Information management system

• US 8,219,815 B2
• Filed: 12/17/2007
• Issued: 07/10/2012
• Est. Priority Date: 11/08/2000
• Status: Expired due to Term

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Malcolm, Peter Bryan, Napier, John A., Stickler, Andrew M., Tamblin, Nathan J., Beadle, Paul James O., Crocker, Jason P.
• Primary Examiner(s): Lipman, Jacob
• Application Number:
  US11/958,258
• Publication Number:
  US 20080301454A1
• Time in Patent Office: 1,667 Days
• Field of Search: 713/170
• US Class Current: 713/170
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information management system is described comprising one or more workstations running applications which allow a user of the workstation to connect to a network, such as the Internet. Each application has an analyzer, which monitors transmission data that the application is about to transmit to the network or has just received from the network, and which determines an appropriate action to take regarding that data. The analyzer may consult policy data containing a supervisor-defined policy to govern the workstations in order to determine what action to take. Such actions may be extracting data from the transmission data, such as passwords and usernames, digital certificates or eCommerce transaction details for storage and record keeping; ensuring that the transmission data is transmitted at an encryption strength appropriate to the contents of the transmission data; determining whether a check needs to be made as to whether a digital certificate received in transmission is valid; determining whether a transaction about to be made by a user of one of the workstations needs third party approval before it is made; and controlling the transmission of messages, such as e-mails according to a policy.

Claims

1. An information management system comprising:

one or more workstations connected to a computer network, each workstation having a memory;

an application stored in said memory of each workstation for transmitting outbound messages to said network and receiving inbound messages from said network;

policy data containing rules for determining one or more particulars of the outbound message, and for controlling the transmission of said outbound message in dependence on those particulars, wherein the one or more particulars include a plurality of certificates available to sign the message, a particular one of the plurality of certificates to be used in signing the message if the message is marked for signature, and whether the message contains one or more words in a pre-determined list of keywords; and

an analyzer, said analyzer determining, in conjunction with said policy data, one or more particulars of the outbound message and selecting, based on the policy data and the one or more particulars determined, a particular action for controlling the transmission of said outbound message from a plurality of actions comprising requiring that the message be digitally signed before transmission, notifying the sender of the message that digitally signing is recommended, requiring that a digitally signed message be transmitted without signature, and notifying the sender of the message digitally signing is not recommended.

2. The system of claim 1 wherein said network includes a server and said analyzer is located at a point on said network intermediate said one or more workstations and said server, or said analyzer is located at said server.

3. The system of claim 1 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the intended recipient or address of the message.

4. The system of claim 1 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on whether the message contains one or more keywords, or combination of keywords, in a pre-determined list of keywords.

5. The system of claim 1 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the identity author of the outbound message.

6. The system of claim 1 wherein whether the digitally signed message is required to be transmitted without signature, or whether it is, recommended that the digitally signed message be transmitted without signature, are dependent on the type of digital certificate or signing key used to digitally sign the message.

7. The system of claim 1 wherein the analyzer determines what digital certificates, or signing keys, are available to digitally sign an outbound message, and wherein whether the message is required to be digitally signed, whether the digitally-signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the type of certificate or signing key used to digitally sign the message, and on the types of digital certificate or signing key available to sign the message.

8. The system of claim 1 wherein the analyzer further causes the outbound message that is to be forwarded to first be re-directed to a third party for approval, wherein if the third party gives his approval, the outbound message is forwarded to the originally intended recipients in the normal way.

9. The system of claim 1 wherein said analyzer is located on each of said one or more workstations.

10. The system of claim 1 wherein said application is a web browser.

11. The system of claim 10 wherein said analyzer is a plug-in module of said web browser.

12. The system of claim 11 wherein said analyzer is a Browser Helper Object.

13. The system of claim 1 wherein said application is an e-mail client.

14. The system of claim 13 wherein said analyzer is a plug-in module of said e-mail client.

15. The system of claim 1 wherein said application is an Instant messaging application.

16. The system of claim 15 wherein said analyzer is a plug-in of said Instant messaging application.

17. The system of claim 1 wherein said application is a Voice Messaging application.

18. The system of claim 17 wherein said analyzer is a plug-in of said Voice messaging application.

19. An information management system comprising:

one or more workstations connected to a computer network, each workstation having a memory;

application means stored in said memory of each workstation for transmitting outbound messages to said network and receiving inbound messages from said network;

policy storage means for storing data containing rules for determining one or more particulars of the outbound message, said rules being for controlling the transmission of said outbound message in dependence on those particulars, wherein the one or more particulars include a plurality of certificates available to sign the message, a particular one of the plurality of certificates to be used in signing the message if the message is marked for signature, and whether the message contains one or more words in a pre-determined list of keywords; and

analyzing means, for determining, in conjunction with said policy data, one or more particulars of the outbound message and for selecting, based on the policy data and the one or more particulars determined, a particular action for controlling the transmission of said outbound message from a plurality of actions comprising requiring that the message be digitally signed before transmission, notifying the sender of the message that digitally signing is recommended, requiring that a digitally signed message be transmitted without signature;

and notifying the sender of the message that not digitally signing the message is recommended.

20. The system of claim 19 wherein said network includes a server and said analyzing means is located at a point on said network intermediate said one or more workstations and said server, or said analyzing means is located at said server.

21. The system of claim 19 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the intended recipient or address of the message.

22. The system of claim 19 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on whether the message contains one or more keywords, or combination of keywords, in a pre-determined list of keywords.

23. The system of claim 19 wherein whether the message is required to be digitally signed whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the identity of the author of the outbound message.

24. The system of claim 19 wherein whether the digitally signed message is required to be transmitted without signature, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the type of digital certificate or signing key used to digitally sign the message.

25. The system of claim 19 wherein the analyzing means determines what digital certificates, or signing keys, are available to digitally sign an outbound message, and wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the type of certificate or signing key used to digitally sign the message, and on the types of digital certificate or signing key available to sign the message.

26. The system of claim 19 wherein the analyzing means further causes the outbound message that is to be forwarded to first be re-directed to a third party for approval, wherein if the third party gives his approval, the outbound message is forwarded to the originally intended recipients in the normal way.

27. The system of claim 19 wherein said analyzing means is located on each of said one or more workstations.

28. The system of claim 19 wherein said application means is a web browser.

29. The system of claim 28 wherein said analyzing means is a plug-in module of said web browser.

30. The system of claim 29 wherein said analyzing means is a Browser Helper Object.

31. The system of claim 19 wherein said application means is an e-mail client.

32. The system of claim 31 wherein said analyzing means is a plug-in module of said e-mail client.

33. The system of claim 19 wherein said application means is an Instant messaging application.

34. The system of claim 33 wherein said analyzing means is a plug-in of said Instant messaging application.

35. The system of claim 19 wherein said application means is a Voice Messaging application.

36. The system of claim 35 wherein said analyzing means is a plug-in of said Voice messaging application.

37. A method of managing information comprising the steps of

providing one or more workstations connected to a computer network, each workstation having a memory;

providing an application stored in said memory of each workstation for transmitting outbound messages to said network and receiving inbound messages from said network;

providing policy data containing rules for determining one or more particulars of the outbound messages, and for controlling the transmission of said outbound message in dependence on those particulars;

analyzing, in conjunction with said policy data said outbound messages, to determine one or more particulars of said outbound messages, in particular, whether said outbound message is digitally signed, wherein the one or more particulars include a plurality of certificates available to sign the message, a particular one of the plurality of certificates to be used in signing the message if the message is marked for signature, and whether the message contains one or more words in a pre-determined list of keywords; and

selecting, based on the policy data and the one or more particulars determined, a particular action for controlling the transmission of said outbound messages from a plurality of actions comprising requiring that the outbound message be digitally signed before transmission, requiring that the outbound message, if digitally signed, not be digitally signed;

notifying the sender of the message that digitally signing is recommended, and notifying the sender of the message that digitally signing is not recommended.

38. The method of claim 37 wherein said network includes a server and said analyzing step is performed at a point on said network intermediate said one or more workstations and said server, or is performed at said server.

39. The method of claim 37 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature are dependent on the intended recipient or address of the message.

40. The method of claim 37 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on whether the message contains one or more keywords, or combination of keywords, in a predetermined list of keywords.

41. The method of claim 37 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the identity of the author of the outbound message.

42. The method of claim 37 wherein whether the digitally signed message is required to be transmitted without signature, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the type of digital certificate or signing key used to digitally sign the message.

43. The method of claim 37 comprising determining what digital certificates, or signing keys, are available to digitally sign an outbound message, and wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the type of certificate or signing key used to digitally sign the message, and on the types of digital certificate or signing key available to sign the message.

44. The method of claim 37 comprising causing the outbound message that is to be forwarded to first be re-directed to a third party for approval, wherein if the third party gives his approval, the outbound message is forwarded to the originally intended recipients in the normal way.

45. The method of claim 37 wherein said analyzing step is performed at each of said one or more workstations.

46. The method of claim 37 wherein said application is a web browser.

47. The method of claim 46 wherein said analyzing step is performed by a plug-in module of said web browser.

48. The method of claim 47 wherein said plug-in module is a Browser Helper Object.

49. The method of claim 37 wherein said application is an e-mail client.

50. The method of claim 49 wherein said analyzing step is performed by a plug-in module of said e-mail client.

51. The method of claim 37 wherein said application is an Instant messaging application.

52. The method of claim 51 wherein said analyzing step is, performed by a plug-in of said Instant messaging application.

53. The method of claim 37 wherein said application is a Voice Messaging application.

54. The method of claim 53 wherein said analyzing step is performed by a plug-in of said Voice messaging application.

55. A computer software product, for controlling a computer to manage information, said computer being connected to a network and having access to policy data containing rules for controlling transmission of outbound data to the network, comprising a recording medium readable by the computer, having program code recorded thereon which when executed on said computer configures the computer to:

analyze, in conjunction with an application running on said computer that transmits outbound messages to said network and receives inbound messages from said network, said outbound messages to determine in conjunction with said rules of said policy data one or more particulars of said outbound message, wherein the one or more particulars include a plurality of certificates available to sign the message, a particular one of the plurality of certificates to be used in signing the message if the message is marked for signature, and whether the message contains one or more words in a pre-determined list of keywords; and

select, based on the policy data and the one or more particulars determined, a particular action for controlling the transmission of said outbound messages from a plurality of actions comprising requiring that the outbound message be digitally signed before transmission, requiring that a digitally signed outbound message not be digitally signed;

notifying the sender of the outbound message that digitally signing is recommended, and notifying the sender of the outbound message in the case of a digitally signed message that digitally signing is not recommended.

56. The computer program product of claim 55 wherein said network includes a server and said program code is executable at a point on said network intermediate said one or more workstations and said server, or said program code is executable at said server.

57. The computer software product of claim 55 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the intended recipient or address of the message.

58. The computer software product of claim 55 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on whether the message contains one or more keywords, or combination of keywords, in a pre-determined list of keywords.

59. The computer software product of claim 55 wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the author of the outbound message.

60. The computer software product of claim 55 wherein whether the digitally signed message is required to be transmitted without signature, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the type of digital certificate or signing key used to digitally sign the message.

61. The computer software product of claim 55 wherein the program code determines what digital certificates, or signing keys, are available to digitally sign an outbound message, and wherein whether the message is required to be digitally signed, whether the digitally signed message is required to be transmitted without signature, whether it is recommended that the message be digitally signed, or whether it is recommended that the digitally signed message be transmitted without signature, are dependent on the type of certificate or signing key used to digitally sign the message, and on the types of digital certificate or signing key available to sign the message.

62. The computer software product of claim 55 wherein the program code further causes the outbound message that is to be forwarded to first be re-directed to a third party for approval, wherein if the third party gives his approval, the outbound message is forwarded to the originally intended recipients in the normal way.

63. The computer program product of claim 55 wherein said program code is executable at each of said computers.

64. The computer program product of claim 55 wherein said application is a web browser.

65. The computer program product of claim 64 wherein said program code when executed on said computer is a plug-in module of said web browser.

66. The computer program product of claim 65 wherein said plug-in module is a Browser Helper Object.

67. The computer program product of claim 55 wherein said application is an e-mail client.

68. The computer program product of claim 67 wherein said program code when executed on said computer is a plug-in module of said e-mail client.

69. The computer software product of claim 55 wherein said application is an Instant messaging application.

70. The computer software product of claim 69 wherein said program code when executed on said computer is a plug-in of said Instant messaging application.

71. The computer software product of claim 55 wherein said application is a Voice Messaging application.

72. The computer software product of claim 71 wherein said program code when executed on said computer is a plug-in of said Voice messaging application.