CUSTOMIZABLE SECURE DATA EXCHANGE ENVIRONMENT

• US 20150163206A1
• Filed: 12/10/2014
• Published: 06/11/2015
• Est. Priority Date: 12/11/2013
• Status: Abandoned Application

• Current Assignee: IntraLinks Incorporated (SS&C Technologies Holdings Incorporated)
• Original Assignee: IntraLinks Incorporated (SS&C Technologies Holdings Incorporated)
• Inventors: Meyer, Jerry Lee, Velamoor, Sudhakar, Siddiqui, Fahim, Ford, Christopher Todd, McCarthy, Kevin L., Lindsay, David Scott, Acharya, Visal Chandrakant, Dsilva, Benedict Robert, Tearnen, Paul, Wenzel, Peter, Held, John, Weiblen, Charlie, Kannan, Ganesh, Parimi, Madhavi, Azuma, Selom Harry, Mahajan, Himali, Lirio, Dario R., Waluk, Michael Joseph, Landy, John, Vora, Margin, Porzio, Matthew A., Morparia, Harshal, Nikolayeva, Yana, Yip, Tony, Choudhary, Mayank, Rozin, Liviu, Hovsepian, Ronald W., Giudice, John William, Purohit, Vedang Shailesh, Awan, Wasif Qayyum, Cleary, Peter W.
• Application Number:
  US14/566,016
• Publication Number:
  US 20150163206A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/901 Indexing; Data structures therefor; Storage structures for retrieval from the web G06F16/951
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

In embodiments, the disclosure provides a secure data exchange system that includes a data management facility; and a plurality of data storage nodes. The data management facility manages content sharing between entities of data stored in the data storage nodes, wherein the data is stored by a user of a first entity and comprises content and metadata. The data management facility only has access to the metadata of the user data for managing of the data in the plurality of data storage nodes and not the content. The data management facility may be geographically distributed at a plurality of data management sites and the data storage nodes may exist inside and outside of a firewall of the first entity.

Claims

1. A system, comprising:

a server-based secure data exchange system for secure sharing of a content between a first client device accessed by a user associated with a first organizational entity and a second client device accessed by a user associated with a second organizational entity, wherein the content has shared relevance with the first organizational entity and the second organizational entity, the secure data exchange system comprising a data management facility managed by a third organizational entity and adapted to provide permissioned control to a plurality of organizational entities for use of at least one of a plurality of data storage nodes, wherein the first organizational entity is granted permissioned control of a first data storage node by the third organizational entity for storing data comprised of the content and metadata, wherein the content is shared between the first client device and the second client device through the first data storage node, wherein the data management facility manages secure data exchange of the content through the first data storage node, and wherein the data management facility has access to the metadata of the stored data for managing sharing of the content via the first data storage node, but the data management facility does not have access to the content;

wherein the data management facility is distributed into a plurality of data management sites to enable management of the plurality of data storage nodes,

wherein the plurality of data storage nodes are located at network locations separate from the data management facility and specified by the plurality of organizational entities.

2. The system of claim 1, wherein the content is user-entered content, and the first organizational entity has control of what portion of the user-entered content is accessible to the data management facility.

3. The system of claim 2, wherein the data management facility has no access to any user-entered content.

4. The system of claim 1, wherein each of the plurality of data storage nodes is controlled by a separate organizational entity.

5. The system of claim 1, wherein the metadata provides information associated with the content to enable management of the content by the data management facility without the data management facility having access to the content.

6. The system of claim 5, wherein the information comprises at least one of content creation information, content revision history, geographic location information, content viewing history, enterprise identification information, and digital rights management information.

7. The system of claim 1, wherein the stored data is at least one of a document, pure metadata, an email message, an image file, and an audio file.

8. The system of claim 1, wherein the managing of the secure data exchange of the content comprises at least one of tracking where various content resides, brokering interactions between users, controlling processing of content, managing content location, enforcing content entitlements, and instrumenting and providing analytics.

9. The system of claim 1, wherein the secure data exchange system provides content services to the plurality of data storage nodes that operate on and store the content, store metadata, provide data transformations to the content, provide analytics related to the content, and provide searching tools for the searching for content.

10. The system of claim 1, wherein a messaging system brokers communications among services provided by and amongst the data management facility and the first data storage node.

11. The system of claim 1, wherein an identity service is responsible for validating the identity of a user.

12. The system of claim 11, wherein the identity service supports a federation model in order to support both login activities, entitlement, and rights management.

13. The system of claim 12, wherein the federation model supports the identity service provided by a fourth organizational entity identity provider.

14. The system of claim 1, wherein the secure data exchange system provides an organizational entity managed keys to enable control of its own data encryption keys.

15. The system of claim 14, wherein a hardware security module (HSM) is utilized in data encryption management, wherein the controlling software on the HSM is independently written and certified to ensure the third organizational entity does not have access to keys controlled by the first organizational entity.

16. The system of claim 1, wherein the management of the data storage nodes is related to the geographic region in which the nodes are located.

17. The system of claim 1, wherein the plurality of data management sites are adapted to address regional and localized management of the plurality of data storage nodes that support distributed control while being part of the secure data exchange system.

18. The system of claim 1, wherein the data management facility is secure and scalable to changing needs of each organizational entity through modular data management facility functional components.

19. The system of claim 1, wherein the data storage node is a data storage hardware node.

20. The system of claim 1, wherein the metadata is stored in an electronic data structure that is independent of the content shared via the first data storage node.

21. The system of claim 20, wherein the electronic data structure representing the metadata is automatically transformed to log each action that is taken with respect to the sharing of the content via the first data storage node.

22. The system of claim 1, wherein the data management facility is precluded from accessing the content on the first data storage node by having at least one of the first organizational entity and the second organizational entity encrypt the content prior to sharing it via the first data storage node.

23. The system of claim 1, wherein the data management facility and the first data storage node communicate through multiple communication bus technologies.

24. The system of claim 1, wherein a virtualization layer is provided to the first organizational entity to interface with physical hardware comprising at least one of the data management facility and the first data storage node.

25. The system of claim 1, wherein content is replicated across at least two of the plurality of data storage nodes.

26. The system of claim 1, wherein the plurality of data management sites are distributed geographically and the plurality of data storage notes are managed in a manner specific to their geographic location.

27. A system, comprising:

a server-based secure data exchange system for secure sharing of a content between a first client device accessed by a user associated with a first organizational entity and a second client device accessed by a user associated with a second organizational entity, wherein the content has shared relevance with the first organizational entity and the second organizational entity, the secure data exchange system comprising a data management facility managed by a third organizational entity and adapted to provide permissioned control to a plurality of organizational entities for use of at least one of a plurality of data storage nodes, wherein the first organizational entity is granted permissioned control of a first data storage node by the third organizational entity for storing data comprised of the content and metadata, wherein the content is shared between the first client device and the second client device through the first data storage node, wherein the data management facility manages secure data exchange of the content through the first data storage node, and wherein the data management facility has access to the metadata of the stored data for managing sharing of the content via the first data storage node, but the data management facility does not have access to the content;

wherein the secure data exchange system is extendable by the first organizational entity through modularized application functionality provided by the third organizational entity to allow the first organizational entity to create a secure exchange environment customized to the requirements of the first organizational entity.

28. The system of claim 27, wherein the modularized application functionality comprises libraries of applications.

29. The system of claim 27, wherein the secure data exchange system supports organizational entity extensions that run in the cloud or connect directly to a organizational entity computer network behind a firewall while the extensions remain fully maintained and managed by the secure data exchange system.

30. The system of claim 27, wherein the modularized application functionality is encapsulated in a secure envelope.

31. The system of claim 27, wherein the modularized application functionality comprises dynamic scaling of services to meet rapid increases in user demand in at least one of the data management facility and the first data storage node.

32. A system, comprising:

a server-based secure data exchange system for secure sharing of a content between a first client device accessed by a user associated with a first organizational entity and a second client device accessed by a user associated with a second organizational entity, wherein the content has shared relevance with the first organizational entity and the second organizational entity, the secure data exchange system comprising a data management facility managed by a third organizational entity and adapted to provide permissioned control to a plurality of organizational entities for use of at least one of a plurality of data storage nodes, wherein the first organizational entity is granted permissioned control of a first data storage node by the third organizational entity for storing data comprised of the content and metadata, wherein the content is shared between the first client device and the second client device through the first data storage node, wherein the data management facility manages secure data exchange of the content through the first data storage node, and wherein the data management facility has access to the metadata of the data for managing sharing of the content via the first data storage node, but the data management facility does not have access to the content;

wherein the secure data exchange system is extendable by the first organizational entity through modularized application functionality to allow the first organizational entity to create a secure exchange environment customized to the requirements of the first organizational entity, and

wherein the plurality of data storage nodes are located at network locations separate from the data management facility and specified by the plurality of organizational entities.

33. A system, comprising:

a server-based secure data exchange system for secure sharing of a content between a first client device accessed by a user associated with a first organizational entity and a second client device accessed by a user associated with a second organizational entity, wherein the content has shared relevance with the first organizational entity and the second organizational entity, the secure data exchange system comprising a data management facility managed by a third organizational entity and adapted to provide permissioned control to a plurality of organizational entities for use of at least one of a plurality of data storage nodes, wherein the first organizational entity is granted permissioned control of a first data storage node by the third organizational entity for storing data comprised of the content and metadata, wherein the content is shared between the first client device and the second client device through the first data storage node, wherein the data management facility manages secure data exchange of the content through the first data storage node, and wherein the data management facility has access to the metadata of the content for managing sharing of the content via the first data storage node, but the data management facility does not have access to the content;

wherein the first data storage node is remotely accessed through a secure application program interface to the secure data exchange system, wherein a two-call authorization procedure is executed between the data management facility and the first data storage node to enable the a secure access to the content stored on first data storage node.

34. The system of claim 33, wherein the secure data exchange system verifies each call authorization of the two-call authorization procedure to ensure that only authorized calls are made to the first data storage node.

35. The system of claim 33, wherein the first client device performs the two-call authorization procedure.

36. The system of claim 33, wherein the permissioned control includes use of customer managed keys.

37. The system of claim 33, wherein the authorization procedure utilizes a token used for a predetermined time period to access the content on the first data storage node.

38. The system of claim 33, wherein the secure application program interface is separated from a logic functionality utilized in the management of the content stored in the first data storage node.

39. A method for managing a networked secure collaborative computer data exchange environment, the method comprising:

establishing, by a secure exchange server hosted by an intermediate business entity, a user login data authentication procedure that allows one or more users through at least one client computing device to access the secure exchange server, wherein the one or more users is of at least one second business entity, wherein communications between the secure exchange server and each of the one or more users is through a communications network;

storing, by the secure exchange server, at least one user login authentication data for the user of the second business entity;

receiving a computer data content from at least one user of a third business entity;

receiving from at least one user of the third business entity an indication of permission for the user of the second business entity to access the computer data content;

by the secure exchange server, permitting access to the computer data content to the user of the second business entity through an exchange content access facility, wherein the exchange content access facility is hosted by the intermediate business entity;

by the secure exchange server, granting access to the computer data content to the user of the second business entity; and

providing, by the secure exchange server, at least one of;

a secure cloud architecture with meshed data centers and various enterprise clouds, a limited content repository, playback of interactions with documents from a diligence process, a buyer interest index and analytic environment for interest indexing, an encrypted file format for desktop access to enable secure un-share, a time-based file deletion facility, a time-bomb de-fuser facility, a mobile watermarking facility, a rules-based workflow management facility, a spreadsheet defined bulk operations facility, a protected drive facility with encrypted content and auditable access history algorithm, a virtual drive facility, a revision timeline facility for version conflicts management, a collections user interface for organizing work streams that allows dragging and dropping assets and contacts with automated permissioning, a secure exchange viewing 3D content facility, an extended metadata facility for on document sharing and access, an investor portal facility, a location-based storage facility, and a comment notification facility.