Methods and systems for using a vault server in conjunction with a client-side restricted-execution vault-mail environment
Disclosed are methods, media, and vault servers for providing a secure messaging system using vault servers in conjunction with client-side restricted-execution vault-mail environments. Methods include the steps of upon activating a vault-mail message containing sensitive content, removing the content from the vault-mail message; placing the content on a vault server; creating a link in the vault-mail message to the content on the vault server; sending the vault-mail message to a designated recipient; and upon activating the link, allowing the content to be only viewed in a restricted-execution session of a client application, wherein the restricted-execution session does not allow the content to be altered, copied, stored, printed, forwarded, or otherwise executed. Preferably, the activation of the vault-mail message is performed by a network-security gateway, and can be performed on a per-message basis. Preferably, the activation of the link requires user authentication which may be designated during activation of the vault-mail message on a per-message basis based on said content. Preferably, the restricted-execution session enforces a security policy.
1. A method for using a vault server in conjunction with a client-side restricted-execution vault-mail environment, the method comprising the steps of:
(a) before sending, by a sender device, a vault-mail message containing sensitive content, removing said content from said vault-mail message;
(b) placing said content on a vault server;
(c) placing a link in said vault-mail message to said content on said vault server;
(d) sending said vault-mail message, that lacks said content, to a designated recipient; and
(e) upon clicking said link, by said designated recipient, allowing said content to be only viewed in a restricted-execution session of a client application, wherein said restricted-execution session does not allow said content to be altered, copied, stored, printed, forwarded, or otherwise executed.
2. The method of claim 1 , wherein activation of said vault-mail message is performed by a network-security gateway.
3. The method of claim 1 , wherein activation of said vault-mail message can be performed on a per-message basis.
4. The method of claim 1 , wherein activation of said link requires user authentication.
5. The method of claim 4 , wherein said user authentication may be designated during activation of said vault-mail message on a per-message basis based on said content.
6. The method of claim 1 , wherein said restricted-execution session enforces a security policy, wherein said security policy designates which user applications are allowed to run in said restricted-execution session.
7. The method of claim 1 , the method further comprising the step of:
(f) prior to said step of allowing, performing a compliance check, by said client application, on a client system to verify that said client system does not contain a virus, said step of performing being optionally operative on a per-message basis based on said content.
8. The method of claim 1 , the method further comprising the step of:
(f) prior to said step of allowing, triggering a restricted-operation mode, by said client application, on a client system during said restricted-execution session, said step of triggering being optionally operative on a per-message basis based on said content.
9. The method of claim 1 , the method further comprising the step of:
(f) prior to said step of allowing, adding a watermark to said content, by said client application, wherein said watermark can be used to identify a content source of said content in case of a content leak, said step of adding being optionally operative on a per-message basis based on said content.
10. A non-transient computer-readable storage medium having computer-readable code embodied on the computer-readable storage medium, the computer-readable code comprising:
(a) program code for, before sending, by a sender device, a vault-mail message containing sensitive content, removing said content from said vault-mail message;
(b) program code for placing said content on a vault server;
(c) program code for placing a link in said vault-mail message to said content on said vault server;
(d) program code for sending said vault-mail message, that lacks said content, to a designated recipient; and
(e) program code for, upon clicking said link, by said designated recipient, allowing said content to be only viewed in a restricted-execution session of a client application, wherein said restricted-execution session does not allow said content to be altered, copied, stored, printed, forwarded, or otherwise executed.
11. The storage medium of claim 10 , wherein activation of said vault-mail message is performed by a network-security gateway.
12. The storage medium of claim 10 , wherein activation of said vault-mail message can be performed on a per-message basis.
13. The storage medium of claim 10 , wherein activation of said link requires user authentication.
14. The storage medium of claim 13 , wherein said user authentication may be designated during activation of said vault-mail message on a per-message basis based on said content.
15. The storage medium of claim 10 , wherein said restricted-execution session enforces a security policy, wherein said security policy designates which user applications are allowed to run in said restricted-execution session.
16. The storage medium of claim 10 , the computer-readable code further comprising:
(f) program code for, prior to said step of allowing, performing a compliance check, by said client application, on a client system to verify that said client system does not contain a virus, said step of performing being optionally operative on a per-message basis based on said content.
17. The storage medium of claim 10 , the computer-readable code further comprising:
(f) program code for, prior to said step of allowing, triggering a restricted-operation mode, by said client application, on a client system during said restricted-execution session, said step of triggering being optionally operative on a per-message basis based on said content.
18. The storage medium of claim 10 , the computer-readable code further comprising:
(f) program code for, prior to said step of allowing, adding a watermark to said content, by said client application, wherein said watermark can be used to identify a content source of said content in case of a content leak, said step of adding being optionally operative on a per-message basis based on said content.
19. A vault server for enabling a client-side restricted-execution vault-mail environment, the vault server comprising:
(a) a memory for storing program code, wherein said program code includes program code for:
(i) before sending, by a sender device, a vault-mail message residing in a client system containing sensitive content, removing said content from said vault-mail message;
(ii) placing said content on the vault server;
(iii) placing a link in said vault-mail message to said content on the vault server;
(iv) sending said vault-mail message, that lacks said content, to a designated recipient; and
(v) upon clicking said link, by said designated recipient, allowing said content to be only viewed in a restricted-execution session of a client application, wherein said restricted-execution session does not allow said content to be altered, copied, stored, printed, forwarded, or otherwise executed; and
(b) a processor for executing said program code.
20. The vault server of claim 19 , wherein activation of said vault-mail message is performed by a network-security gateway.
21. The vault server of claim 19 , wherein activation of said vault-mail message can be performed on a per-message basis.
22. The vault server of claim 19 , wherein activation of said link requires login credentials.
23. The vault server of claim 22 , wherein said user authentication may be designated during activation of said vault-mail message on a per-message basis based on said content.
24. The vault server of claim 19 , wherein said restricted-execution session enforces a security policy, wherein said security policy designates which user applications are allowed to run in said restricted-execution session.
25. The vault server of claim 19 , wherein said memory further includes program code for:
(vi) prior to said step of allowing, performing a compliance check, by said client application, on a client system to verify that said client system does not contain a virus, said step of performing being optionally operative on a per-message basis based on said content.
26. The vault server of claim 19 , wherein said memory further includes program code for:
(vi) prior to said step of allowing, triggering a restricted-operation mode, by said client application, on a client system during said restricted-execution session, said step of triggering being optionally operative on a per-message basis based on said content.
27. The vault server of claim 19 , wherein said memory further includes program code for:
(vi) prior to said step of allowing, adding a watermark to said content, by said client application, wherein said watermark can be used to identify a content source of said content in case of a content leak, said step of adding being optionally operative on a per-message basis based on said content.