Patent Application
20050021938
The present invention relates generally to document access control and, more particularly, to a system and method for controlling access to documents shared through the use of e-mail messages.
The increasing connectivity of computer users through local and public networks such as LANs, WANs and the Internet, has created a corresponding increase in the ability to share information among users regardless of location. For example, if the sharable information is stored at a commonly accessible location, a user can provide access to the sharable information to another user by providing a link to the location in an e-mail sent to the other user. Sharing a document by providing the necessary link to it, such as a URL, is an efficient way to share the document because it uses far less memory then sending a copy of the original document to all of the recipients of the e-mail. One problem, however, with sending a link is that it may make the document accessible to anyone capable of receiving the e-mail. This problem complicates the document owner's responsibility to control access to the document.
Because of this problem, the document owner may elect to send the document itself instead of the link to the document. Sending the document instead of the link raises access control problems as well. The document sent is a copy of the original document. As a result, the sent document is out of the control of the document owner, and any subsequent changes to the original document will not be reflected in the copy sent.
One access control system that is used to improve access control to information is to use an encryption system. Using such a system, original information can be encrypted in a multitude of ways. For example, Microsoft Word (a product of Microsoft Corporation) enables the original information to be encrypted with a password. Whatever the encryption system, the process of encrypting requires additional steps for users who want to share information, and may require special knowledge of the technology.
It would therefore be useful to provide an easy way to handle access rights to shared information.
Briefly, in one aspect of the invention, a system and method for controlling transmission of an e-mail message includes determining whether an e-mail message being transmitted to one or more addresses includes a link to a document, detecting each of the one or more addresses to which the e-mail message is being transmitted, and creating a common user account for the detected one or more addresses. An access right to the linked document is for each of the one or more addresses in the common user account, and the e-mail message is transmitted with the document link to each of the one or more addresses.
The sender workstation 10 and receiver workstations 60 may be a PC, a mobile phone, a PDA, a magnetic card, or some combination thereof, or any other computing structure. Each preferably includes a CPU, a main memory, a ROM, a storage device and a communication interface all coupled together via a bus. The CPU may be implemented as a single microprocessor or as multiple processors for a multi-processing system. The main memory is preferably implemented with a RAM and a smaller-sized cache. The ROM is a non-volatile storage, and may be implemented, for example, as an EPROM or NVRAM. The storage device can be a hard disk drive or any other type of non-volatile, writable storage.
The communication interface for the sender workstation 10 and receiver workstations 60 provides a two-way data communication coupling, such as to a network. For example, if the communication interface is an integrated services digital network (ISDN) card or a modem, the communication interface provides a data communication connection to the corresponding type of telephone line. If the communication interface is a local area network (LAN) card, the communication interface provides a data communication connection to a compatible LAN. Wireless links are also possible. In any such implementation, the communication interface sends and receives electrical, electromagnetic or optical signals, which carry digital data streams representing different types of information.
If the network connection is an Internet connection, the sender workstation 10 and receiver workstations 60 can transmit a requested code for an application program through the Internet, an ISP, the local network and the communication interface. The received code can be executed by the CPU in the sender workstation 10 and receiver workstations 60 as it is received, stored in the storage device, or stored in some other non-volatile storage for later execution. In this manner, the sender workstation 10 and receiver workstations 60 may obtain application code in the form of a carrier wave.
Like the sender workstation 10 and receiver workstations 60, the e-mail server 20 and file server 40 preferably include a CPU, a main memory, a ROM, a storage device and a communication interface all coupled together via a bus. The e-mail server 20 is configured to enable the sender workstation 10 and receiver workstations 60 to create e-mail messages. The e-mail server 20 is also configured to handle the sending and receiving of e-mail messages, as well as storing e-mail messages.
The file server 40 stores a plurality of documents in a non-volatile storage area, such as a hard disk drive or NVRAM. For the purposes of this application, a document can be considered any kind of information (including in any format) that can be accessed and/or shared by the sender workstation 10 and the receiver workstations 60. The user management database 30 includes information about users of documents stored in the file server 40. In addition to information identifying the users, the user management database 30 also includes information about the access rights the users have to respective documents stored in the file server 40. The information included in the user management database 30 may be stored in a non-volatile storage area, such as a hard disk drive or NVRAM.
As shown in
The sender workstation 10 is capable of composing an e-mail message with the e-mail server 20, attaching to the e-mail message a document or a link to a document stored in the file server 40, and set access rights in the user management database 30 to the document. In addition, the user can encrypt the document. The document or link can be sent to one or more receiver workstations 60 by including the address of each receiver workstation 60 in the e-mail message.
Before the e-mail is transmitted to the addresses identified in the e-mail message, the system detects whether there is a link to a document in the e-mail message (step 204). This detection can be performed by the e-mail server 20 or whatever e-mail application the user used to create the e-mail message. In addition to being configured to create, send, receive and store e-mail messages, the e-mail server 20 can be configured to analyze an e-mail message prior to being transmitted to determine whether the e-mail message includes a document or a link to a document.
If a link to a document is detected, each of the addresses identified in the e-mail message are extracted (step 206). The extraction of the addresses can also be performed by the e-mail server 20 or e-mail application used to create the e-mail message. The extracted addresses are then used to create a user account (step 208). The user account includes information identifying one or more users, such as by their addresses. The user account also includes information identifying what rights each user has to access a document, i.e., an access control list to the document. The document being accessed can be a document stored in the file server 40. The user account can be stored in the user management database 30. The user account can be a single account storing information for each of the users addressed in the e-mail message. This single account can be associated with a particular document and store information identifying access control information to the document for one or more users.
Alternatively, the user account can be a plurality of accounts, where each of the plurality of accounts stores information for a respective one of the users addressed in the e-mail message. Each of the plurality of accounts can then store access control information for more than one document for a respective user. In other words, each user can have a respective user account, which stores access control information for that user to each of one or more documents.
An access right to the linked document is set for each address extracted from the e-mail message (step 210). The access right defines the manner in which the recipient of the linked document may view and/or modify the document. Examples of access rights can be, for example, read-only and read/write access. The access right can be set automatically to default to a particular access right, such as read-only. Alternatively, the user sending the link to the document can be prompted to enter what access right to set. When prompted, the user can set the same access right for all of the addresses or set access rights individually for each address. The access rights are stored in the user account created for the addresses extracted from the e-mail message. The e-mail server 20 or e-mail application used to create the e-mail message can be configured to create the user account and set the access rights for the addresses extracted from the e-mail message.
Having created the user account and set the access rights, the e-mail message with the link to the document is sent to all of the addresses in the message (step 212). The e-mail server 20 or e-mail application used to create the e-mail message can be configured to control the transmission of the e-mail message, such as from the sender workstation 10 to one or more of the receiver workstations 60. The message can be considered transmitted once it leaves the e-mail sender workstation.
The recipients of the e-mail message can use the provided link to access the document. As shown in
In response to clicking on the link to the document in the e-mail message, an access request is transmitted to the location of the document (step 216). The access request includes information identifying the location of the document, such as by its HTTP address, and information identifying the user sending the access request, such as the user's e-mail address. The information identifying the location of the document can be used to direct the transmission of the access request. The access request is received at the location of the document (step 218). For example, if the e-mail message links to a document residing in the file server 20, then the access request is transmitted to the file server 20.
Before access to the document is enabled, the user account corresponding to the document is referenced (step 220). As described above, the user account may be stored in the user management database 30, which is associated with the file server 20 where the linked document is stored. The user account is referenced to determine whether or not the user that transmitted the access request has rights to access the document. For example, the user that transmitted the access request is entitled to access the document if the information identifying the user, such as the user's e-mail address, is denoted in the user account. If the information identifying the user is not denoted in the user account, then the user is not entitled to access the document. This may occur if the original recipient of the e-mail forwards the link to the document to another address that was not among the original addresses included in the e-mail message.
If the user transmitting the access request is entitled to access the document, the next step is to determine what access right the user has to the document (step 222). As described above, the user account associated with the document identifies the access right for each recipient address. Using the address identifying the user transmitting the access request and the user account information, the system can determine what access right the user has to the linked document.
Based on the determined access right, the user is provided access to the document (step 224). For example, if the determined access right is read-only, then the user is only able to view the document, but not change its contents. However, if the determined access right is read-write access, then the user is allowed to view the document, as well as change its contents. The system may store the fact that a change has been made by a particular user.
As described above with respect to
Before the e-mail is transmitted to the addresses identified in the e-mail message, the system detects whether the e-mail message contains a link to a document (step 304). If a link is detected, the system determines whether the linked document is encrypted (step 306). The e-mail server 20 or e-mail application used to create the e-mail can be configured to locate the document and determine whether or not it is encrypted. The document may be encrypted using available encryption algorithms as are known in the art. The present process contemplates the use of any such available encryption algorithm.
If the document is encrypted, the encryption key for decrypting the document is retrieved (step 308). The encryption key depends on the type of encryption algorithm used to encrypt the document, and it may, for example, a password or a binary key file (used for PDP algorithms). The e-mail server 20 or e-mail application used to generate the e-mail message can be configured to access the file server 20 or other local files of the sender workstation 10 to identify the location of the encryption key so it can be retrieved. In addition to retrieving the encryption key, it is possible to further encode the key with information about the recipient addresses of the e-mail message. The encoding of this address information can limit the use of the encryption key to users associated with those addresses. The encoding of the encryption key can also include information identifying the access right for those addresses. The access right can be a default setting, or the user can be prompted to identify the access right individually for each recipient. Instead of encoding the encryption key, it is also possible to extract the addresses, create the user account and set the access right for each of the addresses as described above with respect to
The retrieved encryption key is attached to the e-mail message along with the link to the encrypted document (step 310). The e-mail message with the link to the document and the encryption key is then sent to each of the addresses in the message (step 312). The e-mail server 20 or e-mail application used to create the e-mail message can be configured to control the transmission of the e-mail message, such as from the sender workstation 10 to one or more of the receiver workstations 60.
A user at one of the designated addresses can access the encrypted document by clicking on the link in the e-mail message, such as using a mouse (step 314). In response to clicking on the link to the document in the e-mail message, an access request is transmitted to the location of the document (step 316). The access request includes information identifying the location of the document, such as by its HTTP address, information identifying the user sending the access request, such as the user's e-mail address, and the encryption key. The information identifying the location of the document can be used to direct the transmission of the access request. The access request is received at the location of the document (step 318).
The encrypted document is then located (step 320). The location of the document can be determined form the information in the access request. The document is then decrypted using the encryption key included in the access request (step 322). The manner in which the document is decrypted depends on the algorithm used to encrypt the document. Before providing access to the decrypted document is provided, reference can be made to the addresses encoded with the encryption key. If the address submitting the access request does not correspond to any of the addresses, then no access is provided. If it does correspond to one of the addresses, access is provided according to the access right. The limitation to accessing the decrypted document can also be provided by the user account, as described above with respect to
In addition to creating an e-mail message with a link to a document, a user can create an e-mail message with the document attached.
Before the e-mail is transmitted to the addresses identified in the e-mail message, the system detects whether there is a document attached to the e-mail message (step 304). This detection can be performed by the e-mail server 20 or whatever e-mail application the user used to create the e-mail message. In addition to being configured to create, send, receive and store e-mail messages, the e-mail server 20 can be configured to analyze an e-mail message prior to being transmitted to determine whether the e-mail message includes an attached document.
If an attached document is detected, the document is detached from the e-mail message (step 406). The detachment of the document, which removes a copy of the document from the e-mail message, can be performed by the e-mail server 20 or the e-mail application used to create the e-mail message. The detached document is then stored in a storage area (step 408). The storage area can be the file server 40 or other storage location accessible to the sender workstation 10.
In addition to detaching and storing the document, the system extracts identified recipient addresses in the e-mail message (step 410), the extracted addresses are used to create a user account (step 412), and an access right to the detached document is set for each address extracted from the e-mail message (step 414). The user account and access right can be created and stored as described above with respect to
Instead of including the attached document in the e-mail message, a link to the detached document is attached to the e-mail message (step 416). The link corresponds to the location at which the detached document is stored. After attaching the link, the e-mail message with the link to the document is sent to each of the addresses in the message (step 418). The e-mail server 20 or e-mail application used to create the e-mail message can be configured to control the transmission of the e-mail message, such as from the sender workstation 10 to one or more of the receiver workstations 60.
The users at each of the addresses receiving the e-mail message can use the link to the document in the e-mail message to access the document in the same manner as described above with respect to
In response to clicking on the link to the document in the e-mail message, an access request is transmitted to the location of the document (step 422). The access request includes information identifying the location of the document, such as its HTTP address, and information identifying the user sending the access request, such as by the user's e-mail address. The information identifying the location of the document can be used to direct the transmission of the access request. The access request is received at the location of the document (step 424). For example, if the e-mail message links to a document in the file server 20, then the access request is transmitted to the file server 20.
Before enabling access to the document, the user account corresponding to the document is referenced (step 426). As described above, the user account may be stored in the user management database 30, which is associated with the file server 20 in which the linked document is stored. The user account is referenced to determine whether or not the user that transmitted the access request is entitled to access the document. For example, the user that transmitted the access request is entitled to access the document if the information identifying the user, such as the user's e-mail address, is denoted in the user account. If the information identifying the user is not denoted in the user account, then the user is not entitled to access the document. This may occur if the original recipient of the e-mail forwards the link to the document to another address that was not among the original addresses included in the e-mail message.
If the user transmitting the access request is entitled to access the document, the system determines the user's access right to the document (step 428). As described above, the user account associated with the document identifies the access right for each address to which the link to the document is transmitted. Using the address identifying the user transmitting the access request and the user account information, the system can determine what access right the user has to the linked document.
Based on the determined access right, the user is provided access to the document (step 430). For example, if the determined access right is read-only, then the user is only able to view the document, but not change its contents. However, if the determined access right is read-write access, then the user is allowed to view the document, as well as change its contents.
In the process of
Instead of storing the document, creating a user account and attaching a link to the document as described above in
The encrypted document is then attached to the e-mail message along with the encryption key (step 512). The attaching of the encrypted document and encryption key can be performed by the e-mail server 20 or the e-mail application used to generate the e-mail message. After attaching the encrypted document and encryption key, the e-mail message is transmitted to each of the addresses identified in the e-mail message (step 514). The e-mail server 20 or e-mail application used to create the e-mail message can be configured to control the transmission of the e-mail message, such as from the sender workstation 10 to one or more of the receiver workstations 60.
In response to receiving the e-mail message, a user associated with an address in the e-mail message can access the attached encrypted document. As shown in
After initiating the access to the encrypted document, the encryption key is applied (step 518). The manner in which the document is decrypted depends on the algorithm used to encrypt the document. Before providing access to the decrypted document, reference can be made to the addresses encoded with the encryption key. If the address at which the user attempts to access the encrypted document does not correspond to any of the addresses in the e-mail message, then no access is provided. If it does correspond to one of the addresses, then the document is decrypted. The user is then provided with access to the decrypted document (step 520). If the encryption key is encoded with information about the access right to the document, then the system provides access in accordance with the access right.
In the process of
In any of the foregoing embodiments, the recipient addresses in a particular application may include alternative e-mail addresses of that recipient based on remote access or through the system learning alternative e-mail addresses. In addition, it is possible to extinguish the access rights for a recipient address in response to an action of the user at the recipient address. For example, if a user forwards a linked or attached document to another user, the e-mail server 20 can recognize this action and alter the user account to extinguish the access rights for that user.
The foregoing description of preferred embodiments of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed, and modifications and variations are possible in light in the above teachings or may be acquired from practice of the invention. Any aspect of each embodiment can be combined with another aspect of another embodiment The embodiment was chosen and described in order to explain the principles of the invention and as practical application to enable one skilled in the art to utilize the invention in various embodiments and with various modifications are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims appended hereto and their equivalents.
