WO 2007/038708

PCT/US2006/037960

PROCESSING ENCUMBERED ELECTRONIC COMMUNICATIONS
Inventors'
5 Max Christoff
Denis Khodak
Bedros Magardichian
Andrew Sherman
10 PRIORITY
This application claims priority to U.S. Provisional Patent Application
Ser. No. 60/720,873, entitled PROCESSING ENCRYPTED E-MAIL
COMMUNICATIONS, filed on September 27,2005, the entire disclosure of which is
hereby expressly incorporated by reference herein.
15 FIELD OF THE INVENTION
The present invention generally relates to analyzing and processing
information associated with electronic communications. The invention more particularly
relates to processing encrypted or password-protected e-mail communications and their
associated attachments.
20 BACKGROUND
Financial services firms, along with many other companies in regulated
industries, are subject to laws or regulations that require archival, supervisory review,
and searching of e-mail communications. Also, there are established business processes
that require the use of encrypted documents due to die sensitive nature of the content.

WO 2007/038708 PCT/US2006/037960
Various conventional technologies exist to allow parties to exchange e-
mails in encrypted form. These technologies include public key cryptography (PKI) and
Secure/Multipurpose Internet Mail Extensions (S/MIME), which require parties to
exchange keys or install certificates; "gateway" transport-layer security (TLS) solutions,
5 which typically require e-mail system administrators to make substantial modifications
to their e-mail systems; and, proprietary e-mail application plug-ins or web-based
interfaces, which usually require recipients to install new software to open documents
and e-mails, or to visit a web site to download the attachments. Participants in encrypted
e-mail communications may also use native password/encryption facilities available at
10 the time of document creation. These facilities may be found as tools within word
processing programs, spreadsheet programs, and charting/presentation programs, for
example.
The use of encryption or password protection, however, often creates
challenges for compliance with applicable laws or regulations that govern the processing
15 of e-mail communications. Compliance officers who need to browse archives, or
supervisors who need to review e-mails, can request that users supply passwords or
decrypted documents. When documents are needed by such officers or supervisors,
however, the users may no longer be employed by the firm, may have forgotten the
passwords, or may otherwise not wish to assist in the effort to search for or review
20 encrypted documents. In addition, firms may wish to monitor or investigate user e-mail
communications discreetly, and asking users for passwords can jeopardize the discreet
nature of such activity. Also, archive-wide searching of encrypted documents is usually
impossible, because search tools are typically unable to scan the content of such
documents.
2

WO 2007/038708 PCT/US2006/037960
In view of the foregoing issues and deficiencies, more efficient and
effective ways are required for processing and storing encrypted e-mail communications
and their attachments.
SUMMARY '
5 The invention includes, in various embodiments, a method for archiving
an electronic message which includes the steps of scanning the electronic message to
determine whether at least a portion of the message is encumbered, disencumbering the
encumbered portion of the message if it is encumbered, storing a copy of the
disencumbered electronic message, and transmitting the electronic message to a
10 recipient. Once stored, the disencumbered message can be accessed and reviewed by a
supervisor, for example, without having to request a password from the sender or
recipient. Encumbered messages include messages, or portions of messages, which are
password protected, encrypted, and/or otherwise structured to prohibit unauthorized
access thereto. Disencumbering such encumbered messages includes using any suitable
15 method, process, and/or apparatus for making the encumbered messages intelligible such
as, for example, using passwords to unlock password protected documents and/or using
cryptographic software to decipher encrypted documents.
The invention also includes, in various embodiments, a computer-
readable medium including computer-executable instructions thereon for scanning an
20 electronic message to determine whether at least a portion of the electronic message is
encumbered, the electronic message having a sender and a recipient, disencumbering the
encumbered portion of the electronic message if it is encumbered, storing a copy of the
electronic message in a disencumbered format; and transmitting the electronic message
to the recipient
3

WO 2007/038708 PCT7US2006/037960
The invention also includes, in various embodiments, a computer-assisted
system for archiving an electronic message comprising an encryption management
module for scanning an electronic message to determine whether at least a portion of the
electronic message is encumbered, the electronic message having a sender and a
5 recipient, disencumbering the encumbered portion of the electronic message if it is
encumbered, and transmitting the electronic message to the recipient; and an electronic
archive for storing a copy of the electronic message in a disencumbered format.
The invention also includes, in various embodiments, a microprocessor
including computer-executable instructions thereon for scanning an electronic message
10 to determine whether at least a portion of the electronic message is encumbered, the
electronic message having a sender and a recipient, disencumbering the encumbered
portion of the electronic message if it is encumbered, storing a copy of the electronic
message in a disencumbered format, and transmitting the electronic message to the
recipient.
15 BRIEF DESCRIPTION OF THE FIGURES
The utility of the embodiments of the invention will be readily
appreciated and understood from consideration of the following description of the
embodiments of the invention when viewed in connection with the accompanying
drawings, wherein:
20 Figure 1 includes a sample architecture diagram illustrating various
examples of system embodiments provided in association with the invention;
Figure 2 includes a sample process flow diagram illustrating an example
of a method or process embodiment provided in association with the invention; and,
4

WO 2007/038708 PCT/US2006/037960
Figure 3 includes a sample process flow diagram illustrating an example
of an alternative method or process embodiment provided in association with the
invention.
Corresponding reference characters indicate corresponding parts
5 throughout the several views. The exemplification set out herein illustrates preferred
embodiments of the invention, in various forms, and such exemplifications are not to be
construed as limiting the scope of the invention in any manner.
DESCRIPTION
Embodiments of the invention allow users to send or receive e-mails with
10 encrypted attachments while preserving copies of the e-mails with attachments in an
unencrypted form for supervisory review and/or archival purposes. As discussed below,
attachments can be sent in their native form (e.g., as a word processing document, a
spreadsheet, or a presentation) without requiring substantial change in the behavior of
recipients and without requiring new software installation by e-mail recipients. For
15 example, recipients may continue to open password-protected documents in standard
word processing, spreadsheet, and presentation programs and use those programs to enter
passwords, rather than learning a new system, launching a different program, visiting a
web-based service, and so forth.
Referring now to Figures 1 and 2, an encryption management module 102
20 may be operatively associated with, and/or reside within, an e-mail application 104 that
can be employed by one or more users in a firm 106. The e-mail application 104 may be
a conventional e-mail system such as a "Microsoft Outlook" e-mail program, for
example. At step 202, a user attempts to send an e-mail using the e-mail application 104.
At step 204, the module 102 may scan the e-mail for attachments. If it is determined at
25 step 206 that attachments have been found in the e-mail in a known document format
5

WO 2007/038708 PCT/US2006/037960
(e.g., a known word processing program ("Word"), a known spreadsheet program
("Excel"), or a known presentation program ("PowerPoint"), etc.), then the discovered
attachments may be checked at step 208 for native document encryption or password
protection. Native document password protection refers to the use of password facilities
5 that are part of the same application (e.g., word processing application, spreadsheet
application, or presentation application) that created the document.
If it is determined at step 206 that the attachments in the e-mail are in an
unrecognized document format, then module 102 can be configured to allow the e-mail
to be sent without checking for encryption at step 208. If it is determined at step 206 that
10 only some or less than all of the attachments are in a known document format, then those
attachments may be checked at step 208 for native document encryption or password
protection as discussed in further detail below. In at least one embodiment, the module
102 may attach an identifier onto e-mails sent having attachments with unrecognized
document formats. In this embodiment, a supervisor or other employee of the firm 106,
15 for example, may review such identified e-mails and determine whether further
investigation is necessary.
If it is discovered at step 208 that encryption has been used on an attached
document or that the opening of the document is otherwise encumbered by a password,
the module 102 can be configured to prompt the user at step 210 for the document
20 password. The user may then supply the password as requested at step 212. The module
102 may then employ the user-supplied password (if correct as determined at step 214)
to generate a decrypted, or unencumbered, version of the document at step 216. If the
user supplies the incorrect password as determined at step 214, then the module 102 can
be configured to detect this condition and prompt the user one or more additional times
25 at step 210 until the correct password is supplied. If the password is correct, then the
6

WO 2007/038708 PCTYUS2006/037960
module 102 can be configured to allow the e-mail to be sent at step 218, with the
attachments in their original password-protected format, to the recipients listed on the e-
mail as communicated at step 202. At step 220, the module 102 may store one or more
additional copies of the decrypted e-mail and its associated attachments for storage in an
5 e-mail archival / supervisory system 108 of the firm 106. Thus, the stored additional
copies of the e-mail and attachments may include the decrypted or unencumbered
versions of the e-mail and its attached documents.
In various embodiments, the module 102 may set a property in the
decrypted e-mail or documents using a unique correlation identifier to allow the different
10 e-mails (i.e., the encrypted version and the decrypted/unencumbered version) to be
associated with each other in the e-mail archival / supervisory system 108 for future
reference. For example, a code can be generated including alphabetical and/or numerical
characters. This code can be randomly generated and/or the code can be compiled from
information from the electronic message. For example, the code can be generated from
15 the date and time that the message was identified, the sender's computer address, the
name of the encryption management module, and/or a global unique identifier (GUID)
generated by the electronic message software. Furthermore, the code can include a
character, for example, that indicates whether the stored message is either encrypted or
unencrypted. In these embodiments, the codes in the encumbered version and the
20 unencumbered version of the electronic message can be identical but for this character.
In at least one embodiment, the code can be inserted into a header of the electronic
message so that the code can be easily reviewed by the archival system.
In addition, referring to Fig. 3, embodiments of the module 102 may be
applied, at step 302, to e-mails received by users at the firm 106 through one or more
25 external e-mail communication channels 110. When a user at the firm 106 attempts to
7

WO 2007/038708 PC1YUS2006/037960
open an attachment protected by a native document password, for example, the act of
opening the e-mail may be intercepted by the module 102. Similar to the above, at step
304, the module 102 may scan the e-mail for encumbered documents and assess whether
the documents are in a recognized document format At step 307, if the documents are in
5 an unrecognized format, the documents, and/or e-mail containing the documents, may be
stored for review by a supervisor, for example. At step 318, if the documents are in a
recognized format and are unencumbered, the module 102 may permit the user to open
the unencumbered documents and store a copy of the same in the archival system 108.
At step 310, if the documents are encumbered, the module 102 may prompt the user to
10 supply the correct password, for example. At step 314, if the user does not supply the
correct password, the module 102 may re-prompt the user for me correct password until
it is supplied at step 312. In various embodiments, the sender and/or the recipient of the
e-mail can be prompted for the password.
At step 316, the password may then be used to generate an
15 unencumbered/decrypted copy of the document to be sent to and stored within the e-mail
archival / supervisory system 108 at step 318. In addition, a copy of the encumbered
documents, or the e-mail having the encumbered documents, may also be sent to and
stored within the e-mail archival system 108 at step 320. Also, embodiments of the
invention permit integration not just with e-mail programs, but also with other
20 communications channels 110 that allow sending of documents via other forms of
electronic messages, such as instant messaging or web-based conferencing, for example.
The inventors have recognized that conventional encryption systems do
not address die problem of native document passwords/encryption as it relates to archival
and/or supervisory review needs. For example, many word processing programs allow
25 users to set document passwords to prevent unauthorized users from opening the
8
t

WO 2007/038708 PCT/US2006/037960
documents. When a user chooses to use a native document password, however, and
without application of the features of the present invention, the document cannot be read
or searched in the e-mail archival / supervisory system 108. Conventional e-mail
encryption systems merely add their own encryption to a document that is already
5 password-protected and are not capable of preventing users from sending e-mails with
attachments that have native document password protection.
Therefore, embodiments of the present invention allow users to send e-
mails with encrypted documents while promoting firm compliance with regulations or
laws concerning archival, supervisory review, and discovery of e-mail communications.
10 Furthermore, aspects of the invention require little or no behavioral modification on the
part of recipients. Also, those skilled in the art will appreciate that the present invention
permits storage of e-mail communications and associated attachments in an unencrypted,
searchable format within readily accessible e-mail archival / supervisory systems.
The examples presented herein are intended to illustrate potential and
15 specific implementations of the present invention. It can be appreciated that the
examples are intended primarily for purposes of illustration of the invention for those
skilled in the art. No particular aspect or aspects of the examples is/are intended to limit
the scope of the present invention.
It is to be understood that the figures and descriptions of the present
20 invention have been simplified to illustrate elements that are relevant for a clear
understanding of the present invention, while eliminating, for purposes of clarity, other
elements. For example, certain operating system details and modules of network
platforms are not described herein. Those of ordinary skill in the art will recognize,
however, that these and other elements may be desirable in a typical computer system or
25 e-mail application, for example. However, because such elements are well known in the
9

WO 2007/038708 PCT/US2006/037960
art and because they do not facilitate a better understanding of the present invention, a
discussion of such elements is not provided herein.
Any element expressed herein as a means for performing a specified
function is intended to encompass any way of performing that function including, for
5 example, a combination of elements that perform that function. Furthermore the
invention, as defined by such means-plus-function claims, resides in the fact that the
functionalities provided by the various recited means are combined and brought together
in a manner as defined by the appended claims. Therefore, any means that can provide
such functionalities may be considered equivalents to the means shown herein.
10 In general, it will be apparent to one of ordinary skill in the art that at least
some of the embodiments described herein may be implemented in many different
embodiments of software, firmware, and/or hardware. The software code or specialized
control hardware which may be used to implement embodiments of the invention is not
limiting. For example, embodiments described herein may be implemented in computer
15 software using any suitable computer software language type such as, for example, C or
C++ using, for example, conventional or object-oriented techniques. Such software may
be stored on any type of suitable computer-readable medium or media such as, for
example, a magnetic or optical storage medium. The operation and behavior of the
invention embodiments maybe described without specific reference to specific software
20 code or specialized hardware components. The absence of such specific references is
feasible, because it is clearly understood that artisans of ordinary skill would be able to
design software and control hardware to implement the embodiments of the present
invention based on the present description with no more than reasonable effort and
without undue experimentation.
10

WO 2007/038708 PCT/US2006/037960
Moreover, the processes associated with the present embodiments may be
executed by programmable equipment, such as computers or computer systems.
Software that may cause programmable equipment to execute processes may be stored in
any storage device, such as, for example, a computer system (non-volatile) memory, an
5 optical disk, magnetic tape, or magnetic disk. Furthermore, at least some of the
processes may be programmed when the computer system is manufactured or stored on
various types of computer-readable media. Such media may include any of the forms
listed above with respect to storage devices and/or, for example, a carrier wave
modulated, or otherwise manipulated, to convey instructions that may be read,
10 demodulated/decoded, or executed by a computer or computer system.
It can also be appreciated that certain process aspects described herein
may be performed using instructions stored on a computer-readable medium or media
that direct a computer system to perform the process steps. A computer-readable
medium may include, for example, memory devices such as diskettes, compact discs
15 (CDs), digital versatile discs (DVDs), optical disk drives, or hard disk drives. A
computer-readable medium may also include memory storage that is physical, virtual,
permanent, temporary, semi-permanent,, and/or semi-temporary. A computer-readable
medium may further include one or more data signals transmitted on one or more carrier
waves.
20 A "computer" or "computer system" may be, for example and without
limitation, a wireless or wireline variety of a microcomputer, microprocessor,
minicomputer, server, mainframe, laptop, personal data assistant (PDA), wireless e-mail
device (e.g., "BlackBerry" trade-designated devices), cellular phone, pager, processor,
fax machine, scanner, or any other programmable device configured to transmit and/or
25 receive data over a network. Computer systems and computer-based devices disclosed
11

WO 2007/038708 PCT/US2006/037960
herein may include memory for storing certain software applications used in obtaining,
processing and communicating information. It can be appreciated that such memory
may be internal or external with respect to operation of the disclosed embodiments. The
memory may also include any means for storing software, including a hard disk, an
5 optical disk, floppy disk, ROM (read only memory), RAM (random access memory),
PROM (programmable ROM), EEPROM (electrically erasable PROM), and/or other
computer-readable media.
In various embodiments of the present invention disclosed herein, a single
component may be replaced by multiple components, and multiple components may be
10 replaced by a single component, to perform a given function or functions. Except where
such substitution would not be operative, such substitution is within the scope of the
invention. Any servers described herein, for example, may be replaced by a "server
farm" or other grouping of networked servers that are located and configured for
cooperative functions. It can be appreciated that a server farm may serve to distribute
15 workload between/among individual components of the farm and may expedite
computing processes by harnessing the collective and cooperative power of multiple
servers. Such server farms may employ load-balancing software that accomplishes tasks
such as, for example, tracking demand for processing power from different machines,
prioritizing and scheduling tasks based on network demand, and/or providing backup
20 contingency in the event of component failure or reduction in operability.
While various embodiments of the invention have been described herein,
it should be apparent that various modifications, alterations and adaptations to those
embodiments may occur to persons skilled in the art with attainment of at least some of
the advantages of the present invention. The disclosed embodiments are therefore
12

WO 2007/038708 PCTYUS2006/037960
intended to include all such modifications, alterations and adaptations without departing
from the scope and spirit of the present invention as set forth in the attached claims.
13

WO 2007/038708 PCTYUS2006/037960
WHAT IS CLAIMED IS:
1. A computer-assisted method for archiving an electronic message, the method
comprising the steps of:
scanning said electronic message to determine whether at least a portion of said
electronic message is encumbered, said electronic message having a sender and a
recipient;
disencumbering said encumbered portion of said electronic message if it is
encumbered;
storing a copy of at least said disencumbered portion of said electronic message;
and
transmitting said electronic message to said recipient.
2. The method of Claim 1, further including storing a copy of said encumbered
electronic message.
3. The method of Claim 2, further including marking said stored copy of said
encumbered message and said stored copy of said disencumbered message with a
common identifier.
4. The method of Claim 1, wherein said disencumbering step includes:
prompting at least one of said sender or said recipient for a password; and
using said password to access said encumbered portion of said electronic
message.
14

WO 2007/038708 PCT/US2006/037960
5. The method of Claim 1, wherein said electronic message is an e-mail and said
encumbered portion is an attached file.
6. The method of Claim 1, wherein said encumbered portion is an attached file that
is encumbered by the computer application that created the attached file.
7. The method of Claim 1, wherein said storing step includes storing said copy of
said disencumbered message within an electronic message archive, and wherein said
disencumbered portion of said stored copy of said electronic message can be accessed
without requiring a password from said sender or said recipient after said message has
been stored.
8. A computer-readable medium comprising computer-executable instructions
thereon for:
scanning an electronic message to determine whether at least a portion of said
electronic message is encumbered, said electronic message having a sender and a
recipient;
disencumbering said encumbered portion of said electronic message if it is
encumbered;
storing a copy of at least said encumbered portion of said electronic message in a
disencumbered format; and
transmitting said electronic message to said recipient.
15

WO 2007/038708 PCTYUS2006/037960
9. The computer-readable medium of Claim 8, wherein said medium further
comprises computer-executable instructions thereon for storing a copy of said
encumbered electronic message.
10. The computer-readable medium of Claim 9, wherein said medium further
comprises computer-executable instructions thereon for marking said stored copy of said
encumbered message and said stored copy of said disencumbered message with a
common identifier.
11. The computer-readable medium of Claim 8, wherein said instructions for
disencumbering said electronic message include instructions for:
prompting at least one of said sender or said recipient for a password; and
using said password to access said encumbered portion of said electronic
message.
12. The computer-readable medium of Claim 8, wherein said electronic message is
an e-mail and said encumbered portion is an attached file.
13. The computer-readable medium of Claim 8, wherein said encumbered portion is
an attached file that is encumbered by the computer application that created the attached
file.
14. The computer-readable medium of Claim 8, wherein said instructions for storing
said copy of said disencumbered electronic message includes instructions for storing said
copy of said disencumbered electronic message within an electronic message archive
16

WO 2007/038708 PCT/US2006/037960
wherein said disencumbered portion of said stored copy of said electronic message can
be accessed without requiring a password from said sender or said recipient after said
message has been stored.
15. A computer-assisted system for archiving an electronic message, the system
comprising:
an encryption management module for:
scanning an electronic message to determine whether at least a portion of
said electronic message is encumbered, said electronic message having a sender and a
recipient;
disencumbering said encumbered portion of said electronic message if it
is encumbered;
transmitting said electronic message to said recipient; and
an electronic archive for storing a copy of said electronic message in a
disencumbered format.
16. The computer-assisted system of Claim 15, said electronic archive for further
storing a copy of said encumbered electronic message.
17. The computer-assisted system of Claim 16, said encryption management module
further marking said stored copy of said encumbered message and said stored copy of
said disencumbered message with a common identifier.
18. The computer-assisted system of Claim 15, said encryption management module
further: i
17

WO 2007/038708 PCT/US2006/037960
prompting at least one of said sender or said recipient for a password; and
using said password to access said encumbered portion of said electronic
message.
19. The computer-assisted system of Claim 15, wherein said electronic message is an
e-mail and said encumbered portion is an attached file.
20. The computer-assisted system of Claim 15, wherein said encumbered portion is
an attached file that is encumbered by the computer application that created the attached
file.
21. The computer-assisted system of Claim 15, wherein said disencumbered portion
of said stored copy of said electronic message can be accessed without requiring a
password from said sender or said recipient after said message has been stored.
18

The invention includes, in various embodiments, a method for archiving an electronic message which includes the
steps of scanning the electronic message to determine whether at least a portion of the message is encumbered, disencumbering the
encumbered portion of the message if it is encumbered, storing a copy of the disencumbered electronic message, and transmitting
the electronic message to a recipient Once stored, the disencumbered message can be accessed and reviewed by a supervisor, for
example, without having to request a password from the sender or recipient. Encumbered messages include messages, or portions
of messages, which are password protected, encrypted, and/or otherwise structured to prohibit unauthorized access thereto.