Information management system

• US 7,333,956 B2
• Filed: 08/07/2001
• Issued: 02/19/2008
• Est. Priority Date: 11/08/2000
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Orchestria Limited
• Inventors: Malcolm, Peter
• Primary Examiner(s): ELISCA, PIERRE E
• Application Number:
  US09/923,704
• Publication Number:
  US 20020087479A1
• Time in Patent Office: 2,387 Days
• Field of Search: 705/50, 705/51, 705/64, 705/67
• US Class Current: 705/50
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information management system is described including one or more workstations running applications to allow a user of the workstation to connect to a network, such as the Internet. Each application operates in conjunction with an analyzer, which monitors transmission data that the application is about to transmit to the network or about to receive from the network and which determines an appropriate action to take regarding that transmission data. Such actions may be extracting data from the transmission data, such as passwords and usernames, digital certificates or eCommerce transaction details for storage in a database; ensuring that the transmission data is transmitted at an encryption strength appropriate to the contents of the transmission data; determining whether a check needs to be made as to whether a digital certificate received in transmission data is in force, and determining whether a transaction about to be made by a user of one of the workstations needs third party approval before it is made. The analyzer may consult a policy data containing a policy to govern the workstations in order to make its determination. The information management system provides many advantages in the eCommerce environment to on-line trading companies, who may benefit from improvements to record-keeping, security and control over transactions.

Claims

1. An information management system comprising:

a plurality of workstations adapted for connection to a computer network, each workstation having a memory;

a data repository arranged to receive data from each of said workstations;

an application stored in said memory of each workstation for transmitting outbound data to said computer network and receiving inbound data from said computer network;

policy data containing rules defining relevant commercial data which is to be stored in said data repository; and

an analyser, said analyser being operable in conjunction with said policy data to monitor at least one of said outbound data and said inbound data, to identify in at least one of said outbound data and said inbound data, relevant commercial data that is to be stored in said data repository in accordance with said rules in said policy data, and to cause said relevant commercial data to be stored in said data repository.

2. The system of claim 1 wherein said computer network, to which said one or more workstations are adapted for connection, is the Internet.

3. The system of claim 2 wherein said analyser is operable to identify, as relevant commercial data, digital certificates contained in at least one of said outbound or said inbound data or used to digitally sign signed data in said inbound data or said outbound data, or sufficient descriptive data to identify such digital certificates, said digital certificates and/or said descriptive data being stored in said data repository.

4. The system of claim 2 wherein the analyser is operable to identify when an eCommerce transaction is occurring and if an eCommerce transaction is identified as occurring, to identify in said outbound or said inbound data one or more of the following data as relevant commercial data:

the URL address or e-mail address of the remote location to which outbound data is being transmitted or inbound data is being received;

the web pages accessed by a user of said one or more workstations during the transaction;

the amount of the transaction;

the goods or services being traded in the transaction;

the date of the transaction; and

wherein said relevant commercial data is stored in said data repository.

5. The system of claim 1 wherein said analyser is located on each of said one or more workstations.

6. The system of claim 1 wherein said computer network includes a server and said analyser is located at a point on said computer network intermediate to said one or more workstations and said server, or said analyser is located at said server.

7. The system of claim 1 further comprising a supervisor workstation, said supervisor workstation having access to said data repository and being operable to view said relevant commercial data stored in said data repository.

8. The system of claim 1 wherein said computer network to which said one or more workstations are adapted for connection is a public computer network, and wherein said one or more workstations together form a private computer network.

9. An information management system comprising:

one or more workstations adapted for connection to a computer network, each workstation having a memory;

an application stored in said memory of each workstation for transmitting outbound data to said computer network and receiving inbound data from said computer network;

policy data containing rules specifying an appropriate encryption strength for outbound data, the encryption strength depending on the content of the data; and

an analyser, said analyser being operable in conjunction with said policy data to monitor said outbound data and to determine, in accordance with said rules in said policy data, an appropriate encryption strength for the outbound data;

wherein said analyser controls transmission of said outbound data from said application in dependence upon said determination of an appropriate encryption strength.

10. The system of claim 9 wherein said rules in said policy data define confidential data which can not be transmitted, said analyser being operable in conjunction with said policy data to prevent said confidential data being transmitted from said application.

11. The system of claim 9 wherein said analyser is further operable to determine the present encryption strength in use for transmitting said outbound data;

and wherein said analyser controls transmission of said outbound data from said application both in dependence upon said determination of an appropriate encryption strength and in dependence upon said determination of the present encryption strength in use.

12. The system of claim 11 wherein if the analyser determines that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then said analyser prevents transmission of said outbound data from said application.

13. The system of claim 11 wherein if the analyser determines that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then said analyser prevents transmission of said outbound data from said application and controls said application to renegotiate an encryption strength for transmission that is appropriate.

14. The system of claim 11 wherein if the analyser determines that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then said analyser modifies the outbound data such that the present encryption strength is an appropriate encryption strength for the transmission of the modified outbound data.

15. The system of claim 11 wherein if the analyser determines that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, then said analyser controls said application to notify a user of said application that the encryption strength in use is not sufficient.

16. An information management system comprising:

a plurality of client workstations adapted for connection to a computer network, each workstation having a memory;

a data repository arranged to receive data from each of said client workstations;

an application stored in said memory of each workstation for transmitting outbound data to said computer network and receiving inbound data from said computer network;

policy data defining rules for the recording of data that may comprise part of a commercial transaction conducted between a client workstation and a third party across said computer network;

an analyser, said analyser being operable in conjunction with said policy data to analyse at least one of said outbound data and said inbound data, to identify the existence of a commercial transaction occurring between a client workstation and a third party by analysing said outbound or said inbound data, and to cause transaction data that is all or part of said outbound data or said inbound data related to an identified commercial transaction to be stored in said data repository.

17. The system of claim 16 wherein said analyser is operable to identify the existence of a commercial transaction by reference to said rules of said policy data, said rules of said policy data defining one or more of pre-determined digital certificates, account codes, pre-determined keywords, pre-determined names and addresses and embedded codes.

18. The system of claim 16 wherein said analyser is operable to identify electronic receipts, and to identify the existence of a commercial transaction by identifying an electronic receipt in said outbound or inbound data.

19. The system of claim 16 wherein said analyser is operable to record a pre-determined number of subsequent transmissions of said outbound data or said inbound data following an identification of the existence of a commercial transaction by said analyser, providing that the address or organisation to which the subsequent transmissions are sent, or from which they are received, is the same as the address or organisation to which the outbound data was sent or from which the inbound data was received and in which the existence of a commercial transaction was identified.

20. The system of claim 19, wherein said analyser is operable to detect one or more indicators of the nature of the commercial transaction, and said rules of said policy data define the number of subsequent transmissions of said outbound data and said inbound data that are to be recorded in said data repository based on the identified nature of the commercial transaction.

21. The system of claim 16 wherein said analyser is operable to record all subsequent transmissions of said outbound data or said inbound data that occur within a pre-determined amount of time following an identification of the existence of a commercial transaction by said analyser, providing that the address or organisation to which the subsequent transmissions are sent, or from which they are received, is the same as the address or organisation to which the outbound data was sent or from which the inbound data was received and in which the existence of a commercial transaction was identified.

22. The system of claim 16 wherein said analyser is further operable to identify the completion of a commercial transaction by analysing said outbound data or said inbound data, and to cause all or part of said outbound data transmitted by said application and all or part of said inbound data received by said application after said analyser has identified the existence of a commercial transaction and before said analyser has identified the completion of a commercial transaction to be stored in said data repository.

23. The system of claim 22 wherein said analyser is operable to identify subsequent related data in said outbound data transmitted by said application and said inbound data received by said application after said analyser has identified the completion of a commercial transaction, and to cause said subsequent related data to be stored in said data repository with said transaction data already identified.

24. An information management system comprising:

one or more workstations adapted for connection to a computer network, each workstation having a memory;

an application stored in said memory of each workstation for transmitting outbound data to said computer network and receiving inbound data from said computer network;

policy data, containing rules for identifying in outbound data transaction data that is part of a commercial transaction, and rules for the transmission of transaction data so identified; and

an analyser, said analyser being operable in conjunction with said policy data to identify in at least said outbound data, transaction data that may be part of a transaction, and to make a determination in accordance with said rules of said policy data as to whether the transmission of said transaction data would satisfy said rules; and

wherein the transmission of said transaction data by said application is dependent on said determination made by said analyser.

25. The system of claim 24, wherein according to said determination made by said analyser, said transaction data is either, transmitted, not transmitted, or sent to an approver who determines whether or not to transmit the transaction data.

26. The system of claim 25 further comprising:

one or more approvers, for deciding whether the transmission of said data that may be part of a transaction may be made;

wherein said analyser is operable to identify in said data that may be part of a transaction, data that needs approval and to refer said data that needs approval to one of said one or more approvers; and

the transmission of said data that needs approval being dependent on the decision of said one or more approver.

27. The system of claim 26 wherein said analyser is operable to identify said transaction data that needs approval by determining the nature of said transaction data and by checking said rules of said policy data, said rules of said policy data defining whether or not approval is needed in dependence on the determined nature of said transaction data.

28. The system of claim 26 wherein said analyser is operable to determine the nature of said transaction data by identifying at least one of the identity of the transmitter of said data, the identity of the intended recipient of said data, the workstation from which said data is to be transmitted, the sum for which a transaction is to be made, and the account against which a transaction is to be made.

29. The system of claim 26 wherein said analyser is operable to determine the nature of said transaction data that needs approval and to select said one of said one or more approvers in dependence on that determination.

30. The system of claim 29 wherein said analyser is operable to determine the nature of said transaction data that needs approval by identifying at least one of the identity of the transmitter of said data, the identity of the intended recipient of said data, the work station from which said data is to be transmitted, the sum for which a transaction is to be made, and the account against which the transaction is to be made.