Enforcing application and access control policies in an information management system with two or more interactive enforcement points
A method and apparatus for controlling document access and application usage using centrally managed rules. The rules are stored and manipulated in a central rule database via a rule server. Policy enforcers are installed on client systems and/or on servers and perform document access and application usage control for both direct user document accesses and application usage, and application program document accesses by evaluating the rules sent to the policy enforcer. The rule server decides which rules are required by each policy enforcer. A policy enforcer can also perform obligation and remediation operations as a part of rule evaluation. Policy enforcers on client systems and servers can operate autonomously, evaluating policies that have been received, when communications have been discontinued with the rule server.
1. A method of controlling application usage and document access in a plurality of computers the method comprising:
evaluating at least one rule pertaining to an occurrence of an event,
wherein the at least one rule is among a plurality of rules stored on a first computer,
wherein the at least one rule comprises at least one expression used by the evaluating step to decide whether to perform an action,
wherein the at least one rule comprises an abstraction whose corresponding definition statement is stored at a second computer, separate from the first computer, and
wherein evaluating the at least one rule comprises:
retrieving the definition statement stored at the second computer;
collecting information required to evaluate the definition statement;
evaluating the definition statement using the collected information; and
determining a result of evaluating the at least one rule using the at least one expression and the evaluated definition statement;
communicating with the plurality of computers as indicated by the at least one rule; and
instructing the plurality of computers to perform an action as indicated by the at least one rule comprising:
determining a low-level file operation to be executed if the action is allowed;
if the evaluating the at least one rule results in a Boolean true, allowing the low-level file operation to execute; and
if the evaluating the at least one rule results in a Boolean false, disallowing the low-level file operation from executing.
2. The method of claim 1 wherein when the evaluating the at least one rule results in a Boolean false further comprising indicating at a third computer of the plurality of computers the action is allowed.
3. The method of claim 2 wherein the third computer comprises the first computer.
4. A method of controlling application usage and document access in a plurality of computers the method comprising:
evaluating at least one rule pertaining to an occurrence of an event,
wherein the at least one rule is among a plurality of rules accessible by a first policy enforcer,
wherein the at least one rule comprises at least one expression used by the evaluating step to decide whether to perform an action,
wherein the at least one rule comprises an abstraction whose corresponding definition statement accessible by a second policy enforcer, different than the first policy enforcer, and
wherein evaluating the at least one rule comprises:
retrieving the definition statement using the second policy enforcer;
collecting information required to evaluate the definition statement;
evaluating the definition statement using the collected information; and
determining a result of evaluating the at least one rule using the at least one expression and the evaluated definition statement;
communicating with a plurality of policy enforcers as indicated by the at least one rule; and
instructing the plurality of policy enforcers to perform an action as indicated by the at least one rule comprising:
determining a low-level file operation to be executed if the action is allowed;
if the evaluating the at least one rule results in a Boolean true, allowing the low-level file operation to execute; and
if the evaluating the at least one rule results in a Boolean false, disallowing the low-level file operation from executing.
5. The method of claim 4 wherein the at least one rule is among a plurality of rules accessible by a first policy enforcer is a locally accessible rule by the first policy enforcer, accessible without connecting to the network.
6. The method of claim 5 wherein the definition statement accessible by a second policy enforcer is a locally accessible definition statement, accessible without connecting to the network.
7. The method of claim 4 wherein evaluating the at least one rule further comprises:
before retrieving the definition statement, determining the second policy enforcer is executing.
8. The method of claim 4 wherein evaluating the at least one rule further comprises:
transmitting from the second policy enforcer to the first policy enforcer the retrieved definition statement.
9. The method of claim 4 wherein evaluating the at least one rule further comprises:
transmitting from the second policy enforcer to the first policy enforcer the evaluated definition statement.
10. The method of claim 4 wherein the event comprises an occurring date and the instructing the plurality of policy enforcers to perform an action comprises:
instructing the plurality of policy enforcers to delete specific information managed by the first policy enforcer based on the recurring date.
11. The method of claim 10 wherein the deleted specific information comprises e-mail, wherein for each deleted e-mail a difference between the occurring date and a received date of an e-mail to be deleted is greater than a threshold time period.
12. The method of claim 4 wherein the event comprises an occurring time and the instructing the plurality of policy enforcers to perform an action comprises:
at the occurring time, instructing the plurality of policy enforcers to transmit any application usage information, document access information, or both stored at each of the policy enforcers of the plurality of policy enforcers to the first policy enforcer.
13. The method of claim 4 wherein the event comprises deletion of a master file and the instructing the plurality of policy enforcers to perform an action comprises:
instructing the plurality of policy enforcers to delete any copies of the master file stored at each policy enforcer of the plurality of policy enforcers.
14. The method of claim 4 wherein the event comprises identification of a specific file as a backup file and the instructing the plurality of policy enforcers to perform an action comprises:
instructing the plurality of policy enforcers to delete any copies of the specific file stored at each policy enforcer of the plurality of policy enforcers.
15. The method of claim 4 wherein the at least one rule comprises:
a first expression causing evaluation of a first condition at the first policy enforcer to produce a first result,
a second expression causing communication from the first policy enforcer to the second policy enforcer,
a third expression causing evaluation of the definition statement at the second policy enforcer to produce a second result, and
a fourth expression causing evaluation of whether to allow the action based on the first and second results.
16. The method of claim 4 wherein the at least one expression is a subject expression, wherein the subject expression comprises at least one of a user, a user group, a user role, a user business function, a computer, a group of computers, a type of computer, an application program, or a type of application program.
17. The method of claim 4 wherein the event comprises the deletion of information at a server and the instructing the plurality of policy enforcers comprises:
instructing each policy enforcer of the plurality of policy enforcers to search a device on which the policy enforcer resides for copies of the information that reside on the device; and
deleting the found information from each policy enforcer of the plurality of policy enforcers having the information.
18. The method of claim 4 wherein the at least one rule indicates that any document identified as confidential may not be stored on policy enforcers of the plurality of policy enforcers that are of a specific type of computer and the instructing the plurality of policy enforcers to evaluate the at least one rule comprises:
instructing each policy enforcer of the plurality of policy enforcers to provide information indicating whether or not it is of the specific type;
at each policy enforcer of the plurality of policy enforcers that is of the specific type, searching for any documents identified as confidential; and
deleting at each policy enforcer of the plurality of policy enforcers that is of the specific type any found document identified as confidential.
19. A method of controlling application usage and document access in a plurality of computers the method comprising:
evaluating at least one rule pertaining to an occurrence of an event,
wherein the at least one rule is among a plurality of rules stored on a first computer,
wherein the at least one rule comprises at least one expression used by the evaluating step to decide whether to perform an action,
wherein the at least one rule comprises an abstraction whose corresponding definition statement is stored at a second computer, separate from the first computer, and
wherein evaluating the at least one rule comprises:
retrieving over a network the definition statement stored at the second computer, wherein the first computer is coupled to the second computer via the network;
disallowing a low-level operation corresponding to the event until the event is determined to be allowable according to the at least one rule;
collecting information required to evaluate the definition statement;
evaluating the definition statement using the collected information at the first computer; and
determining a result of evaluating the at least one rule using the at least one expression and the evaluated definition statement;
communicating with the plurality of computers as indicated by the at least one rule;
transforming the result of evaluating the at least one rule using the at least one expression and the evaluated definition statement into at least one instruction for the plurality of computers to perform an action as indicated by the at least one rule; and
transmitting the at least one instruction to the plurality of computers to perform the action as indicated by the at least one rule, whereby each of the plurality of computers that perform the action as indicated by the at least one rule do so without needing to reevaluate the rule at that computer.
20. The method of claim 1 wherein determining the low-level file operation to be executed if the action is allowed comprises evaluating whether information collected at a high-level interception, used to interpret the low-level file operation, allows the event.
21. The method of claim 1 wherein determining the low-level file operation to be executed if the action is allowed comprises evaluating whether a point-of-use action identifier provided from an application-layer level of a computing device is allowed.
22. The method of claim 1 wherein the low-level operation is detected using one or more code modules implemented as a library, filter, or device driver.