Information management system

• US 7,836,482 B2
• Filed: 05/12/2005
• Issued: 11/16/2010
• Est. Priority Date: 11/08/2000
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Malcolm, Peter Bryan
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/127,637
• Publication Number:
  US 20050204172A1
• Time in Patent Office: 2,014 Days
• Field of Search: 726 1- 9, 713/183, 713/189, 713193-194, 713/150, 713154-155
• US Class Current: 726/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information management system is described comprising one or more workstations running applications to allow a user of the workstation to connect to a network, such as the Internet. Each application has an analyser, which monitors transmission data that the application is about to transmit to the network or about to receive from the network and which determines an appropriate action to take regarding that transmission data. Such actions may be extracting data from the transmission data, such as passwords and usernames, digital certificates or eCommerce transaction details for storage in a database; ensuring that the transmission data is transmitted at an encryption strength appropriate to the contents of the transmission data; determining whether a check needs to be made as to whether a digital certificate received in transmission data is in force, and determining whether a transaction about to be made by a user of one of the workstations needs third party approval before it is made. The analyser may consult a policy data containing a policy to govern the workstations in order to make its determination. The information management system provides many advantages in the eCommerce environment to on-line trading companies, who may benefit by being able to regulate the transactions made by their staff according to their instructions in a policy data, automatically maintain records of passwords and business conducted on-line, avoid paying for unnecessary checks on the validity of digital certificates and ensure that transmissions of data made by their staff are always protected at an agreed strength of encryption.

Claims

1. A system for recording passwords and usernames comprising:

a plurality of workstations adapted for connection to the Internet, each workstation having a memory;

a data repository arranged to receive data from each of said workstations;

an application stored in said memory of each workstation for transmitting outbound data and receiving inbound data from the Internet; and

/or an application for receiving user input data; and

an analyser, said analyser being operable to monitor at least one of said input data, said outbound data and said inbound data, to identify usernames and passwords contained in said user input data, said outbound data or said inbound data, and to cause said usernames and passwords to be stored in said data repository.

2. The system of claim 1 wherein said analyser is operable to determine whether the usernames and passwords are used to access a web page, and if they are, to identify the URL address of said web page and cause said URL to be stored in said data repository with said usernames and passwords.

3. The system of claim 1 wherein said usernames and passwords data are encrypted prior to being transmitted to said data repository.

4. The system of claim 1 wherein said usernames and passwords that are stored in said data repository are encrypted.

5. The system of claim 1 wherein said analyser is operable to identify said usernames and passwords from the field names of data contained in at least one of said outbound data or said inbound data.

6. The system of claim 1 wherein a representation of the input fields of a web page is stored in said memory of said one or more workstations, and wherein said analyser is operable to identify said usernames and passwords from said representation.

7. The system of claim 1 wherein said analyser is operable to identify said usernames or passwords from the field types of data contained in said outbound or said inbound data.

8. The system of claim 1 wherein said application has a user interface provided with a ‘

remember password’

option which when selected stores input usernames and passwords in memory, and said analyser is operable to identify said usernames and passwords in said input usernames and passwords stored in memory.

9. The system of claim 1 wherein said analyser is located on each of said one or more workstations.

10. The system of claim 1 wherein said application is a web browser.

11. The system of claim 10 wherein said analyser is a plug-in module of said web browser.

12. The system of claim 11 wherein said web browser is Microsoft'"'"'s Internet Explorer and said analyser is a Browser Helper Object.

13. The system of claim 1 wherein said network comprises a server and said analyser is located at a point on said network intermediate said one or more workstations and said server, or said analyser is located at said server.

14. The system of claim 1 further comprising a supervisor workstation, said supervisor workstation having access to said data repository and being operable to view said usernames and passwords stored in said data repository.

15. The system of claim 1 wherein a workstation of said plurality of workstations has access to said data repository and is operable to view said usernames and passwords stored in said data repository.

50. The system of claim 1 wherein the analyzer is integrated into said application.

51. The system of claim 1 wherein the analyzer is operable to monitor at least one of the said outbound or said inbound data and to identify the passwords or usernames in at least said outbound data as transmission of the outbound data is initiated from the application, or in said inbound data as it is received by the application and before it is viewed by a user.

52. The system of claim 1 wherein policy data is centrally defined for the plurality of workstations.

53. The system of claim 1, wherein:

policy data is stored in a central location for access by the plurality of workstations; and

the policy data is transmitted to the plurality of workstations for use by the plurality of workstations in identifying usernames and passwords contained in said user input data, said outbound data or said inbound data.

16. A method for recording passwords and usernames comprising the steps of:

providing a plurality of workstations adapted for connection to the Internet, each workstation having a memory;

providing a data repository arranged to receive data from each of said workstations;

providing an application stored in said memory of each workstation for transmitting outbound data and receiving inbound data from the Internet; and

/or an application for receiving user input data; and

analysing at least one of said user input data, said outbound data and said inbound data, to identify usernames and passwords; and

causing said usernames and passwords to be stored in said data repository.

17. The method of claim 16 further comprising the steps of determining whether the usernames and passwords are used to access a web page, and if they are, identifying the URL address of said web page, and storing said URL in said data repository with said usernames and passwords.

18. The method of claim 16 further comprising the step of encrypting usernames and passwords prior to being stored in said data repository.

19. The method of claim 16 further comprising the step of encrypting the usernames and passwords that are stored in said data repository.

20. The method of claim 16 wherein in said analysing step usernames and passwords are identified from the field names of data contained in at least one of said outbound data or said inbound data.

21. The method of claim 16 wherein a representation of the input fields of a web page is stored in said memory of said workstation, and wherein in said analyser step usernames and passwords are identified from said representation.

22. The method of claim 16 wherein in said analysing step usernames and passwords are identified from the field types of data contained in said outbound or said inbound data.

23. The method of claim 16 wherein said application has a user interface provided with a ‘

remember password’

, option which when selected stores input usernames and passwords in said memory of said one or more workstations, and wherein in said analysing step usernames and passwords are identified from said input usernames and passwords stored in said memory of said one or more workstations.

24. The method of claim 16 wherein said analysing step is performed on said one or more workstations.

25. The method of claim 16 wherein said application is a web browser.

26. The method of claim 25 wherein said analysing step is performed by a plug-in module of said web browser.

27. The method of claim 26 wherein said web browser is Microsoft'"'"'s Internet Explorer and said plug-in module is a Browser Helper Object.

28. The method of claim 16 wherein said network comprises a server and said analysing step is performed at a point on said network intermediate said one or more workstations and said server, or said analysing step is performed at said server.

29. The method of claim 16 further comprising the step of providing a supervisor workstation, said supervisor workstation having access to said data repository and being operable to view said usernames and passwords stored in said data repository.

30. The method of claim 16 wherein a computer of said plurality of computers has access to said data repository and is operable to view said usernames and passwords stored in said data repository.

54. The method of claim 16 wherein the analyzing and causing steps are carried out by means of an analyzer integrated into said application.

55. The method of claim 16 wherein an analyzer executes said analyzing and causing steps as transmission of the outbound data is initiated from the application, or as said inbound data is received by the application and before it is viewed by a user.

56. The method of claim 16 wherein policy data is centrally defined for the plurality of workstations.

57. The method of claim 16, further comprising:

storing policy data in a central location for access by the plurality of workstations; and

transmitting the policy data to the plurality of workstations for use by the plurality of workstations in identifying usernames and passwords contained in said user input data, said outbound data or said inbound data.

31. A system for recording passwords and usernames comprising:

a plurality of workstations adapted for connection to the Internet, each workstation having a memory;

storage means for receiving data from each of said workstations;

application means, stored in said memory of each workstation, for transmitting outbound data and receiving inbound data from the Internet; and

/or application means for receiving user input data; and

analyzing means for monitoring at least one of said input data, said outbound data and said inbound data, to identify usernames and passwords contained in said user input data, said outbound data or said inbound data, and for causing said usernames and passwords to be stored in said storage means.

32. The system of claim 31 wherein said analyzing means is operable to determine whether the usernames and passwords are used to access a web page, and if they are, to identify the URL address of said web page and cause said URL to be stored in said storage means with said usernames and passwords.

33. The system of claim 31 wherein said usernames and passwords data are encrypted prior to being transmitted to said storage means.

34. The system of claim 31 wherein said usernames and passwords that are stored in said storage means are encrypted.

35. The system of claim 31 wherein said analyzing means is operable to identify said usernames and passwords from the field names of data contained in at least one of said outbound data or said inbound data.

36. The system of claim 31 wherein a representation of the input fields of a web page is stored in said memory of said one or more workstations, and wherein said analyzing means is operable to identify said usernames and passwords from said representation.

37. The system of claim 31 wherein said analyzing means is operable to identify said usernames or passwords from the field types of data contained in said outbound or said inbound data.

38. The system of claim 31 wherein said application means has a user interface provided with a ‘

remember password’

option which when selected stores input usernames and passwords in memory, and said analyzing means is operable to identify said usernames and passwords in said input usernames and passwords stored in memory.

39. The system of claim 31 wherein said analyzing means is located on each of said one or more workstations.

40. The system of claim 31 wherein said application means is a web browser.

41. The system of claim 40 wherein said analyzing means is a plug-in module of said web browser.

42. The system of claim 41 wherein said web browser is Microsoft'"'"'s Internet Explorer and said analyzing means is a Browser Helper Object.

43. The system of claim 31 wherein said network comprises a server and said analyzer is located at a point on said network intermediate said one or more workstations and said server, or said analyzing means is located at said server.

44. The system of claim 31 further comprising a supervisor workstation, said supervisor workstation having access to said storage means and being operable to view said usernames and passwords stored in said storage means.

45. The system of claim 31 wherein a workstation of said plurality of workstations has access to said storage means and is operable to view said usernames and passwords stored in said storage means.

46. The system of claim 31 wherein said analyzing means is integrated into said application.

47. The system of claim 31 wherein said analyzing means is operable to monitor at least one of the said outbound or said inbound data and to identify the passwords or usernames in at least said outbound data as transmission of the outbound data is initiated from the application, or in said inbound data as it is received by the application and before it is viewed by a user.

48. The system of claim 31 wherein policy data is centrally defined for the plurality of workstations.

49. The system of claim 31, wherein:

policy data is stored in a central location for access by the plurality of workstations; and

the policy data is transmitted to the plurality of workstations for use by the plurality of workstations in identifying usernames and passwords contained in said user input data, said outbound data or said inbound data.