Information management system

• US 9,225,553 B2
• Filed: 12/17/2007
• Issued: 12/29/2015
• Est. Priority Date: 11/08/2000
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Malcolm, Peter Bryan, Napier, John Anthony, Stickler, Andrew Mark, Beadle, Paul James Owen, Crocker, Jason Paul, Tamblin, Natahan John
• Primary Examiner(s): Coppola, Jacob C.
• Application Number:
  US11/958,252
• Publication Number:
  US 20080172717A1
• Time in Patent Office: 2,934 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: G06Q 10/063 Operations research, analysis or management
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An information management system is described comprising one or more workstations running applications which allow a user of the workstation to connect to a network, such as the Internet. Each application has an analyzer, which monitors transmission data that the application is about to transmit to the network or has just received from the network, and which determines an appropriate action to take regarding that data. The analyzer may consult policy data containing a supervisor-defined policy to govern the workstations in order to determine what action to take. Such actions may be extracting data from the transmission data, such as passwords and usernames, digital certificates or eCommerce transaction details for storage and record keeping; ensuring that the transmission data is transmitted at an encryption strength appropriate to the contents of the transmission data; determining whether a check needs to be made as to whether a digital certificate received in transmission is valid; determining whether a transaction about to be made by a user of one of the workstations needs third party approval before it is made; and controlling the transmission of messages, such as e-mails according to a policy.

Claims

1. An information management system comprising:

a workstation connected to a computer network, the workstation having a memory;

an application stored in said memory of the workstation for receiving inbound messages from said network and for transmitting an originally received message as an outbound message to said network;

policy data containing rules for determining one or more particulars of the outbound message, and for controlling the transmission of said outbound message in dependence on those particulars; and

an analyzer configured to determine whether the originally received message has only been transmitted among a single domain and to prevent, based upon the policy data, the outbound message from being forwarded to an address outside the single domain, or issue a warning before forwarding the message, in response to determining that previously the originally received message has only been transmitted among the single domain.

2. The system of claim 1 wherein the policy data defines one or more predetermined keywords, and wherein if the analyzer determines that the outbound message contains one or more of the pre-determined keywords or combination of keywords, the analyzer is further configured to prevent the outbound message from being forwarded to another recipient or issue a warning before the outbound message is forwarded.

3. The system of claim 1 wherein the received message has a one or more attributes configurable by the sender of the originally received message, one of those attributes being a “

do-not-forward”

attribute, and the analyzer is further configured to prevent the originally received message from being forwarded as an outbound message if the sender of the originally received message set the “

do-not-forward”

attribute.

4. The system of claim 1 wherein the analyzer is further configured to prevent forwarding of the outbound message, or issue a warning before forwarding the outbound message, if the sender forwarding the outbound message was the only recipient of the originally received message associated with the outbound message being forwarded.

5. The system of claim 1 wherein the analyzer is further configured to re-direct the outbound message to a third party for approval, and wherein if the third party gives approval, the analyzer is further configured to forward the outbound message-to the originally intended recipients in the normal way.

6. The system of claim 1 wherein said application is a web browser.

7. The system of claim 6 wherein said analyzer is a plug-in module of said web browser.

8. The system of claim 7 wherein said analyzer is a Browser Helper Object of Microsoft'"'"'s Internet Explorer.

9. The system of claim 1 wherein said application is an e-mail client.

10. The system of claim 9 wherein said analyzer is a plug-in module of said e-mail client.

11. The system of claim 1 wherein said application is an Instant messaging application.

12. The system of claim 11 wherein said analyzer is a plug-in of said Instant messaging application.

13. The system of claim 1 wherein said application is a Voice Messaging application.

14. The system of claim 13 wherein said analyzer is a plug-in of said Voice messaging application.

15. The system of claim 1 wherein said network includes a server and said analyzer is located at a point on said network intermediate of said one or more workstations and said server, or said analyzer is located at said server.

16. An information management system comprising:

a workstation connected to a computer network, the workstation having a memory;

application means, stored in said memory of the workstation, for receiving inbound messages from said network and for transmitting an originally received message as an outbound message to said network;

policy storage means for storing policy data containing rules for determining one or more particulars of the outbound message, said rules being for controlling the transmission of said outbound message in dependence on those particulars;

and analyzing means, for determining whether the originally received message has only been transmitted among a single domain and to prevent, based upon the policy data, the outbound message from being forwarded to an address outside the single domain, or issue a warning before forwarding the message, in response to determining that previously the originally received message has only been transmitted among the single domain.

17. The system of claim 16 wherein the policy data defines one or more predetermined keywords, and wherein if the analyzing means determines that the outbound message contains one or more of the pre-determined keywords or combination of keywords, the outbound message is prevented from being forwarded to another recipient or a warning is issued before the outbound message is forwarded.

18. The system of claim 16 wherein the received message has a one or more attributes configurable by the sender of the originally received message, one of those attributes being a “

do-not-forward”

attribute, and the analyzing means prevents the originally received message being forwarded as an outbound message if the sender of the originally received message set the “

do-not-forward”

attribute.

19. The system of claim 16 wherein the analyzing means prevents forwarding of the outbound message, or issues a warning before forwarding the outbound message, if the sender forwarding the outbound message was the only recipient of the originally received message associated with the outbound message being forwarded.

20. The system of claim 16 wherein the analyzing means further causes the outbound message that is to be forwarded to first be re-directed to a third party for approval, wherein if the third party gives his approval, the outbound message is forwarded to the originally intended recipients in the normal way.

21. The system of claim 16 wherein said application means is a web browser.

22. The system of claim 21 wherein said analyzing means is a plug-in module of said web browser.

23. The system of claim 22 wherein said analyzing means is a Browser Helper Object of Microsoft'"'"'s Internet Explorer.

24. The system of claim 16 wherein said application means is an e-mail client.

25. The system of claim 24 wherein said analyzing means is a plug-in module of said e-mail client.

26. The system of claim 16 wherein said application means is an Instant messaging application.

27. The system of claim 26 wherein said analyzing means is a plug-in of said Instant messaging application.

28. The system of claim 16 wherein said application means is a Voice Messaging application.

29. The system of claim 28 wherein said analyzing means is a plug-in of said Voice messaging application.

30. The system of claim 16 wherein said network includes a server and said analyzing means is located at a point on said network intermediate said one or more workstations and said server, or said analyzing means is located at said server.

31. A method of managing information comprising the steps of:

providing a workstation connected to a computer network, each the workstation having a memory;

providing an application stored in said memory of the workstation for receiving inbound messages from said network and for transmitting an originally received message as an outbound message to said network;

providing policy data containing rules for determining one or more particulars of the outbound message, and for controlling the transmission of said outbound message in dependence on those particulars; and

analyzing said outbound message and determining whether the originally received message has only been transmitted among a single domain and to prevent based upon the policy data, the outbound message from being forwarded to an address outside the single domain, or issue a warning before forwarding the message, in response to determining that previously the originally received message has only been transmitted among the single domain.

32. The method of claim 31 wherein the policy data defines one or more predetermined keywords, and wherein if it is determined in the analyzing step that the outbound message contains one or more of the pre-determined keywords or combination of keywords, the outbound message is prevented from being forwarded to another recipient or a warning is issued before the outbound message is forwarded.

33. The method of claim 31 wherein the received message has one or more attributes configurable by the sender of the originally received message, one of those attributes being a “

do-not-forward”

attribute, and the outbound message is prevented from being forwarded, if it is determined that the sender of the originally received message set the “

do-not-forward”

attribute.

34. The method of claim 31 wherein the outbound message is prevented from being forwarded, or a warning is issued before forwarding the outbound message, if it is determined that the sender forwarding the outbound message was the only recipient of the originally received message associated with the outbound message being forwarded.

35. The method of claim 31 comprising causing the outbound message that is to be forwarded to first be re-directed to a third party for approval, wherein if the third party gives his approval, the outbound message is forwarded to the originally intended recipients in the normal way.

36. The method of claim 31 wherein said application is a web browser.

37. The method of claim 36 wherein said analyzing step is performed by a plug-in module of said web browser.

38. The method of claim 37 wherein said plug-in module is a Browser Helper Object of Microsoft'"'"'s Internet Explorer.

39. The method of claim 31 wherein said application is an e-mail client.

40. The method of claim 39 wherein said analyzing step is performed by a plug-in module of said e-mail client.

41. The method of claim 31 wherein said application is an Instant messaging application.

42. The method of claim 41 wherein said analyzing step is performed by a plug-in of said Instant messaging application.

43. The method of claim 31 wherein said application is a Voice Messaging application.

44. The method of claim 43 wherein said analyzing step is performed by a plug-in of said Voice messaging application.

45. The method of claim 31 wherein said network includes a server and said analyzing step is performed at a point on said network intermediate said one or more workstations and said server, or is performed at said server.

46. A non-transitory computer software product, for controlling a computer to manage information, said computer being connected to a network and having access to policy data containing rules for controlling transmission of outbound data to the network, comprising a recording medium readable by the computer, having program code recorded thereon which when executed on said computer configures the computer to:

analyze in conjunction with an application running on said computer that transmits outbound messages to said network and receives inbound messages from said network, an outbound message that is based upon an originally received message and to determine whether the originally received message has only been transmitted among a single domain and to prevent based upon the policy data, the outbound message from being forwarded to an address outside the single domain, or issue a warning before forwarding the message, in response to determining that previously the originally received message has only been transmitted among the single domain.

47. The computer software product of claim 46 wherein the policy data defines one or more pre-determined keywords, and wherein if it is determined that the outbound message contains one or more of the pre-determined keywords or combination of keywords, the outbound message is prevented from being forwarded to another recipient or a warning is issued before the outbound message is forwarded.

48. The computer software product of claim 46 wherein the received message has a one or more attributes configurable by the sender of the originally received message, one of those attributes being a “

do-not-forward”

attribute, and the program code prevents the originally received message from being forwarded as an outbound message if the sender of the originally received message set the “

do-not-forward”

attribute.

49. The computer software product of claim 46 wherein the program code prevents forwarding of the outbound message, or issues a warning before forwarding the outbound message, if the sender forwarding the outbound message was the only recipient of an originally received message associated with the outbound message being forwarded.

50. The computer software product of claim 46 wherein the program code further causes the outbound message that is to be forwarded to first be re-directed to a third party for approval, wherein if the third party gives his approval, the outbound message is forwarded to the originally intended recipients in the normal way.

51. The computer program product of claim 46 wherein said application is a web browser.

52. The computer program product of claim 51 wherein said program code when executed on said computer is a plug-in module of said web browser.

53. The computer program product of claim 52 wherein said plug-in module is a Browser Helper Object of Microsoft'"'"'s Internet Explorer.

54. The computer program product of claim 46 wherein said application is an e-mail client.

55. The computer program product of claim 54 wherein said program code when executed on said computer is a plug-in module of said e-mail client.

56. The computer software product of claim 46 wherein said application is an Instant messaging application.

57. The computer software product of claim 56 wherein said program code when executed on said computer is a plug-in of said Instant messaging application.

58. The computer software product of claim 46 wherein said application is a Voice Messaging application.

59. The computer software product of claim 58 wherein said program code when executed on said computer is a plug-in of said Voice messaging application.

60. The computer program product of claim 46 wherein said network includes a server and said program code is executable at a point on said network intermediate said one or more workstations and said server, or said program code is executable at said server.