Abstract:
A web based data collaboration tool includes a dynamic international collaborative environment in which system partners, including customers, technology partners and suppliers, can exchange information between one another in a truly collaborative environment. The web based data collaboration tool includes unique “fine grain” security at both the document and sub-document level. This allows one source document to be shared between the system partners, including partners from different companies and those located in different countries, based upon an individual document/sub-document security profile. Further, the web based data collaboration tool includes a secure “Sandbox” for peer-to-peer sharing of sensitive documents and electronically incorporates a business area export representative (BAER) approval process that includes the required retention of International Traffic in Arms Regulations (ITAR) documents making the web based data collaboration tool fully ITAR compliant.

Description:
BACKGROUND OF THE INVENTION  
       [0001]     This application relates generally to a web based data collaboration tool, and more particularly to an interactive web based data exchange that incorporates “fine grain” security at a document and sub-document level, a secure environment for peer-to-peer sharing of sensitive documents, and is fully compliant with the International Traffic in Arms Regulations (ITAR).  
         [0002]     Web based information sharing systems are utilized to share information between multiple groups. Known systems typically include a secure server that provides private areas known as directories for each system partner to upload and/or download information. System security is based at a directory level with each system partner or company, having its own company directory. Individual users within the same system partner or company may have access only to information stored in their own corresponding system partner or company directory. However, partner companies themselves cannot interactively share documents with other partner companies. If a particular document requires sharing with more than one system partner or company, a system manager must place a copy of the document in each partner company&#39;s directory. This can result multiple different versions of the same document being stored on the web-based information sharing system. This creates a major configuration management problem and eliminates the possibility for truly collaborative environment between partner companies.  
         [0003]     Further, in known systems, secure communication between individual users at each of the partner companies requires the use of encrypted email. This requirement creates a burden that limits the amount of communication and increases the possibility of security escapes.  
         [0004]     Finally, some communications are subject to the International Traffic in Arms Regulations (ITAR). Under ITAR, some services and related technical data are designated as defense articles and defense services and are subject to the Arms Export Control Act (22 U.S.C. §§ 2778 and 2794(7)). Communications subject to this act require review and approval of a Business Area Export Representative (BAER) prior to dissemination. In known systems, BAER approval is a manual process that is extremely time intensive, in some cases taking thirty (30) days to complete.  
         [0005]     Therefore, known web based information sharing systems include restrictive security systems that only allow a collaboration between individual users within the same partner company, require the use of encrypted email for secure communication, and are not ITAR compliant. As such, it is desirable to provide a web based data collaboration tool that includes “fine grain” security at the document level that allows a truly collaborative environment not only between individual users within the same partner company but also between the partner companies themselves, provides a secure peer-to-peer sharing capability, and is fully ITAR compliant.  
       SUMMARY OF THE INVENTION  
       [0006]     A web based data collaboration tool is disclosed in the present invention. The web based data collaboration tool includes a dynamic international collaborative environment in which system partners, including customers, technology partners and suppliers, can exchange information between one another in a truly collaborative environment. The web based data collaboration tool includes unique “fine grain” security at both the document and sub-document level. This allows one source document to be shared between the system partners based upon an individual document/sub-document security profile. Further, the web based data collaboration tool includes a secure “Sandbox” for peer-to-peer sharing of sensitive documents and electronically incorporates the BAER workflow approval process including the required retention of ITAR documents making the web based data collaboration tool fully ITAR compliant.  
         [0007]     The web based data collaboration tool of the present invention also includes a coordinated memo capability that tracks workflow and associated embedded action item(s) within a single coordinated memo, allows for large file transfer, and has a batch upload capability. Further, the web based data collection tool of the present invention includes a document version control in which individual documents are “checked-out” for modification and subsequently “checked-in.” During modification, the tool identifies the individual user who has the document checked out and allows other individual users “read-only” access.  
         [0008]     In addition, the web based data collaboration tool of the present invention includes business tools such as, Morning Story, Management Dashboard, Initial Flight Release (IFR), and Request for Action (RFA). Morning Story permits individual users to view a basic daily engine status while restricting visibility to detailed reports to selected system partners. Management Dashboard permits individual users to view overall program status while restricting visibility of detailed reports to selected system partners and permits administrators to add icons and reports as necessary. IFR incorporates a dynamic resource management tool to verify all project requirements and manage the dynamic workflow through customer approval. Finally, RFA tracks actions throughout the IFR and other internal processes, including workflow, which requires customer approval.  
         [0009]     These and other features of the present invention can be best understood from the following specification and drawings, the following of which is a brief description. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0010]      FIG. 1  schematically illustrates a web-based data collaboration tool of the present invention.  
         [0011]      FIG. 2  schematically illustrates a fine-grain security system of the web-based data collaboration tool of the present invention at an individual document level.  
         [0012]      FIG. 3  schematically illustrates a fine-grain security system of the web-based data collaboration tool of the present invention in a secure sandbox environment. 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0013]      FIG. 1  schematically illustrates one embodiment of a web-based data collaboration tool  10  of the present invention that includes a plurality of documents  12  accessible by a plurality of users  14  remotely located from one another through a web-based interface  16 . The users  14  can be located at different partner companies  18  and in different countries. A security system  20  controls access  22  to each of these documents  12  based upon a document share list and a document classification both of which are established by a document owner when the document  12  is imported.  
         [0014]     As schematically illustrate in  FIG. 2 , a document  30  is imported into a sub-folder  32  wherein the sub-folder  32  is subordinate to a level-one folder  34 . In one example, a level-one folder might be allocated to total cost management and contain all document pertaining to a program, while an associated sub-folder may include documents related to the costs associated with only one individual program component. Each level-one folder  34  may have multiple sub-folders  32  that are subordinate to the level-one folder  34 . Further, each level-one folder  34  has an associated level-one folder access control list  36 . The level-one folder access control list  36  is generated by an identity management system  38  from a plurality of user profiles created during a universal registration process discussed in further detail below. Finally, each document  30  imported into a sub-folder  32  has a document share list  40  associated with it.  
         [0015]     To obtain access to the web-based data collaboration tool  10 , each user must create a user profile through a universal registration process in which the user must enter at the least their name and the name of their corporate partner. In addition, the user must select a user nationality, that is, whether he is a United States National or a Foreign National. Based upon the information stored in the user profile, an identity management system grants access to appropriate level-one folders  34 . This means the identity management system includes the user on the appropriate level-one folder&#39;s access control lists, and assigns a role to each user.  
         [0016]     This role determines what each user can do to a document. For example, if a user  14  is assigned a view role, the user can only view or download documents. Other roles include, but are not limited to, edit and update roles. The edit role allows the user to import, view, download and update documents, while the update role allows the user to import, view, download, update and delete documents. Once the user has obtained access through the identity management system, the user may view, download, import, update and/or delete documents based upon the role assigned to each user during the universal registration process.  
         [0017]     When a document  30  is imported into the web-based data collaboration tool  10 , a document importer  42 , which may or may not be a document owner, goes through an importing process that includes but is not limited to selecting which system partners the document  30  is to be shared with, and selecting a document classification which includes flagging whether or not the document  30  includes technical military data. These two criteria make up the document share list  40  for the document  30 . The document share list  40  is then used to define a sub-set of the level-one access control list  36  to which access to the document  30  may be granted.  
         [0018]     The web-based data collaboration tool  10  searches for existing system access control lists and compares the existing system access control list to the sub-set requirements. If a system access control list exists that meets the sub-set requirements, the web-based data collaboration tool  10  associates that system access control list to the document. If, however, a system access control list based upon the sub-set requirement does not exist, the web-based data collaboration tool  10  generates a private access control list to meet the sub-set requirements and associates the private access control list with the document. All private access control lists are then converted to new system access control lists on a daily basis.  
         [0019]     The web-based data collaboration tool  10  of the present invention also includes a “check-in”/“check-out” process. The “check-in”/“check-out” process allows a user to “check-out” a document imported by an importing user if that user is an authorized user. An authorized used is a user who is allowed access based upon the access control list associated with the document desired to be “checked-in” or “checked-out.” When a document in “checked-out,” the web-based data collaboration tool  10  provides notification to other authorized users that the document is “checked-out” and also identifies who “checked-out” the document  30 . Whether a document can be “checked-in”/“checked-out” and whether or not a check-out user may edit the “checked-out” document is controlled by the role assigned to the check-out user during the universal registration process.  
         [0020]     The web-based data collaboration tool  10  of the present invention also includes a coordination memo tool in which users can exchange information or initiate requests for action. All exchanges of information, requests for action and their associated workflows are formally tracked by the coordination memo tool. In addition, the coordination memo tool includes but is not limited to a management approval process and a business area export representative (BAER) approval process.  
         [0021]     Coordination memos initiated by a user require approval of the user&#39;s corporate system partner prior to dissemination of the document to other system partners external to the user&#39;s corporation and require further approval through the BAER approval process discussed below, prior to dissemination to Foreign Nationals. A Foreign National is a user located at a system partner or company corresponding facility resides in a country other than the United States of America.  
         [0022]     A management approval process is electronically initiated within a corporate partner when a user either imports a new document or modifies an existing document, and that document requires dissemination to other system partners. The management approval process requires a minimum of two distinct approvals. A coordinated memo is created in a coordinated memo folder, which is a level-one folder having an associated level-one access control list as previously discussed above. The coordinated memo is initiated by a user and then is transmitted to a first approver for approval. If approved, the coordinated memo is then transmitted to a second approver for approval. If approved, and if the coordination memo does not require any additional management approvals, the coordination memo is evaluated to determine if dissemination to Foreign Nationals is required and is evaluated to determine if the coordinated memo includes technical military data. If none of these are true, the coordination memo is released for dissemination. However, if the coordination memo requires dissemination to Foreign Nationals and includes technical military data, the coordination memo must go through the BAER approval process prior to dissemination to the Foreign Nationals discussed below.  
         [0023]     A coordinated memo may be sent back to the initiating user at any point in the management approval process with instructions that modifications are required. However, each time the coordinated memo is modified the entire management approval process is restarted. In addition, the initiating user may abort the management approval process at any point in the process prior to final approval. However, once the process is complete, the coordinated memo can only be deleted by those users having an update role associated with the coordination memo folder in question.  
         [0024]     The BAER approval process in initiated when the document classification is flagged as including military technical data and when access to the document is required by Foreign Nationals. If these two criteria are met, the document must be approved by a business area export representative (BAER) prior to dissemination to the Foreign Nationals. When a document includes a document share list that includes Foreign Nationals and the document is also flagged as including military technical data, the importing user must select an appropriate BAER group. Upon selection, the BAER approval process is initiated.  
         [0025]     First, an email is automatically generated and sent to the selected BAER group and the document is placed in an inbox associated with the selected BAER group. A BAER group member then acquires the document from the BAER group inbox. The document is removed from the BAER group inbox and placed in the BAER group member inbox. The BAER group member then reviews the document, making modifications where appropriate, and then decides whether to reject or approve the document for dissemination to Foreign Nationals. If the document is approved, the BAER group member selects or adds the appropriate export license number, and the document then becomes viewable by the full document share list including Foreign Nationals. However, if the document is rejected, the document is sent back to the importing user for update and then reinitiates the BAER approval process and access remains restricted to United States Nationals only. Therefore, access to the flagged document will be restricted to United States Nationals only until the BAER approval process is complete.  
         [0026]     The web-based data collaboration tool  10  also includes a secure sandbox environment  50 , as shown in  FIG. 3 , for peer-to-peer sharing of sensitive documents. The secure sandbox environment  50  is a level-one folder  34  that does not have any subordinate sub-folders  32 , as previously illustrated in  FIG. 2 . Instead, a document  30 , including its associated document share list  40 , is directly imported to the secure sandbox environment  50  by an importing user  42 . As a level-one folder  34 , the secure sandbox environment  50  also has an associated level-one folder access control list  36  that cooperates with the document share list  40  associated with the imported document  30  to generate an access control list  44 . However, once the access control list  44  is generated, the importing user  42  has the option to further restrict access to selected individuals within the access control list  44 , creating a selected user access control list  52 . As such, the secure sandbox environment  50  provides a secure environment for selected users to share a particular document without the necessity of encrypted email.  
         [0027]     Although a preferred embodiment of this invention has been disclosed, a worker of ordinary skill in this art would recognize that certain modifications would come within the scope of this invention. For that reason, the following claims should be studied to determine the true scope and content of this invention.