Patent Description:
Reference is also made to <CIT>, and entitled "DATA MANAGEMENT UTILIZING ACCESS AND CONTENT INFORMATION".

Reference is also made to the following patents and patent applications, owned by assignee:.

The present invention relates to data management generally and more particularly enterprise level data management.

The following patent publications are believed to represent the current state of the art:.

The present invention provides improved systems and methodologies for data management.

There is thus provided in accordance with a preferred embodiment of the present invention a system for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, the system including monitoring and collection functionality for providing continuously updated metadata relating to at least one of actual access, access permissions and content of the data elements and operating functionality utilizing the continuously updated metadata provided by the monitoring and collection functionality for functions other than reporting the at least one of actual access, access permissions and content or recommending changes in the access permissions.

Preferably, the functions other than actual access reporting include archiving. Additionally or alternatively the functions other than actual access reporting include encrypting.

In accordance with a preferred embodiment of the present invention, the system resides on a computer server which is connected to an enterprise level network to which is connected a multiplicity of computers and storage devices. Additionally, the computer resources include hardware resources and software resources.

There is also provided in accordance with another preferred embodiment of the present invention a system for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, the system including monitoring and collection functionality for providing continuously updated metadata relating to actual access, access permissions and content of the data elements, and operating functionality utilizing the continuously updated metadata provided by the monitoring and collection functionality for recommending archiving of the data elements.

Preferably, the system also includes a backup storage facility connected to the enterprise computer network. Preferably, the system also includes a remote storage facility connected to the enterprise computer network. Preferably, the system also includes a secure storage facility connected to the enterprise computer network. Preferably, the computer resources include hardware resources and software resources.

In accordance with a preferred embodiment of the present invention, every day the system copies any of the data elements actually accessed by any user on that day to the backup storage facility. Additionally or alternatively, the system copies any of the data elements whose content indicates that they are confidential, are owned by a sensitive unit in the enterprise or are accessible by authorized individuals in the enterprise to the backup storage facility on a daily basis. Additionally or alternatively, the system copies any of the data elements marked with recommendations for changes in access permissions thereto to the backup storage facility on a daily basis.

Preferably, the system migrates to the remote storage facility any of the data elements that have recommendations for changes in access permissions thereto. Additionally or alternatively, the system migrates to the remote storage facility any of the data elements that have not been accessed for a first predetermined time period. Alternatively, the system migrates to the remote storage facility any of the data elements that have not been accessed for a first predetermined time period and that contain content indicating that they are confidential, are owned by a sensitive unit in the enterprise or are accessible by authorized individuals in the enterprise.

In accordance with a preferred embodiment of the present invention, the system migrates to the remote storage facility any of the data elements that have not been migrated to the remote storage facility for a second predetermined time period. Alternatively, the system migrates to the remote storage facility any of the data elements that have not been migrated to the remote storage facility for a second predetermined time period and that contain content indicating that they are confidential, are owned by a sensitive unit in the enterprise or are accessible by authorized individuals in the enterprise.

Preferably, the system migrates to the secure storage facility any of the data elements that contain personal identity information or sensitive information. Additionally or alternatively, when a user initiates a migration of data elements to a new storage device, the system recommends that all data elements actually accessed by any specified user or group of users, be migrated to the new storage device.

In accordance with a preferred embodiment of the present invention, at various times the system recommends that all data elements actually accessed by any specified user or group of users, be replicated to the backup storage facility. Additionally or alternatively, the system replicates to the backup storage facility any of the data elements whose content indicates that they are relevant to predetermined subjects.

Preferably, the system resides on a computer server which is connected to an enterprise level network to which is connected a multiplicity of computers and storage devices. Additionally or alternatively, an associated archiving system resides on a server other than the computer server.

There is further provided in accordance with yet another preferred embodiment of the present invention a system for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, the system including monitoring and collection functionality for providing continuously updated metadata relating to actual access, access permissions and content of the data elements, and operating functionality utilizing the continuously updated metadata provided by the monitoring and collection functionality for recommending encrypting the data elements.

Preferably, for each individual data element of the data elements, at predetermined time intervals the system compiles a list of users having access permissions to each individual data element, compares the list of users to a predetermined list of authorized users, each of the authorized users being authorized to access confidential enterprise information, labels each individual data element that may be accessed by any of the authorized users as a confidential data element and encrypts the confidential data elements.

Additionally or alternatively, for each individual data element of the data elements, at predetermined time intervals the system compiles a list of users actually having accessed each individual data element, compares the list of users to a predetermined list of authorized users, each of the authorized users being authorized to access confidential enterprise information, labels each individual data element that has been accessed by any of the authorized users as a confidential data element and encrypts the confidential data elements.

Additionally or alternatively, for each individual data element of the data elements, at predetermined time intervals the system searches each individual data element for the appearance of any of a predetermined list of confidential information related terms, labels each individual data element that contains any of the predetermined list of confidential information related terms as a confidential data element and encrypts the confidential data elements.

Preferably, the computer resources include hardware resources and software resources. Additionally, the system resides on a computer server which is connected to an enterprise level network to which is connected a multiplicity of computers and storage devices. Additionally or alternatively, an associated encryption system resides on a server other than the computer server.

There is yet further provided in accordance with still another preferred embodiment of the present invention a method for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, the method including monitoring and collecting continuously updated metadata relating to at least one of actual access, access permissions and content of the data elements and utilizing the continuously updated metadata for functions other than reporting the at least one of actual access, access permissions and content or recommending changes in the access permissions.

Preferably, the functions other than actual access reporting include archiving. Additionally or alternatively, the functions other than actual access reporting include encrypting. Preferably, the computer resources include hardware resources and software resources.

There is also provided in accordance with another preferred embodiment of the present invention a method for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, the method including monitoring and collecting continuously updated metadata relating to actual access, access permissions and content of the data elements, and utilizing the continuously updated metadata for recommending archiving of the data elements.

Preferably, the method also includes providing a backup storage facility connected to the enterprise computer network. Preferably, the method also includes providing a remote storage facility connected to the enterprise computer network. Preferably, the method also includes providing a secure storage facility connected to the enterprise computer network. Preferably, the computer resources include hardware resources and software resources.

In accordance with a preferred embodiment of the present invention, every day any of the data elements actually accessed by any user on that day are copied to the backup storage facility. Additionally or alternatively, any of the data elements whose content indicates that they are confidential, are owned by a sensitive unit in the enterprise or are accessible by authorized individuals in the enterprise are copied to the backup storage facility on a daily basis. Additionally or alternatively, any of the data elements marked with recommendations for changes in access permissions thereto are copied to the backup storage facility on a daily basis.

Preferably, any of the data elements that have recommendations for changes in access permissions thereto are migrated to the remote storage facility. Additionally or alternatively, any of the data elements that have not been accessed for a first predetermined time period are migrated to the remote storage facility. Alternatively, any of the data elements that have not been accessed for a first predetermined time period and that contain content indicating that they are confidential, are owned by a sensitive unit in the enterprise or are accessible by authorized individuals in the enterprise are migrated to the remote storage facility.

In accordance with a preferred embodiment of the present invention, any of the data elements that have not been migrated to the remote storage facility for a second predetermined time period are migrated to the remote storage facility. Alternatively, any of the data elements that have not been migrated to the remote storage facility for a second predetermined time period and that contain content indicating that they are confidential, are owned by a sensitive unit in the enterprise or are accessible by authorized individuals in the enterprise are migrated to the remote storage facility.

Preferably, any of the data elements that contain personal identity information or sensitive information are migrated to the secure storage facility. Additionally or alternatively, when a user initiates a migration of data elements to a new storage device, all data elements actually accessed by any specified user or group of users are recommended to be migrated to the new storage device.

In accordance with a preferred embodiment of the present invention, at various times all data elements actually accessed by any specified user or group of users are recommended to be replicated to the backup storage facility. Additionally or alternatively, any of the data elements whose content indicates that they are relevant to predetermined subjects are replicated to the backup storage facility.

There is further provided in accordance with yet another preferred embodiment of the present invention a method for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, the method including monitoring and collecting continuously updated metadata relating to actual access, access permissions and content of the data elements and utilizing the continuously updated metadata for recommending encrypting the data elements.

Preferably, for each individual data element of the data elements, at predetermined time intervals a list of users having access permissions to each individual data element is compiled, the list of users is compared to a predetermined list of authorized users, each of the authorized users being authorized to access confidential enterprise information, each individual data element that may be accessed by any of the authorized users is labeled as a confidential data element and the confidential data elements are encrypted.

Additionally or alternatively, for each individual data element of the data elements, at predetermined time intervals a list of users actually having accessed each individual data element is compiled, the list of users is compared to a predetermined list of authorized users, each of the authorized users being authorized to access confidential enterprise information, each individual data element that has been accessed by any of the authorized users is labeled as a confidential data element and the confidential data elements are encrypted.

Additionally or alternatively, for each individual data element of the data elements, at predetermined time intervals each individual data element is searched for the appearance of any of a predetermined list of confidential information related terms, each individual data element that contains any of the predetermined list of confidential information related terms is labeled as a confidential data element and the confidential data elements are encrypted.

Preferably, the computer resources include hardware resources and software resources.

Reference is now made to <FIG>, which is a simplified diagram illustrating aspects of operation of a rule-based system for management of data elements, constructed and operative in accordance with a preferred embodiment of the present invention.

This system preferably is suitable for operating in an enterprise computer network including multiple disparate clients, data elements, computer hardware resources and computer software resources, and includes:.

As seen in <FIG>, the system may reside on a server <NUM>, connected to an enterprise level network <NUM> to which may be connected hundreds or thousands of computers <NUM> and storage devices <NUM>. A matrix <NUM> is defined at any given time including all of the data elements in the enterprise at that time. Various characteristics of the data elements and metadata of the data elements are applied to the matrix and define subsets of the data elements meeting various criteria. A data element normally belongs to multiple subsets.

The term "metadata" for the purposes of this application is defined to include, inter alia, anything characterizing a data element other than the content thereof. Examples of metadata include size, type, creation date, keywords, last access date and access permissions.

The various data elements in the matrix are sorted according to the subsets to which they belong and various rules are applied to data elements which fall within various combinations of subsets. The results of application of these rules are higher level subsets, with each of which is associated a data element management recommendation.

Reference is now made to <FIG>, which is a simplified pictorial illustration of the operation of an archiving management system, constructed and operative in accordance with an embodiment of the present invention, and to <FIG> & <FIG>, which are simplified flowcharts indicating steps in the operation of the archiving management system. The archiving management system constitutes one example of a system for operating an enterprise computer network including multiple disparate clients, data elements, computer hardware resources and computer software resources in accordance with a preferred embodiment of the present invention. Such a system generally includes:.

As noted hereinabove with reference to <FIG>, it is appreciated that the system may reside on a server <NUM>, connected to an enterprise level network <NUM> to which may be connected hundreds or thousands of computers <NUM> and storage devices <NUM>. As illustrated in <FIG>, the server preferably records actual access of every user to every data element, such as a file, in the enterprise, in matrix <NUM>.

As seen in <FIG>, the system recommends that all data elements actually accessed by any user during a given day, such as March <NUM>, <NUM>, be copied to a backup storage facility. An associated archiving system, which may be resident on another server <NUM>, may carry out the archiving recommendation.

Additionally or alternatively, the system preferably iterates through a list of data elements and checks the content, metadata, location, owner, and access permissions thereof. Any data element containing content indicating, for example, that the data element is confidential, is owned by a sensitive unit in the enterprise or is accessible by certain individuals in the enterprise, is recommended to be copied to the backup storage facility on a daily basis.

Additionally or alternatively, the system preferably iterates through a list of data elements and checks for recommendations for changes in access permissions thereto. For example, all data elements having recommendations for changes in access permissions thereto are also recommended to be copied to the backup storage facility on a daily basis.

Preferably, the system iterates through a list of data elements and checks whether a first predetermined time period has elapsed since the last actual access to each of the data elements. It is appreciated that the first predetermined time period may be a fixed time or alternatively a time which varies based on other parameters.

As seen in <FIG> & <FIG>, at the expiration of the first predetermined time period, such as on March <NUM>, <NUM>, the system recommends that all data elements not actually accessed, or accessed less than a predetermined number of times, during the predetermined period, such as twenty days, be migrated to a remote storage facility.

As also seen in <FIG> & <FIG>, at the expiration of a second predetermined time period, such as on April <NUM>, <NUM>, the system recommends that all data elements that have not been migrated to the remote storage facility within the second predetermined period, be migrated to the remote storage facility.

Alternatively, as seen in <FIG>, at the expiration of the first predetermined time period, such as on March <NUM>, <NUM>, the system recommends that all data elements not actually accessed, or accessed less than a predetermined number of times, during the predetermined period, such as twenty days, and that match a predetermined set of content-based rules, be migrated to the remote storage facility.

As also seen in <FIG>, at the expiration of a second predetermined time period, such as on April <NUM>, <NUM>, the system recommends that all data elements that have not been migrated to the remote storage facility within the second predetermined period and that match a predetermined set of content-based rules, be migrated to the remote storage facility.

Additionally or alternatively, any data element containing content indicating that the data element contains personal identity information or sensitive information is also recommended to be migrated to a secure storage facility.

Additionally or alternatively, all data elements having recommendations for changes in access permissions thereto are also recommended to be migrated to the remote storage facility.

At various times a user may initiate a migration of data elements to a new storage device. In such a case, the system may also recommend that all data elements actually accessed by any specified user or group of users, be migrated to the new storage device.

Additionally or alternatively, any data element containing content indicating that the data element is relevant to subjects defined by the user are also recommended to be copied to the new storage device.

Additionally or alternatively, at various times the system may recommend that all data elements actually accessed by any specified user or group of users, be replicated on the backup storage facility.

Additionally or alternatively, all data elements whose content indicates that they are relevant to predetermined subjects are also recommended to be replicated on the backup storage facility.

The associated archiving system, which may be resident on another server <NUM>, may carry out the archiving recommendations.

Reference is now made to <FIG>, which is a simplified pictorial illustration of the operation of an encryption management system, constructed and operative in accordance with another embodiment of the present invention, and to <FIG>, <FIG>, which are simplified flowcharts indicating steps of the operation of the encryption management system. The encryption management system constitutes another example of a system for operating an enterprise computer network including multiple disparate clients, data elements, computer hardware resources and computer software resources in accordance with another embodiment of the present invention. Such a system generally includes:.

Turning now to <FIG>, it is appreciated that the system may reside on a server <NUM>, connected to an enterprise level network <NUM> to which may be connected hundreds or thousands of computers <NUM> and storage devices <NUM>. Similar to server <NUM> illustrated in <FIG>, the server <NUM> preferably records access permissions to every data element, such as a file, in the enterprise.

As seen in <FIG> & <FIG>, the system preferably iterates through the list of data elements at predetermined intervals. For each data element, the system retrieves a list of users who have access permissions to the data element and compares the list of users to a predetermined list of authorized users, each of which being authorized to access confidential enterprise information, thereby determining which of the data elements may be accessed by the authorized users. The system then compiles a list of confidential data elements that may be accessed by the authorized users.

Additionally or alternatively, as seen in <FIG> & <FIG>, the system preferably iterates through the list of data elements at predetermined intervals. For each data element, the system retrieves a list of users who have actually accessed each data element during the last predetermined interval and compares the list of users to the predetermined list of authorized users each of which being authorized to access confidential enterprise information, thereby determining which of the data elements have been accessed by the authorized users. The system then compiles a list of confidential data elements that have been accessed by the authorized users.

Additionally or alternatively, as seen in <FIG> & <FIG>, the system preferably iterates through the list of data elements at predetermined intervals, and searches each data element for the appearance of confidential information related terms, such as "confidential". The system then compiles a list of confidential data elements containing the confidential information related terms.

Claim 1:
A system (<NUM>)(<NUM>) for operating an enterprise computer network (<NUM>)(<NUM>) including multiple disparate clients, data elements and computer resources, said system (<NUM>)(<NUM>) comprising:
a remote storage facility connected to said enterprise computer network;
monitoring and collection functionality for providing continuously updated metadata relating to at least one of executed actual access, access permissions and content of said data elements;
operating functionality utilizing said continuously updated metadata provided by said monitoring and collection functionality for functions other than reporting said at least one of executed actual access, access permissions and content or recommending changes in said access permissions, wherein the operating functionality is operative to utilize said continuously updated metadata provided by said monitoring and collection functionality for recommending archiving of said data elements, said recommending archiving of said data elements including recommending that all data elements not actually accessed, or accessed less than a predetermined number of times, during a first predetermined time period be migrated to said remote storage facility; and
an associated archiving system operative to carry out said archiving recommendations.