Handling files containing confidential or sensitive information

• US 8,205,078 B2
• Filed: 02/20/2009
• Issued: 06/19/2012
• Est. Priority Date: 06/27/2002
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bhogal, Kulvir Singh, Dinh, Hung The, Hu, Teng, Ishmael, Nizamudeen Jr., Sidhu, Mandeep Singh
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US12/389,495
• Publication Number:
  US 20090158391A1
• Time in Patent Office: 1,215 Days
• Field of Search: 726 1- 2, 726/16, 726/30, 726/5, 726/18, 726/19, 726/27, 713/193, 713/165, 709/219, 707/9
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method, apparatus, and computer instructions for managing files in a data processing system. An attribute for a file is specified as having a special designation. The file with the attribute having the special designation is processed, by the operating system, in a different manner from other files when performing operations, such as, for example, copying the file to a removable media, printing the file, or sending the file over a network.

Claims

1. A data processing system for managing files, the data processing system comprising:

a bus system;

a communications unit connected to the bus system;

a memory connected to the bus system, wherein the memory includes a set of instructions; and

a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to determine whether a confidentiality attribute has been set for a file and a type of file access being requested in response to receiving a file access request from a user application;

determine whether the type of file access being requested is one of a plurality of pre-specified access types in response to determining that the confidentiality attribute is set; and

process the file access request using pre-specified confidentiality protection procedures associated with one of the plurality of pre-specified access types in response to determining that the type of file access being requested is the one of the plurality of pre-specified access types.

2. A data processing system for managing files, the data processing system comprising a processor capable of executing:

determining means, responsive to receiving a request to access a file, for determining whether a confidentiality attribute has been set for the file and a type of file access being requested;

processing means, responsive to determining that the confidentiality attribute is set, for determining whether the type of file access being requested is one of a plurality of pre-specified access types; and

processing means, responsive to determining that the type of file access being requested is one of the plurality of pre-specified access types, for processing the request to access the file using pre-specified confidentiality protection procedures associated with the one of the plurality of pre-specified access types.

3. The data processing system of claim 2, wherein the processing means comprises:

displaying means for displaying a confidentiality designation.

4. The data processing system of claim 2, wherein the processing means comprises:

ensuring means for ensuring the file is encrypted before allowing the file to be sent of the network.

5. The data processing system of claim 2, wherein the processing means comprises:

including means for automatically including a confidentiality notice to an email to which the file is attached when sending the file over the network.

6. The data processing system of claim 2, wherein the processing means comprises:

adding means for adding a designation to pages printed when printing the file.

7. The data processing system of claim 2, wherein the processing means comprises:

displaying means for displaying a statement regarding handling of the file performing one of detaching the file from an email message, copying the file, deleting the file, and moving the file.

8. The data processing system of claim 2, wherein the processing means is a first processing means and wherein the processor is further capable of executing:

second processing means, responsive to determining that the confidentiality attribute is set, for processing the request to access the file when the request is to send the file to an output device.

9. The data processing system of claim 8, wherein the output device is a network adapter.

10. The data processing system of claim 8, wherein the output device is a printer.

11. The data processing system of claim 8, wherein the processing means includes:

presenting means for presenting a warning in which the warning indicates confidential data is present in the file when the request is to send the file to an output device.

12. The data processing system of claim 8, wherein the output device is a network adapter and wherein the processing means includes:

means for determining whether the file is encrypted when sending the file onto a network through the network adapter; and

preventing means for preventing sending of the file onto the network if the file is unencrypted.

13. The data processing system of claim 2, wherein the determining means is a first determining means and wherein the processing means further includes:

second determining means for determining whether the file is encrypted when the request is to attach the file to an email message; and

preventing means for preventing attachment of the file if the file is unencrypted.

14. The data processing system of claim 2, wherein the determining means and the processing means are located in an operating system executing on the processor.

15. A non-transitory computer readable media having a computer program product for managing files, the computer program product comprising:

first instructions, responsive to receiving a request to access a file, for determining whether a confidentiality attribute has been set for the file and a type of file access being requested;

second instructions, responsive to determining that the confidentiality attribute is set, for determining whether the type of file access being requested is one of a plurality of pre-specified access types; and

third instructions, responsive to determining that the type of file access being requested is one of the plurality of pre-specified access types, for processing the request to access the file using pre-specified confidentiality protection procedures associated with the one of the plurality of pre-specified access types.