Approach For Managing Access To Electronic Documents On Network Devices Using Document Analysis, Document Retention Policies And Document Security Policies

Abstract

An approach for managing access to electronic documents uses document retention and document security policies. In response to a request to access a particular electronic document, a document retention policy and a document security policy are applied to the particular electronic document. Deletion and/or access to the electronic document are managed based upon the document retention policy and the document security policy. A content analyzer automatically analyzes the content of electronic documents and determines one or more classifications that apply to the electronic documents. The content analyzer may be configured to use one or more of semantic analysis, text analysis, video analysis, voice analysis or image analysis to analyze electronic documents. A policy verifier is configured to check one or more classifications manually assigned to electronic documents by users against one or more classifications automatically determined for the electronic documents by the content analyzer and allow mismatches to be corrected.

What is claimed is: 
     
         1 . An apparatus for managing an electronic document on a network device, the apparatus comprising:
 one or more processors; and   one or more memories communicatively coupled to the one or more processors and storing instructions which, when processed by the one or more processors, cause:
 determining a document retention classification that corresponds to the electronic document; 
 determining, based upon one or more deletion criteria for the document retention classification; 
 determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document; 
 determining, based upon a current time and the expiration date determined for the electronic document, whether the electronic document is to be retained; 
 in response to determining, based upon a current time and the expiration data determined for the electronic document, that the electronic document is not to be retained, then causing the electronic document to be deleted; 
 in response to determining, based upon a current time and the expiration data determined for the electronic document, that the electronic document is to be retained, then:
 determining, based upon document security policy data, a document security classification that corresponds to the electronic document, 
 determining, based upon the document security classification that corresponds to the electronic document, whether a particular user is authorized to access the electronic document, 
 in response to determining, based upon the document security classification that corresponds to the electronic document, that the particular user is not authorized to access the electronic document, then preventing the user from accessing the electronic document via the network device. 
 
   
     
     
         2 . The apparatus as recited in  claim 1 , wherein determining, based upon document security policy data, a document security classification that corresponds to the electronic document includes using a content analyzer to determine a document security classification that corresponds to the electronic document. 
     
     
         3 . The apparatus as recited in  claim 1 , wherein:
 the one or more deletion criteria for the document retention classification specifies a retention length, and   determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document includes determining an expiration data for the electronic document based upon both a creation date for the electronic document and the retention length specified by the one or more deletion criteria for the document retention classification that corresponds to the electronic document.   
     
     
         4 . The apparatus as recited in  claim 1 , wherein the one or more memories store additional instructions which, when processed by the one or more processors, cause:
 attempting to obtain the one or more deletion criteria for the document retention classification from a document retention manager over one or more networks,   in response to the attempt to obtain the one or more deletion criteria for the document retention classification from a document retention manager over one or more networks being unsuccessful, then obtaining the one or more deletion criteria for the document retention classification from document retention policy data stored locally on the network device.   
     
     
         5 . The apparatus as recited in  claim 1 , wherein the one or more memories store additional instructions which, when processed by the one or more processors, cause:
 attempting to obtain the document security policy data from a document security management system over one or more networks,   in response to the attempt to obtain the document security policy data from a document security management system over one or more networks being unsuccessful, then obtaining the document security policy data from data stored locally on the network device.   
     
     
         6 . The apparatus as recited in  claim 1 , wherein determining, based upon the document security classification that corresponds to the electronic document, whether the user is authorized to access the electronic document includes generating and transmitting an authorization check to a personnel information system, wherein the authorization check includes data that at least identifies the particular user and the document security classification that corresponds to the electronic document. 
     
     
         7 . The apparatus as recited in  claim 1 , wherein preventing the user from accessing the electronic document via the network device includes causing the electronic document to be deleted from the network device. 
     
     
         8 . The apparatus as recited in  claim 1 , wherein determining a document retention classification that corresponds to the electronic document, determining, based upon one or more deletion criteria for the document retention classification, determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document, and determining, based upon a current time and the expiration date determined for the electronic document, whether the electronic document is to be retained are performed in response to a document retention manager performing an audit. 
     
     
         9 . The apparatus as recited in  claim 1 , wherein:
 the one or more memories store additional instructions which, when processed by the one or more processors, cause receiving a request for the particular user to access the electronic document on the network device, and   determining a document retention classification that corresponds to the electronic document, determining, based upon one or more deletion criteria for the document retention classification, determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document, and determining, based upon a current time and the expiration date determined for the electronic document, whether the electronic document is to be retained are performed in response to receiving the request for the particular user to access the electronic document on the network device.   
     
     
         10 . One or more non-transitory computer-readable media storing instructions which, when processed by one or more processors, cause:
 determining a document retention classification that corresponds to the electronic document;   determining, based upon one or more deletion criteria for the document retention classification;   determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document;   determining, based upon a current time and the expiration date determined for the electronic document, whether the electronic document is to be retained;   in response to determining, based upon a current time and the expiration data determined for the electronic document, that the electronic document is not to be retained, then causing the electronic document to be deleted;   in response to determining, based upon a current time and the expiration data determined for the electronic document, that the electronic document is to be retained, then:
 determining, based upon document security policy data, a document security classification that corresponds to the electronic document, 
 determining, based upon the document security classification that corresponds to the electronic document, whether a particular user is authorized to access the electronic document, 
 in response to determining, based upon the document security classification that corresponds to the electronic document, that the particular user is not authorized to access the electronic document, then preventing the user from accessing the electronic document via the network device. 
   
     
     
         11 . The one or more non-transitory computer-readable media as recited in  claim 10 , wherein determining, based upon document security policy data, a document security classification that corresponds to the electronic document includes using a content analyzer to determine a document security classification that corresponds to the electronic document. 
     
     
         12 . The one or more non-transitory computer-readable media as recited in  claim 10 , wherein:
 the one or more deletion criteria for the document retention classification specifies a retention length, and   determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document includes determining an expiration data for the electronic document based upon both a creation date for the electronic document and the retention length specified by the one or more deletion criteria for the document retention classification that corresponds to the electronic document.   
     
     
         13 . The one or more non-transitory computer-readable media as recited in  claim 10 , wherein the one or more memories store additional instructions which, when processed by the one or more processors, cause:
 attempting to obtain the one or more deletion criteria for the document retention classification from a document retention manager over one or more networks,   in response to the attempt to obtain the one or more deletion criteria for the document retention classification from a document retention manager over one or more networks being unsuccessful, then obtaining the one or more deletion criteria for the document retention classification from document retention policy data stored locally on the network device.   
     
     
         14 . The one or more non-transitory computer-readable media as recited in  claim 10 , wherein the one or more memories store additional instructions which, when processed by the one or more processors, cause:
 attempting to obtain the document security policy data from a document security management system over one or more networks,   in response to the attempt to obtain the document security policy data from a document security management system over one or more networks being unsuccessful, then obtaining the document security policy data from data stored locally on the network device.   
     
     
         15 . The one or more non-transitory computer-readable media as recited in  claim 10 , wherein determining, based upon the document security classification that corresponds to the electronic document, whether the user is authorized to access the electronic document includes generating and transmitting an authorization check to a personnel information system, wherein the authorization check includes data that at least identifies the particular user and the document security classification that corresponds to the electronic document. 
     
     
         16 . The one or more non-transitory computer-readable media as recited in  claim 10 , wherein preventing the user from accessing the electronic document via the network device includes causing the electronic document to be deleted from the network device. 
     
     
         17 . The one or more non-transitory computer-readable media as recited in  claim 10 , wherein determining a document retention classification that corresponds to the electronic document, determining, based upon one or more deletion criteria for the document retention classification, determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document, and determining, based upon a current time and the expiration date determined for the electronic document, whether the electronic document is to be retained are performed in response to a document retention manager performing an audit. 
     
     
         18 . The one or more non-transitory computer-readable media as recited in  claim 10 , wherein:
 the one or more memories store additional instructions which, when processed by the one or more processors, cause receiving a request for the particular user to access the electronic document on the network device, and   determining a document retention classification that corresponds to the electronic document, determining, based upon one or more deletion criteria for the document retention classification, determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document, and determining, based upon a current time and the expiration date determined for the electronic document, whether the electronic document is to be retained are performed in response to receiving the request for the particular user to access the electronic document on the network device.   
     
     
         19 . A computer-implemented method comprising:
 determining a document retention classification that corresponds to the electronic document;   determining, based upon one or more deletion criteria for the document retention classification;   determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document;   determining, based upon a current time and the expiration date determined for the electronic document, whether the electronic document is to be retained;   in response to determining, based upon a current time and the expiration data determined for the electronic document, that the electronic document is not to be retained, then causing the electronic document to be deleted;   in response to determining, based upon a current time and the expiration data determined for the electronic document, that the electronic document is to be retained, then:
 determining, based upon document security policy data, a document security classification that corresponds to the electronic document, 
 determining, based upon the document security classification that corresponds to the electronic document, whether a particular user is authorized to access the electronic document, 
 in response to determining, based upon the document security classification that corresponds to the electronic document, that the particular user is not authorized to access the electronic document, then preventing the user from accessing the electronic document via the network device. 
   
     
     
         20 . The computer-implemented method as recited in  claim 19 , wherein:
 the one or more deletion criteria for the document retention classification specifies a retention length, and   determining, based upon the one or more deletion criteria for the electronic document, an expiration date for the electronic document includes determining an expiration data for the electronic document based upon both a creation date for the electronic document and the retention length specified by the one or more deletion criteria for the document retention classification that corresponds to the electronic document.