Managing document access

• US 8,291,471 B2
• Filed: 04/06/2009
• Issued: 10/16/2012
• Est. Priority Date: 04/15/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Piccinini, Sandro, Pichetti, Luigi, Secchi, Marco, Secomandi, Antonio
• Primary Examiner(s): ZIA, SYED
• Application Number:
  US12/419,011
• Publication Number:
  US 20090257596A1
• Time in Patent Office: 1,289 Days
• Field of Search: 726/2, 713/156
• US Class Current: 726/2
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

Methods, computer program products and systems for protecting a document from access by one or more users based on one or more document access rules. In one embodiment, the method includes creating a data set representing the one or more document access rules, storing the document and the associated data set, determining and storing a key for opening the document when one or more document access rules from the data set are met, and releasing the key to open the document to one or more users in response to a request from a user which meets one or more document access rules, thereby enabling the user to access the document.

Claims

1. A method for managing access to a first document, the method comprising:

creating a first data set comprising metadata relating to the first document, the metadata relating to the first document comprising one or more document access rules for accessing the first document;

creating a second data set comprising metadata relating to a second document, the metadata relating to the second document comprising one or more document access rules for accessing the second document;

storing the first and second documents;

storing the metadata relating to the first document and the metadata relating to the second document;

determining and storing a key for accessing the first document on the condition that the one or more document access rules for accessing the first document are met;

releasing the key to one or more users responsive to a request from at least one user of the one or more users and to a determination that the one or more document access rules for accessing the first document are met, the one or more document access rules for accessing the first document comprising a rule requiring that the one or more document access rules for accessing the second document are met; and

enabling the one or more users to access the first document using the key.

2. The method of claim 1, further comprising requesting the key by means of an authorization request, wherein the authorization request is generated at a viewer plug-in as the at least one user attempts to open the document.

3. The method of claim 1, wherein the one or more document access rules for accessing the first document and/or the one or more document access rules for accessing the second document comprise one or more rules based on at least one of the following criteria:

a time, a date, a user access level, a trigger event or time, a user equipment, other user criteria, a start time or a finish time.

4. The method of claim 1, further comprising denying access to the first document by preventing determination of the key when the one or more document access rules for accessing the first document are unmet.

5. The method claim 1, wherein the releasing the key comprises transmitting the key to the one or more users.

16. The method of claim 1, further comprising:

initially storing the first document in an unencrypted state; and

encrypting the first document after a predetermined time period specified in the metadata relating to the first document has elapsed.

6. A computer program product comprising:

a non-transitory computer readable medium comprising computer program instructions for managing access to a first document and implemented by a computer system, the program instructions comprising instructions for;

attempting to open the first document by means of a document viewer;

creating a first data set comprising metadata relating to the first document, the metadata comprising one or more document access rules for accessing the first document;

creating a second data set comprising metadata relating to a second document, the metadata relating to the second document comprising one or more document access rules for accessing the second document;

storing the metadata relating to the first document and the metadata relating to the second document in a storage medium;

sending an authorization request from the document viewer to an authorization server asking for permission to open the first document;

receiving a key for accessing the first document generated by the authorization server responsive to a determination that the request meets the one or more document access rules for accessing the first document, the one or more document access rules for accessing the first document comprising a rule requiring that the one or more document access rules for accessing the second document are met; and

enabling access of the first document using the key to allow one or more users to view the first document.

7. The computer program product of claim 6, wherein the first document and the second document are stored in the storage medium.

8. The computer program product of claim 6, further comprising program instructions for deriving the one or more document access rules for accessing the first document from the first data set and program instructions for deriving the one or more document access rules for accessing the second document from the second data set.

9. The computer program product of claim 8, further comprising program instructions for basing one of more rules of the document access rules for accessing the first document and/or the document access rules for accessing the second document on at least one of the following criteria:

a time, a date, a user access level, a trigger event or time, a user equipment, other user criteria, a start time or a finish time.

10. The computer program product of claim 6, further comprising program instructions for denying access to the first document by preventing determination of the key when the document access rules for accessing the first document are unmet.

11. The computer program product of claim 6, further comprising program instructions for releasing the key for accessing the first document.

12. The computer program product of claim 11, further comprising program instructions for transmitting the key to the one of more users.

17. The computer program product of claim 6, the computer-readable medium further comprising:

program instructions for initially storing the first document in an unencrypted state; and

program instructions for encrypting the first document after a predetermined time period specified in the metadata relating to the first document has elapsed.

13. A system for managing document access to a first document, the system comprising:

a processor; and

a computer memory operatively coupled to the processor;

the computer memory having disposed therein computer program instructions for;

creating a first data set comprising metadata relating to the first document, the metadata comprising one or more document access rules for accessing the first document;

creating a second data set comprising metadata relating to a second document, the metadata relating to the second document comprising one or more document access rules for accessing the second document;

storing the first and second documents;

storing the metadata relating to the first document and the metadata relating to the second document;

determining and storing a key for accessing the first document

on the condition that the one or more document access rules for accessing the first document are met;

releasing the key to one or more users responsive to a request from at least one user of the one or more users and to a determination that the one or more document access rules for accessing the first document are met, the one or more document access rules for accessing the first document comprising a rule requiring that the one or more document access rules for accessing the second document are met; and

enabling the one or more users to access the first document using the key.

14. The system of claim 13, further comprising a viewer plug-in for opening the first document, the viewer plug-in storing the first data set.

15. The system of claim 13, further comprising an authorization server, wherein the viewer plug-in sends an authorization request to the authorization server.

18. The system of claim 13, the memory having further disposed therein computer program instructions for:

initially storing the first document in an unencrypted state; and

encrypting the first document after a predetermined time period specified in the metadata relating to the first document has elapsed.