Decryption of electronic communication in an electronic discovery enterprise system

• US 8,572,376 B2
• Filed: 11/13/2009
• Issued: 10/29/2013
• Est. Priority Date: 03/27/2009
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Andersen, David M., Mayer, Michael J., Miller, Emerson D.
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Korsak, Oleg
• Application Number:
  US12/618,430
• Publication Number:
  US 20100250931A1
• Time in Patent Office: 1,446 Days
• Field of Search: 713/168, 707/809, 707/741, 707/785
• US Class Current: 713/168
• CPC Class Codes: G06F 16/325 Hash tables
• CPC Class Codes: G06F 16/35 Clustering; Classification
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 50/18 Legal services

Abstract

Apparatus, methods and computer program products are described herein for automatically decrypting electronic communication that is harvested from custodians in an enterprise-wide electronic discovery system. Automatic decryption provides for electronic communication that is encrypted to be decrypted, even in instances in which the system is not provided the password and/or decryption key(s) from the encrypting custodian. The automatic decryption process, which ensues prior to delivering data to the third party data analysis provider or the requesting party, allows for data that may otherwise be unavailable or incomprehensible to the third party or requester to be readily accessible. Thus, decryption of such data in a relatively efficient and automated manner is highly beneficial.

Claims

1. A method for electronic communication decryption in an enterprise-wide electronic discovery system, the method comprising:

generating, by a computing device processor, a user identification file database by scanning at least a portion of an enterprise-wide network for user identification files and adding user identification files identified during the scan to the user identification file database;

identifying, by a computing device processor, a file owner for each of a plurality of user identification files stored in the user identification file database by parsing a name of each of the user identification files and comparing parsed data to data stored in enterprise human resources databases to identify the file owner for each of the user identification files;

identifying, by a computing device processor, a password for each of the plurality of user identification files stored in the user identification file database by parsing a name of each of the user identification files to deduce the password from within the name of the user identification file;

verifying, by a computing device processor, the validity of each of the passwords by applying the password to an associated user identification file to determine that the password is successful in rendering one or more decryption keys;

in response to successful verification of the validity of the password, recording the file owner and the password in an entry of the user identification file in the user identification file database; and

decrypting, automatically, encrypted electronic communication entries in electronic communication files collected from custodians in the electronic discovery system by;

automatically generating a client-specific communication session based on an electronic communication file being associated with a user identification file based on a same file owner,

accessing the electronic communication file within the client-specific communication session,

automatically identifying encrypted electronic communication entries in the electronic communication file,

accessing the associated user identification file based on the identified password to provide the decryption key for decrypting the encrypted electronic communication entries, and

decrypting the encrypted electronic communication entries by application of the decryption key,

wherein the custodians are limited to individuals or groups of individuals within the enterprise who created or are associated with electronic data required to be collected in an electronic discovery matter and wherein the electronic discovery matter is one of a legal proceeding, audit or forensic investigation in which electronic data is sought, located, secured and searched with the intent of using it as evidence.

2. The method of claim 1, wherein generating a user identification file database further comprises retrieving one or more user identification file databases from one or more of an enterprise server of an enterprise file share.

3. The method of claim 1, wherein identifying a file owner for each of the plurality of user identification files in the user identification database further comprises analyzing content of a user identification file and comparing the content to one or more enterprise databases to identify the owner of the files.

4. The method of claim 1, wherein identifying a password further comprises deciphering the password from the user identification file name.

5. The method of claim 1, wherein identifying a password further comprises brute-force deciphering of the password.

6. A system for decrypting electronic communication in an enterprise-wide electronic discovery system, the system comprising:

a computing platform including at least one processor and a memory; and

a decryption module stored in the memory, in communication with at least one of the one or more processors and configured to automatically decrypt encrypted entries in an electronic communication file, wherein the module includes,

a user identification file database generator configured to generate a user identification file database by scanning at least a portion of an enterprise-wide network for user identification files and adding user identification files identified during the scan to the user identification file database,

a user identification file owner identifier configured to identify the owner of each of a plurality of user identification files stored in the user identification file database by parsing a name of each of the user identification files and comparing parsed data to data stored in enterprise human resources databases to identify the file owner for each of the user identification files,

a user identification file password identifier configured to determine an associated password for each of the plurality of user identification files stored in the user identification file database by parsing a name of each of the user identification files to deduce the password from within the name of the user identification file,

a password verifier configured to verify the validity of each of the determined passwords by applying the password to an associated user identification file to determine that the password is successful in rendering one or more decryption keys,

a recorder configured to, in response to successful verification of the validity of the password, record the password and owner as an entry in the associated user identification file of the user identification file database, and

a decryption application configured to automatically decrypt encrypted entries in electronic communication files collected from custodians in the electronic discovery system and including;

a communication session generator configured to automatically generate a client-specific communication session based on an electronic communication file being associated with a user identification file based on a same file owner,

an encryption entry identifier configured to access the electronic communication file within the client-specific communication session and identify encrypted electronic communication entries in the electronic communication file, and

a decryption routine configured to access the associated user identification file based on the identified password to provide the decryption key for decrypting the encrypted electronic communication entries and decrypt the encrypted electronic communication entries by application of the decryption key,

wherein the custodians are limited to individuals or groups of individuals within the enterprise who created or are associated with electronic data required to be collected in an electronic discovery matter and wherein the electronic discovery matter is one of a legal proceeding, audit or forensic investigation in which electronic data is sought, located, secured and searched with the intent of using it as evidence.

7. The system of claim 6, wherein the user identification file database generator is further configured to retrieve one or more user identification file databases from one or more of an enterprise server of an enterprise file share.

8. The system of claim 6, wherein the user identification file owner identifier is further configured to analyze content of a user identification file and compare the content to one or more enterprise databases to identify the owner of the files.

9. The system of claim 6, wherein the user identification file password identifier is further configured to decipher the password from the user identification file name.

10. The system of claim 6, wherein the user identification file password identifier is further configured to brute-force decipher the password.

11. A computer program product comprising:

a non-transitory computer-readable medium comprising;

a first set of codes for causing a computer to generate a user identification file database by scanning at least a portion of an enterprise-wide network for user identification files and adding user identification files identified during the scan to the user identification file database;

a second set of codes for causing a computer to identify a file owner for each of a plurality of user identification files stored in the user identification file database by parsing a name of each of the user identification files and comparing parsed data to data stored in enterprise human resources databases to identify the file owner for each of the user identification files;

a third set of codes for causing a computer to identify a password for each of the plurality of user identification files stored in the user identification file database by parsing a name of each of the user identification files to deduce the password from within the name of the user identification file;

a fourth set of codes for causing a computer to verify the validity of each of the passwords by applying the password to an associated user identification file to determine that the password is successful in rendering one or more decryption keys;

a fifth set of codes for causing a computer to, in response to successful verification of the validity of the password, record the file owner and the password in an entry of the user identification file in the user identification file database; and

a sixth set of codes for causing a computer to decrypt, automatically, encrypted electronic communication entries in electronic communication files collected from custodians in the electronic discovery system by;

automatically generating a client-specific communication session based on an electronic communication file being associated with a user identification file based on a same file owner,

accessing the electronic communication file within the client-specific communication session,

automatically identifying encrypted electronic communication entries in the electronic communication file,

accessing the associated user identification file based on the identified password to provide the decryption key for decrypting the encrypted electronic communication entries, and

decrypting the encrypted electronic communication entries by application of the decryption key,

wherein the custodians are limited to individuals or groups of individuals within the enterprise who created or are associated with electronic data required to be collected in an electronic discovery matter and wherein the electronic discovery matter is one of a legal proceeding, audit or forensic investigation in which electronic data is sought, located, secured and searched with the intent of using it as evidence.

12. The computer program product of claim 11, wherein the first set of codes is further configured to cause the computer to retrieve one or more user identification file databases from one or more of an enterprise server of an enterprise file share.

13. The computer program product of claim 11, wherein the second set of codes is further configured to cause the computer to analyze content of a user identification file and compare the content to one or more enterprise databases to identify the owner of the files.

14. The computer program product of claim 11, wherein the third set of codes is further configured to cause the computer to decipher the password from the user identification file name.

15. The computer program product of claim 11, wherein the third set of codes is further configured to cause the computer to brute-force deciphering of the password.