Techniques and System to Monitor and Log Access of Information Based on System and User Context Using Policies

• US 20080060051A1
• Filed: 10/30/2007
• Published: 03/06/2008
• Est. Priority Date: 12/29/2005
• Status: Active Grant

• Current Assignee: Blue Jungle
• Original Assignee: Blue Jungle
• Inventors: Lim, Keng
• Granted Patent: US 8,832,048 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2216/03 Data mining
• CPC Class Codes: G06F 2221/032 Protect output to user by software means
• CPC Class Codes: G06F 3/0601 Interfaces specially adapted for storage systems
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 67/60 : Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: Y10S 707/922 : Communications

Abstract

An information management system approves or denies user requests to access information of the system. The information includes all types of information including documents and e-mail. The information management system is driven using a policy language having policies and policy abstractions. The information management system may approve or deny many different types of requests including opening a document or file, copying a file, printing a file, sending an e-mail, reading an e-mail, cut and paste of a portion of a document, saving a document, executing an application on a file, and many others.

Claims

1. A method of managing information comprising:

providing an organization having an information management system comprising one or more rules and policy abstractions to manage information of the organization, wherein a rule comprises an expression having a policy abstraction;

within the organization, providing a user and a confidential document managed by the information management system; and

when the user attempts to perform an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the attempted operation in a storage location.

2. The method of claim 1 wherein the when the user attempts to perform an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

when the user performs an operation on the confidential document, storing information regarding the operation in a storage location based on the one or more rules to manage information of the organization.

7. The method of claim 1 wherein the when the user attempts to perform an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

when the user performs an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the operation in a storage location.

8. The method of claim 1 wherein the attempted operation comprises at least one of sending the confidential document via e-mail, sending the confidential document to a recipient outside the organization, attaching a confidential document to an e-mail message, opening the confidential document using an application program, printing the confidential document, copying the confidential document, embedding a confidential document into another document, or storing the confidential document to a removable media.

9. The method of claim 1 wherein the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

one or more rules to determine whether to encrypt the confidential document.

10. The method of claim 1 wherein the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

one or more rules to determine whether to send a notification to at least one recipient within the organization regarding the attempted operation on the confidential document.

11. The method of claim 1 wherein the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

one or more rules to determine whether to send a notification to at least one machine within the organization regarding the attempted operation on the confidential document.

12. The method of claim 1 wherein when the user attempts to perform an operation on the confidential document, the one or more rules further determine whether to encrypt the confidential document.

13. The method of claim 1 wherein when the user attempts to perform an operation on the confidential document, the one or more rules further determine whether to send a notification to at least one recipient within the organization regarding the attempted operation on the confidential document.

3. A method of managing information comprising:

providing an organization having an information management system comprising one or more rules comprising a context expression to manage information of the organization;

within the organization, providing a user and a confidential document managed by the information management system; and

when the user attempts to perform an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the attempted operation in a storage location.

4. The method of claim 3 wherein the when the user attempts to perform an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

when the user performs an operation on the confidential document, storing information regarding the operation in a storage location based on the one or more rules to manage information of the organization.

14. The method of claim 3 wherein based on the context expression of a rule, approving the attempted operation will occur only during a particular time period.

15. The method of claim 3 wherein based on the context expression of a rule, approving the attempted operation will occur only when the user is in a particular location.

16. The method of claim 3 wherein based on the context expression of a rule, approving the attempted operation will occur only when the user has a particular connectivity type.

17. The method of claim 3 wherein based on the context expression of a rule, approval the attempted operation will occur only when the user does not have a particular connectivity type.

18. The method of claim 3 wherein based on the context expression of a rule, approving the attempted operation will occur only when the device used to access the confidential document is a specific device type.

19. The method of claim 3 wherein the when the user attempts to perform an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

when the user performs an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the operation in a storage location.

20. The method of claim 3 wherein the attempted operation comprises at least one of sending the confidential document via e-mail, sending the confidential document to a recipient outside the organization, attaching a confidential document to an e-mail message, opening the confidential document using an application program, printing the confidential document, copying the confidential document, embedding a confidential document into another document, or storing the confidential document to a removable media.

21. The method of claim 3 wherein the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

one or more rules to determine whether to encrypt the confidential document.

22. The method of claim 3 wherein the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

one or more rules to determine whether to send a notification to at least one recipient within the organization regarding the attempted operation on the confidential document.

23. The method of claim 3 wherein the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

one or more rules to determine whether to send a notification to at least one machine within the organization regarding the attempted operation on the confidential document.

24. The method of claim 3 wherein when the user attempts to perform an operation on the confidential document, the one or more rules further determine whether to encrypt the confidential document.

25. The method of claim 3 wherein when the user attempts to perform an operation on the confidential document, the one or more rules further determine whether to send a notification to at least one recipient within the organization regarding the attempted operation on the confidential document.

5. A method of managing information comprising:

providing an organization having an information management system comprising a policy server comprising one or more rules to manage information of the organization;

within the organization, providing a user logged onto a device and a confidential document managed by the information management system;

storing a subset of the one or more rules of the policy server on the device; and

when the user attempts to perform an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the attempted operation in a storage location.

6. The method of claim 5 wherein the when the user attempts to perform an operation on the confidential document, evaluating the one or more rules to determine whether to store information regarding the attempted operation in a storage location is replaced by

when the user performs an operation on the confidential document, storing information regarding the operation in a storage location based on the one or more rules to manage information of the organization.