Abstract:
The present invention discloses a solution for tracking email dispersion through content substitution. In the solution, a set of entities to receive an email can be identified, where the email can contains textual content. A subset of words contained within the textual content can be programmatically selected. A set of replacement words for each of the determined words can be determined. For each email receiving entity, at least one replacement word can be programmatically substituted for it&#39;s equivalent to generate an entity specific message. Each entity specific message can contain a unique combination of substitutions so that no two entity specific message are identical. A record of which email receiving entities are associated with which entity specific message can be maintained. The entity specific messages can be sent to the associated set of email receiving entities.

Description:
BACKGROUND 
     1. Field of the Invention 
     The present invention relates to the field of email tracking and, more particularly, to embedding a unique serial number into the content of an email for tracking information dispersion. 
     2. Description of the Related Art 
     In business today, email is commonly used to communicate with a business&#39; employees. Often these emails contain sensitive information that is not intended for public consumption. Many problems could arise for a business if such sensitive information was leaked. For example, an email could contain information regarding a new line of products in development by the company. If this information was leaked to a competitor for example, this could give the competitor the chance to come up with a better product before the product is even released. 
     Currently, protection exists to keep a user from copying sensitive information, but these protections can easily be circumvented. For example, a user can take screenshots of the information, or copy them to a USB drive to prevent firewall based tracking. The user can then disperse the sensitive information to whoever they want. There are currently solutions for tracking down such information leaks. For example, one such solution is called a “canary trap” where the contents can be modified in each email and sent to a unique user, associating a revision of the content with the recipient user. When a leak occurs, the leaked text can be referenced to the user to find the source of the leak. The problem with implementing such a system is that a user has to manually do these modifications and track the changes with their associated users. This kind of implementation becomes very troublesome with a large number of recipient users. A more intuitive solution is required to track information dispersion in emails. 
     SUMMARY OF THE INVENTION 
     The present invention can allow for embedding a unique serial number into the content of an email for tracking information dispersion. This can allow a similar solution such as a “canary trap” to work on a much larger scale to track information dispersion. The present invention can allow the email author to build a serial number system into their email. A serial number can be embedded into email content by strategically changing words in the email content with synonyms. Each word replacement can have an associated bit flag or value. When all of the text replacements are processed together, their associated value or bit flag can create a unique serial number. In one embodiment, the replacements can occur at the client-side based upon substitutions defined in a unique, possibly encrypted header that is included with each sent message. When a leak occurs, the author can input the leaked text and the application can return the serial number for that revision. The disclosed invention can also allow the option to build in redundancy checking in the event a portion of the document is quoted. This also allows for the assignment of a serial number based on department. This can prevent two users from noticing a difference between emails sent to them and someone else in their department. The serial number can also include a CRC (Cyclic Redundancy Code) number or modulus check. This can prevent a recipient from noticing the serial number and attempting to change the number and potentially picking the wrong person as the source of the leak. 
     Another aspect of the present invention can include a user interface for configuring the embedded serial numbers and tracking them. One such user interface can allow a user to establish and identify interchangeable words in the email. Synonyms for these interchangeable words can be retrieved from a thesaurus and displayed for the user, which can allow the user to select which words to use for substitution. The present invention can also allow for random generation of email content with embedded serial numbers. A user can preview the generated revisions of the email content with embedded serial numbers for clarity, to make sure the initial content is still intact, before assigning each revision to a department, user, company, or the like. Serial numbers and therefore revisions of the email can be assigned to any distinguishable entity for tracking information dispersion. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       There are shown in the drawings, embodiments which are presently preferred, it being understood, however, that the invention is not limited to the precise arrangements and instrumentalities shown. 
         FIG. 1  is a schematic diagram of a system for embedding a unique serial number into the content of an email for tracking information dispersion in accordance with an embodiment of the inventive arrangements disclosed herein. 
         FIG. 2  illustrates a system of sample user interfaces for embedding a unique serial number into the content of an email for tracking information dispersion in accordance with an embodiment of the inventive arrangements disclosed herein. 
         FIG. 3  illustrates a system of sample user interfaces for embedding a unique serial number into the content of an email for tracking information dispersion in accordance with an embodiment of the inventive arrangements disclosed herein. 
         FIG. 4  is a flow chart of a method for embedding a unique serial number into the content of an email for tracking information dispersion in accordance with an embodiment of the inventive arrangements disclosed herein. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       FIG. 1  is a schematic diagram of a system  100  for embedding a unique serial number into the content of an email for tracking information dispersion in accordance with an embodiment of the inventive arrangements disclosed herein. In system  100 , user  102  can generate a series of emails  120  to be sent to recipient users  104 ,  106 ,  108 ,  109  with embedded serial numbers for tracking information dispersion. The serial number can be hidden in email content through a series of equivalent word substitutions. User  102  can interact with an email client running on computing device  110  to create the emails to be sent. Computing device  110  can interact with mail server  150  through network  140  to send emails  120 . Emails  120  can be sent as emails  122 ,  124 ,  126 , and  128  to user  104 ,  106 ,  109 , and  108 . Each email  122 - 128  can include a unique serial number that can identify the recipient of the email. Users  104 ,  106 ,  108 , and  109  can use client  112 ,  114 ,  116 , and  118  respectively to receive their associated email. If any user  104 ,  106 ,  108 , or  109  were to share the content of a received email  122 ,  124 ,  126 , or  128 , the content of the email could be used to detect the source of the leak. The serial number can be retrieved from the leaked email, which would be associated with the recipient user that caused the information leak. 
     Further, the mail server  150  can include a tracking and automatic discovery capability, which makes detecting a leak source easier. The automatic discovery capability can permit content from a breeched message (e.g., unique content from message  122 - 128  that includes message  122 - 128  specific substitutions) to be fed into the server  150 , which automatically returns a unique serial number associated with the breeched message and/or an identity of a user  104 - 109  associated with that serial number/breeched message. 
     In one embodiment, the actual content of a body of email  120  can be identical to the body content of each email  122 - 126  sent to the set of users  104 - 109 . The unique serial number and/or word substitutions can be defined in an email  120  header, which is unique for each end-user  104 - 109 . That is, a client-side program can use the header information, which can be encrypted, to generate a unique set of synonym substitutions. The client-side substitutions can be made before the email content is rendered to an associated user  104 - 109 . Client-side substitutions has a benefit of minimizing an additional load imposed upon mail server  150 , which would otherwise have to handle a unique email message  122 - 128  for each recipient (users  104 - 109 ). 
     Additionally, use of headers and client-side substitutions ensures that when another user is viewing messages  122 - 128  in a shared system, no extra substitution related overhead in incurred. For example, on a factory floor, a kiosk system can exist for users to log in and read an electronic bulletin board using a common machine. In such instances, the login of a user can define the user and a unique user-specific header used to perform substitutions. The bulletin board itself needs to contain only one message, which changes when another user logs into the kiosk system to read the message. 
     Computing device  110  can be any computing device capable of running an email client with extended functionalities for embedding a serial number or numbers into email content for tracking information dispersion. Computing device  110  can run an application to generate emails  120  and convey them to mail server  150  via network  140 . The computing device  110  can be any computing device capable of reproducing the described functionality including, but not limited to, a laptop computer, a cell phone, a personal data assistant (PDA), a desktop computer, or the like. 
     Mail server  150  can be a computing device setup to receive incoming mail messages and transmit them to their intended recipients. In system  100 , mail server  150  can receive emails  120  via network  140  and disperse them to their recipients as email  122 ,  124 ,  126 , and  128 . The mail server  150  can also be a bulletin board server, a BLOG server, and the like, where a unique content object can be a bulletin board message, a BLOG entry, and the like instead of an email message  122 - 128 , as illustrated. Mail server  150  can be implemented in any way, including, but not limited to, a server computer, a desktop computer, a laptop computer, and the like. 
     Emails  122 ,  124 ,  126 , and  128  can be serial embedded email messages intended for users  104 ,  106 ,  109 , and  108  respectively. Each email can have a unique serial number embedded in its content to uniquely identify the source of the content. Words can be strategically replaced to create the embedded serial number. This can make the content in each email to be different, but still contain the same content. For example, words can be replaced with synonyms to keep the meaning of the content at least relatively the same. The emails  122 ,  124 ,  126 , and  128  can be used to track the dispersion of the information contained in the emails. 
     Clients  112 ,  114 ,  116 , and  118  can be used by user  104 ,  106 ,  108 , and  109  to receive each email  122 ,  124 ,  126 , and  128  respectively. Clients  112 - 118  can be any computing device equipped with a transceiver capable of communications via network  140  and capable of running an email client for receiving email. Clients  112 - 118  can be any computing device, including, but not limited to, a desktop computer, a laptop computer, a cell phone, a personal data assistant (PDA), or the like. 
       FIG. 2  illustrates a system  200  of sample user interfaces for embedding a unique serial number into the content of an email for tracking information dispersion in accordance with an embodiment of the inventive arrangements disclosed herein. In system  200 , email client  205  can be an interface of an email client which can allow the creation of an email. Email client  205  can include button  208 , which can initiate the process of embedding a serial number or numbers into the created email. Email client  205  can include standard fields  206  and content  210 . Button  208  can be any GUI option that can allow for the initiation of the serial number embedding process. For example, button  208  can be a button, menu option, key combination, or the like. Standard fields  206  can include to, carbon copy (cc), blind carbon copy (bcc), subject, and the like. Content  210  can be the email content in which a serial number or numbers are to be embedded into. Email client  205  can be used to initiate the process of embedding serial numbers into email content to tracking information dispersion. Dispersion tracking configuration  250  can be shown after button  208  has been activated. Dispersion tracking configuration  250  can allow for initial settings to be configured before embedding the serial number or numbers into the email content. Dispersion tracking configuration  250  can include options such as serial number type  252 , number of serials to embed  254 , serial checking  256 , and option  258 . Email client  205  and dispersion tracking configuration  250  can be run on a computing device in context with computing device  110  in system  100 . 
     Dispersion tracking configuration  250  can allow for the initial configuration of the process of embedding a serial number or numbers into email content  210 . Dispersion tracking configuration  250  can include field serial number type  252 . Serial number type  252  can include many options, including, but not limited to, a predefined number of serial numbers to embed, a range for each serial number, serial numbers that are linked to identifiable items such as employee ID or domain ID, and the like. Number of serials to embed  254  can be a field in which can show the detected number of serial numbers to embed depending on the option selected for serial number type  252 . In the case that serial number type  252  is selected to be a predefined number of serial numbers, number of serials to embed  254  can be used to specify the number of serial numbers to embed. Serial checking  256  can be a field that can allow a user to specify whether to add cyclic redundancy checking, modulus, or no checking for the embedded serial. Option  258  can allow the user to specify whether to just give the user the options to choose which synonyms to replace words on email content  210  with or to allow the application to randomly generate revisions of email content  210  with words it sees fitting to generate the number of revisions matching the required serial numbers. 
       FIG. 3  illustrates a system  300  of sample user interfaces for embedding a unique serial number into the content of an email for tracking information dispersion in accordance with an embodiment of the inventive arrangements disclosed herein. In system  300 , information dispersion tracking configuration  305  can be an interface used to define which words are to be replaced and by what words to embed a unique serial number. Content area  311  can show the email content and can display words that are replaceable differently. 
     In this example, words that are replaceable are displayed in bold, however the current invention can allow for any alternate display of replaceable words. A user can select a word to replace, which can allow possible word replacements  312  to be populated with synonyms of the selected word that can be possible substitutions. For example, word  310  can be highlighted after being selected, which can cause possible word replacements  312  to populate with synonyms of word  310 . This can allow a user to select preferred substitutions. For example, words  314  can be selected as preferred substitutions for word  310 . System  300  also includes replacement preview interface  350 , which can be an interface that can be used to preview email content replacements before they&#39;re used. In this example, content  352  can be associated with checkbox  354 , content  356  can be associated with  358 , content  360  can be associated with checkbox  362 , and content  364  can be associated with checkbox  366 . In this example, a user can either check or uncheck a checkbox  354 ,  358 ,  362 ,  366  to approve or disapprove of the associated content. 
     It should be noted that system  300  represents an overly simplistic substitution scheme presented to illustrate the concepts of the invention. In most real world implementations, multiple words subject to substitution will be identified within an email body (instead of one as shown) and multiple different substitutions/replacement words will exist. A unique number (e.g., the serial number) can be assigned/generated to represent a set of unique word replacements. Storing/tracking unique serial numbers simplifies a management of a large number of email messages, each having a unique substitution set of words. Additionally, in one embodiment, substitutions can be performed client-side as defined by a header, as previously mentioned. 
     To illustrate by another example, the following table shows a replacement set of words for message  311 . The table lists each original word, a replacement word, and a word location within the message. 
                                                                   Original Word   Replacement Word   Word Location                                        we   IBM team members   6           dedicated   committed   9           drove   lead   30           increased   exceeded   48           acquiring   purchasing   52                        
Assuming header defined substitutions, a header for the above table can be:
         X-WordList1:UserID,None,IBM team members, 6, committed, 9, lead, 30, exceeded, 48, purchasing, 52.
 
This header follows a convention of:
   X-WordListn: SerialType, CRCChecking, Text, WordLocation, . . . Text-n, WordLocation-n       

     X-WordListn can be a mail header, where n can be a header number that is a sequential number based upon a number of serial numbers to process. 
     SerialType can be set to “UserID” or “DomainID.” The SerialType can tell a client what serial number the header relates to. 
     CRCChecking can be set to “None,” “CRC,” or “Modulus-11”. This tells the client if the serial number has CRC or modulus checking to ensure the number isn&#39;t tampered with when converted to a serial number. If set to none then the serial number isn&#39;t modified. 
     Text, WordLocation specifies the replacement text and the word location that has to be replaced. The placement of the word specifies the bit flag it relates to. The first in the list relates to the right most bit flag and moves to the left on the next replacement word. If the replacement is a punctuation character then the character will be escaped out. For example, “\,” can be used for a comma and “\\” can be used for a back slash. 
     In one arrangement, once headers are created they can be encrypted with a key that only the client can decrypt. The body of the text can also be encrypted with the same key. This ensures that only those clients conforming to the serial number system can read the email message. Additionally, the email system can be signed by a sender&#39;s signature to ensure that it is not tampered with in transit. A receiving client can detect that the message has an embedded serial number and can active a processing operation. The client can, for instance, determine a user&#39;s serial number and domain number using an address book look-up. If no CRC or Modulus check is established, it can be applied to the serial number prior to processing. The details from the header can permit the client to replace the selected text based upon bit flags value match up, before the email message is able to be viewed. 
     For example: a UserID can equal 25. (Binary format: 11001) and no CRC/Modulus-11 can be established. A user can receive the email message derived from message  311  of system  100  and based upon the header of:
         Over the last 20 years, IBM team members have remained committed to a single mission: ensuring the success of customers who depend on developing or deploying software. During those 20 years, we have taken the company through many stages as we lead it to the next level, ahead of the market. The latest stage began in 1997 when we exceeded our capabilities by purchasing a number of leading tools companies in the software development tools market, resulting in our product line. This strategy was very successful and today we see many of our competitors emulating it.       

     Assuming the above text is leaked, it can be compared against the original message, shown in system  300  as message  311 . In one embodiment the serial number for the message can be generated visually and cross referenced against the employee/domain. For example, 
     
       
         
               
               
               
             
           
               
                   
                   
               
             
             
               
                   
                 IBM Team Members 
                 00001 
               
               
                   
                 exceeded 
                 01000 
               
               
                   
                 purchasing 
                 10000 
               
               
                   
                 Total 
                 11001 = 25 
               
               
                   
                   
               
             
          
         
       
     
     Implementation specifics for the header-implemented example (above) are not meant to constrain the scope of the invention, but to illustrate one possible implementation scheme. Other implementation schemes and derivatives are contemplated. 
       FIG. 4  is a flow chart of a method  400  for embedding a unique serial number into the content of an email for tracking information dispersion in accordance with an embodiment of the inventive arrangements disclosed herein. Method  400  can begin in step  410 , where a user can write an email they would like to send in an email client. In step  412 , the user can activate the process of embedding a serial number or serial numbers into the email and configure the initial settings. The user can activate the process of embedding the serial number or numbers in context with button  208  of system  200 . The user can configure the initial settings in context with dispersion tracking configuration  250  of system  200 . In step  414 , the application can search the email content for replaceable words and punctuation and can optionally display the results to the user. The results can be displayed to the user in context with information dispersion tracking configuration  305  of system  300 . A configurable option to enable/disable search results of replaceable words can be included in one embodiment of the invention. In step  416 , the user can select a word to replace in the email content. The application can already display the replaceable words differently to show the user their options. In step  418 , a list of substitution words can be retrieved and displayed to the user. In some embodiments, the substitution words can be synonyms retrieved from a thesaurus. In step  420 , the user can select a word or words to be used to substitute the word selected in step  416 . In step  422 , the system can determine if the user is finished defining words to substitute in the email content. 
     If in step  422 , the user is not completed, method  400  can return to step  416 , where the user can select another word for substitution in the email content. If in step  422 , the user is completed, method  400  can continue to step  424 , where the user can optionally preview each substitution in the email content before continuing. Previewing each substitution can prevent substitutions from being allowed when they change the meaning or the content or do not have a good enough fit in the content. In this step, if the user chooses to preview each substitution, the user can accept or reject each possible substitution for the email content. In step  426 , the application can check to make sure enough serials can be generated by the words to be replaced to match the requested number of serials. In one embodiment, this checking can be performed dynamically “on the fly,” where a visual cue is presented to a user (e.g., a status display element) that indicates if enough words have been replaced to generate needed serials. 
     If in step  426 , the application can not generate enough serials, method  400  can alert the user and return to step  414 , where the application can search the email content for replaceable words and punctuation and displays the results to the user. If in step  426 , the application can generate enough serials, method  400  can continue to step  428  where a mail header can be generated and attached to the mail that details the replaced words and their locations. In step  430 , the mail header and body can be encrypted with a key only the receiving client or clients can decrypt. A key can be any key usable for encryption. One such example can be a public key infrastructure (PKI) key. These keys are split into a public and private key, where a private key is kept and a public key is distributed. When the keys are combined, they can allow the decryption of encrypted data. In step  432 , mails can be sent to each person on the mailing list with associated substitutions of the words to be replaced. 
     The present invention may be realized in hardware, software, or a combination of hardware and software. The present invention may be realized in a centralized fashion in one computer system, or in a distributed fashion where different elements are spread across several interconnected computer systems. Any kind of computer system or other apparatus adapted for carrying out the methods described herein is suited. A typical combination of hardware and software may be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein. 
     The present invention also may be embedded in a computer program product, which comprises all the features enabling the implementation of the methods described herein, and which when loaded in a computer system is able to carry out these methods. Computer program in the present context means any expression, in any language, code or notation, of a set of instructions intended to cause a system having an information processing capability to perform a particular function either directly or after either or both of the following: a) conversion to another language, code or notation; b) reproduction in a different material form. 
     This invention may be embodied in other forms without departing from the spirit or essential attributes thereof. Accordingly, reference should be made to the following claims, rather than to the foregoing specification, as indicating the scope of the invention.