Method and apparatus to report policy violations in messages

• US 8,595,849 B2
• Filed: 12/30/2010
• Issued: 11/26/2013
• Est. Priority Date: 09/18/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Jones, Chris, Chen, Hai, Ansanelli, Joseph, Wolfe, Michael R., Rowney, Kevin T.
• Primary Examiner(s): REYES, MARIELA D
• Application Number:
  US12/982,750
• Publication Number:
  US 20110099638A1
• Time in Patent Office: 1,062 Days
• Field of Search: 707/781, 707/783
• US Class Current: 726/26
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method and apparatus for reporting policy violations in messages is described. A violation is identified by detecting fragments in a message that match information from any one or more rows within a tabular structure of source data. The fragments that match this information are then specified as part of reporting the violation.

Claims

1. A method comprising:

identifying, by a computing device, a policy that protects use-restricted content, the use-restricted content stored in a tabular structure of source data comprising a plurality of data elements in a plurality of columns and a plurality of rows, wherein the policy identifying the use-restricted content is stored separately from the user-restricted content;

searching, based on the policy, text in a message for the use-restricted content;

identifying a violation of the policy when detecting fragments in the message that match one or more of the plurality of data elements of the use-restricted content from one or more of the plurality of columns and one or more of the plurality of rows within the tabular structure; and

specifying, in a report of the violation;

the detected fragments in the message that match the one or more data elements of the use-restricted content from the one or more columns and the one or more rows within the tabular structure, and

the one or more columns within the tabular structure that contain the data elements matching the detected fragments in the message.

2. The method of claim 1 wherein the fragments that match are specified in the report via any one of a user interface and a structured output format.

3. The method of claim 1 wherein the specifying further comprises specifying, the in the report of the violation, at least one of a message component containing the fragments that match, the source data, the one or more rows within the tabular data structure, a number of the one or more rows within the tabular data structure, a policy being violated, and one or more rules of the policy being violated.

4. The method of claim 1 wherein the identifying the violation comprises:

searching the message for the fragments that contain one or more sub-sets of tokens, each of the one or more sub-sets of tokens matching information from a single row within the tabular data structure; and

determining that the message violates a predefined policy.

5. The method of claim 4 wherein the predefined policy comprises at least one rule selected from the group consisting of one or more rules pertaining to the source data, a rule specifying an expression pattern, a rule specifying a message attachment type, a rule specifying a message attachment size, a rule specifying a sender identifier pattern, a rule specifying a recipient identifier pattern, a rule specifying keywords, a rule specifying a file attachment name pattern, a rule specifying a protocol to carry the message, and a rule specifying a newsgroup name.

6. The method of claim 1 wherein the specifying, in the report of the violation, the fragments comprises highlighting the fragments that match on a screen.

7. The method of claim 6 further comprising:

providing a link from the fragments that match highlighted on the screen to the message containing the matching fragments.

8. The method of claim 1 wherein the specifying, in the report of the violation, the fragments comprises:

determining a permission level of a user with respect to access to the source data; and

presenting information pertaining to the fragments that match in accordance with the permission level of the user.

9. The method of claim 8 wherein the presenting information pertaining to the matching fragments comprises:

notifying the user about the fragments that match without displaying the matching fragments to the user.

10. The method of claim 8 wherein the presenting information pertaining to the fragments that match comprises:

identifying, to the user, columns within the tabular data structure that contain data matching the fragments from the message, without displaying the matching fragments to the user.

11. A system comprising:

a memory; and

a processor coupled with the memory, the process configured to;

identify a policy that protects use-restricted content, the use-restricted content stored in a tabular structure of source data comprising a plurality of data elements in a plurality of columns and a plurality of rows, wherein the policy identifying the use-restricted content is stored separately from the user-restricted content

search, based on the policy, text in a message for the use-restricted content;

identify a violation of the policy when detecting fragments in the message that match one or more of the plurality of data elements of the use-restricted content from one or more of the plurality of columns and one or more of the plurality of rows within the tabular structure; and

specify, in a report of the violation;

the detected fragments in the message that match the one or more data elements of the use-restricted content from the one or more columns and the one or more rows within the tabular structure, and

the one or more columns within the tabular structure that contain the data elements matching the detected fragments in the message.

12. The system of claim 11 further comprising a user interface to specify the fragments.

13. The system of claim 11 wherein the processor is further configured to specify, in the report of the violation, at least one of a message component containing the fragments that match, the source data, the one or more rows within the tabular data structure, a number of the one or more rows within the tabular data structure, a policy being violated, and one or more rules of the policy being violated.

14. The system of claim 11 wherein a policy being violated comprises at least one rule selected from the group consisting of one or more rules pertaining to the source data, a rule specifying an expression pattern, a rule specifying a message attachment type, a rule specifying a message attachment size, a rule specifying a sender identifier pattern, a rule specifying a recipient identifier pattern, a rule specifying keywords, a rule specifying a file attachment name pattern, a rule specifying a protocol to carry the message, and a rule specifying a newsgroup name.

15. The system of claim 11 wherein the processor is further configured to highlight the fragments that match in the report of the violation that is displayed on a screen to a user.

16. The system of claim 11 wherein the processor is further configured to specify the fragments by determining a permission level of a user with respect to access to the source data, and present information pertaining to the fragments that match in accordance with the permission level of the user.

17. A non-transitory computer readable medium including instructions that, when executed by a processor, cause the processor to perform a method comprising:

identifying, by the processor, a policy that protects use-restricted content, the use-restricted content stored in a tabular structure of source data comprising a plurality of data elements in a plurality of columns and a plurality of rows of, wherein the policy identifying the use-restricted content is stored separately from the user-restricted content

searching, based on the policy, text in a message for the use-restricted content;

identifying a violation of the policy when detecting fragments in the message that match one or more of the plurality of data elements of the use-restricted content from one or more of the plurality of columns and one or more of the plurality of rows within the tabular structure; and

specifying, in a report of the violation;

the detected fragments in the message that match the one or more data elements of the use-restricted content from the one or more columns and the one or more rows within the tabular structure, and

the one or more columns within the tabular structure that contain the data elements matching the detected fragments in the message.

18. The computer readable medium of claim 17 wherein the specifying, in the report of the violation, further comprises specifying at least one of a message component containing the fragments that match, the source data, the one or more rows within the tabular data structure, a number of the one or more rows within the tabular data structure, a policy being violated, and one or more rules of the policy being violated.

19. The computer readable medium of claim 17 wherein identifying the violation comprises:

searching the message for the fragments that contain one or more sub-sets of tokens, each of the one or more sub-sets of tokens matching information from a single row within the tabular data structure; and

determining that the message violates a predefined policy.

20. The computer readable medium of claim 17 wherein the specifying, in the report of the violation, the fragments comprises highlighting the fragments that match on a screen.