Systems and methods for controlling email access

Patent metadata

Field	Value
Publication number	US-11050719-B2
Application number	US-202016868680-A
Country	US
Kind code	B2
Filing date	May 7, 2020
Priority date	Dec 6, 2012
Publication date	Jun 29, 2021
Grant date	Jun 29, 2021

Abstract

Embodiments of the disclosure relate to proxying one or more email resources in transit to the client devices from the email services, removing one or more email attachments from the email resources, and encoding the stripped email attachments based at least in part on one or more cryptographic keys.

First claim

The claimed invention is:

1. A method for controlling access to email attachments, comprising:
receiving, through a graphical user interface (GUI), a selection of a user group comprising a plurality of users;
receiving, through the GUI, a selection of a rule, wherein the rule comprises at least one of:
an encryption rule that requires encrypting at least one attachment to an email; and
a removal rule that requires removing at least one attachment to an email; and

enforcing the selected rule on the selected user group.

2. The method of claim 1 , wherein enforcing the selected rule is performed without interaction by a user sending the email.

3. The method of claim 1 , wherein the GUI enables selection of a storage location for the selected rule.

4. The method of claim 1 , wherein the GUI enables selection of an expiration date for the selected rule.

5. The method of claim 1 , further comprising:
enabling a selection of a first subgroup of users and a second subgroup of users, the first and second subgroups each comprising users of the plurality of users; and
receiving, through the GUI, a selection assigning the encryption rule to the first subgroup and assigning the removal rule to the second subgroup.

6. The method of claim 5 , wherein enforcing the selected rule comprises enforcing the encryption rule on the first subgroup and enforcing the removal rule on the second subgroup.

7. The method of claim 1 , wherein enforcing the encryption rule comprises encrypting the at least one email attachment with a cryptographic key accessible to an application separate from an email application used to send or retrieve the email.

8. A non-transitory, computer-readable medium comprising code that, when executed by a processor, causes the processor to perform stages for controlling access to email attachments, the stages comprising:
receiving, through a graphical user interface (GUI), a selection of a user group comprising a plurality of users;
receiving, through the GUI, a selection of a rule, wherein the rule comprises at least one of:
an encryption rule that requires encrypting at least one attachment to an email; and
a removal rule that requires removing at least one attachment to an email; and

enforcing the selected rule on the selected user group.

9. The non-transitory, computer-readable medium of claim 8 , wherein enforcing the selected rule is performed without interaction by a user sending the email.

10. The non-transitory, computer-readable medium of claim 8 , wherein the GUI enables selection of a storage location for the selected rule.

11. The non-transitory, computer-readable medium of claim 8 , wherein the GUI enables selection of an expiration date for the selected rule.

12. The non-transitory, computer-readable medium of claim 8 , the stages further comprising:
enabling a selection of a first subgroup of users and a second subgroup of users, the first and second subgroups each comprising users of the plurality of users; and
receiving, through the GUI, a selection assigning the encryption rule to the first subgroup and assigning the removal rule to the second subgroup.

13. The non-transitory, computer-readable medium of claim 12 , wherein enforcing the selected rule comprises enforcing the encryption rule on the first subgroup and enforcing the removal rule on the second subgroup.

14. The non-transitory, computer-readable medium of claim 8 , wherein enforcing the encryption rule comprises encrypting the at least one email attachment with a cryptographic key accessible to an application separate from an email application used to send or retrieve the email.

15. A system for controlling access to email attachments, comprising:
a processor that generates a graphical user interface (GUI) that enables selection of at least one rule to govern email access for a plurality of users; and
an access control server communicatively coupled to the processor and configured to receive selections provided through the GUI,
wherein the GUI receives a selection of a rule comprising at least one of:
an encryption rule that requires encrypting at least one attachment to an email; and
a removal rule that requires removing at least one attachment to an email; and

wherein the access control server enforces the selected rule on the selected user group.

16. The system of claim 15 , wherein enforcing the selected rule is performed without interaction by a user sending the email.

17. The system of claim 15 , wherein the GUI enables selection of a storage location for the selected rule.

18. The system of claim 15 , wherein the GUI:
enables a selection of a first subgroup of users and a second subgroup of users, the first and second subgroups each comprising users of the plurality of users; and
receives a selection assigning the encryption rule to the first subgroup and assigning the removal rule to the second subgroup.

19. The system of claim 18 , wherein enforcing the selected rule comprises enforcing the encryption rule on the first subgroup and enforcing the removal rule on the second subgroup.

20. The system of claim 19 , wherein enforcing the encryption rule comprises encrypting the at least one email attachment with a cryptographic key accessible to an application separate from an email application used to send or retrieve the email.

Assignees

• Airwatch Llc

Inventors

• Dabbiere Alan
• Stuntebeck Erich
• Brannon Jonathan Blake

Classifications

• H04L63/0435 Primary

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L51/08

  Annexed information, e.g. attachments · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0281

  Proxies · CPC title