Granted Patent B1

US 12,406,080 · App. 18/396,229 · Granted Sep 2, 2025

Inventors: Keng Lim (Atherton, CA); Poon Fung (Cupertino, CA)

Assignee: NextLabs, Inc.

G06F21/6218G06F16/93G06F16/951G06F16/986H04L41/08H04L63/102H04L67/02H04L67/06

Abstract

Claims (78)

1. A method comprising:

providing a document repository having a plurality of protected documents;

providing a content access governor having a plurality of policies;

providing a secured viewing server having access to the content access governor and the document repository;

connecting to the secured viewing server via a web browser;

at the web browser, opening a protected document in the document repository by a user;

at the secured viewing server, receiving a request to open the protected document;

at the secured viewing server, querying the content access governor on whether the request is allowed;

at the secured viewing server, if the request is allowed, receiving a plurality of rights granted to the user on the protected document;

at the secured viewing server, if the request is allowed, converting the protected document into a converted document, wherein the converted document comprises a plurality of raster images, and the converting the protected document further comprises converting a page of the protected document into a raster image;

at the secured viewing server, if the request is allowed, constructing a code fragment to modify a web browser feature, wherein modifying the web browser feature implements in part the plurality of rights granted to the user on the protected document;

at the secured viewing server, if the request is allowed, constructing an HTML document to deliver the converted document and the code fragment to the web browser;

at the secured viewing server, if the request is allowed, sending the HTML document to the web browser in response to the request;

at the web browser, if the request is allowed, loading the HTML document to display content of the protected document in the web browser, wherein loading the HTML document implements the plurality of rights granted to the user on the protected document, wherein the user opens the protected document successfully;

at the secured viewing server, if the request is not allowed, sending a response to the web browser indicating that the user is not allowed to open the protected document; and

at the web browser, if the request is not allowed, rendering the response in the web browser, wherein the user failed to open the protected document.

2. The method of claim 1 wherein the document repository is a file server.

3. The method of claim 1 wherein the document repository is an application server.

4. The method of claim 1 wherein the document repository is a cloud storage.

5. The method of claim 1 wherein the plurality of policies controls access to the plurality of protected documents.

6. The method of claim 1 wherein the plurality of policies controls uses of contents of the plurality of protected documents.

7. The method of claim 1 wherein the document repository, the content access governor and the secured viewing server run on a computer.

8. The method of claim 1 wherein the document repository, the content access governor and the secured viewing server run on separate computers.

9. The method of claim 1 wherein the content access governor and the secured viewing server are components of an application program.

10. The method of claim 1 wherein the web browser connects to the secured viewing server using HTTPS protocol.

11. The method of claim 1 wherein the at the secured viewing server, querying the content access governor on whether the request is allowed further comprises:

at the secured viewing server, sending information relevant to the request to the content access governor, wherein the information relevant to the request comprises at least information about the request, the protected document and the user;

at the content access governor, selecting a first subset of policies from the plurality of policies relevant to the request, the protected document and the user;

at the content access governor, evaluating the first subset of policies to determine whether the request is allowed;

at the content access governor, if the request is allowed, selecting a second subset of policies from the plurality of policies relevant to the protected document and the user; and

at the content access governor, if the request is allowed, analyzing the second subset of policies to produces a plurality of rights granted to the user on the protected document.

12. The method of claim 1 wherein the at the secured viewing server, querying the content access governor on whether the request is allowed further comprises:

at the secured viewing server, retrieving a plurality of discretionary policies from the protected document;

at the secured viewing server, sending the plurality of discretionary policies and information relevant to the request to the content access governor, wherein the information relevant to the request comprises at least information about the request and the user;

at the content access governor, evaluating the plurality of discretionary policies to determine whether the request is allowed; and

at the content access governor, if the request is allowed, analyzing the plurality of discretionary policies to produces a plurality of rights granted to the user on the protected document.

13. The method of claim 1 wherein the at the secured viewing server, querying the content access governor on whether the request is allowed further comprises:

at the secured viewing server, retrieving a plurality of discretionary policies from the protected document;

at the secured viewing server, sending the plurality of discretionary policies and information relevant to the request to the content access governor, wherein the information relevant to the request comprises at least information about the request, the protected document and the user;

at the content access governor, selecting a first subset of policies from the plurality of policies relevant to the request, the protected document and the user;

at the content access governor, evaluating the first subset of policies and the plurality of discretionary policies to determine whether the request is allowed;

at the content access governor, if the request is allowed, selecting a second subset of policies from the plurality of policies relevant to the protected document and the user; and

at the content access governor, if the request is allowed, analyzing the second subset of policies and the plurality of discretionary policies to produces a plurality of rights granted to the user on the protected document.

14. The method of claim 1 wherein the plurality of rights granted includes a view right.

15. The method of claim 1 wherein the plurality of rights granted includes a copy right.

16. The method of claim 1 wherein the plurality of rights granted includes a print right.

17. The method of claim 1 wherein the at the secured viewing server, if the request is allowed, converting the protected document into a converted document, wherein the converted document comprises a plurality of raster images further comprises:

retrieving an encryption key identifier from the protected document;

obtaining an encryption key associated with the encryption key identifier from the content access governor; and

decrypting the protected document with the encryption key.

18. A method comprising:

providing a document repository having a plurality of protected documents;

providing a content access governor having a plurality of policies;

providing a secured viewing server having access to the content access governor and the document repository;

connecting to the secured viewing server via a web browser;

at the web browser, opening a protected document in the document repository by a user;

at the secured viewing server, receiving a request to open the protected document;

at the secured viewing server, querying the content access governor on whether the request is allowed;

at the secured viewing server, if the request is allowed, receiving a plurality of rights granted to the user on the protected document;

at the secured viewing server, if the request is allowed, converting the protected document into a converted document, wherein the converted document comprises a plurality of raster images;

at the secured viewing server, if the request is allowed, constructing a code fragment to modify a web browser feature, wherein modifying the web browser feature implements in part the plurality of rights granted to the user on the protected document, and the plurality of rights are used by the secured viewing server and the plurality of rights are not transmitted to the web browser;

at the secured viewing server, if the request is allowed, constructing an HTML document to deliver the converted document and the code fragment to the web browser;

at the secured viewing server, if the request is allowed, sending the HTML document to the web browser in response to the request;

at the web browser, if the request is allowed, loading the HTML document to display content of the protected document in the web browser, wherein loading the HTML document implements the plurality of rights granted to the user on the protected document, wherein the user opens the protected document successfully;

at the secured viewing server, if the request is not allowed, sending a response to the web browser indicating that the user is not allowed to open the protected document; and

at the web browser, if the request is not allowed, rendering the response in the web browser, wherein the user failed to open the protected document.

19. The method of claim 1 wherein the converting the protected document into a converted document, wherein the converted document comprises a plurality of raster images includes excluding content of the protected document that is not consistent with the plurality of rights granted to the user on the protected document in the converted document.

20. The method of claim 1 wherein the converting the protected document into a converted document, wherein the converted document comprises a plurality of raster images includes excluding a feature of the protected document that is not consistent with the plurality of rights granted to the user on the protected document in the converted document.

21. The method of claim 1 wherein the converting the protected document into a converted document, wherein the converted document comprises a plurality of raster images includes adding a security overlay over content of the converted document.

22. The method of claim 1 wherein the converting the protected document into a converted document, wherein the converted document comprises a plurality of raster images includes adding navigation functions in the converted document.

23. The method of claim 1 wherein the code fragment includes HTML code.

24. The method of claim 1 wherein the code fragment includes JavaScript code.

25. The method of claim 1 wherein the constructing a code fragment to modify a web browser feature includes enabling a web browser feature.

26. The method of claim 1 wherein the constructing a code fragment to modify a web browser feature includes disabling a web browser feature.

27. The method of claim 1 wherein the constructing a code fragment to modify a web browser feature includes disabling the save function of a web browser.

28. The method of claim 1 wherein the constructing a code fragment to modify a web browser feature includes disabling the print function of a web browser.

29. The method of claim 1 wherein the constructing a code fragment to modify a web browser feature includes adding an event handler to handle an event.

30. The method of claim 1 wherein the constructing a code fragment to modify a web browser feature includes blocking execution of program code.

Continuity (4)

References Cited (33)