Information aggregation, processing and distribution system

• US 20040111639A1
• Filed: 06/10/2003
• Published: 06/10/2004
• Est. Priority Date: 02/14/2000
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Scott, William D., Schwartz, Michael I., Auten, Charles W., Flesher, Kevin E., Tolley, Richard G., Franklin, Keith
• Granted Patent: US 7,437,408 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/302 gathering intelligence information for situation awareness or reconnaissance

Abstract

A utility is provided for managing exchanges of information within a context involving multiple users, for example, multi-user network collaboration. The invention enables automatic enforcement of a policy regarding sensitive information. The policy may be negotiated among the users and expressed as multiple rule sets that govern access to a use of sensitive information. The utility also logs activities involving sensitive information to ensure compliance with the policy. These logs can be audited by a third party or automatically processed for audit compliance by the utility. In this manner, an environment of trust is created which encourages fruitful collaboration.

Claims

1. A method for use in enabling collaboration among multiple network users and protecting sensitive information of one or more of the users, comprising the steps of:

establishing a collaborative environment for collaboration among said multiple network users, said collaborative environment including network structure for use in enabling a collaboration with respect to collaboration subject matter including sensitive information subject to a policy regarding handling thereof relative to said network users, said collaborative environment further including a computer-based tool for automatic enforcement of said policy; and

using said computer-based tool to manage said collaboration by monitoring activities relating to said collaboration subject matter using said network structure, identifying an activity concerning a portion of said sensitive information and controlling said identified activity based on said policy.

2. A method as set forth in claim 1, wherein said sensitive information includes multiple items of sensitive information associated with multiple network users.

3. A method as set forth in claim 2, wherein said multiple items of sensitive information are associated with multiple rule sets regarding dissemination thereof.

4. A method as set forth in claim 1, wherein said computer based tool is operative for processing an item of said collaboration including a portion of said sensitive information in accordance with said policy so as to provide multiple, different presentations of said item to multiple ones of said network users.

5. A method as set forth in claim 1, wherein said multiple network users include government users and non-government users, and said policy includes first rules governing dissemination of information as between government and non-government users.

6. A method as set forth in claim 1, wherein said sensitive information includes personal information and said policy includes first rules for protecting the privacy of said information.

7. A method as set forth in claim 1, wherein said computer-based tool is further operative for compiling a log of activities involving said sensitive information so that a party can review said log to verify compliance with said policy.

8. A method as set forth in claim 7, wherein said computer-based tool is further operative for automated processing of said log for auditing compliance with said policy in accordance with pre-established audit rules.

9. A method as set forth in claim 1, wherein said computer-based tool is operative for associating a classification with said portion of said sensitive information and using said classification to enforce said policy.

13. A method as set forth in claim 1, wherein said collaborative environment involves multiple groups of network users where each group is associated with a policy governing activities involving sensitive information within said group, and said computer-based tool is further operative for automatically executing rules controlling activities involving sensitive information as between a first one of said groups and a second one of said groups.

10. A method as set forth in claim 10, wherein said classification determines which ones of said multiple network users are entitled to use said portion of said sensitive information.

11. A method as set forth in claim 10, wherein said classification determines what kinds of activities a particular one of said users is entitled to perform involving said sensitive information.

12. A method as set forth in claim 10, wherein said classification is part of a classification system defining multiple classes associated with multiple rule sets governing use of said sensitive information.

14. A method for use in managing access to and release of information in a collaborative environment, comprising the steps of:

establishing a collaborative environment for collaboration among said multiple network users, said collaborative environment including network structure for use in enabling a collaboration with respect to collaboration subject matter including sensitive information subject to a policy regarding handling thereof relative to particular ones of said network users, said collaborative environment further including a computer-based tool for monitoring activities involving said collaboration subject matter;

first operating said computer-based tool to identify an activity involving said sensitive information; and

second operating said computer-based tool to establish a log entry for said activity identifying a user associated with said activity and a nature of said activity.

15. A method as set forth in claim 14, wherein said identified activity involves one of transfer of and attempted access to a portion of said sensitive information.

16. A method as set forth in claim 14, wherein said computer-based tool is further operative for auditing compliance with said policy based on pre-established audit rules.

17. A method for use in managing access to and release of information in a collaborative environment, comprising the steps of:

establishing a network structure for handling information relative to multiple users of the network structure, said information including sensitive information subject to a policy regarding handling thereof;

storing rules defining said policy;

first operating a computer-based tool to monitor operation of said network structure to identify an activity concerning an item of said sensitive information involving a particular user;

in response to said monitoring, second operating said computer-based tool to access at least one of said rules associated with said particular user; and

third operating said computer-based tool to control operation of said network structure based on said at least one rule so as to automatically handle said activity concerning said item of sensitive information in accordance with said policies.

18. A method as set forth in claim 17, wherein said activity comprises a request to provide access to said item by said potential user and said step of third handling comprises preventing said access.

19. A method as set forth in claim 17, wherein said activity comprises a request to access a document including said item of sensitive information and said step of third processing comprises creating an altered version of said document that is altered with respect to said item of sensitive information.

20. A method for securely sharing information among multiple information systems, comprising the steps of:

first establishing a community of multiple information systems to be included within a secure context for sharing of information;

second establishing a collaboration system for facilitating sharing of information among said community of multiple information systems, said collaboration system being configured to communicate with each of said multiple information systems using a defined network interface;

third establishing, in connection with said collaboration system, a set of rules governing distribution of information between said multiple information systems on a recipient specific basis; and

operating said collaborative system to control a transmission from a first one of said multiple information systems to a second one of said information systems based on said set of rules and an identity of said second one of said multiple information systems.

21. A method as set forth in claim 20, wherein said rules govern one of a format and a content of said transmission.

22. A method as set forth in claim 20, wherein said rules relate to handling of sensitive information and said step of operating comprises altering a content of said transmission in relation to a portion of said sensitive information included in said transmission.

23. A method as set forth in claim 20, wherein said set of rules relates to limitations on access to sensitive information that differ between said multiple information systems and said method further comprises the step of controlling transmissions between said multiple information systems based on said set of rules, wherein collaboration is allowed between said multiple information systems and said sensitive information is protected.

24. A method for use in securely sharing information among multiple information systems, comprising the steps of:

first establishing a community of multiple information systems to be included within a secure context for sharing of information;

second establishing a collaboration system for facilitating sharing of information among said community of multiple information systems, said collaboration system being configured to communicate with each of said multiple information systems using a defined network interface;

said collaboration system being configured to process information transmitted between first and second systems of said community on a system dependent basis with regard to one of a form and a content of said information so as to facilitate sharing of information;

performing an audit of transmissions of information between said multiple information systems of said community; and

generating a report based on said audit.

25. A method as set forth in claim 24, further comprising the step of automatically auditing said reports to verify compliance with a policy governing transmissions between said first and second systems.

26. A method for use in enabling collaboration among multiple network users and protecting sensitive information of one or more of the users, comprising the steps of:

establishing a collaborative environment for collaboration among said multiple network users, said collaborative environment including network structure for use in enabling a collaboration with respect to collaboration subject matter including sensitive information subject to one or more policies regarding handling thereof relative to particular ones of said network users, said collaborative environment further including a computer-based tool for monitoring activities concerning said sensitive information and controlling said activities based on said policies; and

using said computer-based tool to manage said collaboration such that different ones of said network users are allowed different uses of said collaboration subject matter as determined by said one or more policies.

27. A method as set forth in claim 26, wherein said step of first accessing comprises obtaining said first information from a non-government source.

28. A method as set forth in claim 27, wherein said step of second accessing comprises obtaining said second information from a government source.

29. A method as set forth in claim 26, wherein said processing information relates to converting at least one of said first and second information into a converted form related to data structure.

30. A method as set forth in claim 29, wherein said converted form is an internal form of said collaboration system.

31. A method as set forth in claim 26, wherein said processing information relates to said recipient system.

32. A method as set forth in claim 26, wherein said processing information relates to modifying a content of one said first and second information.

33. A method as set forth in claim 26, wherein said processing information relates to combining said first input information and said second input information.

34. A method as set forth in claim 26, wherein said processing information relates to using said first information and said second information in performing a comparison to a threshold for identifying a condition of interest.

35. A method as set forth in claim 26, wherein said processing information relates to controlling a content of said output based on an identity of said recipient system.

36. A method as set forth in claim 26, wherein said processing information relates to controlling a content of said output based on a policy of an entity associated with one of said first and second source systems.

37. A method as set forth in claim 26, wherein said processing information relates to controlling a content of said output based on a civil liberties related criterion.

38. A method as set forth in claim 26, wherein said processing information relates to controlling a content of said output based on one of an authorization and a security clearance associated with said recipient system.

39. A method for use in sharing information between at least one source system and multiple recipient systems, comprising the steps of:

providing a collaboration system interposed between said source system and said recipient systems for facilitating sharing of information between said source system and said recipient systems, said collaboration system configured for communication with each of said source system and said recipient system using a defined network interface;

first accessing, using said collaboration system, first input information from said source system;

second accessing, using said collaboration system, a first instruction set related to a first recipient system;

third accessing, using said collaboration system, a second instruction set related to a second recipient system;

first operating said collaboration system to provide a first output to said first recipient system based on said first input information and said first instruction set; and

second operating said collaboration system to provide a second output to said second recipient system based on said first input information and said second instruction set, where said second output has a content different than said first output.

40. An apparatus for use in facilitating sharing of information among multiple information systems, comprising:

storage for storing at least one rule set governing sharing of information between said multiple information systems on a system dependent basis;

a processing platform for accessing said rule set and using said rule set to control information addressed to one of said multiple information systems, relative to one of a form and a content of said information, based on an identity of said one of said multiple information systems and said rule set; and

interface logic for enabling communication between said processing platform and each of said multiple information systems in accordance with a defined network interface.

41. An apparatus as set forth in claim 40, wherein said storage stores multiple rules sets governing said sharing of information, wherein said rules sets collectively define a policy regarding dissemination of sensitive information.

42. An apparatus as set forth in claim 40, wherein said processing platform is operative for altering particular transmissions between said multiple information systems relative to sensitive information contained therein.