Preventing conflicts of interests between two or more groups

• US 10,223,366 B2
• Filed: 07/19/2016
• Issued: 03/05/2019
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Nextlabs
• Original Assignee: Nextlabs
• Inventors: Lim, Keng
• Primary Examiner(s): Singh, Amresh
• Application Number:
  US15/214,370
• Publication Number:
  US 20160328574A1
• Time in Patent Office: 959 Days
• Field of Search: None
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 9/468 Specific access rights for resources, e.g. using capability register
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

To prevent conflicts of interest, an information management system is used to make sure two or more groups are kept apart so that information does not circulate freely between these groups. The system has policies to implement an “ethical wall” to separate users or groups of users. The user or groups of user may be organized in any arbitrary way, and may be in the same organization or different organizations. The two groups (or two or more users) will not be able to access information belonging to the other, and users in one group may not be able to pass information to the other group. The system may manage access to documents, e-mail, files, and other forms of information.

Claims

1. A method of managing information comprising:

providing an information management system for an organization, wherein the information management system comprises a policy server comprising one or more rules to manage information of the organization;

providing a first user associated with the organization and a first document managed by the information management system;

determining the first user attempts to access the first document at a first computer then seeking approval from the policy server by evaluating a first rule of the one or more rules to manage information,

wherein the first rule is created before the first document and the first rule comprises a first conditional statement and a first abstraction component, the first abstraction component stored separately from the first rule at a second computer different than the first computer and the first abstraction component comprises a second conditional statement,

wherein the first user'"'"'s attempt corresponds to at least one operating system level operation comprising an operating system library function of an operating system, and

the first abstraction is defined in a definition statement stored separately from the policy server and the definition statement for the first abstraction includes at least one of a document category, a document storage location, a document sent by users of a group, a document received by users of a group, a document sent by a user of a Lightweight Directory Access Protocol (LDAP) group, or a document received by a user of a LDAP group and evaluating the first rule comprises;

retrieving the first abstraction component stored at the second computer and its associated second conditional statement, stored separately from the first rule;

determining a first result for the first conditional statement associated with the first rule to determine whether to allow access to the first document; and

determining the first result evaluates to a Boolean false, then blocking the first user from accessing the first document wherein the blocking comprises at least one of (a) blocking or altering an application program after it is invoked directly or indirectly by the first user but before accessing the first document;

(b) disabling or hiding a user interface element responsible for invoking an application program operation so that the first user cannot invoke the application program operation through the user interface element;

or (c) removing, altering or obscuring a part or all of the information accessed from the first document by making certain information not available to the first user.

2. The method of claim 1 comprising:

determining a second result for the second conditional statement associated with the first abstraction component to determine whether to allow access to the first document;

determining if the second result evaluates to a Boolean true, then permitting the first user to access the first document; and

determining if the second result evaluates to a Boolean false, then blocking the first user from accessing the first document.

3. The method of claim 2 comprising:

determining a third result of the evaluated first rule based on the first result associated with the first conditional statement and the second result associated with the second conditional statement;

determining if the third result evaluates to a Boolean true, then permitting the first user to access the first document; and

determining if the third result evaluates to a Boolean false, then blocking the first user from accessing the first document.

4. The method of claim 1 wherein the organization comprises a first group and a second group, and the first user is within the first group.

5. The method of claim 1 wherein seeking approval comprises:

receiving from the policy server the first result.

6. The method of claim 1 comprising permitting the first user to access the first document including allowing the operating system level operation on the first computer.

7. The method of claim 1 wherein the first user'"'"'s attempt comprises at least one of opening a file, deleting a file, changing a file'"'"'s security attributes, printing at least a portion of a document, opening an e-mail, sending an e-mail, forwarding an e-mail, attaching a document to an e-mail, editing a cell on a spreadsheet, cutting and pasting application data, requesting a report on a financial application, opening an order on an enterprise resource planning application, updating an order on an enterprise resource planning application, or creating a quote on a customer relationship management application.

8. The method of claim 1 wherein the policy server determines the first result.

9. The method of claim 1 wherein the at least one operating system level operation is an open operating system library function.

10. The method of claim 1 wherein the first document is stored on at least one of a direct attached storage (DAS) or a storage area network (SAN).

11. The method of claim 1 wherein the first user'"'"'s attempt to access the first document comprises one of opening/reading a file, reading a file when connected using VPN, opening a file at a particular time of a day, writing/saving a file, deleting a file, reading a file'"'"'s permission (or security setting), changing a file'"'"'s permission, reading a file'"'"'s attribute, or changing a file'"'"'s attribute.

12. The method of claim 1 wherein the first user'"'"'s attempt to access the first document includes a server application program specific operation.

13. The method of claim 1 wherein the seeking the approval from the policy server includes using network-level information to determine whether to allow the first user'"'"'s attempt.

14. The method of claim 1 wherein the policy server comprises a separate computing device than the second computer.

15. The method of claim 1 wherein the determining a first result comprises:

determining an identity of the first user;

evaluating the second conditional statement comprising determining whether the first user is a permitted user based on the identity of the first user; and

determining whether to allow access to the first document based on the evaluated second conditional statement.

16. The method of claim 1 wherein the at least one operating system level operation is detected when the first user attempts to access the first document and is prevented from being executed.