Method and apparatus for automatically administrating access rights for confidential information

A method and apparatus for automatically administrating access rights for confidential information is disclosure. In one embodiment, access rights are established for at least one user group. Each user group is identified by at least one authentication attribute. In response to verification information from a user requesting access to the confidential information that is stored at a, the verification information is compared with the at least one attribute for the each user group to generate a comparison result. Access to the confidential information by a second computerized device is controlled based on the comparison result and the access rights.

BACKGROUND

1. Technical Field

Embodiments of the present application generally relate to data loss prevention systems and, more particularly, to a method and apparatus for automatically administrating access rights for confidential information.

2. Description of the Related Art

Members of an organization (e.g., a small or large corporation, a government entity and/or the like) create and use confidential information (e.g., proprietary data, intellectual property, medical records, financial statements, customer information and/or the like). For example, an employee of an investment company views personal bank statements of various people in order to complete necessary business-related tasks. As another example, patients entrust a doctor with records of their medical histories. It is essential that this doctor protect this confidential information from unauthorized disclosure by employing a data loss prevention system.

Conventional data loss prevention systems use various authentication techniques to verify users that request access on internal and remote computerized devices. If a user is using an internal computerized device, it would be very simple for an administrator to verify the user and provision access rights for certain confidential information. Often, the administrator and the user are located in the same building and can perform the authentication in person. For example, the administrator can hand deliver a username and password of which the user can use to open documents containing the confidential information.

Authenticating users on the remote computerized devices, on the other hand, is difficult and overwhelmingly time consuming for the administrators. Transmitting documents to the remote computerized devices exposes the confidential information to undesired disclosure. In order to reduce security risks and prevent data loss, the administrators exercise great care when provisioning accounts for users on remote computerized devices and creating access rights associated with viewing the documents. For example, the administrator may secure the document with a password-protection feature. Before an authorized user can open the document, the administrator must personally email or communicate the password.

Therefore, there is a need in the art for a method and apparatus for automatically administrating access rights for confidential information that is both convenient for the users and administrators and at the same time ensuring high level of security.

SUMMARY

Various embodiments of the present disclosure generally include a method and apparatus for automatically administrating access rights for confidential information. In one embodiment, access rights for at least one user group are established. Each user group is identified by at least one authentication attribute. In response to verification information from a user requesting access to the confidential information, the verification information is compared with the at least one attribute for the each user group to generate a comparison result. Based on the comparison result and the access rights, access to the confidential information is controlled.

DETAILED DESCRIPTION OF EMBODIMENTS

FIG. 1is a block diagram of a system100for automatically administrating access rights for confidential information according to various embodiments. The system100includes a server102and a remote computerized device104where each is coupled to each other through a network106. The system100further includes an identity provider140.

The server102is a type of computerized device (e.g., a laptop, a desktop, a Personal Digital Assistant (PDA), a tablet, a smart phone (e.g., APPLE® iPhone), other data processing and display systems or devices and/or the like) known to one of ordinary skill in the art having the benefit of this disclosure. Details of a computerized device that can function as the server102is described with respect toFIG. 5. The server102comprises a Central Processing Unit (CPU)108, various support circuits110and a memory112. The CPU108may comprise one or more commercially available microprocessors or microcontrollers that facilitate data processing and storage. Various support circuits110facilitate operation of the CPU108and may include clock circuits, buses, power supplies, input/output circuits and/or the like. The memory112includes a read only memory, random access memory, disk drive storage, optical storage, removable storage, and the like. The memory112includes various software packages, such as an operating system138and security module114, as well as various data, such as access right information116, control information118and comparison result120.

The operating system138generally manages various computerized device resources (e.g., network resources, data storage resources, file system resources and/or the like). The operating system138is configured to execute operations on one or more hardware and/or software devices, such as Network Interface Cards (NICs), hard disks, virtualization layers, firewalls and/or the like. For example, the various software packages call commands associated with the operating system138(i.e., native operating system commands) to perform various file system and/or storage operations, such as creating files or metadata, writing data to the files, reading data from the files, modifying metadata associated with the files and/or the like. The operating system138may call one or more functions associated with device drivers to execute various file system and/or storage operations.

The remote computerized device104is a type of computerized device (e.g., a laptop, a desktop, a Personal Digital Assistant (PDA), a tablet, a smart phone (e.g., APPLE® iPhone), other data processing and display systems or devices and/or the like) known to one of ordinary skill in the art having the benefit of this disclosure. The remote computerized device104comprises a Central Processing Unit (CPU)122, various support circuits124and a memory126. The CPU122may comprise one or more commercially available microprocessors or microcontrollers that facilitate data processing and storage. Various support circuits124facilitate operation of the CPU122and may include clock circuits, buses, power supplies, input/output circuits and/or the like. The memory126includes a read only memory, random access memory, disk drive storage, optical storage, removable storage, and the like. The memory126includes various software packages, such as a viewer module128, as well as various data, such as a document130comprising confidential information132and verification information134. In some embodiments, the document130is a Portable Document Format (PDF) file. PDF is an open standard for document exchange created by Adobe Systems of San Jose, Calif. Therefore, the confidential information132may include financial statements, medical records, intellectual property and/or the like that are stored in a document file format type (e.g., ADOBE® PDF, XPDF, MICROSOFT® XML Paper Specification (XPS), Word Document (DOC), PowerPoint Presentation (PPT) and/or the like).

The network106comprises a communication system that connects computing devices by wire, cable, fiber optic, and/or wireless links facilitated by various types of well-known network elements, such as hubs, switches, routers, and the like. The network106may employ various well-known protocols to communicate information amongst the network resources. For example, the network106may be part of the Internet or intranet using various communications infrastructure such as Ethernet, WiFi, WiMax, General Packet Radio Service (GPRS), and the like.

In some embodiments, the access right information116constitutes a policy for controlling access to the confidential information132for various user groups. The access right information116may indicate a time period (e.g., an event, a fixed date and/or time, a number of units of time (e.g., hours, days, months, years and the like)) when the confidential information132is no longer confidential or, alternatively, no longer viewable by a member of a user group.

In some embodiments, the viewer module128(e.g., ADOBE® Reader/Acrobat) includes processor executable instructions for automatically controlling access to the confidential information132. Although one embodiment of the viewer module128may be implemented in software, other embodiments may be implemented in hardware or as firmware. In response to the control information118from the security module114, the viewer module128restricts access to the document130that includes the confidential information132to only members of a user group having appropriate access rights. As described in detail further below, the viewer module128is utilized by the security module114to automatically authenticate the user as a member of such a user group, provision the member with access rights and/or open the document130to display the confidential information132.

In some embodiments, the security module114includes processor executable instructions for automatically administrating access rights for the confidential information132. Although one embodiment of the security module114may be implemented in software, other embodiments may be implemented in hardware or as firmware. The security module114creates the access rights for one or more user groups where each includes one or more members. For example, the security module114may establish rights to view, change and/or print the document130for users having a particular email domain name. Hence, an unprovisioned user may use an email address with a same domain name to automatically access the document130at the remote computerized device104via the viewer module128. Then, the security module114stores the access rights in the access right information116along with the particular domain name as one of the authentication attributes136for identifying each user group. As another example, the security module114may establish access rights for users having a particular Internet Protocol (IP) Address or a portion thereof (i.e., a subnet).

The one or more members may refer to users of remote computerized devices, such as the remote computerized device104, or the remote computerized device being used to attempt to view the confidential information132within the document130. Some of these members are not provisioned with the access rights until an attempt to view the confidential information132. According to various embodiments, the security module114automatically provisions these members as legitimate users and grants access to the confidential information as further explained in detail below.

When an unprovisioned user attempts to view the confidential information132by opening the document130, in response the security module114determines whether the verification information134matches each and every authentication attribute136for a particular user group. Subsequently, the security module114communicates the control information118instructing the viewer module128to either grant or deny access for the unprovisioned user and to restrict the confidential information132to members of the particular user group. If the unprovisioned user is not a member, the viewer module128is instructed to deny access to the document. Hence, even though the server102or an authorized member at another remote computerized device may distribute the document130to an unauthorized user, the security module114and the viewer module128cooperate to prevent the unauthorized user from opening and viewing the document130.

If, however, the unprovisioned user is identified as a member of the particular user group, the viewer module128grants access to the document130. In addition, the security module114creates an account for the unprovisioned user at the server102in order to handle future access requests from the same user. When the now provisioned user tries to open the document130or another document at another time, the security module114recalls the user account and automatically instructs the viewer module128to grants access.

Before a user may be provisioned with such access rights, the security module114must perform an authentication technique. In some embodiments, the security module114instructs the viewer module128to prompt the user for the verification information134. For example, the user may input an email address that includes a domain name in addition to name, title, company name, work address and work phone number. The user may also be required to enter sensitive data, such as a home address or a personal phone number. Each is an authentication attribute136that may be used to identify a user group of which the user is a member.

Before comparing the verification information134with some of these authentication attributes136, the security module114authenticates the user based on the verification information134. In some embodiments, the security module114sends an authentication email to the user at the email address and waits for an acknowledgment. When such an acknowledgement arrives, the security module114ensures that the verification information134is actually from the user associated with the email address. In some embodiments, the security module114independently validates the verification information134by authenticating an Internet Protocol (IP) address associated with the remote computerized device104. Alternatively, the security module114performs a reverse-lookup of the email address and validates the data provided. As another example, the security software114prompts the user for various information (e.g., full name, organization name, work/home/mobile phone numbers, home/office addresses, an image of the company trademark (i.e., logo), cost center number, date of hire, office computer login username and/or the like). As yet another example, the user may communicate encryption information (e.g., an alphanumeric key) or biometric data (e.g., an image having a thumb print).

Optionally, the security module114is communicably coupled to the identity provider140, which independently validates the verification information134. Before communicating the verification information134to the server102, the user may select a specific identity provider to perform the independent validation. The viewer module128may access metadata associated with the document130and stores such metadata (e.g., author information, such as name, title, location, social security number and/or the like) in the verification information134. Each identity provider140is an independent web-based service that processes the verification information134including the metadata and returns information indicating whether the user is the actual owner of the email address. As another example, the viewer module128may communicate an authentication credential that is stored within an electronic, digitally signed card.

After comparing the verification information134with the authentication attributes136, the security module114generates a comparison result120based upon which the security module114controls access to the confidential information132. The comparison result120includes data indicating whether an authentication attribute within the verification information134matches an authentication attribute136within the access right information. If the verification information134matches each and every authentication attribute for a particular user group, the security module114communicates the control information118instructing the viewer module128to grant access. In response to subsequent access requests from the user, the security module114automatically grants access without repeating the authentication technique. In some embodiments, the security module114creates account information for the user. On the other hand, if the verification information134does not match all of the authentication attributes for the particular user group, the security module114communicates the control information118instructing the viewer module128to deny the user access to the confidential information132within the document130.

In some embodiments, the security module114instructs the viewer module128to restrict access in accordance with the access rights that are established for the confidential information132. If a user (e.g., an out of band user) on the remote computerized device102attempts to view the confidential information132when not permitted, the control information118instructs the viewer module128to prevent access. For example, the control information118may permit the confidential information130to be viewed at any time but the document130may only be printed once. Whenever the user attempts to open the document128, the viewer module128grants access to view. However, the viewer module128denies access if the user attempts to print more than one copy.

It is appreciated that the access rights for the document130may be extended to other documents. In some embodiments, the security module114instructs the viewer module128to grant access to additional documents that may be communicated to the user at the remote computerized device108at a later date. For example, if the document130is a first in a series of documents, the user is also granted access to view the remaining documents in the series. Some of the remaining documents may be provided by a same company or a same person for a specific task. As another example, the additional documents may be unrelated to the document130but still require authentication from the server102. After granting the user with access to the document130, the security module114instructs the viewer module to also grant access to the additional documents without repeating the same authentication operations.

FIG. 2is a flow diagram of a method200for automatically administrating access rights for confidential information according to various embodiments. In some embodiments, security module (e.g., the security module114ofFIG. 1) performs the steps of the method200. The method200starts at step202and proceeds to step204. At step202, the method200establishes access rights for at least one user group. Each user group is identified through one or more authentication attributes. Each authentication attribute corresponds with a shared characteristic of each and every member of a particular user group, such as an email domain.

At step206, the method200determines whether a user attempted to view confidential information. In some embodiments, the confidential information is a stored within a document (e.g., a computerized device file) and the user attempted to open the document via a viewer module (e.g., the viewer module128ofFIG. 1). In turn, the viewer module requests instructions from a server (e.g., the server102ofFIG. 1) that is configured to automatically administrate access rights for the confidential information (e.g., the confidential information132ofFIG. 1) to users on remote computerized devices (e.g., the remote computerized device104ofFIG. 1). If the method200determines that an attempt to view the confidential has not occurred, the method200proceeds to step208and waits. In some embodiments, the method200waits for a message from the viewer module requesting instructions for authenticating and provisioning the user. When such a message is detected, the method200proceeds to step210.

At step210, the method200initializes an authentication technique during which verification information is aggregated. In some embodiments, the method200requests various information from the user, such as an email address, name and company name. Such information may be utilized as attributes for authenticating the user and identifying a user group of which the user is a member. For example, security module instructs the viewer module to prompt the user for authentication attributes, which are communicated to the server. The viewer module may also be configured automatically identify and communicate the authentication attributes without user assistance.

At step212, the method200processes the verification information. At optional step214, the method200validates the verification information. In some optional embodiments, the method200uses an identity provider to independently validate the verification information. The identity provider may correspond with metadata associated with the document. As an example, the user may be a University professor that communicates the document to another professor and uses the server as an access rights management server. As such, the access right information is a policy that protects the document from unauthorized disclosure. Upon opening the document, the viewer module presents the other professor with an authentication dialog box through which the other professor registers with the server as a legitimate member of a user group having appropriate access rights. Before such registration, the security module examines metadata associated with the document and determines that the intended recipient is from an education institute. Accordingly, the security module presents the other professor with the option of utilizing a university authentication service to validate the verification information and obtain access to the document. When the university authentication server communicates information verifying the identity of the other professor, the security module proceeds to compare the verification information with the authentication attributes for the user groups.

At step216, the method200compares the verification information with at least one authentication attribute for identifying at least one user group. At step218, the method200determines whether the verification information matches at least one authentication attribute. After receiving the verification information from the remote computerized device, the method200compares each authentication attribute within the verification information with a corresponding authentication attribute (e.g., the authentication attributes136ofFIG. 1) from access right information (e.g., the access right information116ofFIG. 1). For example, if the security module defines a particular user group by an email domain name, then each authorized member shares the same email domain name. The security module subsequently compares an email domain name associated with the user is compared with the email domain name for the particular user group.

If the method200determines that the verification information matches the at least one authentication attribute, the method200proceeds to step220. At step220, the method200generates a comparison result indicating a match. If, on the other hand, the method200determines that the verification information and the at least one authentication attribute do not match, the method200proceeds to step222. At step222, the method200generates a comparison result indicating that the verification information and the at least one authentication attribute do not match.

At step224, the method200controls access to the confidential information based on the comparison result. In some embodiments, the method200communicates control information (e.g., the control information118ofFIG. 1) to restrict access to the authorized members of the particular user group. For example, the security module may instruct the viewer module to deny access to any user that does not share the email domain name with the particular user group. At step226, the method200ends.

FIG. 3is a flow diagram of a method300for restricting access to confidential information to members of a user group having access rights according to various embodiments. In some embodiments, the method300represents one implementation of step222of the method200during which security module (e.g., the security module114ofFIG. 1) controls access to the confidential information based on a comparison result (e.g., the comparison result120ofFIG. 1) and access right information (e.g., the access right information116ofFIG. 1) as described further below.

The method300starts at step302and proceeds to step304. At step304, the method300processes the comparison result, which indicates whether there is a matching authentication attribute within verification information for each and every authentication attribute for identifying a user group. Access rights for confidential information are established for the identified user group. The verification information pertains to a user at a remote computerized device and may include job-related data, such as a company email address or email domain name, according to some embodiments.

At step306, the method300determines whether a user is a member of a user group having access rights for confidential information. If the method300determines that the user is not a member, the method300proceeds to step308. At step308, the method300communicates control information denying access. If, on the other hand, the method300determines that the user is a member, the method300proceeds to step310. At step310, the method300provisions access rights for the user. At step312, the method300communicates control information granting access. At step314, the method300instructs a viewer module to open a document comprising the confidential information. At step316, the method300instructs the viewer module to grant access to a plurality of documents to which the user group associated with the user has access rights to open, print and/or modify. At step318, the method300ends.

FIG. 4is a flow diagram of a method400for automatically controlling access to confidential information at a remote computerized device according to various embodiments. In one embodiment, steps of the method400are performed by a viewer module (e.g., the viewer module128ofFIG. 1).

The method400starts at step402and proceeds to step404. At step404, the method400processes instructions to open a document from a user. At step406, the method400requests instructions for authenticating the user. These instructions should also indicate whether to grant or deny access to the confidential information. At step408, the method400prompts the user for at least one authentication attribute. At step410, the method400communicates verification information.

At step412, the method400accesses control information. Based on the control information, the method400restricts access to the document to members of an authorized user group. At step414, the method400determines whether the user is a member of an authorized user group. If the method400determines that the user is an authorized member, the method400proceeds to step416. At step416, the method400grants access to the document. In some embodiments, the method400opens the document and displays the confidential information. If, on the other hand, the method400determines that the user is not authorized to access the confidential information within the document, the method400proceeds to step418. At step418, the method400denies access to the document. At step420, the method400ends.

Example Computerized device System

Various embodiments of a method and apparatus for automatically administrating access rights, as described herein, may be executed on one or more computerized device systems, which may interact with various other devices. One such computerized device system is computerized device system500illustrated byFIG. 5, which may in various embodiments implement any of the elements or functionality illustrated inFIGS. 1-4. In various embodiments, computerized device system500may be configured to implement the server102or the remote computerized device104described above. While the illustrated system demonstrates computerized device system500implementing the software114or the viewer module128, computerized device system500may be used to implement any other system, device, element, functionality or method of the above-described embodiments. In the illustrated embodiments, computerized device system500may be configured to implement the security module114and/or the viewer module128as processor-executable executable program instructions522(e.g., program instructions executable by processor(s)510a-n) in various embodiments.

In the illustrated embodiment, computerized device system500includes one or more processors510coupled to a system memory520via an input/output (I/O) interface530. Computerized device system500further includes a network interface540coupled to I/O interface530, and one or more input/output devices550, such as cursor control device560, keyboard570, and display(s)580. In various embodiments, any of components560or570may be utilized by the security module114and/or the viewer module128to receive the verification information134as described above. In various embodiments, a user interface may be generated and displayed on display580. In some cases, it is contemplated that embodiments may be implemented using a single instance of computerized device system500, while in other embodiments multiple such systems, or multiple nodes making up computerized device system500, may be configured to host different portions or instances of various embodiments. For example, in one embodiment some elements may be implemented via one or more nodes of computerized device system500that are distinct from those nodes implementing other elements. In another example, multiple nodes may implement computerized device system500in a distributed manner.

In different embodiments, computerized device system500may be any of various types of devices, including, but not limited to, a personal computerized device system, desktop computerized device, laptop, notebook, or netbook computerized device, mainframe computerized device system, handheld computerized device, workstation, network computerized device, a camera, a set top box, a mobile device, a consumer device, video game console, handheld video game device, application server, storage device, a peripheral device such as a switch, modem, router, or in general any type of computing or electronic device.

In various embodiments, computerized device system500may be a uniprocessor system including one processor510, or a multiprocessor system including several processors540(e.g., two, four, eight, or another suitable number). Processors510may be any suitable processor capable of executing instructions. For example, in various embodiments processors510may be general-purpose or embedded processors implementing any of a variety of instruction set architectures (ISAs), such as the x96, PowerPC, SPARC, or MIPS ISAs, or any other suitable ISA. In multiprocessor systems, each of processors510may commonly, but not necessarily, implement the same ISA.

System memory520may be configured to store program instructions522and/or data532accessible by processor510. In various embodiments, system memory920may be implemented using any suitable memory technology, such as static random access memory (SRAM), synchronous dynamic RAM (SDRAM), nonvolatile/Flash-type memory, or any other type of memory. In the illustrated embodiment, program instructions and data implementing any of the elements of the embodiments described above may be stored within system memory520. In other embodiments, program instructions and/or data may be received, sent or stored upon different types of computerized device-accessible media or on similar media separate from system memory520or computerized device system500.

In one embodiment, I/O interface530may be configured to coordinate I/O traffic between processor510, system memory520, and any peripheral devices in the device, including network interface540or other peripheral interfaces, such as input/output devices550, In some embodiments, I/O interface530may perform any necessary protocol, timing or other data transformations to convert data signals from one components (e.g., system memory520) into a format suitable for use by another component (e.g., processor510). In some embodiments, I/O interface530may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard, for example. In some embodiments, the function of I/O interface530may be split into two or more separate components, such as a north bridge and a south bridge, for example. Also, in some embodiments some or all of the functionality of I/O interface530, such as an interface to system memory520, may be incorporated directly into processor510.

Network interface540may be configured to allow data to be exchanged between computerized device system500and other devices attached to a network (e.g., network106), such as one or more external systems or between nodes of computerized device system500. In various embodiments, network540may include one or more networks including but not limited to Local Area Networks (LANs) (e.g., an Ethernet or corporate network), Wide Area Networks (WANs) (e.g., the Internet), wireless data networks, some other electronic data network, or some combination thereof. In various embodiments, network interface540may support communication via wired or wireless general data networks, such as any suitable type of Ethernet network, for example; via telecommunications/telephony networks such as analog voice networks or digital fiber communications networks; via storage area networks such as Fibre Channel SANs, or via any other suitable type of network and/or protocol.

Input/output devices550may, in some embodiments, include one or more display terminals, keyboards, keypads, touchpads, scanning devices, voice or optical recognition devices, or any other devices suitable for entering or accessing data by one or more computerized device systems500. Multiple input/output devices550may be present in computerized device system500or may be distributed on various nodes of computerized device system500. In some embodiments, similar input/output devices may be separate from computerized device system500and may interact with one or more nodes of computerized device system500through a wired or wireless connection, such as over network interface540.

In some embodiments, the illustrated computerized device system may implement any of the methods described above, such as the methods illustrated by the flowcharts ofFIGS. 2-4. In other embodiments, different elements and data may be included.

Those skilled in the art will appreciate that computerized device system500is merely illustrative and is not intended to limit the scope of embodiments. In particular, the computerized device system and devices may include any combination of hardware or software that can perform the indicated functions of various embodiments, including computerized devices, network devices, Internet appliances, PDAs, wireless phones, pagers, etc. Computerized device system500may also be connected to other devices that are not illustrated, or instead may operate as a stand-alone system. In addition, the functionality provided by the illustrated components may in some embodiments be combined in fewer components or distributed in additional components. Similarly, in some embodiments, the functionality of some of the illustrated components may not be provided and/or other additional functionality may be available.

Those skilled in the art will also appreciate that, while various items are illustrated as being stored in memory or on storage while being used, these items or portions of them may be transferred between memory and other storage devices for purposes of memory management and data integrity. Alternatively, in other embodiments some or all of the software components may execute in memory on another device and communicate with the illustrated computerized device system via inter-computerized device communication. Some or all of the system components or data structures may also be stored (e.g., as instructions or structured data) on a computerized device-accessible medium or a portable article to be read by an appropriate drive, various examples of which are described above. In some embodiments, instructions stored on a computerized device-accessible medium separate from computerized device system500may be transmitted to computerized device system500via transmission media or signals such as electrical, electromagnetic, or digital signals, conveyed via a communication medium such as a network and/or a wireless link. Various embodiments may further include receiving, sending or storing instructions and/or data implemented in accordance with the foregoing description upon a computerized device-accessible medium or via a communication medium. In general, a computerized device-accessible medium may include a storage medium or memory medium such as magnetic or optical media, e.g., disk or DVD/CD-ROM, volatile or non-volatile media such as RAM (e.g., SDRAM, DDR, RDRAM, SRAM, etc.), ROM, etc.

Various elements, devices, modules and circuits are described above in associated with their respective functions. These elements, devices, modules and circuits are considered means for performing their respective functions as described herein.