Virtual data labeling and policy manager system and method
View Patent ↗A mandatory access control system and method that employs a policy manager subsystem with virtual data labeling (VDL) on the communications channel to allow aspects about the data to determine by whom and where such data can be accessed. When combined with a secure network system, the VDL system is able to base delivery decisions not only on destination address but also on the type of data that is to be delivered.
1. A virtual data labeling system operative on an Internet communications channel between a client server and a data repository, said labeling system cooperating with a label processor for discriminating communications channel traffic, comprising:
a policy manager subsystem for storing policy rules, said policy manager subsystem including;
a rules loader for inputting metadata defining data categories and corresponding rules into said policy manager subsystem as explicit rules; and
a default manager for establishing implicit rules applying to data categories for which a corresponding rule does not appear in said policy manager subsystem;
a front-end subsystem for receiving a search request from a requester at the client server, said front-end subsystem receiving at least some of said policy rules from the policy manager subsystem and generating a modified search request;
a back-end subsystem interposed between the front end subsystem and the data repository for reformatting said modified search request to generate an enhanced search request, said back-end subsystem forwarding the enhanced search request to the data repository and receiving the requested data from said data repository as retrieved data, said back-end subsystem forwarding said retrieved data to said front-end subsystem; and
a labeling engine subsystem, coupled to said front-end subsystem, for labeling a communication header of said retrieved data;
said front end subsystem transferring the labeled retrieved data through said label processor to the requester.
2. The virtual data labeling system as set forth in claim 1 , wherein said rules loader processes manually input metadata.
3. The virtual data labeling system as set forth in claim 1 wherein said rules loader loads pre-stored rules formatted in a Domain of Interpretation document format.
4. The virtual data labeling system as set forth in claim 1 , wherein said policy manager subsystem further comprises a metadata manager for mapping content data to rules, said rules loader receiving automatically cataloged metadata through a database scanning utility run by said metadata manager.
5. The virtual data labeling system as set forth in claim 4 , said policy manager subsystem further comprising:
a policy associator for associating label values to data content values; and
a policy exporter for exporting policy data to said front-end subsystem.
6. The virtual data labeling system as set forth in claim 5 , wherein said metadata manager comprises:
a metadata collector for scanning existing data sources and capturing metadata for loading by said rules loader;
an association analyzer for analyzing associations established by said policy associator; and
a metadata reporter for providing a user interface to said metadata manager.
7. A virtual data labeling system operative on an Internet communications channel between a client server and a data repository, said labeling system cooperating with a label processor for discriminating communications channel traffic, comprising:
a policy manager subsystem for storing policy rules, said policy manager subsystem including;
a rules loader for inputting metadata defining data categories and corresponding policy rules into said policy manager subsystem; and
a metadata manager for mapping content data to said policy rules, said metadata manager running a database scanning utility to provide automatically cataloged metadata to said rules loader;
a front-end subsystem for receiving a search request from a requester at the client server, said front-end subsystem receiving at least some of said policy rules from the policy manager subsystem and generating a modified search request;
a back-end subsystem interposed between the front-end subsystem and the data repository for reformatting the modified search request to generate an enhanced search request, said back-end subsystem forwarding the enhanced search request to the data repository and receiving the requested data from said data repository as retrieved data, said back-end subsystem forwarding said retrieved data to said front-end subsystem; and
a labeling engine subsystem, coupled to said front-end subsystem, for labeling a communication header of said retrieved data;
said front-end subsystem transferring the labeled retrieved data through said label processor to the requester.
8. The virtual data labeling system as set forth in claim 7 , said policy manager subsystem further comprising:
a policy associator for associating label values to data content values; and
a policy exporter for exporting policy data to said front-end subsystem.
9. The virtual data labeling system as set forth in claim 8 , wherein said metadata manager comprises:
a metadata collector for scanning existing data sources and capturing metadata for loading by said rules loader;
an association analyzer for analyzing associations established by said policy associator; and
a metadata reporter for providing a user interface to said metadata manager.
10. The virtual data labeling system as set forth in claim 7 , wherein said policy manager subsystem further comprises a default manager for establishing implicit rules applying to data categories for which a corresponding explicit policy rule does not appear in said policy manager subsystem.
11. The virtual data labeling system as set forth in claim 10 , wherein said implicit rules represent a plurality of programmable default options.