Dynamic access control for documents in electronic data transfer processes in a cloud computing environment

Abstract

Method for providing dynamic access control for documents in electronic data transmission operations in a cloud computing environment, wherein the method comprises the following: Receiving an electronic data transmission in a cloud computing environment, where the electronic data transmission includes a document; Removal of the document from electronic data transmission; Saving the document to a document database; Adding a pointer to an entry in the document database where the document is stored to the electronic data transmission; Generating an access control list for the document upon storage, wherein the access control list identifies a sender and a group of initial recipients of the electronic data transmission by means of a set of addresses of the sender and the group of initial recipients, wherein the set of addresses is used to authorize access to the document in the document database; and Controlling access to the document in the document database based on the access control list, the procedure also includes: the dynamic updating of the access control list so that, based on a forwarding of the electronic message by at least one of the initial recipients, it contains a group of forwarded recipients, provided that the electronic message contains a pointer to an entry in the document database and where metadata is inserted into the file or filename by means of a server agent to easily identify changes and to carry out version control of the file, and the change control is carried out on the basis of the system used by all parties involved, i.e. the same forms of electronic data transmission, instant messaging or non-hierarchical file sharing.

Description

FIELD OF THE INVENTION

[0001] The present invention relates to access control in general. More specifically, the present invention relates to dynamic access control for documents in electronic data transmission processes (e.g., email) in a cloud computing environment. FUNDAMENTALS OF THE INVENTION

[0002] As electronic data transmissions (e.g., email, instant messaging, etc.) become the standard for business and personal communications, the need for access control for such data transmissions grows. Consider email, for example, where the sender has no control over where the email message and / or any attached document may be sent (and returned) and who may access the content once it has been sent. Storing multiple documents in multiple locations (e.g., in different email accounts) can impose excessive processing and storage requirements on both servers and networks. Existing solutions focus on transmitting metadata associated with documents rather than providing access control.Furthermore, once one person has sent a document to another, existing solutions only allow a sender to restrict who receives the document (through multiple forwarding), by "prevent copying," or by using some other similar feature that prevents the document from being resent in its original form. This approach is very limiting and places a strain on the desktop email client.

[0003] US 2005 / 0 021 938 A1 discloses a system and method for controlling the transmission of an email message, comprising determining whether an email message transmitted to one or more addresses contains a link to a document, identifying each of the one or more addresses to which the email message is transmitted, and creating a shared user account for the identified one or more addresses. Each of the one or more addresses in the shared user account has access to the linked document, and the email message is transmitted with the document link to each of the one or more addresses.

[0004] WO 01 / 75651 A2 provides a system that replaces an attachment of an e-mail message with a reference to a storage location where the attachment is stored. After receiving the e-mail message, the system examines the e-mail message to determine whether the e-mail message contains an attachment. If the e-mail message contains the attachment, the system stores the attachment in a storage location on a communications network from which the attachment can be retrieved. The system also modifies the e-mail message by replacing the attachment with a reference specifying the storage location of the attachment and sends the modified e-mail message to a recipient of the e-mail message. In one embodiment of the present invention, the recipient receives the modified e-mail message and uses the reference specifying the storage location of the attachment to retrieve the attachment via the communications network.

[0005] US 2008 / 0 147 679 A1 shows a software application and a corresponding architecture for implementing the application that dynamically updates the access control list and tracks the distribution paths of a document in a repository where the document is created and accessed via a common email system. The access control list and distribution paths are created by tracking the recipients of the email message linked to the document. Some recipients can be deactivated by the sender from forwarding the referenced databases within the emailed document, while others can specify further transmissions to selected individuals or groups.

[0006] US 6 505 236 B1 shows a network-based storage system for email attachments and methods for: receiving an electronic mail piece from a sender containing a forwarding specification and an attachment; detaching the attachment from the electronic mail piece; storing the attachment on a storage device at a specific address under a specific file name; generating a handle corresponding to the specific address and the specific file name; appending the electronic mail piece to include the handle; and transmitting the attached electronic mail piece according to the forwarding specification, including the handle but excluding the stored attachment.

[0007] US 2007 / 0 033 654 A1 enables changes to the access control settings for a computer-based resource to be detected and stored in a set (e.g., one or more) of electronic documents. In a typical embodiment, each stored change contains a previous access control setting and a new access control setting, so that the exact differences resulting from the changes are known. Furthermore, in the event of an access control condition, such as an undesirable security risk or restriction, the change history stored in the document group can be viewed and a previous version of the access control settings can be reverted to. DISCLOSURE OF THE INVENTION

[0008] The present invention provides a solution for managing and controlling document transmission and electronic data transfer. Specifically, the present invention solves the problem of maintaining control over data (documents, image files, and attachments, hereinafter referred to as 'documents') associated with multiple types of data transfer. In this sense, the present invention provides a hub-and-spoke communication model to achieve multiple benefits in terms of performance, cost-effectiveness, flexibility, and control. This type of targeted control is crucial for data sharing in a cloud computing environment.This approach is also useful for collaboration tools and can be enhanced by creating and managing access control lists (ACLs) for the hub-spoke system. In this respect, the present invention solves the problem of automatically updating access control lists when documents are forwarded or otherwise exchanged between multiple people. These ACLs are kept up to date by analyzing who (and where) a document has been sent.

[0009] In a first aspect, the present invention provides a method for providing dynamic access control for documents in electronic data transmissions in a cloud computing environment, the method comprising: receiving an electronic data transmission in the cloud computing environment, the electronic data transmission including a document; removing the document from the electronic data transmission; storing the document in a document database; creating an access control list for the document upon storage, the access control list identifying a sender and a group of initial recipients of the electronic data transmission; and controlling access to the document in the document database based on the access control list.

[0010] In a second aspect, the present invention provides a cloud computing system for providing dynamic access control for documents in electronic data transmissions, the system comprising: a storage medium comprising instructions; a bus connected to the storage medium; and a processor connected to the bus, which, upon execution of the instructions, causes the cloud computing system to: receive an electronic data transmission in the cloud computing environment, wherein the electronic data transmission includes a document; remove the document from the electronic data transmission; store the document in a document database; create an access control list for the document upon storage, the access control list identifying a sender and a group of initial recipients of the electronic data transmission;and controlling access to the document in the document database based on the access control list;

[0011] In a third aspect, the present invention provides a computer-readable medium comprising: a program for providing dynamic access control for documents in electronic data transmissions in a cloud computing environment, the computer-readable medium comprising program code for causing a cloud computing system to: receive an electronic data transmission in the cloud computing environment, the electronic data transmission including a document; remove the document from the electronic data transmission; store the document in a document database; create an access control list for the document upon storage, the access control list identifying a sender and a group of initial recipients of the electronic data transmission; and control access to the document in the document database based on the access control list.

[0012] In a fourth aspect, the present invention provides a method for deploying a cloud service to provide dynamic access control for documents in electronic data transmissions in a cloud computing environment, the method comprising: providing a cloud computing infrastructure capable of: receiving an electronic data transmission in the cloud computing environment, wherein the electronic data transmission includes a document; removing the document from the electronic data transmission; storing the document in a document database; creating an access control list for the document upon storage, wherein the access control list identifies a sender and a group of initial recipients of the electronic data transmission; and controlling access to the document in the document database based on the access control list. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] These and other features of the present invention will be readily understood by reference to the following detailed description of the various aspects of the present invention when read in conjunction with the accompanying drawings in which: Fig. 1 shows a cloud system node according to the present invention. Fig. 2 shows a cloud computing environment according to the present invention. Fig. 3 shows cloud abstraction model layers according to the present invention. Fig. 4 shows an illustrative architectural diagram according to the present invention. Fig. 5 shows a flow diagram of a method according to the present invention.

[0014] The drawings are not necessarily to scale. The drawings are merely schematic representations and are not intended to depict specific parameters of the present invention. The drawings are intended to illustrate only typical embodiments of the present invention and should therefore not be considered limiting the scope of the present invention. Throughout the drawings, like numbering represents like elements. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

[0015] For convenience, the detailed description of the preferred embodiment has the following sections: I. Definitions for cloud computing II. Detailed introduction of the preferred embodiment I. Definitions for cloud computing

[0016] The following definitions were derived from the “Draft NIST Working Definition of Cloud Computing” by Peter Mell and Tim Grance dated October 7, 2009, which is cited in an IDS submitted herewith and a copy of which is attached.

[0017] Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and made available with minimal administrative effort or interaction from service providers. This cloud model promotes availability and includes at least five characteristics: at least three service models, and at least four deployment models.

[0018] The characteristics are the following: On-demand self-service: A consumer can unilaterally and automatically use computing resources, such as server time and network storage, as needed, without requiring human-led interaction with the provider of each service.

[0019] Broad network access: Resources are available over a network and accessible through standard mechanisms that support use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0020] Resource pooling: The provider's computing resources are pooled to serve multiple consumers, using a multi-tenant model in which various physical and virtual resources are dynamically allocated and reassigned according to user demand. There is a degree of location independence in that the customer generally has no control over or knowledge of the exact location of the deployed resources, but can specify the location at a higher level of abstraction (e.g., region, state, or data center). Examples of resources include disk space, processing, storage, network bandwidth, and virtual machines.

[0021] Rapid elasticity: Resources can be provisioned quickly and adaptably, in some cases automatically, to provide rapid expansion (scale out) and released quickly, providing rapid reduction (scale in). From the consumer's perspective, the resources available for provision often appear unlimited and can be acquired in any quantity and at any time.

[0022] Measured service: Cloud systems control and optimize resource utilization by implementing a measurement function at an abstraction level appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource utilization can be monitored, controlled, and recorded, providing transparency for both the provider and the consumer of the service.

[0023] The service models are as follows: Cloud software as a service (SaaS): The functionality provided to the consumer is the use of a provider's applications running in a cloud infrastructure. The applications can be accessed from various client devices through a thin client interface, such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0024] Cloud platform as a service (PaaS): The functionality provided to the consumer is the use of applications created or requested by the consumer, generated using programming languages ​​and utilities supported by the provider, on the cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly configurations of the application hosting environment.

[0025] Cloud infrastructure as a service (IaaS): The functionality provided to the consumer is the provision of computing, storage, networking, and other basic computing resources, allowing the consumer to deploy and run any software, including operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but has control over operating systems, storage, deployed applications, and possibly limited control over the selection of network components (e.g., host firewalls).

[0026] The deployment models are as follows: Private cloud: The cloud infrastructure is operated solely for one organization. It can be managed by the organization itself or by a third party, and the location can be internal or external to the organization. Community cloud: The cloud infrastructure is shared by multiple organizations and supports a specific community with common interests (e.g., mission, security requirements, strategy, and compliance considerations). It can be managed by the organization or a third party and can be internal or external to the organization.

[0027] Public cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization that sells cloud services.

[0028] Combined cloud (hybrid cloud): The cloud infrastructure consists of two or more clouds (private, shared or public) that remain independent entities but are connected by a standardized or proprietary technology that enables the portability of data and applications (e.g. cloud bursting for load balancing between clouds).

[0029] A cloud computing environment is service-oriented with an emphasis on statelessness, loose coupling, modularity, and semantic interoperability. II. Realization of the preferred embodiment

[0030] The present invention provides a solution for managing and controlling document transmission and electronic data transfer. In particular, the present invention solves the problem of maintaining control over data (documents, image files, and attachments)—hereinafter referred to as "documents"—associated with multiple types of data transfer.

[0031] In this sense, the present invention provides a hub-to-spoke data transfer model to achieve several advantages in terms of performance, cost-effectiveness, flexibility, and control. This type of targeted control is crucial for data sharing in a cloud computing environment. This approach is also useful for process optimization utilities and can be enhanced by the creation and management of access control lists (ACLs) for the hub-to-spoke system. In this respect, the present invention solves the problem of being able to automatically update access control lists when documents are forwarded or otherwise transferred between multiple people. These ACLs are kept up to date by analyzing who (and where) a document has been sent to.

[0032] With reference to Fig. 1, a schematic representation of an exemplary cloud computing node is shown. Cloud computing node 10 is merely an example of a suitable cloud computing node and is not intended to imply any limitation on the scope or functionality of the present invention described herein. Nevertheless, cloud computing node 10 may be implemented and / or perform all of the functions set forth in Section I above.

[0033] Within the cloud computing node 10, there is a computer system / server 12 that may operate with numerous other general or specialized computing system environments or configurations. Examples of well-known computing systems, environments, and / or configurations that may be suitable for use with the computer system / server 12 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop computers, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe systems, and distributed cloud computing environments, which may include any of the above systems or devices, and the like.

[0034] The computer system / server 12 may be described in the general context of instructions executable within a computer system, such as program modules executed by a computer system. Generally, program modules include routines, programs, objects, components, logic elements, data structures, and so on, that perform specific tasks or implement specific abstract data types. The example computer system / server 12 may be applied in distributed cloud computing environments where tasks are executed by remote processing units connected by a data transmission network. In a distributed cloud computing environment, program modules may be located on both local and remote computer system storage media, including memory units.

[0035] As in Fig. 1, the computer system / server 12 in the cloud computing node 10 is shown in the form of a general-purpose computing device. Components of the computer system / server 12 may include, but are not limited to, one or more processors or processing units 16, a system memory 28, and a bus 18 that interconnects various system components, including the system memory 28 to the processor 16.

[0036] Bus 18 represents one or more of any type of bus structure, including, but not limited to, a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus, using any of a variety of bus architectures. Examples and not limited to, such architectures include the Industry Standard Architecture (ISA) bus, the Micro Channel Architecture (MCA) bus, the Enhanced ISA (EISA) bus, the Video Electronics Standards Association (VESA) local bus, and the Peripheral Component Interconnect (PCI) bus.

[0037] The computer system / server 12 typically includes a variety of computer system-readable media. Such media may be any available media accessible from the computer system / server 12, including both volatile and non-volatile media, as well as removable and non-removable media.

[0038] The system memory 28 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. The computer system / server 12 may also include other removable / non-removable, volatile / non-volatile computer system storage media. For example only, a storage system 34 may be provided to read from and write to a non-removable, non-volatile magnetic medium (not shown and typically referred to as a "hard disk drive"). Although not shown, a magnetic disk drive for reading from a removable, non-volatile magnetic disk (e.g.,a "floppy disk") and for writing to it, and an optical disk drive for reading from and writing to a removable, non-volatile optical disk, such as a CD-ROM, a DVD-ROM, or other optical media. In such cases, each unit may be connected to the bus 18 through one or more data media interfaces. As will be explained and described in more detail below, the memory 28 may include at least one program product having a set (e.g., at least one) of program modules configured to perform the functions of the present invention.

[0039] By way of example and not limitation, the program / utility 40, which includes a set of (at least one) program modules 42, as well as an operating system, one or more application programs, other program modules, and program data, may be stored in the memory 28. Both the operating system and one or more application programs, other program modules, and program data, or a combination thereof, may include an implementation of a networking environment. The program modules 42 generally perform the functions and / or methods of the present invention as described herein.

[0040] The computer system / server 12 may also communicate with one or more external devices 14, such as a keyboard, a pointing device, a display 24, etc.; one or more devices that enable a user to interact with the computer system / server 12; and / or any devices (e.g., network card, modem, etc.) that enable the computer system / server 12 to communicate with one or more other computing devices. Such communication may occur via I / O interfaces 22. Furthermore, the computer system / server 12 may communicate with one or more networks, such as a local area network (LAN), a wide area network (WAN), and / or a public network (e.g., the Internet), via a network adapter 20. As illustrated, the network adapter 20 communicates with the other components of the computer system / server 12 via bus 18.Although not shown, it should be understood that other hardware and / or software components could be used in conjunction with the computer system / server 12. Examples include, but are not limited to: microcode, device drivers, redundant processing units, external hard disk drive arrays, RAID systems, tape drives, and data archiving systems, etc.

[0041] With reference to Fig. 2, an illustrative cloud computing environment 50 is shown. As shown, the cloud computing environment 50 comprises one or more cloud computing nodes 10 with which data processing units, such as a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, and / or a car computer system 54N, exchange data. This makes it possible to offer infrastructure, platforms, and / or software as services (as described above in Section I) from the cloud computing environment 50, so that each client does not have to separately maintain such resources. It is clear that the Fig. 2 are for illustrative purposes only and that the cloud computing environment 50 may communicate with any type of computer-based device over any type of network and / or network connection / addressable connection (e.g., a web browser).

[0042] With reference to Fig. 3 shows a set of functional abstraction layers used by the cloud computing environment 50 ( Fig. 2) are provided. It must be clear in advance that the Fig. The components, layers, and functions shown in Figure 3 are for illustrative purposes only, and the present invention is not limited thereto. As shown, the following layers and corresponding functions are provided: The hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe computers, for example, IBM® zSeries® systems; servers based on the RISC (Reduced Instruction Set Computer) architecture, for example, IBM pSeries® systems; IBM xSeries® systems; IBM BladeCenter® systems; storage devices; networks and networking components. Examples of software components include network application server software, for example, IBM WebSphere® application server software; and database software, for example, IBM DB2® database software. (IBM, zSeries, pSeries, xSeries, BladeCenter, WebSphere, and DB2 are trademarks of International Business Machines Corporation in the U.S., other countries, or both.)

[0043] The virtualization layer 62 provides an abstraction layer from which the following example virtual entities may be provided: virtual servers; virtual storage; virtual networks, including virtual private networks; virtual applications; and virtual clients.

[0044] The management layer 64 provides the exemplary functions described below. Resource provisioning provides dynamic procurement of computing resources and other resources used to perform tasks in the cloud computing environment. Metering and pricing provides cost tracking when resources are used in the cloud computing environment and billing for the use of these resources. In one example, these resources may include application software licenses. Security provides identity verification for users and tasks, as well as protection for data and other resources. The user portal provides access to the cloud computing environment for both users and system administrators.Service level agreement (SLA) management provides allocation and management of cloud computing resources so that service level requirements are met. Service level agreement (SLA) planning and fulfillment provides preparation for and procurement of cloud computing resources for which future demand is anticipated according to an SLA.

[0045] The workloads layer 66 provides functionality for which the cloud computing environment is used. Examples of workloads and functions that can be provided by this layer include: mapping and navigation; software development and lifecycle management; educational virtual classrooms; data analytics processing; transaction processing; and dynamic access control.

[0046] In general, the dynamic access control functionality of the workload layer 66 performs the functions of the present invention as described herein in connection with the Fig. 4 to 5. As mentioned above, the present invention provides a system that retrieves documents from non-hierarchical (one-to-one or one-to-many) data transmission media (e.g., cloud computing) and stores the documents in a central and widely accessible electronic repository. The present invention can replace the document with a link to this central document storage, transmit this link to both the sender and the recipient, and, most importantly, create an access control list for the now-secured document based on the addresses of the recipients and the sender to ensure a suitable means of authorization for the message and / or the attached document. The sender is then able to manage the access control list for the document—regardless of where the document was sent.The recipient can prove his identity to the storage, which can be based on his address (or any other unique identifier, such as a private key, a passcode, etc.).

[0047] If any of the people on the recipient list have never used the system before, the central repository would automatically generate a password, which would be transmitted as a separate data transfer. Users whose identities have been verified to the document repository would have centralized access to all documents transferred to them. The process also enables the creation of central document repositories to improve version control and storage.

[0048] The present invention may be implemented by using an agent or other code that performs automatic ACL updates and document metadata conversion. Use cases

[0049] According to these concepts, the following illustrative use cases can be carried out below: A service is created that provides database management functionality (creation, deletion, and editing of entries) and access control management functionality, including user ID generation, password management, user and password verification, and password management (creation, reset, and modification). An agent captures data transfers and removes documents from the data transfer, replacing them with a pointer to an entry in the service. (1) Sending an email with an embedded document to multiple recipients

[0050] An email containing a document is sent. The server agent processes the email, creates an entry in the service with an access control list based on the recipient and sender. The agent then removes each document and replaces the message with a hyperlink to each associated entry in the service.

[0051] The email size is reduced by removing all attachments, and network traffic is reduced outside of the client / server data transfer process based on the document stored in a central repository. The sender of the document has control over the recipients of the document to provide the permission verification and authorization services offered by the ACL.

[0052] The present invention results in more efficient and effective use of memory and bandwidth, increased document security, and the ability to dynamically modify the document by the owner, while recipients of the document have access to the latest version. The processing engine is shifted to the server agent to provide the necessary control over the document. (2) Forwarding an email that has passed the process to several different recipients

[0053] The agent detects that the email contains a pointer to an entry in the service and automatically updates the entry's access control list to include the email recipient. The additions to the entry's access control list can be managed by the entry owner and the sender of the email.

[0054] The size of the email is reduced, network traffic is reduced, the owner of the entry can monitor to whom the document has been transferred, and the sender of the forwarded email can manage subsequent access to the document for the subset of users to whom the email was forwarded. (3) Document sent to recipient via instant message

[0055] As instant messaging potentially becomes more important as a form of electronic data transmission, there may be a desire and need for document sharing through this medium. The application of the present invention may enable efficient and powerful document distribution to members of an instant messaging community.

[0056] The document doesn't necessarily have to be stored locally, and network bandwidth can be saved because only recipients who need to view the material need access to the entry. The document's access control lists can allow the entry owner to determine who has access based on the access control lists. Version control of the document would remain up-to-date through the use of a central repository. (4) Version control of distributed documents

[0057] The owner of the entry can edit the content of the entry. The database can store a change log of document changes in the entry based on a unique identifier, allowing the most recent version of the document to be available to those in the access control list. The access control list and an effective timestamp can still allow previous versions of the document (referenced in specific data transfer operations) to be viewed.

[0058] If the recipient may need to update the document, the server agent can create additional copies of the file based on the unique identifier. This allows additional users to make changes to the original file based on a specific set of parameters under which the original file was transmitted. Based on certain criteria, editing or modification of the original file can be limited depending on how similar the file is to its original content. Once the file has been updated or edited in any way, the server agent can transmit another electronic message to all recipients notifying them of the new change.

[0059] According to the invention, metadata is inserted into the file or file name to easily identify changes and perform version control of the file. This enables better control of changes and improved collaboration between team members who may need access to the same document. According to the invention, change control must be performed based on the system used by all parties, for example, the same forms of electronic data transmission, instant messaging, or non-hierarchical file sharing. (5) Time Sensitivity

[0060] Regarding time sensitivity and document sharing, central ACL services must ensure that the central repository only permits access to or modifications to the file based on specific time criteria. This may include considering different time zones, work schedules, and capabilities for monitoring timestamp tampering to ensure the system is not exploited. (6) Cloud computing

[0061] Given the relative anonymity of cloud computing, the need to manage document security and sharing is paramount due to the relative lack of transparency regarding where documents might be sent depending on the availability of the cloud infrastructure. Using the central ACL service, or perhaps a specialized service, particularly for highly granular authorization and access to specific documents, the central repository for managing these documents could address any lack of security within the cloud, as long as the central ACL or a set of security services is aware of the various endpoints, and clients do not need to be secured as part of the document management system.

[0062] This system is based on at least two parts: 1. A client- or server-based agent automatically generates an access control list and an entry in a database. The agent can run on a client mail or messaging system or on a mail or messaging server. 2. A service that provides the display of entries in a database to users and the ability to manage user IDs, passwords, access control lists, and the contents of entries.

[0063] With reference to Fig. 4 a logical or process flow diagram is used to better describe the functions listed below.

[0064] Agent and service function when a document is found in the data transfer process flow: An agent 70 captures an electronic data transmission (for example, an email or instant message, hereinafter referred to as a “data transmission”) that contains a document (for example, an attached document).

[0065] For each document included in the data transmission, an entry 72 is created in the service for storage in an entry database 76. Ownership of the entry and an access control list 74 for the entry are assigned to the sender of the data transmission.

[0066] For entry 72, an access control list 74 containing the user IDs is generated based on the list of recipient destination addresses, and the sender address is stored in an access control database 78. The user IDs are the recipient destination and sender source addresses.

[0067] The user IDs are either (1) verified (in the case of recognized user IDs) or (2) generated ("new" user ID) in the service. For generated user IDs: • An automatic password is generated for these “new” email addresses. • A data transmission is sent to each "new" user ID on the access control list, containing the user ID and automatically generated password, along with details on how to change that password and verify the email account and user ID for future access to the server. In each case, user IDs are stored and / or retrieved from the user database 80.

[0068] The document contained in the data transfer is removed / extracted, stored in a document database 82, and replaced by a reference pointer (e.g., an electronic link) generated in the service. This electronic link "points" to the storage location of the document in the document database 82 and / or to the entry 72 in the entry database 76.

[0069] Recipients of the data transfer may access the document by referring to this pointer, confirming their membership in the access control list by entering their user ID and password in the service.

[0070] Agent and service function when a pointer to a service is found in the data transfer process: A mail containing a pointer to an entry 72 in the service is forwarded to a new group of recipients.

[0071] The recipients of this new mail will be added to the access control list 74 of the entry 72 in the server if the entry 72 in the server (e.g. computer system / server 12 of Fig. 1) is not “secured”.

[0072] The verification and generation of a user ID takes place according to the process outlined above.

[0073] The owner of entry 72 in the server is notified by email of a change to the access control list.

[0074] The owner of entry 72 in the server can manage the access control list of the entry in the server according to the process described below.

[0075] The sender of the forwarded mail can manage the subset of this additional access control list 74 according to the process described below.

[0076] According to these concepts, the following functionality can be provided: Sharing an entry generated by the process with others

[0077] The access control list for the service entry can be updated according to the process described above. A new mail or data transmission with reference to the service entry pointer can be transmitted separately to multiple recipients without requiring forwarding of the initial data transmission mechanism (mail or instant message) and independently of the automatic generation of user IDs and access control lists. Managing user IDs in the service

[0078] User ID registration and the ability to manage that user ID with a password are open. User ID management would include the ability to register a "destination" or "source" address, typically an email address, and generate a user ID equal to that address.

[0079] Password management is available for the user ID: • Generate a password for new user IDs in the service. • Resetting a password for a user ID in the service by sending an automatically generated password to the address. • Change a password for a user ID by entering an existing password and a new password. • Manage the access control list for the service entry.

[0080] The owner of the entry in the service can edit the entire access control list for the entry and add and remove user IDs from the entry's access control list. Access control lists can be set to "secure" so that they only contain the user IDs created for the entry and user IDs added or modified by the entry owner. When an entry is distributed by an access control list member, that member can manage the subset of user IDs referenced in that distribution. The subset can also be managed by the entry owner. Managing the content of the entry in the server

[0081] The owner of the entry in the service can edit the entry in the service, providing an updated document. The service would maintain a change log of the various versions of the document to allow users to determine which version of the document was referenced in a specific data transfer operation.

[0082] With reference to Fig. 5 shows a method flow diagram according to the present invention. In step S1, an electronic data transmission with a document (e.g., attached) is received. In step S2, the document is removed from the electronic data transmission. In step S3, the document is stored in a document database and a reference to it is provided. In step S4, an access control list is generated for the attached stored document, the access control list identifying a sender and a group of initial recipients of the electronic data transmission. In step S5, it is determined whether a user attempting to access the document is authorized to do so (based on the access control list). If not, access is denied in step S6. If so, access is permitted in step S7 via an electronic reference, e.g., a link.

[0083] Although shown and described herein as a dynamic access control solution, it is understood that the present invention also provides various alternative embodiments. For example, in one embodiment, the present invention provides a computer-readable / computer-usable medium containing computer program code for enabling a computer infrastructure to provide dynamic access control functionality as discussed herein. As such, the computer-readable / computer-usable medium contains program code that performs each of the various processes of the present invention. It is understood that the terms computer-readable medium or computer-usable medium encompass one or more of any type of physical embodiment of the program code.In particular, the computer-readable / computer-usable medium may comprise program code embodied in one or more portable storage fabrications (e.g., a compact disk, a magnetic disk, a tape, etc.), in one or more data storage portions of a data processing device, for example, a memory 28 (. Fig. 1) and / or a storage system 34 ( Fig. 1) (e.g., a hard disk, a read-only memory, a random access memory, a cache memory, etc.) and / or as a data signal (e.g., a transmitted signal) that is conveyed over a network (e.g., during wired / wireless electronic distribution of the program code).

[0084] In another embodiment, the present invention provides a method that performs the process of the present invention based on a subscription, an advertisement, and / or a fee. That is, a service provider, such as a solution integrator, could offer to provide dynamic access control. In this case, the service provider may provide a computer infrastructure, such as a computer system 12 ( Fig. 1), generate, manage, support, etc., that performs the process of the present invention for one or more customers. In return, the service provider may receive payment from the customer(s) under a subscription and / or fee agreement, and / or the service provider may receive payment from the sale of advertising content to one or more third parties.

[0085] In yet another embodiment, the present invention provides a computer-implemented method for providing dynamic access control functionality. In this case, a computer infrastructure, for example, a computer system 12 ( Fig. 1), and one or more systems for carrying out the process of the present invention may be obtained (e.g., created, delivered, used, modified, etc.) and deployed in the computer infrastructure. To this extent, deployment of a system may include one or more of the following: (1) Installing program code from a computer-readable medium in a data processing device, such as a computer system 12 ( Fig.1); (2) adding one or more data processing units to the computer infrastructure; and (3) incorporating and / or modifying one or more existing systems of the computer infrastructure to enable it to carry out the process of the present invention.

[0086] When used herein, the terms "program code" and "computer program code" are to be understood as synonymous and mean any expression in any language, code, or notation of a set of instructions intended to cause a data processing device with information processing capability to perform a particular function directly or after one or both of the following operations: (a) translation into another language, code, or notation; and / or (b) representation in another material form. As such, program code may be embodied in one or more of the following forms: an application / software program, component software / a library of functions, an operating system, a base unit system / driver for a particular data processing device, and the like.

[0087] A data processing system suitable for storing and / or executing program code may be provided hereunder and may include at least one processor connected directly or indirectly to one or more storage elements by a system bus for data exchange. The storage elements may include, but are not limited to, local memory used during actual execution of the program code, mass storage, and cache memory providing temporary storage of at least one program code to reduce the number of times the code must be retrieved from mass storage during execution. One or more input / output devices (including, but not limited to, keyboards, displays, pointing devices, etc.) may be connected to the system directly or through intervening control units.

[0088] Additionally, network adapters may be connected to the system to enable the data processing system to be connected to other data processing systems, remote printers, storage devices, and the like through any combination of intervening private or public networks. Illustrative network adapters include, but are not limited to, modems, cable modems, and Ethernet cards.

[0089] The foregoing description of various aspects of the present invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the present invention to the precise form disclosed, and obviously many modifications and changes are possible. Such modifications and changes, which may be obvious to those skilled in the art, are intended to be within the scope of the present invention as defined by the accompanying claims.

Claims

[1] A method for providing dynamic access control for documents in electronic data transfer operations in a cloud computing environment, the method comprising: Receiving an electronic data transmission in the cloud computing environment, wherein the electronic data transmission includes a document; Removing the document from the electronic data transmission; Saving the document in a document database; Adding a pointer to an entry in the document database in which the document is stored to the electronic data transmission; Creating an access control list for the document upon storage, the access control list identifying a sender and a group of initial recipients of the electronic data transmission by a set of addresses of the sender and the group of initial recipients, the set of addresses being used to authorise access to the document in the document database; and Controlling access to the document in the document database based on the access control list, the method further comprising: dynamically updating the access control list so that it contains a group of forwarded recipients based on a forwarding of the electronic message by at least one of the group of initial recipients, provided that the electronic message contains a pointer to an entry in the document database and where, by means of a server agent, metadata is inserted into the file or file name to easily identify changes and perform version control of the file and where the change control is performed on the basis of the system used by all parties, i.e. the same forms of electronic data transmission, instant messaging or non-hierarchical file sharing. [2] The method of claim 1, further comprising providing a reference to the document when it is stored in the repository. [3] The method of claim 2, wherein the reference comprises an electronic link. [4] A method according to claim 2 or claim 3, further comprising: replacing the document with the electronic link. [5] A method according to any preceding claim, further comprising enabling the access control list to be managed by the sender of the electronic data transmission. [6] A method according to any preceding claim, wherein the electronic data transmission is an email message. [7] A method according to any preceding claim, wherein the method comprises a cloud service configured to operate in conjunction with an electronic messaging application. [8] A method according to any preceding claim, wherein the access control list identifies an address of the sender and an address of the recipient. [9] A method according to any preceding claim, wherein the recipient proves his identity to the document database. [10] A method according to any preceding claim, further comprising: Creating an entry associated with the document in a document database; and Allow the sender of the electronic data transmission to manage the entry. [11] A method according to any preceding claim, further comprising: Updating the document; and Saving data associated with the update when a change occurs. [12] A cloud computing system for providing dynamic access control for documents in electronic data transmission processes, comprising a storage medium comprising instructions and a bus connected to the storage medium; the system comprising: a processor connected to the bus, which, upon execution of the instructions, causes the cloud computer system to carry out a method according to one of the preceding method claims. [13] A computer program comprising computer program code stored on a computer-readable medium which, when loaded into and executed on a computer system, causes the computer system to carry out all the steps of a method according to any one of the preceding method claims. [14] A method for using a cloud service to provide dynamic access control for documents in electronic data transmission processes in a cloud computing environment, the method comprising: Providing a cloud computing infrastructure that is functionally capable of executing a method according to any one of the preceding method claims.

Images