Security for hard copies and soft copies of a document during the document's lifecycle can be a matter of extreme importance to businesses and other organizations. A compromise or breach of security can have serious consequences for the organization, potentially including loss of a valuable trade secret and associated competitive advantage.
The accompanying drawings illustrate various embodiments and are a part of the specification. The illustrated embodiments are examples and do not limit the scope of the claims. Throughout the drawings, identical reference numbers designate similar, but not necessarily identical elements.
The same part numbers designate the same or similar parts throughout the figures.
An automated document management system can provide considerable protection for an organization's confidential information. Document management systems typically attempt to control the dissemination of soft copies and/or the printing of hard copies of a document identified as confidential by requiring a user to provide a personal identification number (“PIN”) or password as a security measure. For example, a user may be required to provide a PIN or a password prior to sending a copy to another user via an email, or prior to downloading the soft copy document to a memory device. Similarly, a user may be required to provide a PIN or a password prior to printing a hard copy of a secured document.
However, existing document management systems typically do not consider the life cycle of the confidential document and operate according to a static set of rules and procedures. Security measures and rules for existing document management systems are typically created by an administrative user in accordance with that administrative user's understanding of the level of confidentially associated with the document. Given the ease and speed with which confidential documents can be created, copied, distributed and destroyed today, it will be appreciated to employ a document security method and system that considers of the history of the document after its creation and the assignment of the confidentiality rating. It will also be appreciated for such a method and system to provide for dynamic security protection for documents distributed outside the organization.
Accordingly, various embodiments described herein were developed to provide a document security method and system that meets these needs. In an example of the disclosure, a system marks a confidential document with a unique identifier and stores the document in memory. Responsive to a user request to perform an operation upon the stored document or a copy of the document at a requester computer, the system accesses a database that associates users authorized to access the documents or copies of the documents with operations the users are authorized to perform. The operation authorization as indicated by the database is determined at least in part according to a document threat index. Upon determining the user is an authorized user and determining via the database the requested operation is an authorized operation, the system sends an access code to the requester computer to enable the operation. Advantages of the disclosure include that the system provides a complete security solution for organizations' soft and hard copy confidential documents, and adapts to events in the document's lifecycle, including incidences of dissemination, copying, printing, and destruction of copies of the document. Another advantage of the disclosure is that the system provides security protection for documents even when distributed outside the organization.
As used in this application, a “document” refers to a collection of data that provides information or evidence, or that serves as a record. A document may be in hard copy or soft copy form. “Hard copy” refers to a printed version or copy of the document, including but not limited to a version or copy printed upon paper. “Soft copy” refers to an electronic copy of a document, such as an electronic file viewed on a computer's display or transmitted as an e-mail attachment. “Soft copy” and “electronic document” are used synonymously in this application. “Memory” refers to any memory configured to store program instructions and other data, including but not limited to any non-volatile storage medium. Memory may be in the form of, but is not limited to, read-only memory (ROM), flash memory, hard drive memory, or optical disc storage. “Database” refers to any organized collection of data in digital form such that it can be stored in computer memory or a data storage device. A “document threat index” refers to an indicator, sign, gauge, meter, measure, or estimate of a security threat or threats with respect to a document. “Access code” refers to one or more alphanumeric or other characters that are provided in some manner, e.g., by a user or a system, to initiate an event or get the use of something, including, but not limited to, to create, read, update and/or delete a document. A “printer” or “printing device” refers to any liquid inkjet printer, solid toner-based printer, liquid toner-based printer, or any other electronic device that prints.” “Printer” or “printing device” includes any multifunctional electronic device that performs a function such as scanning and/or copying in addition to printing.
Sender computer 104 and requester computer 106 each represent generally any computing device or group of computing devices configured to send and receive network requests, send and receive electronic documents and other data, and otherwise communicate with, computer system 102 over network 108. In an example, either, or both of, sender computer 104 and requester computer 106 may be a printer computing device that is operable to produce a printed print job or printed content.
Network 108 represents generally hardware components and computers interconnected by communications channels that allow sharing of resources and information. Network 108 may include a cable, wireless, fiber optic, or remote connection via a telecommunication link, an infrared link, a radio frequency link, or some combination of these, or any other connectors or systems that provide electronic communication. Network 108 may include, at least in part, an intranet, the internet, or a combination of both. Network 108 may also include intermediate proxies, routers, switches, load balancers, and the like. The paths followed by network 108 between computer system 102, sender computer 104, and requester computer 106 as depicted in
Computer system 102 is shown to include a document security service 110, an association database 112, a processor 114, and a memory 116. Document security service 110 represents generally any combination of hardware and programming configured to provide a document security system that determines authorization for requested user operations in consideration of document threat index. Association database 112 represents generally a database, registry, lookup table or list that associates users authorized to access a document (or a copy of a document) with operations the users are authorized to perform. Processor 114 represents generally any instruction execution system, such as a computer/processor based system or an ASIC (Application Specific Integrated Circuit), a computer, or other system that can fetch or obtain instructions or logic stored in memory 116 and execute the instructions or logic contained therein. Memory 116 represents generally any memory configured to store program instructions and other data.
In the example of
The document security service 110 causes the document 118 to be marked with a unique identifier 120. A “unique identifier” refers to an identifier that distinguishes the document 118 from other documents managed via the service 110. In an example, the document 118 may be marked with a metadata tag that is readable by a computer, but which will not be visible to a user that views the document in a production mode, or absent a view mode that displays HyperText Markup Language (“HTML”) or other markup language coding. In other examples, the marking may be in the form of a text marking, a barcode, or a watermark. In some embodiments such markings are invisible to a user viewing the document with the naked eye when the document is a production mode (e.g. when viewed at a computer monitor or when the document is printed). In other embodiments the markings may be visible to a user viewing the document with the naked eye when the document is a production mode. After causing the document 118 to be marked with the identifier 120, the document security service causes the marked document to be stored in a memory 116.
The document security service 110 receives from the requester computer 106 a user-initiated request 122 to perform an operation upon the document 118 held in memory 116, or upon a soft or hard copy of the document 118. In examples, the operation request 122 may be a request to edit the document 118 stored in memory 116, a request to produce a soft or hard copy of the document 118 at requester computer 106, or a request to destroy (e.g., deletion of a soft copy from a hard drive, or shredding of a hard copy) a copy of the document 118 at the requester computer 106.
In response to receipt of the operation request 122, the document security service 110 accesses the association database 112, which includes data associating users that are authorized to access documents and copies of the documents with a listing of operations that the authorized users are permitted or authorized to perform. Such operation authorization as detailed by the association database 112 is determined at least in part according to a document threat index 146 that provides information regarding a then-current threat level, height, stage, ranking, or quantity applicable to the document 118. In the example of
In an example, the document security service 110, after determining, via accessing the association database 112, that the user that is requesting the document operation is an authorized user and that the requested operation detailed in the operation request 122 is an authorized operation, sends an access code 124 to the requester computer 106 to enable the requested operation.
In another example, the document security service 110 determines that the user that is requesting the document operation is an authorized user by accessing a user directory or other user authorization service, e.g., via a Lightweight Directory Access Protocol (“LDAP”) or other network protocol. Such authorization service may be and addition to, in lieu of, confirming user authorization via the association database 112. The document security service 110 then determines that the requested operation detailed in the operation request 122 is an authorized operation via accessing the association database 112, and sends an access code 124 to the requester computer 106 to enable the requested operation.
Following the document security service's 110 determination that the user is an authorized user and that the user-requested operation is an authorized operation, the user at the requester computer 106 may then proceed with the authorized operation. In examples, the authorized operation may be to read, copy, edit, destroy, or perform another operation upon the document 118 or a copy of the document 118. In examples, the document security service 110 requires that each authorized operation be conducted in a manner such that the unique identifier 120 appears on all hard and/or soft copies of the document 118 produced or edited via an authorized operation.
The computer system's 102 receipt of the operation request 122 from the requester computer 106, and/or the computer system's 102 sending of the access code 124 to the requester computer 106, may be via a networking protocol, including but not limited to Transmission Control Protocol/Internet Protocol (“TCP/IP”), HyperText Transfer Protocol (“HTTP”), Simple Mail Transfer Protocol (“SMTP”), Extensible Messaging and Presence Protocol (“XMPP”) and/or Session Initiation Protocol (“SIP”).
The functions and operations described with respect to document security service 110 and computer system 102 may be implemented as a non-transitory computer-readable storage medium containing instructions executed by a processor (e.g., processor 114) and stored in a memory (e.g., memory 116). In a given implementation, processor 114 may represent multiple processors, and memory 116 may represent multiple memories. Processor 114 represents generally any instruction execution system, such as a computer/processor based system or an ASIC (Application Specific Integrated Circuit), a computer, or other system that can fetch or obtain instructions or logic stored in memory 116 and execute the instructions or logic contained therein. Memory 116 represents generally any memory configured to store program instructions and other data.
The computing device 204 represents generally a computing device, or group of computing devices, configured to send and receive network requests, send content to, and otherwise communicate with, the server system 202.
In this example, the requester computing device 206 represents generally a multifunction printer computing device that is operable to produce a printed print job or printed content, and additionally operable to send network requests, print jobs and other content to, receive network requests, print jobs, and other content from, and otherwise communicate with server system 202 over internet 208. In this example, the requester computing device 206 is additionally operable to receive a hard copy of a document and create additional hard copies thereof (a copy function), create soft copies thereof (a scan function), save a soft copy to a local or external memory (a file save function), and transmit soft copies of the document to other computing devices (an email or file transfer function). In other examples, the requester computing device 206 may be device that is configured to perform less than all of the operations listed above in this paragraph, or may be a computing device configured to perform different document operations.
Internet 208 represents generally hardware components and computers interconnected by communications channels that allow sharing of resources and information over an internet or intranet network, or over a combination of both. Internet 208 may include a cable, wireless, fiber optic, or remote connection via a telecommunication link, an infrared link, a radio frequency link, or some combination of these, or any other connectors or systems that provide electronic communication. Internet 208 may also include intermediate proxies, routers, switches, load balancers, and the like. The paths followed by internet 208 between server system 202, computing device 204, and requester computing device 206 as depicted in
Server system 202 is shown to include a document security service 210, an association database 212, a processor 214, and a memory 216. Document security service 210 represents generally any combination of hardware and programming configured to provide for document security by determining authorization for user requests to perform document operations in light of a document threat index. The service 210 includes a marking module 226, an authorization module 228, a threat index calculation module 230, an unauthorized attempts counter module 232, a hard copy counter module 234, a soft copy counter module 236, and an administrator access module 238.
The association database 212 represents generally a database, registry, lookup table or list that associates users authorized to access a document (or a copy of a document) with sets of operations the authorized users may perform. Processor 214 represents generally any instruction execution system, such as a computer/processor based system or an ASIC (Application Specific Integrated Circuit), a computer, or other system that can fetch or obtain instructions or logic stored in memory 216 and execute the instructions or logic contained therein. Memory 216 represents generally any memory configured to store program instructions and other data.
In the example of
The authorization module 228, receives, from a user 242 via the requester computing device 206, an operation request 222 to perform an operation at the device 206 upon the document 218 or a copy of the document. In an example, the request is a request to read, edit, copy, email, file transfer, or delete the electronic document 218 stored in memory 216 at the server system 202. In another example, the request is a request to read, edit, copy, email, file transfer, or delete a soft copy of the document 218 that is stored in a memory at the requester computing device 206, or at a removable memory device that is connected to requester computing device 206. In another example, the request is a request to scan, copy, email, file transfer, or shred a hard copy of the document 218 that is present at the requester computing device 206.
In response to receipt of the request, the authorization module 228 accesses the association database 212, which contains data associating users authorized to access the documents or copies of the documents with operations the users are authorized to perform. The operation authorization as indicated by the database 212 is determined at least in part according to a document threat index 246 that takes into account unauthorized attempts by a user to access the document or a copy of the document. In this example, the document threat index also takes and counts of hard copies and soft copies of the document in circulation.
Returning to the example of
In the example of
In the example of
Threat Index=(x*5)+y+z.
In this example, “x” is the number of unauthorized attempts by users or systems to access the document 218, “y” is the count hard copies of the document 218 currently in existence, and “z is the count of soft copies of the document 218 currently in existence. This particular formula weighs the count of unauthorized access attempt more heavily in comparison to the counts of hard and soft copies of the document in circulation. This is merely an example, however, and various methodologies and formulas may be utilized in other embodiments. Moving to
In an example, the document security service 210 additionally includes an administrator access module 238, configured to enable an administrative user to edit the association database 212 to define access permissions and privileges for users specific to the document 218. In an example, the administrator access module 238 enables the administrative user to define or edit an access expiration policy 256 for the document, such that upon the reaching of a date or milestone, some or all users are denied the ability to perform, read, copy, edit, delete, and/or other operations upon the document 218 or a copy of the document 218. In an example the expiration policy 256 may be a policy with respect a particular type of copy of the document 218, e.g. a “soft copy expiration policy”, and not affect requests for hard copy operations. In another example, the expiration policy 256 may be an expiration policy that restricts both hard and soft copy operations.
The authorization module 228, after determining, via accessing the database 212, that the user 242 that is requesting the document operation is an authorized user and that the requested operation detailed in the operation request 222 is an authorized operation, sends an access code 224 to the requester computer 206 to enable the operation. The user 242 at requester computer may then proceed with the reading, copying, editing, destroying, or other operation that the user 242 requested for the document 218, and that the document authorization module 228 determines is authorized for such user's interaction with the document 218.
On the other hand, if the authorization module 228 determines that the user 242 that is requesting the document operation is an unauthorized user, or determines via the association database 212 that the requested operation 222 is an unauthorized operation, the module 228 causes a denial message 258 to be sent to the multifunction computer 206 for display to a user, to communicate the requested operation 258 is denied or prohibited.
The server system's 202 receipt of the operation request 222 from the computing device 204, and/or the server system's 202 sending of the access code 224 or denial message 258 to the requester computing device 206 may be via a networking protocol, including but not limited to TCP/IP, HTTP, SMTP, XMPP, and/or SIP.
In an example, the remote version module 402 sends the remote version 404 to the computing device 408. Validation 412 of an attempt by the user 406 to open the remote version 404 at the computing device 408 occurs via an online connection 410 established between the computing device 408 that executes the remote version 404 and the second computer system 416. The authorized user 406 submits to the second system 416, via interaction with the document or a user interface at the computing device 408, authentication information 414 that is recognized by the second system 416.
In one embodiment, validation 412 of the user's 406 authorization to access the remote version 404 of the document via the remote version module 402 is available when the computing device 408 is not in electronic connection with the server system 202. In another embodiment, validation 412 of the user's 406 authorization to access the remote version 404 of the document via the remote version module 402 is available even when the computing device 408 in electronic connection with the server system 202. In the latter example, the user 406 or a system may choose to validate the user 406 as authorized via the authorization module 228 and an electronic connection with the server system 202. Alternatively, in the latter example the user 406 or a system may choose to validate 412 the user 406 as authorized via the remote version module 402 and the electronic connection 410 between the computing device 408 and the second computer system 416.
In an example, the remote version 404 includes a document identifier 420 that identifies the remote version 404 as a remote copy of the document 218 that is stored in memory 216 at the server system 202. In another example, the remote version 404 includes a list of operations 414 that are authorized for that user 406, and the remote version 404 restricts the user 406 to the listed operations.
The functions and operations described with respect to the document security service 210 and server system 202 may be implemented as a non-transitory computer-readable storage medium containing instructions executed by a processor (e.g., processor 214) and stored in a memory (e.g., memory 216). In a given implementation, processor 214 may represent multiple processors, and memory 216 may represent multiple memories. Processor 214 represents generally any instruction execution system, such as a computer/processor based system or an ASIC (Application Specific Integrated Circuit), a computer, or other system that can fetch or obtain instructions or logic stored in memory 216 and execute the instructions or logic contained therein. Memory 216 represents generally any memory configured to store program instructions and other data.
Continuing with
Various modifications may be made to the disclosed embodiments and implementations without departing from their scope. Therefore, the illustrations and examples herein should be construed in an illustrative, and not a restrictive, sense.