Information management system

• US 7,685,626 B2
• Filed: 05/12/2005
• Issued: 03/23/2010
• Est. Priority Date: 11/08/2000
• Status: Expired due to Fees

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Malcolm, Peter Bryan
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/127,899
• Publication Number:
  US 20050216771A1
• Time in Patent Office: 1,776 Days
• Field of Search: 726 1- 4, 726 7- 15, 726/21, 726 26- 30, 713/193, 713/168, 705/50, 705/64, 705/67
• US Class Current: 726/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information management system is described comprising one or more workstations running applications to allow a user of the workstation to connect to a network, such as the Internet. Each application has an analyzer, which monitors transmission data that the application is about to transmit to the network or about to receive from the network and which determines an appropriate action to take regarding that transmission data. Such actions may be extracting data from the transmission data, such as passwords and usernames, digital certificates or eCommerce transaction details for storage in a database; ensuring that the transmission data is transmitted at an encryption strength appropriate to the contents of the transmission data; determining whether a check needs to be made as to whether a digital certificate received in transmission data is in force, and determining whether a transaction about to be made by a user of one of the workstations needs third party approval before it is made. The analyzer may consult a policy data containing a policy to govern the workstations in order to make its determination. The information management system provides many advantages in the eCommerce environment to on-line trading companies, who may benefit by being able to regulate the transactions made by their staff according to their instructions in a policy data, automatically maintain records of passwords and business conducted on-line, avoid paying for unnecessary checks on the validity of digital certificates and ensure that transmissions of data made by their staff are always protected at an agreed strength of encryption.

Claims

1. A computer program product, for controlling a plurality of computers in a private network to manage information, the network having a data repository arranged to receive data from the plurality of computers and policy data containing rules defining relevant commercial data which is to be extracted from at least one of outbound data transmitted to a public network or inbound data received from the public network and stored in the data repository, comprising:

a recording medium readable by a computer, having program code recorded thereon which when executed on each of said plurality of computers, configures said plurality of computers to;

analyse, in conjunction with an application running on each of said plurality of computers that is operable to transmit the outbound data and receive the inbound data, at least one of said outbound data and said inbound data, with reference to said policy data, to identify in at least one of said outbound data and said inbound data, relevant commercial data that is to be stored in said data repository in accordance with said rules in said policy data; and

cause said relevant commercial data to be stored in said data repository.

2. The computer program product of claim 1 wherein said program code when executed on said computer is operable to cause said relevant commercial data that is to be stored in said data repository to be encrypted prior to it being stored in said data repository.

3. The computer program product of claim 1 wherein said program code when executed on said computer is operable to cause said relevant commercial data that is stored in said data repository to be encrypted.

4. The computer program product of claim 1 wherein said application is adapted to transmit outbound data to the Internet and receive inbound data from the Internet.

5. The computer program product of claim 4 wherein at least one of usernames and passwords used to identify a user, and usernames and passwords used to access web pages on the Internet, and the URL address of those web pages, are identified as relevant commercial data.

6. The computer program product of claim 5 wherein usernames and passwords are identified from the field names of data contained in at least one of said outbound data and said inbound data.

7. The computer program product of claim 5 wherein a representation of the input fields of a web page is stored in the memory of one or more computers of the plurality of computers, and wherein said usernames and passwords are identified from said representation.

8. The computer program product of claim 5 wherein usernames or passwords are identified from the field types of data contained in said outbound or said inbound data.

9. The computer program product of claim 4 wherein digital certificates contained in at least one of said outbound or said inbound data or used to digitally sign signed data in said inbound data or said outbound data, or sufficient descriptive data to identify any such digital certificates, are identified as relevant commercial data.

10. The computer program product of claim 9 wherein one or more of the following data are identified as relevant commercial data:

whether or not said digital certificate has been revoked;

the identity of the holder of said digital certificate;

the amount of any eCommerce transaction being made that is related to said digital certificate;

the goods or services being sold in any eCommerce transaction being made with said digital certificate; and

the date of receipt of said digital certificate.

11. The computer program product of claim 4 wherein the program code when executed on said computer is further operable to:

identify when an eCommerce transaction is occurring; and

if an eCommerce transaction is identified as occurring, to identify in said outbound or said inbound data one or more of the following data as relevant commercial data;

the URL address or e-mail address of the remote location to which outbound data is being transmitted or inbound data is being received;

the web pages accessed by a user of one or more computers of the plurality of computers during the transaction;

the amount of the transaction;

the goods or services being traded in the transaction; and

the date of the transaction.

12. The computer program product of claim 1 wherein said program code is executable at each of said plurality of computers.

13. The computer program product of claim 1 wherein said application is a web browser.

14. The computer program product of claim 13 wherein said program code when executed on said computer is a plug-in module of said web browser.

15. The computer program product of claim 14 wherein said web browser is Microsoft'"'"'s Internet Explorer and said plug-in module is a Browser Helper Object.

16. The computer program product of claim 1 wherein said application is an e-mail client.

17. The computer program product of claim 16 wherein said program code when executed on said computer is a plug-in module of said e-mail client.

18. The computer program product of claim 17 wherein said e-mail client is Microsoft'"'"'s Outlook e-mail client and said plug-in module is a Microsoft Exchange client extension.

19. The computer program product of claim 1 wherein said network includes a server and said program code is executable at a point on said network intermediate one or more computers of the plurality of computers and said server, or said program code is executable at said server.

20. The computer program product of claim 1 further comprising program code recorded on the recording medium which when executed on a first computer in said plurality of computers enables said first computer as a supervisor workstation, said supervisor workstation having access to said data repository and being operable to view said relevant commercial data stored in said data repository.

21. The computer program product of claim 20 wherein said policy data is accessible by said supervisor workstation, such that a user of said supervisor workstation can edit said policy data.

22. The computer program product of claim 1 further comprising program code recorded on the recording medium which when executed on a computer in said plurality of computers provides that computer with access to said data repository such that a users of said computer can view said relevant commercial data stored in said data repository.

42. The computer program product of claim 1 wherein the analyzing step is carried out by an analyzer integrated into said application.

43. The computer program product of claim 42 wherein the analyzer is operable to carry out said analyzing step at least as transmission of the outbound data is initiated by the application, or after the inbound data is received by the application and before it is viewed by a user of the application.

44. The computer program product of claim 1 wherein the policy data is centrally defined for the plurality of computers.

45. The computer program product of claim 1, wherein the program code when executed on said computer is further operable to:

store the policy data in a central location for access by the plurality of computers; and

transmit the policy data containing the rules defining the relevant commercial data to the plurality of computers for use by the plurality of workstations in identifying the relevant commercial data in at least one of said outbound data and said inbound data.

23. A computer program product, for controlling a plurality of computers in a private network to record passwords and usernames, the network having a data repository arranged to receive data from the plurality of computers, said computer program product comprising:

a recording medium readable by a computer, having program code recorded thereon which when executed on each of said plurality of computers, configures said plurality of computers to;

analyse, in conjunction with an application running on the computer that is operable to transmit outbound data to the Internet and receive inbound data from the Internet, and/or an application running on the computer for receiving user input data, at least one of said user input data, said outbound data and said inbound data, to identify in at least one of said user input data, said outbound data and said inbound data, relevant commercial data that is to be stored in said data repository; and

control said computer to store said relevant commercial data in said data repository.

24. The computer program product of claim 23 wherein said program code when executed on said computer is further operable to determine whether the usernames and passwords are used to access a web page, and if they are, to identify the URL address of said web page and to direct the computer to store said URL in said data repository with said usernames and passwords.

25. The computer program product of claim 23 wherein said program code when executed on said computer is further operable to cause said usernames and passwords to be encrypted prior to them being stored in said data repository.

26. The computer program product of claim 23 wherein said program code when executed on said computer is further operable to cause said usernames and passwords that are stored in said data repository to be encrypted.

27. The computer program product of claim 23 wherein said program code when executed on said computer is operable to identify usernames and passwords from the field names of data contained in at least one of said outbound data or said inbound data.

28. The computer program product of claim 23 wherein a representation of the input fields of a web page is stored in the memory of said computer, and wherein said program code when executed on said computer is operable to identify usernames and passwords from said representation.

29. The computer program product of claim 23 wherein said program code when executed on said computer is further operable to identify usernames and passwords from the field types of data contained in said outbound or said inbound data.

30. The computer program product of claim 23 wherein said application for receiving user input data has a user interface provided with a ‘

remember password’

option which when selected stores input usernames and passwords in said memory of said computer, and wherein said program code when executed on said computer is operable to identify usernames and passwords from said input usernames and passwords stored in said memory of said computer.

31. The computer program product of claim 23 wherein said program code is executable at each of said computers.

32. The computer program product of claim 23 wherein said application is a web browser.

33. The computer program product of claim 32 wherein said program code when executed on said computer is a plug-in module of said web browser.

34. The computer program product of claim 33 wherein said web browser is Microsoft'"'"'s Internet Explorer and said plug-in module is a Browser Helper Object.

35. The computer program product of claim 23 wherein said network comprises a server and said program code is executable at a point on said network intermediate said computer and said server, or said program code is executable at said server.

36. The computer program product of claim 23 further comprising program code which when executed on said computer enables that computer as a supervisor workstation, said supervisor workstation having access to said data repository and being operable to view said relevant usernames and passwords stored in said data repository.

37. The computer program product of claim 23 wherein a computer of said plurality of computers has access to said data repository and is operable to view said relevant usernames and passwords stored in said data repository.

38. The computer program product of claim 23 wherein the analyzing step is carried out by an analyzer integrated into said application.

39. The computer program product of claim 38 wherein the analyzer is operable to carry out said analyzing step at least as transmission of the outbound data is initiated by the application, or after the inbound data is received by the application and before it is viewed by a user of the application.

40. The computer program product of claim 23 wherein the policy data is centrally defined for the plurality of computers.

41. The computer program product of claim 23, wherein the program code when executed on said computer is further operable to:

store the policy data in a central location for access by the plurality of computers; and

transmit the policy data containing the rules defining the relevant commercial data to the plurality of computers for use by the plurality of workstations in identifying the relevant commercial data in at least one of said outbound data and said inbound data.