity.

31. A method according to claim 1, wherein said analyzing comprises modifying said first domain security policy to encompass security policy rules of said second domain.

41. A method according to claim 1, wherein said data item is transferred from a source organization to a recipient organization, said first security policy and said second security policy being autonomously defined by said source and recipient organizations respectively and applied within the perimeter of said source and recipient organizations respectively.

44. A method according to claim 1, wherein said digital data item comprises one of:

a document, a digital audio file, a digital video file, a digital image and a drawing.

21. A method for providing multi-domain monitoring over a digital data item, said data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, the method comprising:

assigning a digital data item specific security policy to said digital data item within said first domain, said digital data item specific security policy being able to comprise digital data item specific requirements for breach reports, said digital data item specific security policy being applied in accordance with a first domain security policy operational within said first domain;

transferring said digital data item having said respective digital data item specific first security policy to said second domain, said second domain having a second domain security policy operational within said second domain, said first and second domain security policies being autonomously defined, said transferring being together with additional data defining said respective digital data item specific first domain security policy;

analyzing said digital data item specific first domain security policy within said autonomous second domain; and

reporting about breaches or breach attempts within said autonomous second domain in accordance with said analyzed digital data item specific first domain security policy and said breach report requirements.

22. A method according to claim 21, wherein, in a case in which said second domain does not accept a breach reporting requirement of said first domain, at least one of distribution and usage of said digital item within said second domain is prohibited.

23. A method according to claim 21, wherein in a case in which said second domain does not accept said a policy of said first domain, at least one of said distribution and usage of said digital item within said second domain is restricted.

24. A method according to claim 23, wherein said usage comprises at least one of the following:

Storage;

Copying a file;

copying an excerpt;

editing;

copying to clipboard;

copying an excerpt to clipboard;

changing format;

changing encoding;

renaming a file;

encryption;

decryption;

changing digital management;

opening by an application; and

printing.

42. A method according to claim 21, wherein said data item is transferred from a source organization to a recipient organization, said first security policy and said second security policy being autonomously defined by said source and recipient organizations respectively and applied within the perimeter of said source and recipient organizations respectively.

45. A method according to claim 21, wherein said digital data item comprises one of:

a document, a digital audio file, a digital video file, a digital image and a drawing.

32. Apparatus for providing multi-domain control over specific digital data items via a digital data item specific first domain security policy assigned to a respective digital data item at a first domain, said data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, apparatus comprising:

a policy reference monitor, configured for assigning a digital data item specific security policy to a digital item within said first domain, said digital data item specific security policy being applied in accordance with a first domain security policy operational within said first domain; and

an assurance reference monitor configured for;

receiving said digital data items sent to said second domain together with data defining respective digital data item specific first domain security policy, said second domain having a second domain security policy operational within said second domain, said first and second domain security policies being autonomously defined;

analyzing said data defining said respective digital data item specific first domain security policy,

performing at least one of distributing and allowing usage of said digital items within said second domain in accordance with said analyzed digital data item specific first domain security policy, and

communicating with said policy reference monitor.

33. Apparatus according to claim 32, further comprising an intra-organization reference monitor associated with said intra-organization reference monitor, and configured for checking whether said security policy assigned to said digital item complies with the policy applied within said second domain.

34. Apparatus according to claim 32, further comprising an audit database configured for recording details of events in which a digital item, to which a distribution policy was assigned, was received by said assurance reference monitor.

35. Apparatus according to claim 32, further comprising an identification module, said identification module is operable to identify the information content of said digital item received by said assurance reference monitor.

36. Apparatus according to claim 32, further comprising an arbitrator, said arbitrator being operable to resolve conflicts between said assigned policy and the policy applied within said second domain.

37. Apparatus according to claim 32, further comprising an assurance entity, said assurance entity being operable to assures or certify the execution of said security policy assigned to said digital item.

43. A method according to claim 32, wherein said data item is transferred from a source organization to a recipient organization, said first security policy and said second security policy being autonomously defined by said source and recipient organizations respectively and applied within the perimeter of said source and recipient organizations respectively.

46. A method according to claim 32, wherein said digital data item comprises one of:

a document, a digital audio file, a digital video file, a digital image and a drawing.

38. A method for providing multi-domain control over a digital data item via a first domain security policy assigned to said digital data item at a first domain, said data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, the method comprising:

assigning said security policy to said digital item within said first domain, wherein said first domain security policy is operational within the perimeter of a source organization;

transferring said digital items to said second domain together with data defining said first domain security policy;

analyzing said first domain security policy within said second domain, wherein said second domain is operational within the perimeter of a recipient organization, said first and second domain security policies being autonomously defined by said source and said recipient organizations respectively;

performing at least one of distributing and allowing usage of said digital items within said second domain in accordance with said analyzed first domain security policy; and

utilizing an arbitrator for resolutions of conflicts, said arbitrator being independent of both said first domain and said second domain, wherein said arbitrator utilizes accumulated results of similar negotiations from the same or similar organizations as precedents and resolves said conflicts based on such precedents.

39. A method for providing multi-domain control over a digital data item via a first domain security policy assigned to said digital data item at a first domain, said data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, the method comprising:

assigning said security policy to said digital item within said first domain, wherein said first domain is operational within the perimeter of a source organization;

transferring said digital items to said second domain together with data defining said first domain security policy, wherein said second domain is operational within the perimeter of a recipient organization, said first and second domain security policies being autonomously defined by said source and said recipient organizations respectively;

analyzing said first domain security policy within said second domain;

performing at least one of distributing and allowing usage of said digital items within said second domain in accordance with said analyzed first domain security policy; and

utilizing an assurance authority for assuring the execution of said distribution policy, said assurance authority being independent of said first domain and said second domain and comprising assurance functionality to render trust at both said first and said second domain.

40. A method for providing multi-domain control over a digital data item via a first domain security policy assigned to said digital data item at a first domain, said digital data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, the method comprising:

assigning said security policy to said digital item within said first domain, wherein said first domain is operational within the perimeter of a source organization;

transferring said digital items to said second domain together with data defining said first domain security policy, wherein said second domain is operational within the perimeter of a recipient organization, said first and second domain security policies being autonomously defined by said source and said recipient organizations respectively;

analyzing said first domain security policy within said second domain;

performing at least one of distributing and al1owing usage of said digital items within said second domain in accordance with said analyzed first domain security policy; and

utilizing a trustee for auditing compliance of said second domain with said first domain security policy at said first domain.

47. A method for providing multi-domain control over a digital data item via a first domain digital data item specific security policy assigned to said digital data item at a first domain, said digital data item being transferred from said first domain to a second domain, the method comprising:

assigning said digital data item specific security policy to said digital data item within said first domain;

transferring said digital data item to said second domain together with additional data defining said digital data item specific first domain security policy, said second domain being autonomous from said first domain in respect of security policies;

analyzing said digital data item specific first domain security policy within said second domain in respect of said digital data item; and

performing at least one of distributing and allowing usage of said digital item within said autonomous second domain in accordance with said analyzed digital data item specific first domain security policy, so as to provide control of said digital data item in said autonomous second domain in accordance with said digital data item specific security policy of said first domain,

and wherein said digital data item comprises one of;

a document, a digital audio file, a digital video file, a digital image and a drawing.

48. Apparatus for providing multi-domain control over specific digital data items via a digital data item specific first domain security policy assigned to a respective digital data item at a first domain, said digital data item being transferred from said first domain to a second domain, said second domain being autonomous from said first domain in respect of security policies, comprising:

a policy reference monitor, configured for assigning said digital data item specific security policy to said digital item within said first domain; and

an assurance reference monitor configured for;

receiving said digital items sent to said second domain together with data defining respective digital data item specific first domain security policy;

analyzing said data defining said respective digital data item specific first domain security policy,

performing at least one of distributing and allowing usage of said digital items within said second domain in accordance with said analyzed digital data item specific first domain security policy, and

communicating with said policy reference monitor,

and wherein said digital data item comprises one of;

a document, a digital audio file, a digital video file, a digital image and a drawing.