Patent ID: 8631227

Claim:
A data processing system, comprising: a computer configured to receive and process electronic documents directed to one or more users; a key server coupled to the computer and configured to store decryption data associated with one or more users, groups or domains; a quarantine coupled to the computer; electronic document processing logic coupled to the computer and to the quarantine and when executed operable to: identify an encrypted electronic document received at the computer; determine whether the key server stores particular decryption data, or credentials to access decryption data, that can decrypt the encrypted electronic document; in response to determining that the key server stores particular decryption data of a document recipient and that can decrypt the encrypted electronic document: first, retrieve the particular decryption data of the document recipient from the key server; second, decrypt the electronic document using the particular decryption data of the document recipient and retrieved from the key server; third, scan the electronic document to identify specified content in the electronic document to determine whether the specified content contains malicious elements; fourth, encrypt the scanned document using the particular decryption data retrieved from the key server; and fifth, perform one or more responsive actions based on the specified content; in response to determining that the key server does not store particular decryption data of a document recipient and that can decrypt the encrypted electronic document: first, store the electronic document in the quarantine; second, notify one of the users; third, receive from the one of the users the particular decryption data of the document recipient; fourth, decrypt the electronic document using the particular decryption data of the document recipient and received from the one of the users; fifth, scan the electronic document to identify specified content in the electronic document to determine whether the specified content contains malicious elements; sixth, encrypt the scanned document using the particular decryption data received from the one of the users; and seventh, perform one or more responsive actions based on the specified content.