Information management system

• US 9,203,650 B2
• Filed: 11/08/2001
• Issued: 12/01/2015
• Est. Priority Date: 11/08/2000
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Malcolm, Peter Bryan, Napier, John Anthony, Stickler, Andrew Mark, Tamblin, Nathan John, Beadle, Paul James Owen, Crocker, Jason Paul
• Primary Examiner(s): Coppola, Jacob C.
• Application Number:
  US10/416,095
• Publication Number:
  US 20040078334A1
• Time in Patent Office: 5,136 Days
• Field of Search: 705 50- 79
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information management system is described comprising one or more workstations running applications which allow a user of the workstation to connect to a network, such as the Internet. Each application has an analyzer, which monitors transmission data that the application is about to transmit to the network or has just received from the network, and which determines an appropriate action to take regarding that data. The analyzer may consult policy data containing a supervisior-defined policy to govern the workstations in order to determine what action to take. Such actions may be extracting data from the transmission data, such as passwords and usernames, digital certificates or eCommerce transaction details for storage and record keeping; ensuring that the transmission data is transmitted at an encryption strength appropriate to the contents of the transmission data; determining whether a check needs to be made as to whether a digital certificate received in transmission is valid; determining whether a transaction about to be made by a user of one of the workstations needs third party approval before it is made; and controlling the transmission of messages, such as e-mails according to a policy.

Claims

1. An information management system comprising:

a plurality of workstations adapted for connection to a computer network, each workstation having a memory;

an application stored in said memory of each workstation configured to transmit an outbound message to said network for delivery to an intended recipient;

policy data containing rules for determining one or more particulars of the outbound message, and for controlling the transmission of said outbound message in dependence on those particulars; and

an analyser integrated into the application, said analyser configured to;

utilize said policy data to determine one or more particulars of the outbound message before transmission of the outbound message by the application;

selectively re-direct the outbound message to a third party instead of the originally intended recipient responsive to said policy data wherein the policy data is centrally defined for the plurality of workstations;

determine whether an address of the recipient of the outbound message is associated with a sender of the outbound message, by;

determining whether the address of the recipient contains one of a predetermined list of domain names; and

determining whether the address of the recipient contains at least one of a surname, first name, or initials of the sender of the outbound message; and

re-direct the outbound message to the third party in response to determining that the address of the recipient of the outbound message is associated with the sender of the outbound message.

2. The system of claim 1 wherein the analyser is further configured to re-direct the outbound message to said third party in response to determining that the message is to be sent to one or more of a predetermined list of recipients or addresses.

3. The system of claim 1 wherein the analyser is further configured to re-direct the outbound message to said third party in response to determining that the message contains one or more pre-determined keywords or combination of keywords.

4. The system of claim 1 wherein the analyser is further configured to:

re-direct the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission.

5. The system of claim 4 wherein the analyser is further configured to:

prevent the outbound message from being encrypted prior to re-directing the outbound message; and

re-direct the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

6. The system of claim 4 wherein the analyser is further configured to add text to the message before it is re-directed indicating that it is a re-directed message.

7. The system of claim 1 wherein the analyser further configured to re-direct the outbound message to said third party in response to determining that the message contains attachments, or particular types of attachments.

8. The system of claim 1 wherein the analyser further configured to re-direct the outbound message to said third party in response to determining that the message contains attachments and the body or the subject of the message contains less than a pre-determined amount of text.

9. The system of claim 1 wherein the analyzer is further configured to re-direct the outbound message to said third party in dependence on the identity of the author of the message.

10. The system of claim 1 further comprising a third party operable to approve or deny transmission of the message to the originally intended recipient.

11. The system of claim 1 wherein said analyser is located on each of said plurality of workstations.

12. The system of claim 1 wherein said application is a web browser.

13. The system of claim 12 wherein said analyser is a plug-in module of said web browser.

14. The system of claim 13 wherein said analyser is a dynamic-link library plugin to said web browser.

15. The system of claim, 1 wherein said application is an e-mail client.

16. The system of claim 15 wherein said analyser is a plug-in module of said e-mail client.

17. The system of claim 16 wherein said analyser is a client extension.

18. The system of claim 1 wherein said application is an instant messaging application.

19. The system of claim 18, wherein said analyser is a plug-in of said instant messaging application.

20. The system of claim 19 wherein said application is a voice messaging application.

21. The system of claim 20 wherein said analyser is a plug-in of said voice messaging application.

22. An information management system comprising:

a plurality of workstations adapted for connection to a computer network, each workstation having a memory;

application means, stored in said memory of each workstation, for transmitting an outbound message to said network for delivery to an intended recipient;

policy storage means for storing policy data containing rules for determining one or more particulars of the outbound message, said rules being for controlling the transmission of said outbound message in dependence on those particulars; and

analysing means, integrated into the application means, for;

determining, utilizing said policy data, one or more particulars of the outbound message before transmission of the outbound message by the application;

selectively re-directing the outbound message to a third party instead of the originally intended recipient responsive to said policy data wherein the policy data is centrally defined for the plurality of workstations;

determine whether an address of the recipient of the outbound message is associated with a sender of the outbound message, by;

determining whether the address of the recipient contains one of a predetermined list of domain names; and

determining whether the address of the recipient contains at least one of a surname, first name, or initials of the sender of the outbound message; and

re-direct the outbound message to the third party in response to determining that the address of the recipient of the outbound message is associated with the sender of the outbound message.

23. The system of claim 22 wherein the analysing means re-directs the outbound message to said third party in response to determining that the message is to be sent to one or more of a predetermined list of recipients or addresses.

24. The system of claim 22 wherein the analysing means re-directs the outbound message to said third party in response to determining that the message contains one or more predetermined keywords or combination of keywords.

25. The system of claim 22 wherein the analysing means re-directs the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission.

26. The system of claim 24 wherein the analysing means is further configured to:

prevent the outbound message from being encrypted prior to re-directing the outbound message; and

re-direct the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

27. The system of claim 24 wherein the analysing means adds text to the message before it is re-directed indicating that it is a re-directed message.

28. The system of claim 22 wherein the analysing means re-directs the outbound message to said third party in response to determining that the message contains attachments, or particular types of attachments.

29. The system of claim 22 wherein the analysing means re-directs the outbound message to said third party in response to determining that the message contains attachments and the body or the subject of the message contains less than a pre-determined amount of text.

30. The system of claim 22 wherein the analysing means re-directs the outbound message to said third party in dependence on the identity of the author of the message.

31. The system of claim 22 wherein the third party has means to approve the message for transmission to the originally intended recipient.

32. The system of claim 22 wherein said analysing means is located on each of said plurality of workstations.

33. The system of claim 22 wherein said application means is a web browser.

34. The system of claim 33 wherein said analysing means is a plug-in module of said web browser.

35. The system of claim 34 wherein said analysing means is a dynamic-link library plugin to said web browser.

36. The system of claim 22 wherein said application means is an e-mail client.

37. The system of claim 36 wherein said analysing means is a plug-in module of said e-mail client.

38. The system of claim 37 wherein said analysing means is a client extension.

39. The system of claim 22 wherein said application means is an instant messaging application.

40. The system of claim 39 wherein said analysing means is a plug-in of said instant messaging application.

41. The system of claim 22 wherein said application means is a voice messaging application.

42. The system of claim 41 wherein said analysing means is a plug-in of said voice messaging application.

43. A method of managing information comprising the steps of:

providing a plurality of workstations adapted for connection to a computer network, each providing an application stored in said memory of each workstation for transmitting an outbound message to said network for delivery to an intended recipient;

providing policy data containing rules for determining one or more particulars of the outbound message, and for controlling the transmission of said outbound message in dependence on those particulars wherein the policy data is centrally defined for the plurality of workstations;

analysing said outbound message before transmission of the outbound message by the application, using said application to determine, in conjunction with said policy data, said one or more particulars;

selectively re-directing the outbound message to a third party instead of the originally intended recipient in dependence on said one or more particulars;

determining whether an address of the recipient of the outbound message is associated with a sender of the outbound message, by;

determining whether the address of the recipient contains one of a predetermined list of domain names; and

determining whether the address of the recipient contains at least one of a surname, first name, or initials of the sender of the outbound message; and

re-directing the outbound message to the third party in response to determining that the address of the recipient of the outbound message is associated with the sender of the outbound message.

44. The method of claim 43 wherein the outbound message is re-directed to said third party in response to determining that the message is to be sent to one or more of a predetermined list of recipients or addresses.

45. The method of claim 43 wherein the outbound message is re-directed to said third party in response to determining that the message contains one or more pre-determined keywords or combination of keywords.

46. The method of claim 43 wherein selectively re-directing the outbound message comprises:

re-directing the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission.

47. The method of claim 46 wherein selectively re-directing the outbound message comprises:

preventing the outbound message from being encrypted prior to re-directing the outbound message; and

re-directing the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

48. The method of claim 46 comprising adding text to the message before it is re-directed indicating that it is a re-directed message.

49. The method of claim 43 wherein the outbound message is re-directed to said third party in response to determining that the message contains attachments, or particular types of attachments.

50. The method of claim 43 wherein the outbound message is re-directed to said third party in response to determining that the message contains attachments and the body or the subject of the message contains less than a pre-determined amount of text.

51. The method of claim 43 wherein the outbound message is re-directed to said third party in dependence on the identity of the author of the message.

52. The method of claim 43 comprising providing for the third party to approve the message for transmission to the originally intended recipient.

53. The method of claim 43 wherein said analysing step is performed at each of said plurality of workstations.

54. The method of claim 43 wherein said application is a web browser.

55. The method of claim 54 wherein said analysing step is performed by a plug-in module of said web browser.

56. The method of claim 55 wherein said plug in module is a dynamic-link library plugin to said web browser.

57. The method of claim 43 wherein said application is an e-mail client.

58. The method of claim 57 wherein said analysing step is performed by a plug-in module of said e-mail client.

59. The method of claim 58 wherein said plug-in module is a client extension.

60. The method of claim 43 wherein said application is an Instant messaging application.

61. The method of claim 60 wherein said analysing step is performed by a plug-in of said instant messaging application.

62. The method of claim 43 wherein said application is a voice messaging application.

63. The method of claim 62 wherein said analysing step is performed by a plug-in of said voice messaging application.

64. A computer software product, for controlling a computer to manage information, said computer being connected to a network and having access to policy data containing rules for controlling transmission of outbound data to the network, comprising a recording medium readable by the computer, having program code recorded thereon which when executed on said computer configures the computer to:

analyse, with an application running on said computer that transmits outbound messages to said network and receives inbound messages from said network, an outbound message to determine in conjunction with said rules of said policy data one or more particulars of said outbound message, wherein the analysing is performed before transmission of said outbound message by the application, and wherein the policy data is centrally defined for a plurality of computers including said computer;

selectively re-direct said outbound message to a third party instead of the originally intended recipient in dependence on said one or more particulars;

determine whether an address of the recipient of the outbound message is associated with a sender of the outbound message, by;

determining whether the address of the recipient contains one of a predetermined list of domain names; and

determining whether the address of the recipient contains at least one of a surname, first name, or initials of the sender of the outbound message; and

re-direct the outbound message to the third party in response to determining that the address of the recipient of the outbound message is associated with the sender of the outbound message.

65. The computer software product of claim 64 wherein the program code further configures the computer to re-direct the outbound message to said third party in response to determining that the message is to be sent to one or more of a pre-determined list of recipients or addresses.

66. The computer software product of claim 64 wherein the program code further configures the computer to re-direct the outbound message to said third party in response to determining that the message contains one or more pre-determined keywords or combination of keywords.

67. The computer software product of claim 64 wherein the program code further configures the computer to:

re-direct the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission.

68. The computer software product of claim 67 wherein the program code further configures the computer to:

prevent the outbound message from being encrypted prior to re-directing the outbound message; and

re-direct the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

69. The computer software product of claim 67 wherein the program code further configures the computer to add text to the message before it is re-directed indicating that it is a re-directed message.

70. The computer software product of claim 64 wherein the program code further configures the computer to re-direct the outbound message to said third party in response to determining that the message contains attachments, or particular types of attachments.

71. The computer software product of claim 64 wherein the program code further configures the computer to re-direct the outbound message to said third party in response to determining that the message contains attachments and the body or the subject of the message contains less than a pre-determined amount of text.

72. The computer software product of claim 64 wherein the program code further configures the computer to re-direct the outbound message to said third party in dependence on the identity of the author of the message.

73. The computer software product of claim 64 wherein the program code further configures the computer to allow the third party to approve or deny the message for transmission to the originally intended recipient.

74. The computer program product of claim 64 wherein said program code is executable at each of said computers.

75. The computer program product of claim 64, wherein said application is a web browser.

76. The computer program product of claim 75 wherein said program code when executed on said computer is a plug-in module of said web browser.

77. The computer program product of claim 76 wherein said plug-in module is a dynamic-link library plugin to said web browser.

78. The computer program product of claim 64 wherein said application is an e-mail client.

79. The computer program product of claim 78 wherein said program code when executed on said computer is a plug-in module of said e-mail client.

80. The computer program product of claim 79 wherein said plug-in module is a client extension.

81. The computer software product of claim 64 wherein said application is an instant messaging application.

82. The computer software product of claim 81 wherein said program code when executed on said computer is a plug-in of said instant messaging application.

83. The computer software product of claim 64 wherein said application is a voice messaging application.

84. The computer software product of claim 83 wherein said program code when executed on said computer is a plug-in of said voice messaging application.

85. An information management system comprising:

a plurality of computer workstations adapted for connection to a computer network, each computer workstation having a memory, each computer workstation storing an application in said memory including instructions executed by said workstation, the workstation configured to;

transmit an outbound message to said network for delivery to an intended recipient;

utilize policy data containing rules to determine the one or more particulars of the outbound message using an analyser integrated into the application before transmission of the outbound message by the application, wherein the policy data is centrally defined for the plurality of workstations;

control the transmission of said outbound message in dependence on the particulars of the outbound message;

selectively re-direct the outbound message using said analyser to a third party destination instead of the originally intended recipient responsive to said policy data;

determine whether an address of the recipient of the outbound message is associated with a sender of the outbound message, by;

determining whether the address of the recipient contains one of a predetermined list of domain names; and

determining whether the address of the recipient contains at least one of a surname, first name, or initials of the sender of the outbound message; and

re-direct the outbound message to the third party in response to determining that the address of the recipient of the outbound message is associated with the sender of the outbound message.

86. The system of claim 85 wherein the workstation is further configured to re-direct the outbound message to said third party in response to determining that the message is to be sent to one or more of a pre-determined list of recipients or addresses.

87. The system of claim 85 wherein the workstation is further configured to re-direct the outbound message to said third party in response to determining that the message contains one or more pre-determined keywords or combination of keywords.

88. The system of claim 85 wherein the workstation is further configured to:

re-direct the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission.

89. The system of claim 88 wherein the workstation configured to selectively re-direct the outbound message is further configured to:

prevent the outbound message from being encrypted prior to re-directing the outbound message; and

re-direct the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

90. The system of claim 85 wherein the workstation is further configured to add text to the message before it is re-directed indicating that it is a re-directed message.

91. The system of claim 85 wherein the workstation is further configured to re-direct the outbound message to said third party in response to determining that the message contains attachments, or particular types of attachments.

92. The system of claim 85 wherein the workstation is further configured to re-direct the outbound message to said third party in response to determining that the message contains attachments and if the body or the subject of the message contains less than a pre-determined amount of text.

93. The system of claim 85 wherein the workstation is further configured to re-direct the outbound message to said third party in dependence on the identity of the author of the message.

94. The system of claim 85 wherein the workstation is further configured to, when the re-directed message is received by the third party, allow the third party to approve or deny the message for transmission to the originally intended recipient.

95. The system of claim 85 wherein said analyser is located on each of said plurality of workstations.

96. An information management system comprising:

a plurality of workstations adapted for connection to a computer network, each workstation having a memory;

an application stored in said memory of each workstation configured to transmit an outbound message to said network for delivery to an intended recipient;

policy data containing rules for determining one or more particulars of the outbound message, and for controlling the transmission of said outbound message in dependence on those particulars; and

an analyser integrated into the application, said analyser configured to;

utilize said policy data to determine one or more particulars of the outbound message before transmission of the outbound message by the application;

selectively re-direct the outbound message to a third party instead of the originally intended recipient responsive to said policy data wherein the policy data is centrally defined for the plurality of workstations;

re-direct the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission;

prevent the outbound message from being encrypted prior to re-directing the outbound message; and

re-direct the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

97. An information management system comprising:

a plurality of workstations adapted for connection to a computer network, each workstation having a memory;

application means, stored in said memory of each workstation, for transmitting an outbound message to said network for delivery to an intended recipient;

policy storage means for storing policy data containing rules for determining one or more particulars of the outbound message, said rules being for controlling the transmission of said outbound message in dependence on those particulars; and

analysing means, integrated into the application means, for;

determining, utilizing said policy data, one or more particulars of the outbound message before transmission of the outbound message by the application;

selectively re-directing the outbound message to a third party instead of the originally intended recipient responsive to said policy data wherein the policy data is centrally defined for the plurality of workstations;

re-directing the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission;

preventing the outbound message from being encrypted prior to re-directing the outbound message; and

re-directing the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

98. A method of managing information comprising the steps of:

providing a plurality of workstations adapted for connection to a computer network, each providing an application stored in said memory of each workstation for transmitting an outbound message to said network for delivery to an intended recipient;

providing policy data containing rules for determining one or more particulars of the outbound message, and for controlling the transmission of said outbound message in dependence on those particulars wherein the policy data is centrally defined for the plurality of workstations;

analysing said outbound message before transmission of the outbound message by the application, using said application to determine, in conjunction with said policy data, said one or more particulars;

selectively re-directing the outbound message to a third party instead of the originally intended recipient in dependence on said one or more particulars;

re-directing the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission;

preventing the outbound message from being encrypted prior to re-directing the outbound message; and

re-directing the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

99. A computer software product, for controlling a computer to manage information, said computer being connected to a network and having access to policy data containing rules for controlling transmission of outbound data to the network, comprising a recording medium readable by the computer, having program code recorded thereon which when executed on said computer configures the computer to:

analyse, with an application running on said computer that transmits outbound messages to said network and receives inbound messages from said network, an outbound message to determine in conjunction with said rules of said policy data one or more particulars of said outbound message, wherein the analysing is performed before transmission of said outbound message by the application, and wherein the policy data is centrally defined for a plurality of computers including said computer;

selectively re-direct said outbound message to a third party instead of the originally intended recipient in dependence on said one or more particulars;

re-direct the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission;

prevent the outbound message from being encrypted prior to re-directing the outbound message; and

re-direct the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.

100. An information management system comprising:

a plurality of computer workstations adapted for connection to a computer network, each computer workstation having a memory, each computer workstation storing an application in said memory including instructions executed by said workstation, the workstation configured to;

transmit an outbound message to said network for delivery to an intended recipient;

utilize policy data containing rules to determine the one or more particulars of the outbound message using an analyser integrated into the application before transmission of the outbound message by the application, wherein the policy data is centrally defined for the plurality of workstations;

control the transmission of said outbound message in dependence on the particulars of the outbound message;

selectively re-direct the outbound message using said analyser to a third party destination instead of the originally intended recipient responsive to said policy data;

re-direct the outbound message to said third party in response to determining that the message or attachments to the message are to be encrypted before transmission;

prevent the outbound message from being encrypted prior to re-directing the outbound message; and

re-direct the unencrypted outbound message and its original encryption key to the third party to allow the third party to approve or deny transmission of the message.