Enforcing compliance policies in a messaging system

• US 8,073,911 B2
• Filed: 05/12/2005
• Issued: 12/06/2011
• Est. Priority Date: 05/12/2004
• Status: Active Grant

• Current Assignee: STERLING COMPUTERS CORPORATION
• Original Assignee: BLUESPACE SOFTWARE CORP. (STERLING COMPUTERS CORPORATION)
• Inventors: Marston, Justin, Hatch, Andrew Stuart
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Ali, Farhad
• Application Number:
  US11/129,212
• Publication Number:
  US 20060031351A1
• Time in Patent Office: 2,399 Days
• Field of Search: 709/206
• US Class Current: 709/206
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A messaging system enforces compliance policies for the electronic messages. The messaging system treats a set of related messages, such as an email string between two or more people, as a message container (200) having relational references to one or more submessages (210, 212, 214). A messaging server (112) stores the messages and submessages as discrete message components within a message database (416). In addition, the messaging server (112) stores one or more compliance policies. A compliance policy describes the set of rules that apply to message components during their lifecycles and is defined in terms of a population structure, a set of rules, and a set of jobcodes. When an action occurs that involves a piece of content, the messaging system identifies the relevant compliance policy in the governance policy database (424) and applies any rules that are applicable given the population structure and jobcode.

Claims

1. A computerized messaging server in an electronic messaging system, comprising:

a messaging module adapted to control a message database storing messages sent among users of the messaging system, at least one of the sent messages stored in the message database comprising a message container containing relational references pointing to a plurality of sent submessages stored externally to the message container in the message database, at least one of the sent submessages being one of a reply to and a forward of other sent submessages of the sent message; and

a governance module adapted to control a governance policy database storing a compliance policy describing rules applicable to the sent submessages, the governance module further adapted to determine rules described by the compliance policy that are applicable to ones of the plurality of sent submessages, wherein different rules of the compliance policy are applicable to different ones of the plurality of sent submessages;

wherein the messaging system is utilized by a set of entities in a population structure and wherein a rule of the compliance policy includes one or more rule elements describing whether the rule is applicable to a sent submessage, at least one of the rule elements selected from the group consisting of;

a source element describing a population structure entity that is a source of the sent submessage;

a target element describing a population structure entity that is a recipient of the sent submessage; and

a rank describing a ranking of the rule relative to other rules in the compliance policy.

2. The messaging server of claim 1, wherein the compliance policy describes a population structure of end-users of the messaging system, a set of jobcodes with which the sent submessages can be classified, and a set of rules applicable to the population structure, jobcodes, and sent submessages.

3. The messaging server of claim 2, wherein a jobcode describes a set of jobcode rules applicable to all sent submessages classified with the jobcode.

4. The messaging server of claim 2, wherein the messaging module is further adapted to receive an indication of a jobcode and of a sent submessage from an end-user, and is further adapted to associate the jobcode with the sent submessage responsive to receipt of the indication of the jobcode from the end-user.

5. The messaging server of claim 1, wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

communication rules describing which population structure entities can communicate with other population structure entities via the messaging system; and

readership rules describing which population structure entities can read messages from other population structure entities via the messaging system.

6. The messaging server of claim 1, wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

validity rules describing a time period for which a sent submessage or entity in the population structure is useable; and

retention rules describing a time period after which a sent submessage or entity in the population structure should be deleted from the messaging system.

7. The messaging server of claim 1, wherein the governance policy database further stores at least one prior compliance policy active at a time prior to a time at which the compliance policy was active, and wherein the sent submessages of the stored messages are associated with a compliance policy that was active at a time that content of the sent submessages was created.

8. The messaging server of claim 7, wherein at least one of the messages stored in the message database has a first sent submessage associated with a first compliance policy and a second sent submessage associated with a second compliance policy different from the first compliance policy, and wherein the governance module applies the rules described by the first compliance policy to the first sent submessage and applies the rules described by the second compliance policy to the second sent submessage.

9. The messaging server of claim 1, wherein the rules described by the compliance policy include search rules describing which population structure entities can view which sent submessages when searching the sent submessages stored by the messaging system.

10. A computer program product having a non-transitory computer-readable medium having embodied thereon program code for use in an electronic messaging system, the program code comprising:

a messaging module adapted to control a message database storing messages sent among users of the messaging system to at least one other end user of the messaging system, at least one of the sent messages comprising a message container containing relational references pointing to a plurality of sent submessages stored in the message database externally to the message container, at least one of the sent submessages being one of a reply to and a forward of other sent submessages of the sent message; and

a governance module adapted to control a governance policy database storing a compliance policy describing rules applicable to the sent submessages, the governance module further adapted to determine rules described by the compliance policy that are applicable to ones of the plurality of sent submessages, wherein different rules of the compliance policy are applicable to different ones of the plurality of sent submessages;

wherein the messaging system is utilized by a set of entities in a population structure and wherein a rule of the compliance policy includes one or more rule elements describing whether the rule is applicable to a sent submessage, at least one of the elements selected from the group consisting of;

a source element describing a population structure entity that is a source of the sent submessage;

a target element describing a population structure entity that is a recipient of the sent submessage; and

a rank describing a ranking of the rule relative to other rules in the compliance policy.

11. The computer program product of claim 10, wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

communication rules describing which population structure entities can communicate with other population structure entities via the messaging system;

readership rules describing which population structure entities can read messages from other population structure entities via the messaging system;

action rules describing actions a population structure entity can perform on a message component in the messaging system; and

search rules describing which population structure entities can view which message components when searching the messaging components stored by the messaging system.

12. The computer program product of claim 10, wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

validity rules describing a time period for which a sent submessage or entity in the population structure is useable; and

retention rules describing whether a sent submessage or entity in the population structure should be deleted from the messaging system.

13. A computer-implemented method of managing messages in an electronic messaging system, comprising:

defining a compliance policy describing rules applicable to sent submessages of sent messages in the electronic messaging system;

receiving a message sent by one end user of the messaging system to at least one other end user of the messaging system, the sent message comprising a message container containing relational references pointing to a plurality of sent submessages stored in a message database externally to the message container, the plurality of sent submessages including a first sent submessage and a second sent submessage, at least one of the sent submessages being one of a reply to and a forward of another sent submessage of the plurality of sent submessages; and

selectively applying rules of the compliance policy to the sent submessages;

wherein the messaging system is utilized by a set of entities in a population structure and wherein a rule of the compliance policy includes one or more rule elements describing whether the rule is applicable to a sent submessage, at least one of the elements selected from the group consisting of;

a source element describing a population structure entity that is a source of the sent submessage;

a target element describing a population structure entity that is a recipient of the sent submessage; and

a rank describing a ranking of the rule relative to other rules in the compliance policy.

14. The computer-implemented method of claim 13, wherein the compliance policy describes the set of entities in the population structure, the method further comprising:

defining a team containing a set of entities of the population structure; and

reflecting an action of an entity on the team across all of the entities on the team.

15. The computer-implemented method of claim 13, wherein the compliance policy describes the set of entities in the population structure, the method further comprising:

defining a group containing a set of entities, the entities in the group defined by their locations in a hierarchy defined by the hierarchical population structure; and

defining a set of rules applicable to the entities in the group.

16. The computer-implemented method of claim 13, wherein a rule of the compliance policy includes a rule element describing an action that is allowed or denied subject to approval by an entity in the population structure.

17. The computer-implemented method of claim 13, wherein defining the compliance policy comprises:

defining a set of rules describing digital rights management (DRM) actions that are allowed or denied on a sent submessage, the actions including one or more of printing, saving, taking offline, copying, and replying to, the sent submessage.

18. The computer-implemented method of claim 13, wherein the rules described by the compliance policy include one or more types of rules from the set consisting of:

communication rules describing which population structure entities can communicate with other population structure entities via the messaging system;

readership rules describing which population structure entities can read sent messages from other population structure entities via the messaging system;

action rules describing actions a population structure entity can perform on a sent submessage in the messaging system; and

search rules describing which population structure entities can view which sent submessages when searching the sent submessages stored by the messaging system.

19. The computer-implemented method of claim 13, wherein the rules described by the compliance policy include encryption rules describing whether and/or how to encrypt sent submessages.

20. The computer-implemented method of claim 13, wherein the rules described by the compliance policy include action rules describing actions an entity can perform on a sent submessage in the messaging system, and wherein the action rules describe a number of times within a given time period that the entity can perform a specified action.

21. The computer-implemented method of claim 13, further comprising:

defining a group of entities in the population structure;

defining group rules applicable to sent submessages related to the group of entities; and

applying the group rules to a sent submessage related to the group of entities.

22. The computer-implemented method of claim 21, wherein the defined group includes geographically-related population structure entities.

23. The computer-implemented method of claim 13, wherein applying the compliance policy to the message component comprises:

determining whether the compliance policy prohibits an attempted action on the sent submessage; and

recording the attempted action in a compliance log.

24. The computer-implemented method of claim 13, further comprising:

logging interactions with the messaging client in an audit log.

25. The computer-implemented method of claim 13, further comprising:

determining that a first rule of the compliance policy applies to the first sent submessage based at least in part on at least one of a source element and a target element of the first rule; and

determining that the first rule of the compliance policy does not apply to the second sent submessage based at least in part on at least one of the source element and the target element of the first rule;

wherein the source element of the first rule describes a population structure entity that is a source of a sent submessage with respect to which the first rule is evaluated, and the target element describes a population structure entity that is a recipient of the sent submessage with respect to which the first rule is evaluated.

26. The computer-implemented method of claim 13, wherein content of the first sent submessage was created at a first time and content of the second sent submessage was created at a second time later than the first time, the compliance policy active at the second time and associated with the second sent submessage, the method further comprising:

storing a prior compliance policy active at the first time and associated with the first sent submessage; and

responsive to an occurrence of an action associated with the message container;

responsive to determining that the prior compliance policy is associated with the first sent submessage, applying the prior compliance policy to the first sent submessage, and

responsive to determining that the compliance policy is associated with the second sent submessage, applying the compliance policy to the second sent submessage.

27. A computerized messaging server in an electronic messaging system, comprising:

a messaging module adapted to control an email database storing emails sent among users of the messaging system, wherein;

at least one of the sent emails comprises an email container containing relational references pointing to a plurality of sent submessages stored in the email database externally to the email container, at least one of the sent submessages being one of a reply to and a forward of other sent submessages of the message, and

each of the sent submessages is stored exactly once within the email database, and

upon receipt of a reply to a first email having a first email container containing a first sent submessage, the reply is added to the message container as an additional sent submessage but the first sent submessage is not duplicated within the email database; and

a governance module adapted to control a governance policy database storing a compliance policy describing rules applicable to the sent submessages, the governance module further adapted to determine rules described by the compliance policy that are applicable to ones of the plurality of sent submessages, wherein different rules of the compliance policy are applicable to different ones of the plurality of sent submessages,

wherein the messaging system is utilized by a set of entities in a population structure and wherein a rule of the compliance policy includes one or more rule elements describing whether the rule is applicable to a sent submessage, at least one of the elements selected from the group consisting of;

a source element describing a population structure entity that is a source of the sent submessage;

a target element describing a population structure entity that is a recipient of the sent submessage; and

a rank describing a ranking of the rule relative to other rules in the compliance policy.

28. The computerized messaging server of claim 27, wherein the email container additionally contains a reference to embedded graphics.

29. The computerized messaging server of claim 27, wherein the email container additionally contains a reference to a questionnaire.