Content-based policy compliance systems and methods

• US 7,903,549 B2
• Filed: 05/15/2006
• Issued: 03/08/2011
• Est. Priority Date: 03/08/2002
• Status: Expired due to Term

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing Corporation (McAfee, LLC)
• Inventors: Yang, Weilai, Schneck, Phyllis Adele, Zdziarski, Jonathan Alexander, Judge, Paul
• Primary Examiner(s): Chou; Albert T
• Application Number:
  US11/383,347
• Publication Number:
  US 20070195779A1
• Time in Patent Office: 1,758 Days
• Field of Search: 370/230, 455/466, 715/501.1, 715/510, 709/229, 707/6, 706/1
• US Class Current: 370/230
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0263 Rule management

Abstract

Methods and systems for operation upon one or more data processors to filter communications of users in accordance with content-based policy.

Claims

1. A method for operation upon one or more data processors to filter communications based upon content based policy compliance, the method comprising:

for each of a plurality of sets of pre-existing files, defining a corresponding classification to be associated with the set of pre-existing files, the corresponding classification classifying content of the set of files as being associated with at least one of a plurality of departments of a business;

processing each of the sets of pre-existing files by one or more classification techniques;

generating a set of identifying characteristics for each corresponding classification, each set of identifying characteristics based on the set of pre-existing files associated with the corresponding classification;

for each of the plurality of corresponding classifications, receiving a rule specifying treatment of content identified as associated with the classification based on the set of known identifying characteristics; and

wherein each rule defines whether to forward a communication including content to a recipient based upon the classification of the content and at least one of the recipient and the sender.

2. The method of claim 1, wherein the set of identifying characteristics associated with each correspond classification are generated by examining the content of the set of files associated with the corresponding classification.

3. The method of claim 2, wherein the processing each of the sets of pre-existing files includes fingerprinting analysis, a cluster analysis, a contextual analysis, and an adaptive lexical analysis.

4. The method of claim 1, wherein the rule is generated according to access control rights associated with at least one of the sender or the recipient, wherein the access control rights are derived from access control rights associated with the set of files.

5. The method of claim 4, wherein the access control rights associated with the set of files controls who can view the files.

6. The method of claim 1, wherein the rule is defined based upon access control rights associated with at least one of the sender or the recipient and content contained in a communication.

7. The method of claim 6, wherein access control rights are provided to groups of users, wherein the sender and the recipient are included in at least one group of users.

8. The method of claim 1, further comprising the steps of:

receiving a communication from an originating system;

extracting identifying characteristics associated with the communication;

comparing the communication'"'"'s identifying characteristics with the set of identifying characteristics for each of the corresponding classification to identify a classification to be associated with the communication; and

applying a rule associated with the corresponding classification, the rule specifying whether the communication should be forwarded to its intended recipient.

9. The method of claim 8, further comprising the step of forwarding the communication based upon application of the rule.

10. The method of claim 8, further comprising the step of forwarding the communication responsive to the communication not being associated with any identifying characteristics.

11. The method of claim 8, further comprising the step of automatically generating a rule responsive to learning communications patterns between a group of users and based on types of content being distributed among the group of users.

12. The method of claim 11, wherein the users belong to the same organization.

13. The method of claim 8, further comprising delaying delivery of the communication based upon application of the rule.

14. The method of claim 13, further comprising notifying an originator of the communication responsive to delivery of the communication being delayed.

15. The method of claim 14, wherein the delay is at least one of storing the communication in a quarantine folder, dropping the communication, temporarily rejecting the communication, storing the communication until approval is received from an administrator to forward the communication, automatically encrypting the communication, notifying an administrator, notifying a recipient, or combinations thereof

16. The method of claim 8, further comprising converting a communication from one of a plurality of mismatched formats to a comparison format prior to extracting identifying characteristics from the communication.

17. The method of claim 8, further comprising translating a file or communication into a common language or format prior to extracting identifying characteristics or generating the known identifying characteristics.

18. The method of claim 17, wherein the translating step creates metadata to be used in extracting identifying characteristics.

19. The method of claim 8, further comprising the steps of:

observing communication traffic;

identifying one or more patterns exhibited by observed communication traffic; and

generating a rule based upon the identified one or more patterns.

20. The method of claim 19, wherein a communication falling outside of one or more identified traffic patterns is sent to a quarantine folder, dropped, temporarily rejected, stored until approval is received from an administrator to forward the communication, automatically encrypted, a recipient is notified, a sender is notified, or combinations thereof.

21. The method of claim 1, wherein the corresponding classifications are at least one of:

management files, legal files, technical files, marketing files, financial files, information technology files, proprietary files, strategy files, sensitive files, or government classified files.

22. The method of claim 1, wherein a system administrator specifies the rule by selecting a corresponding classification of files for application of the rule, selecting a class of users who are permitted to send the selected classification of files, and selecting a class of users who are permitted to receive the selected classification of files.

23. The method of claim 22, wherein the steps of selecting a class of users comprises selecting individual users who have permission to send or receive the selected classification of files.

24. A content-based policy compliance system configured to filter messages based upon content and at least one of senders or recipients associated with the messages, the system comprising:

a messaging content classifier configured to;

access a plurality of sets of pre-existing files and for each set of pre-existing files define corresponding classification to be associated with the set of pre-existing files, the corresponding classification classifying content of the set of files as being associated with at least one of a plurality of departments of a business;

processing each of the sets of pre-existing files by one or more classification techniques;

generating a set of identifying characteristics for each corresponding classification, each set of identifying characteristics based on the set of pre-existing files associated with the corresponding classification;

receive a message and classify the message as associated with at least one of the corresponding classifications associated with the business departments based upon the content of the message and the sets of identifying characteristics of the plurality of content classifications;

a messaging filter configured to receive the at least one corresponding classification from the messaging content classifier and to apply a rule to the message based upon the at least one corresponding classification and upon at least one of a sender or recipient of the message; and

forwarding logic configured to transmit the message responsive to output from the messaging filter.

25. The system of claim 24, further comprising a user interface configured to receive the plurality of files and the specified classification from a user and provide the plurality of files and the specified classification to the messaging content classifier.

26. The system of claim 25, wherein the user interface is further configured to allow a user to specify rules for the messaging filter.

27. The system of claim 26, wherein the rules specify which classes of individuals are permitted to send and receive a specified content classification associated with the rule.

28. The system of claim 27, wherein the messaging content classifier is configured to use one or more of the following identification techniques to identify commonalities between the plurality of files as well as to classify messages with one of the plurality of classes:

a fingerprinting analysis, a cluster analysis, a contextual analysis, and an adaptive lexical analysis.

29. The system of claim 24, wherein the forwarding logic is operable to forward the message to a recipient, quarantine the message, drop the message, or encrypt the message before forwarding the message to a recipient.

30. The system of claim 24, wherein the system is a messaging client, wherein the messaging client periodically receives updates from a messaging server comprising at least one of update rules, updated content classifications, or updated identifying characteristics for the content classifications.

31. The system of claim 24, wherein the message comprises an e-mail communication, an instant messaging communication, an HTTP communication, an FTP communication, a WAIS communication, a telnet communication, a Gopher communication, or a voice over internet protocol communication.

32. Computer readable storage media storing instructions that upon execution by a system processor cause the system processor to filter communications transmitted over a communication network based upon the content of a communication and upon the sender and recipient(s) of the communication, the media having stored instruction that cause the system processor to perform operations comprising:

for each of a plurality of sets of pre-existing files, defining a corresponding classification to be associated with the set of pre-existing files, the corresponding classification classifying content of the set of files as being associated with at least one of a plurality of departments of a business;

processing each of the sets of pre-existing files by one or more classification techniques;

generating a set of identifying characteristics for each corresponding classification, each set of identifying characteristics based on the set of pre-existing files associated with the corresponding classification;

for each of the plurality of corresponding classifications, receiving a rule specifying treatment of content identified as associated with the classification based on the set of known identifying characteristics; and

wherein each rule defines whether to forward a communication including content to a recipient based upon the classification of the content and at least one of the recipient and the sender.

receiving a communication from a user, the communication containing an originating address, a receiving address, and content;

determining whether the content of the communication substantially matches any of the corresponding classifications based upon the sets of known identifying characteristics associated with the corresponding classifications, respectively; and

forwarding the communication responsive to the rule associated with the substantially matched corresponding classification, wherein the rule specifies an action to perform on the communication based upon the corresponding classification of the communication and upon the originating address and the receiving address of the communication.