Information management system

• US 7,797,240 B2
• Filed: 12/17/2007
• Issued: 09/14/2010
• Est. Priority Date: 11/08/2000
• Status: Expired due to Fees

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Malcolm, Peter Bryan
• Primary Examiner(s): Elisca; Pierre E
• Application Number:
  US11/958,297
• Publication Number:
  US 20080301762A1
• Time in Patent Office: 1,002 Days
• Field of Search: 705/50, 705/51
• US Class Current: 705/51
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information management system is described comprising one or more workstations running applications to allow a user of the workstation to connect to a network, such as the Internet. Each application has an analyzer, which monitors transmission data that the application is about to transmit to the network or about to receive from the network and which determines an appropriate action to take regarding that transmission data. Such actions may be extracting data from the transmission data, such as passwords and usernames, digital certificates or eCommerce transaction details for storage in a database; ensuring that the transmission data is transmitted at an encryption strength appropriate to the contents of the transmission data; determining whether a check needs to be made as to whether a digital certificate received in transmission data is in force, and determining whether a transaction about to be made by a user of one of the workstations needs third party approval before it is made. The analyzer may consult a policy data containing a policy to govern the workstations in order to make its determination. The information management system provides many advantages in the eCommerce environment to on-line trading companies, who may benefit by being able to regulate the transactions made by their staff according to their instructions in a policy data, automatically maintain records of passwords and business conducted on-line, avoid paying for unnecessary checks on the validity of digital certificates and ensure that transmissions of data made by their staff are always protected at an agreed strength of encryption.

Claims

1. An information management system comprising:

one or more workstations connected to a computer network, each workstation having a memory;

an application stored in said memory of each workstation for transmitting outbound data to said computer network and receiving inbound data from said computer network;

policy data containing rules specifying an appropriate encryption strength for outbound data, the encryption strength depending on the content of the data; and

an analyzer, said analyzer monitoring, in conjunction with said policy data, said outbound data and determining, in accordance with said rules in said policy data, an appropriate encryption strength for the outbound data;

wherein said analyzer controls transmission of said outbound data from said application in dependence upon said determination of an appropriate encryption strength.

2. The system of claim 1 wherein said rules in said policy data define confidential data which can not be transmitted, said analyzer preventing, in conjunction with said policy data, said confidential data being transmitted from said application.

3. The system of claim 1 wherein said analyzer further determines the present encryption strength in use for transmitting said outbound data;

and

wherein said analyzer controls transmission of said outbound data from said application both in dependence upon said determination of an appropriate encryption strength and in dependence upon said determination of the present encryption strength in use.

4. The system of claim 3 wherein if the analyzer determines that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then said analyzer prevents transmission of said outbound data from said application.

5. The system of claim 3 wherein if the analyzer determines that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then said analyzer prevents transmission of said outbound data from said application and controls said application to renegotiate an encryption strength for transmission that is appropriate.

6. The system of claim 3 wherein if the analyzer determines that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then said analyzer modifies the outbound data such that the present encryption strength is an appropriate encryption strength for the transmission of the modified outbound data.

7. The system of claim 3 wherein if the analyzer determines that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then said analyzer controls said application to notify a user of said application that the encryption strength in use is not sufficient.

8. The system of claim 1 wherein the analyzer further identifies credit card numbers in said outbound data.

9. The system of claim 8 wherein the analyzer further distinguishes a predetermined set of credit card numbers from other credit card numbers, wherein said rules of said policy data define different appropriate encryption strengths for outbound data containing credit card numbers in the predetermined set than for other credit card numbers.

10. The system of claim 9 wherein said rules of said policy data specify that there is no appropriate encryption strength for a pre-determined set of one or more credit card numbers.

11. The system of claim 1 wherein said analyzer further identifies at least one or more of, credit card numbers, account codes, usernames, passwords, names and addresses and other predetermined keywords in the content of said outbound data.

12. The system of claim 1 wherein said rules in said policy data specify an appropriate encryption strength for said outbound data, that is dependent on the address to which said outbound data is to be transmitted.

13. The system of claim 1 wherein said analyzer is located on each of said one or more workstations.

14. The system of claim 1 wherein said application is a web browser.

15. The system of claim 14 wherein said analyzer is a plug-in module of said web browser.

16. The system of claim 15 wherein said web browser is Microsoft'"'"'s Internet Explorer and said analyzer is a Browser Helper Object.

17. The system of claim 1 wherein said application is an e-mail client.

18. The system of claim 17 wherein said analyzer is a plug-in module of said e-mail client.

19. The system of claim 18 wherein said e-mail client is Microsoft'"'"'s Outlook e-mail client and said analyzer is a Microsoft client extension.

20. The system of claim 1 wherein said computer network comprises a server and said analyzer is located at a point on said computer network intermediate to said one or more workstations and said server, or said analyzer is located at said server.

21. The system of claim 1 wherein said computer network to which said one or more workstations are connected is a public computer network, and wherein said one or more workstations together form a private computer network.

22. The system of claim 1 further comprising a supervisor workstation, said policy data being accessible by said supervisor workstation, such that a user of said supervisor workstation can edit said policy data.

23. The system of claim 1 wherein the analyzer is integrated into said application.

24. The system of claim 1 wherein the analyzer is operable to analyze the outbound data as transmission of the outbound data is initiated by the application.

25. The system of claim 1 wherein the policy data is centrally defined for the plurality of workstation.

26. A method of managing information comprising the steps of:

providing one or more workstations connected to a computer network, each workstation having a memory;

providing an application stored in said memory of each workstation for transmitting outbound data to said computer network and receiving inbound data from said computer network;

providing policy data containing rules specifying an appropriate encryption strength for outbound data, the encryption strength depending on the content of the data; and

analyzing said outbound data to determine, in accordance with said rules in said policy data, an appropriate encryption strength for the outbound data;

controlling transmission of said outbound data from said application in dependence upon the determination of an appropriate encryption strength in said analyzing step.

27. The method of claim 26 wherein said rules in said policy data define confidential data which cannot be transmitted, and wherein in said controlling step transmission of said confidential data is prevented.

28. The method of claim 26 wherein said analyzing step further comprising the step of determining the present encryption strength in use for transmitting said outbound data;

and wherein in said controlling step the transmission of said outbound data from said application is dependent upon both the determination of an appropriate encryption strength and the determination of the present encryption strength in use.

29. The method of claim 28 wherein if it is determined that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then in said controlling step transmission of said outbound data from said application is prevented.

30. The method of claim 28 wherein if in said analyzing step it is determined that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then in said controlling step an encryption strength appropriate for transmission of said outbound data is negotiated before transmission.

31. The method of claim 28 wherein if in said analyzing step it is determined that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then in said controlling step the outbound data is modified such that the present encryption strength is an appropriate encryption strength.

32. The method of claim 28 wherein in said analyzing step if it is determined that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then in said controlling step a user of said application is notified that the encryption strength in use is not sufficient.

33. The method of claim 26 wherein said analyzing step includes identifying credit card numbers in said outbound data.

34. The method of claim 33 wherein said analyzing step includes distinguishing a pre-determined set of one or more credit card numbers from other credit card numbers, and wherein said rules of said policy data define a different appropriate encryption strength for outbound data containing credit card numbers in that pre-determined set than for other credit card numbers.

35. The method of claim 34 wherein said rules of said policy data specifies that there is no appropriate encryption strength for said pre-determined set of one or more credit card numbers.

36. The method of claim 26 wherein said analyzing step includes identifying at least one or more of, credit card numbers, account codes, usernames, passwords, names and addresses and other predetermined keywords in the content of said outbound data.

37. The method of claim 26 wherein said rules in said policy data specify an appropriate encryption strength for said outbound data, that is dependent on the address to which said outbound data is to be transmitted.

38. The method of claim 26 wherein said analyzing step is performed at said one or more workstations.

39. The method of claim 26 wherein said application is a web browser.

40. The method of claim 39 wherein said analyzing step is performed by a plug-in module of said web browser.

41. The method of claim 40 wherein said web browser is Microsoft'"'"'s Internet Explorer and said plug-in module is a Browser Helper Object.

42. The method of claim 26 wherein said application is an e-mail client.

43. The method of claim 42 wherein said analyzing step is performed by a plug-in module of said e-mail client.

44. The method of claim 43 wherein said e-mail client is Microsoft'"'"'s Outlook e-mail client and said plug-in module is a Microsoft Exchange client extension.

45. The method of claim 26 wherein said computer network comprises a server and said analyzing step is performed at a point on said computer network intermediate to said one or more workstations and said server, or said analyzing step is performed at said server.

46. The method of claim 26 wherein said computer network to which said one or more workstations are connected is a public computer network, and wherein said one or more workstations together form a private computer network.

47. The method of claim 26 further comprising the step of providing a supervisor workstation, said policy data being accessible by said supervisor workstation, such that a user of said supervisor workstation can edit said policy data.

48. The method of claim 26 wherein the analyzing and controlling steps are carried out by means of an analyzer integrated into said application.

49. The method of claim 26 wherein the analyzer executes said analyzing and controlling steps as transmission of the outbound data is initiated.

50. The method of claim 26 wherein the policy data is centrally defined for the plurality of workstations.