Information management system

• US 7,669,227 B2
• Filed: 05/12/2005
• Issued: 02/23/2010
• Est. Priority Date: 11/08/2000
• Status: Active Grant

• Current Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Malcolm, Peter Bryan
• Primary Examiner(s): Song; Hosuk
• Application Number:
  US11/127,675
• Publication Number:
  US 20050203855A1
• Time in Patent Office: 1,748 Days
• Field of Search: 726 1- 4, 726 7- 15, 726/21, 726 26- 30, 713/173, 713/175, 713/193, 713/150, 713/162, 713/168, 713/189, 705/50, 705/64, 705 75- 78
• US Class Current: 726/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information management system is described comprising one or more workstations running applications to allow a user of the workstation to connect to a network, such as the Internet. Each application has an analyzer, which monitors transmission data that the application is about to transmit to the network or about to receive from the network and which determines an appropriate action to take regarding that transmission data. Such actions may be extracting data from the transmission data, such as passwords and usernames, digital certificates or eCommerce transaction details for storage in a database; ensuring that the transmission data is transmitted at an encryption strength appropriate to the contents of the transmission data; determining whether a check needs to be made as to whether a digital certificate received in transmission data is in force, and determining whether a transaction about to be made by a user of one of the workstations needs third party approval before it is made. The analyzer may consult a policy data containing a policy to govern the workstations in order to make its determination. The information management system provides many advantages in the eCommerce environment to on-line trading companies, who may benefit by being able to regulate the transactions made by their staff according to their instructions in a policy data, automatically maintain records of passwords and business conducted on-line, avoid paying for unnecessary checks on the validity of digital certificates and ensure that transmissions of data made by their staff are always protected at an agreed strength of encryption.

Claims

1. A computer program product for controlling a computer of a plurality of computers adapted for connection to a public computer network to manage information, the computer having access to policy data containing rules specifying an appropriate encryption strength for outbound data transmitted to the public network, the encryption strength depending on the content of the data, comprising:

a recording medium readable by the computer, having program code recorded thereon which when executed on said computer, configures said computer to;

determine, in conjunction with an application running on the computer that is operable at least to transmit outbound data to said public network, with reference to said rules in said policy data, an appropriate encryption strength for the outbound data; and

control the transmission of said outbound data by said application in dependence upon the determination of an appropriate encryption strength.

2. The computer program product of claim 1 wherein said rules in said policy data define confidential data which cannot be transmitted, wherein said program code when executed on said computer is operable to prevent transmission of said confidential data from said application.

3. The computer program product of claim 1 wherein said program code when executed on said computer is further operable to determine the present encryption strength in use for transmitting said outbound data;

and to control the transmission of said outbound data from said application in dependence upon both the determination of an appropriate encryption strength and the determination of the present encryption strength in use.

4. The computer program product of claim 3 wherein said program code when executed on said computer is further operable, if it is determined that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, to prevent the transmission of said outbound data from said application.

5. The computer program product of claim 3 wherein said program code when executed on said computer is further operable, if it is determined that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, to negotiate an appropriate encryption strength for transmission of said outbound data before transmission.

6. The computer program product of claim 3 wherein said program code when executed on said computer is further operable, if it is determined that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, to modify the outbound data such that the present encryption strength is an appropriate encryption strength.

7. The computer program product of claim 3 wherein said program code when executed on said computer is further operable, if it is determined that the present encryption strength in use for transmitting outbound data is less than said appropriate encryption strength, to provide notification that the encryption strength in use is not sufficient.

8. The computer program product of claim 1 wherein said program code when executed on said computer is further operable to identify credit card numbers in said outbound data.

9. The computer program product of claim 8 wherein said program code when executed on said computer is further operable to identify a pre-determined set of one or more credit card numbers from other credit card numbers, and wherein said rules of said policy data define a different appropriate encryption strength for outbound data containing credit card numbers in that pre-determined set than for other credit card numbers.

10. The computer program product of claim 9 wherein said rules of said policy data specifies that there is no appropriate encryption strength for said pre-determined set of one or more credit card numbers.

11. The computer program product of claim 1 wherein said program code when executed on said computer is further operable, to identify at least one or more of, credit card numbers, account codes, usernames, passwords, names and addresses and other predetermined keywords in the content of said outbound data.

12. The computer program product of claim 1 wherein said rules in said policy data specify an appropriate encryption strength for said outbound data, that is dependent on the address to which said outbound data is to be transmitted.

13. The computer program product of claim 1 wherein said program code is executable on said computer.

14. The computer program product of claim 1 wherein said application is a web browser.

15. The computer program product of claim 14 wherein said program code when executed on said computer is a plug-in module of said web browser.

16. The computer program product of claim 15 wherein said web browser is an Internet browser and said plug-in module is a Browser Helper Object.

17. The computer program product of claim 1 wherein said application is an e- mail client.

18. The computer program product of claim 17 wherein said program code when executed on said computer is a plug-in module of said e-mail client.

19. The computer program product of claim 18 wherein said plug-in module is an exchange client extension.

20. The computer program product of claim 1 wherein said network includes a server and said program code is executable at a point on said network intermediate said one or more workstations and said server, or program code is executable at said server.

105. The computer program product of claim 1 wherein the determination and control steps are carried out by means of at least one analyser integrated into said application.

106. The computer program product of claim 105 wherein the at least one analyser executes said determination and control steps as transmission of the outbound data is initiated.

107. The computer program product of claim 1 wherein the policy data is centrally defined for the plurality of computers.

21. A computer program product for controlling a plurality of computers adapted for connection to a private computer network to manage information, the computer network having a data repository arranged to receive data from the plurality of computers, and policy data defining rules for the recording of data that may comprise part of a commercial transaction conducted between a computer of the plurality of computers in the private computer network and a third party across a public computer network, comprising:

a recording medium readable by a computer, having program code recorded thereon which when executed on each of said plurality of computers configures said computers to;

analyze, in conjunction with an application running on the computer that is operable to transmit outbound data to said public computer network and receive inbound data from said public computer network, at least one of said outbound data and said inbound data to identify, with reference to said rules of said policy data, the existence of a commercial transaction occurring between the computer and a third party; and

to control said computer to store transaction data that is all or part of said outbound data or said inbound data related to an identified commercial transaction in said data repository.

22. The computer program product of claim 21 wherein said program code when executed on said computer is operable to identify the existence of a commercial transaction by determining whether a secure link has been negotiated between said application and a remote site on said public network, and whether the outbound data or said inbound data is transmitted on that link.

23. The computer program product of claim 22 wherein said public network is the Internet, and said rules of said policy data define the addresses of non-eCommerce web sites and/or non-eCommerce e-mail accounts, wherein said program code when executed on said computer is operable to disregard any transactions that are identified between the computer and a non-eCommerce web site and/or e-mail account such that no transaction data related to a transaction made to a non-eCommerce web sites or a non-eCommerce e-mail account is stored in the data repository.

24. The computer program product of claim 21 wherein said program code when executed on said computer is operable to identify the existence of a commercial transaction by reference to said rules of said policy data, said rules of said policy data defining the addresses of known eCommerce locations.

25. The computer program product of claim 21 wherein said program code when executed on said computer is operable to identify credit card numbers, and the existence of a commercial transaction is identified by identifying credit card numbers in said outbound data or inbound data.

26. The computer program product of claim 21 wherein said program code when executed on said computer is operable to identify the existence of a commercial transaction by reference to said rules of said policy data, said rules of said policy data defining one or more of pre-determined digital certificates, account codes, pre-determined keywords, pre-determined names and addresses and embedded codes.

27. The computer program product of claim 21 wherein said program code when executed on said computer is operable to identify in said inbound data an embedded code said embedded code having been placed in said inbound data to identify it as transaction data.

28. The computer program product of claim 21 wherein said program code when executed on said computer is operable to identify the existence of a commercial transaction by identifying an electronic receipt in said outbound or inbound data.

29. The computer program product of claim 21 wherein said program code when executed on said computer is further operable to control the computer to record a pre-determined number of subsequent transmissions of said outbound data or said inbound data following an identification of the existence of a commercial transaction, providing that the address or organisation to which the subsequent transmissions are transmitted, or from which they are received, is the same as the address or organisation to which the outbound data was sent or from which the inbound data was received and in which the existence of a commercial transaction was identified.

30. The computer program product of claim 29, wherein said program code when executed on said computer is operable to detect one or more indicators of the nature of the commercial transaction, and said rules of said policy data define the number of subsequent transmissions of said outbound data and said inbound data that are to be recorded in the data repository based on the identified nature of the transaction.

31. The computer program product of claim 29 wherein said rules of said policy data define the number of subsequent transmissions of said outbound and said inbound data that are to be stored in said data repository in dependence on the indicator by which the existence of a commercial transaction was identified.

32. The computer program product of claim 21 wherein said program code when executed on said computer is operable to control the computer to record all subsequent transmissions of said outbound data or said inbound data that occur within a pre-determined amount of time following an identification of the existence of a commercial transaction, providing that the address or organisation to which the subsequent transmissions are transmitted, or from which they are received, is the same as the address or organisation to which the outbound data was transmitted or from which the inbound data was received and in which the existence of a transaction was identified.

33. The computer program product of claim 32 wherein said program code when executed on said computer is operable to detect one or more indicators of the nature of the transaction, and said rules of said policy data define the amount of time for which all subsequent transmissions of said outbound data and said inbound data are to be recorded in said data repository based on the identified nature of the transaction.

34. The computer program product of claim 32 wherein said rules of said policy data define the amount of time for which subsequent transmissions of said outbound and said inbound data are to be stored in said data repository in dependence on the indicator by which the existence of a commercial transaction was identified.

35. The computer program product of claim 21 wherein said program code when executed on said computer is operable to identify the completion of a transaction, and control the computer to store all or part of said outbound data transmitted by said application and all or part of said inbound data received by said application after the existence of a commercial transaction has been identified and before the completion of a transaction has been in identified in said data repository.

36. The computer program product of claim 35 wherein said program code when executed on said computer is operable to identify subsequent related data contained in said outbound data transmitted by said application and said inbound data received by said application after the completion of a transaction, and control the computer to store said subsequent related data in the data repository with said transaction data already identified.

37. The computer program product of claim 36 wherein said program code when executed on said computer is operable to identify said subsequent related data by identifying common indicators in both said transaction data already identified and said outbound data transmitted by said application and said inbound data received by said application after the completion of a transaction has been identified, said common indicators being one or more of the address of the location to which said outbound data is transmitted or from which said inbound data is received, part of the data path to the location to which said outbound data is transmitted or from which said inbound data is received, account code or reference numbers.

38. The computer program product of claim 21 wherein said application is operable such that a user of said application can indicate said outbound and said inbound data that is related to a transaction, said program code when executed on said computer being operable to identify said outbound and said inbound data so indicated.

39. The computer program product of claim 21 wherein said program code when executed on said computer is operable to control the computer to store all of said outbound data and said inbound data in memory as previous data, irrespective of whether it may or may not be part of a transaction and, to retrieve a pre-determined amount of previous data from said outbound data and said inbound data stored in memory if the existence of a commercial transaction is identified, and to control the computer to store said previous data in the data repository with said transaction data.

40. The computer program product of claim 39 wherein said rules of said policy data specify the amount of previous data that is to be retrieved in dependence on the indicator by which the existence of a commercial transaction is identified.

41. The computer program product of claim 39 wherein said public network is the Internet and said application is a web browser, said web browser being operable to store each web page that is viewed by said web browser in memory as previous data.

42. The computer program product of claim 41 wherein said rules of said policy data specify the number of web pages that are to be retrieved from those previously stored in memory in dependence on the indicator by which the existence of a commercial transaction is identified.

43. The computer program product of claim 21 wherein said program code when executed on said computer is further operable to control the computer to store all of said outbound data and said inbound data in memory as previous data, irrespective of whether it may or may not be part of a transaction and, to identify, in said previous data, earlier relevant data that is related to said transaction data already identified, and control the computer to store the earlier relevant data in the data repository with said transaction data.

44. The computer program product of claim 43 wherein said program code when executed on said computer is further operable to identify said earlier relevant data in said previous data, by identifying common indicators in both said transaction data and said previous data, said common indicators being one or more of the address of the location to which said outbound data is transmitted or from which said inbound data is received, part of the data path to the location to which said outbound data is transmitted or said inbound data is received, account codes or reference numbers.

45. The computer program product of claim 21 wherein said program code when executed on said computer is further operable to control the computer to store all of said outbound data and said inbound data in memory as previous data, irrespective of whether it may or may not be part of a transaction;

and wherein said computer program product further comprises a selector, recorded on said recording medium, said selector being operable to select earlier relevant data from said previous data in response to input from a user, and wherein said program code when executed on said computer is further operable to control the computer to store said earlier relevant data selected by the user in said data repository together with said transaction data.

46. The computer program product of claim 21 wherein said program code when executed on said computer is operable, once the existence of a transaction has been identified, to determine the nature of said transaction by analysing the content of said outbound and inbound data, said rules of said policy data defining how said transaction data is to be stored in said data repository in dependence on the nature of the transaction that has been determined, said transaction data being stored in said database according to said determination and said rules of said policy data.

47. The computer program product of claim 46 wherein said program code when executed on said computer is further operable to determine the nature of the transaction by identifying in said outbound data and said inbound data one or more indicators, said indicators being defined in said rules of said policy data, and being one or more of:

the address of the public network location to which said data that may be part of a transaction is transmitted or from which it is received;

part of the data path to the public network location to which said transaction data is transmitted or from which it is received;

account codes;

reference numbers;

credit card numbers;

digital certificates and pre-determined keywords.

48. The computer program product of claim 21 wherein said program code when executed on said computer is further operable, once the existence of a commercial transaction has been identified, to identify one or more indicators of the nature of said transaction, and to control the computer to organise the storage of said transaction data by said one or more indicators such that it forms a record.

49. The computer program product of claim 48 wherein said rules of said policy data define said one or more indicators of the nature of a transaction, said indicators being one or more of:

the address of the public location to which said transaction data is transmitted or from which it is received;

part of the data path to the public location to which said transaction data is transmitted or from which it is received;

account codes, reference numbers, credit card numbers, digital certificates and pre-determined keywords.

50. The computer program product of claim 21 wherein the data repository is accessible by one or more of an accounts application, an order processing application or other transaction management application.

51. The computer program product of claim 21 wherein said program code when executed on said computer is further operable to cause any identified relevant data to be encrypted before it is stored in said data repository.

52. The computer program product of claim 21 wherein said program code when executed on said computer is further operable to cause any relevant data stored in the data repository to be encrypted.

53. The computer program product of claim 21 wherein said program code is executable at each of said computers.

54. The computer program product of claim 21 wherein said application is a web browser.

55. The computer program product of claim 54 wherein said program code when executed on said computer is a plug-in module of said web browser.

56. The computer program product of claim 55 wherein said web browser is an Internet browse and said plug-in module is a Browser Helper Object.

57. The computer program product of claim 21 wherein said application is an e-mail client.

58. The computer program product of claim 57 wherein said program code when executed on said computer is a plug-in module of said e-mail client.

59. The computer program product of claim 58 wherein said plug-in module is an exchange client extension.

60. The computer program product of claim 21 wherein said network includes a server and said program code is executable at a point on said network intermediate said one or more workstations and said server, or said program code is executable at said server.

61. The computer program product of claim 21 further comprising program code recorded on the recording medium which when executed on a computer in the plurality of computers enable that computer as a supervisor workstation, said supervisor workstation having access to said data repository and being operable to view said relevant data stored in said data repository.

62. The computer program product of claim 61 wherein said policy data is accessible by said supervisor workstation, such that a user of said supervisor workstation can edit said policy data.

108. The computer program product of claim 21 wherein the analysis and control steps are carried out by means of at least one analyser integrated into said application.

109. The computer program product of claim 108 wherein the at least one analyser executes said analysis and control steps as transmission of the outbound data is initiated, or after said inbound data is received by the application and before it is viewed by a user of the application.

110. The computer program product of claim 21 wherein the policy data is centrally defined for the plurality of computers.

113. The computer program product of claim 21 wherein the policy data is centrally defined for the plurality of computers.

116. The computer program product of claim 21 wherein the policy data is centrally defined for the plurality of computers.

63. A computer program product, for controlling a computer of a plurality of computers to manage information, said plurality of computers being connected to a public computer network and said computer having access to policy data containing rules for identifying in outbound data transmitted to the public computer network transaction data that is part of a commercial transaction;

and rules for the transmission of commercial transaction data so identified;

comprising;

a recording medium readable by the computer, having program code recorded thereon which when executed on said computer configures the computer to;

analyze, in conjunction with an application running on the computer that is operable to transmit outbound data to the public network and receive inbound data from the public network, at least said outbound data to identify, with reference to said rules of said policy data, commercial transaction data that may be part of a commercial transaction to determine, in accordance with said rules of said policy data, whether the transmission of said commercial transaction data would satisfy said rules; and

control the transmission of said commercial transaction data by said application in dependence on the determination made by said analyzer.

64. The computer program product of claim 63 wherein said program code when executed on said computer is operable to control the computer such that said transaction data is either, transmitted, not transmitted, or sent to an approver who determines whether or not to transmit the transaction data.

65. The computer program product of claim 64 wherein the program code when executed on said computer is further operable to identify in said data that may be part of a transaction, data that needs approval;

refer said data that needs approval to one or more approvers for approval, and monitor whether or not approval is received from said one or more approvers; and

wherein the transmission of said transaction data by said application depends on whether or not approval is received from said one or more approvers.

66. The computer program product of claim 65 wherein said program code when executed on said computer is further operable to identify said transaction data that needs approval by determining the nature of said transaction data and checking said rules of said policy data, said rules of said policy data defining whether or not approval is needed in dependence on the determined nature of said transaction data.

67. The computer program product of claim 65 wherein said program code when executed on said computer is further operable to determine the nature of said transaction data by identifying at least one of the identity of the transmitter of said data, the identity of the intended recipient of said data, the computer in the private network from which said data is to be transmitted, the sum for which a transaction is to be made, and the account from which a transaction is to be made.

68. The computer program product of claim 65 wherein said program code when executed on said computer is further operable to determine the nature of said transaction data that needs approval and select said one of said one or more approvers in dependence on that determination.

69. The computer program product of claim 68 wherein said program code when executed on said computer is operable to determine the nature of said transaction data that needs approval by identifying at least one of the identity of the transmitter of said data, the identity of the intended recipient of said data, the computer in the private network from which said data is to be transmitted, the sum for which a transaction is to be made, and the account from which the transaction is to be made.

70. The computer program product of claim 63 wherein said program code when executed on said computer is operable to determine whether a secure link has been negotiated between said application and a remote site on said public network, and to identify said outbound data or said inbound data as transaction data, if it is transmitted on a secure link.

71. The computer program product of claim 70 wherein said public network is the Internet, and said rules of said policy data define the addresses of web sites or e-mail accounts that negotiate secure links for the transmission of data but which are known not to be eCommerce sites or accounts, and said program code when executed on said computer is operable to disregard said outbound data transmitted to those web sites or accounts or said inbound data received from those web sites or accounts, such that no approval is required.

72. The computer program product of claim 63 wherein said program code when executed on said computer is operable to identify transaction data by reference to said rules of said policy data, said rules of said policy data defining the addresses of known eCommerce web sites and the e-mail accounts.

73. The computer program product of claim 63 wherein said program code when executed on said computer is operable to identify credit card numbers in said outbound data or said inbound data, and to identify outbound data or inbound data that contains a credit card number as transaction data.

74. The computer program product of claim 73 wherein said policy data specifies pre-determined credit card numbers that can never be transmitted.

75. The computer program product of claim 63 wherein said program code when executed on said computer is operable to identify transaction data by reference to said rules of said policy data, said rules of said policy data defining one or more of pre-determined digital certificates, account codes, pre-determined keywords, pre-determined names and addresses and embedded codes.

76. The computer program product of claim 63 wherein said program code when executed on said computer is operable to detect an embedded code in said inbound data, said embedded code having been placed in said inbound data to mark said inbound data as transaction data.

77. The computer program product of claim 63 further comprising, a selector, recorded on said recording medium, said selector being operable to select data in said outbound and said inbound data that is part of a transaction in response to input from a user, said program code when executed on said computer being operable to identify said outbound and said inbound data so selected.

78. The computer program product of claim 63 wherein said program code is executable at said computer.

79. The computer program product of claim 63 wherein said application is a web browser.

80. The computer program product of claim 79 wherein said program code when executed on said computer is a plug-in module of said web browser.

81. The computer program product of claim 80 wherein said web browser is an Internet browser and said plug-in module is a Browser Helper Object.

82. The computer program product of claim 63 wherein said application is an e-mail client.

83. The computer program product of claim 82 wherein said program code when executed on said computer is a plug-in module of said e-mail client.

84. The computer program product of claim 83 wherein said plug-in module is an exchange client extension.

85. The computer program product of claim 63 wherein said public network includes a server and said program code is executable at a point on said network intermediate said computer and said server, or said program code is executable at said server.

111. The computer program product of claim 63 wherein the analysis and control steps are carried out by means of at least one analyser integrated into said application.

112. The computer program product of claim 111 wherein the at least one analyser executes said analysis and control steps as transmission of the outbound data is initiated, or after said inbound data is received by the application and before it is viewed by a user of the application.

86. A computer program product for controlling a computer of a plurality of computers adapted for connection to a public computer network to manage information, said computer having access to policy data containing rules which define whether or not verification is required for a digital certificate used to digitally sign signed data received in inbound data from the public computer network, comprising:

a recordable medium readable by the computer, having program code recorded thereon which when executed on said computer configures said computer to;

analyze, in conjunction with an application running on the computer that is operable to receive at least inbound data from the public computer network, signed data that has been digitally signed with a digital certificate, to extract one or more details of said signed data;

to determine whether or not verification is required for said digital certificate in dependence on said rules of said policy data and in dependence on the one or more extracted details of said signed data; and

to control the application in dependence on the determination.

87. The computer program product of claim 86 wherein said verification for the digital certificate includes determining whether the digital certificate has been revoked.

88. The computer program product of claim 87 wherein said program code when executed on said computer is further operable to determine whether said signed data is part of an eCommerce transaction, and if it is, to determine the amount of money that is promised in that eCommerce transaction, wherein said verification for the digital certificate also includes determining whether said digital certificate can be taken as a guarantee of receiving the amount of money promised in said eCommerce transaction.

89. The computer program product of claim 86 wherein said one or more details of said signed data, include one or more of said digital certificate holder'"'"'s identity, the expiry date of said digital certificate, the issue number of said digital certificate, and the domain name from which the signed data was received, and wherein said rules of said policy file define whether or not verification for said digital certificate is required in dependence on the one or more details.

90. The computer program product of claim 86 wherein said program code when executed on said computer is further operable to determine whether or not an eCommerce transaction is occurring, and if it is, to extract as one or more details of said signed data, the amount of any transaction being made with said digital certificate, the account code from which any payment is being made, a credit card number, one or more indicators of the nature of the transaction, and wherein said rules of said policy file define whether or not verification is required for said digital certificate in dependence on said one or more details.

91. The computer program product of claim 90 wherein the program code when executed on said computer is further operable to control the computer to record digital certificates used to digitally sign any signed data received in said inbound data or sufficient descriptive data to identify any such digital certificates, and transaction data describing any transactions made with those digital certificates in a data repository such that a record is maintained of transactions made with a digital certificate;

said transaction data being at least one or more of the date of any transactions made with a digital certificate, and the amount of any transaction made with that digital certificate, and wherein said rules of said policy file define whether or not verification for said digital certificate is required in dependence on said transaction data.

92. The computer program product of claim 86 wherein said program code when executed on said computer is further operable to control the computer to store digital certificates used to sign signed data in said inbound data or digital certificates transmitted in said inbound data and storing said digital certificates or sufficient descriptive data to identify said digital certificates in a data repository.

93. The computer program product of claim 92 wherein said program code when executed on said computer is further operable to control the computer to record the results of any verification for an identified digital certificate in said data repository together with said identified digital certificate.

94. The computer program product of claim 93 wherein said program code when executed on said computer is operable to determine whether said identified digital certificate has been previously stored in said data repository, and if it has been previously stored, to look-up the results of any previous verification for said identified digital certificate, wherein the determination of whether or not verification is required for said identified digital certificate is dependent on said results of any previous verification for said identified digital certificate.

95. The computer program product of claim 86 wherein said program code when executed on said computer is operable to determine whether or not a digital certificate has been revoked, and control said application to prevent said inbound data being viewed by a user of said application if said identified digital certificate has been revoked.

96. The computer program product of claim 86 wherein said program code when executed on said computer is operable to determine whether or not a digital certificate has been revoked, and to control said application to notify a user of said application that said inbound data is not to be relied upon if said identified digital certificate has been revoked.

97. The computer program product of claim 86 wherein said program code is executable at said computer.

98. The computer program product of claim 86 wherein said application is a web browser.

99. The computer program product of claim 98 wherein said program code when executed on said computer is a plug-in module of said web browser.

100. The computer program product of claim 99 wherein said web browser is an Internet browser and said plug-in module is a Browser Helper Object.

101. The computer program product of claim 86 wherein said application is an e-mail client.

102. The computer program product of claim 101 wherein said program code when executed on said computer is a plug-in module of said e-mail client.

103. The computer program product of claim 102 wherein said plug-in module is a an exchange client extension.

104. The computer program product of claim 86 wherein said network includes a server and said program code is executable at a point on said network intermediate said computer and said server, or said program code is executable at said server.

114. The computer program product of claim 86 wherein the analysis, determination and control steps are carried out by means of at least one analyser integrated into said application.

115. The computer program product of claim 114 wherein the at least on analyser executes said analysis, determination and control steps after said inbound data is received by the application, and before it is viewed by a user of the application.