# US 10,121,018 B2 · Secure data synchronization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,121,018 B2 - Document ID: US10121018B2 - Status: Granted - Kind: B2 - Application number: 15/210,112 - Filed: 2016-07-14 - Published: 2016-11-03 - Granted: 2018-11-06 - Earliest claimed: 2011-09-12 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Matthew Z. Tamayo-Rios; Saurav Sinha; Ruslan Ovechkin; Gopinathan Kannan; Vijay G. Bharadwaj; Christopher R. Macaulay; Eric Fleischman; Nathan J. Ide; Kun Liu - Web page: https://patentgrep.com/patent/US10121018B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/44: Program or device authentication - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/6272: {by registering files or documents with a third party} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - G06F 2221/2107: File encryption - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for secure data synchronization are described. In one or more implementations, a determination is made as to whether enterprise data is stored locally on a first device corresponding to an enterprise device. Based on a determination that the second device is a non-enterprise device, a determination is made as to whether a permission associated with the first device indicates that the first device is permitted to propagate the enterprise data to non-enterprise devices. If the first device lacks permission to propagate the enterprise data to non-enterprise devices, the enterprise data is prevented from being propagated to the second device. ## Claims ### Claim 1 A method comprising: determining that enterprise data is stored locally on a first device, the first device corresponding to an enterprise device based on an association with at least one enterprise policy or permission; receiving a request to propagate the enterprise data from the first device to a second device; determining whether the second device is an enterprise device or a non-enterprise device; based at least on a determination that the second device is a non-enterprise device based on a lack of the association with at least one enterprise policy or permission, determining whether a propagation permission associated with the first device indicates that the first device is permitted to propagate the enterprise data to non-enterprise devices; and based at least on a determination that the first device lacks permission to propagate the enterprise data to a non-enterprise device, preventing the enterprise data from being propagated from the first device to the second device. ### Claim 2 (depends on 1) The method as recited in claim 1, further comprising identifying the enterprise data based on at least one of a device type of the first device, a type of application that generates the enterprise data, or a nature of the enterprise data itself. ### Claim 3 (depends on 1) The method as recited in claim 1, wherein the propagation permission associated with the first device includes a data synchronization policy that indicates that the enterprise data is not to be propagated to a non-enterprise device. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein the propagation permission associated with the first device permits the enterprise data to be propagated to a particular non-enterprise device, wherein the first device has previously propagated other enterprise data to the particular non-enterprise device. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the permission associated with the first device permits the enterprise data to be propagated to a particular non-enterprise device, wherein the enterprise data includes a first type of data that is a same type as a second type of data that was previously transmitted from the first device to the particular non-enterprise device. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein the enterprise data includes one or more of business data or work-related data. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein the determination that the first device lacks permission to propagate the enterprise data to non-enterprise devices includes a determination that an additional permission associated with the enterprise data indicates that the enterprise data is not permitted to be propagated to non-enterprise devices. ### Claim 8 (depends on 1) The method as recited in claim 1, wherein propagation of the enterprise data is controlled based on a type of the enterprise data. ### Claim 9 (depends on 1) The method as recited in claim 1, wherein the propagation permission specifies a type of storage to which the enterprise data may be propagated. ### Claim 10 A system comprising: one or more processors; and one or more computer-readable hardware storage media storing computer-executable instructions which are executable by the one or more processors to cause the system to perform operations including: identifying an association of a first device with at least one enterprise policy or permission; determining that enterprise data is stored locally on the first device, the first device corresponding to an enterprise device based on the association with at least one enterprise policy or permission; receiving a request to propagate the enterprise data from the first device to a second device; determining whether the second device is an enterprise device or a non-enterprise device; based at least on a determination that the second device is a non-enterprise device made by identifying a lack of an association of the second device with at least one enterprise policy or permission, determining whether the enterprise data is permitted to be propagated to non-enterprise devices based on a propagation permission associated with one of the first device or the enterprise data; and based at least on the propagation permission indicating that the enterprise data is not to be propagated to a non-enterprise device, preventing the enterprise data from being propagated from the first device to the second device. ### Claim 11 (depends on 10) The system as recited in claim 10, wherein: the propagation permission is associated with the first device; and the propagation permission specifies that a particular type of data was previously transmitted from the non-enterprise device to the first device, wherein additional data of a same type as the particular type of data is permitted to be propagated from the first device to the non-enterprise device. ### Claim 12 (depends on 10) The system as recited in claim 10, wherein the operations further comprise identifying the enterprise data based on at least one of a device type of the first device, a type of application that generates the enterprise data, or a nature of the enterprise data itself. ### Claim 13 (depends on 10) The system as recited in claim 10, wherein the propagation permission specifies a type of storage to which the enterprise data is permitted to be propagated. ### Claim 14 (depends on 10) The system as recited in claim 10, wherein the propagation permission includes a data synchronization policy that indicates that the enterprise data is not to be propagated to the non-enterprise device. ### Claim 15 (depends on 10) The system as recited in claim 10, wherein propagation of the enterprise data is controlled based on a type of the enterprise data, the type including at least one sensitive personal data or sensitive work-related data. ### Claim 16 A method comprising: determining that enterprise data is stored locally on a device having an association with at least one enterprise policy or permission; ascertaining whether the enterprise data is permitted to be propagated to a different device based at least in part on whether the different device is an enterprise device or a non-enterprise device; and in an event that the different device is a non-enterprise device according to a lack of an association of the different device with at least one enterprise policy or permission, preventing the enterprise data from being propagated to the non-enterprise device unless a propagation permission associated with the device indicates that the enterprise data is permitted to be propagated to the non-enterprise device. ### Claim 17 (depends on 16) The method as recited in claim 16, further comprising identifying the enterprise data based on at least one of a device type of the device, a type of application that generates the enterprise data, or a nature of the enterprise data itself. ### Claim 18 (depends on 16) The method as recited in claim 16, wherein the propagation permission associated with the device includes a data synchronization policy that indicates that the enterprise data is not to be propagated to a non-enterprise device. ### Claim 19 (depends on 16) The method as recited in claim 16, wherein the propagation permission associated with the enterprise device indicates that the enterprise data is permitted to be propagated to the non-enterprise device based on an indication that the device has previously propagated other enterprise data to the non-enterprise device. ### Claim 20 (depends on 16) The method as recited in claim 16, wherein the propagation permission associated with the enterprise device indicates that the enterprise data is permitted to be propagated to the non-enterprise device based at least on the enterprise data including a first type of data that is a same type as a second type of data that was previously transmitted from the device to the non-enterprise device. ### Claim 21 A method comprising: determining that enterprise data is stored on an enterprise portion of a device, the enterprise portion of the device having an association with at least one enterprise policy or permission; receiving a request to propagate the enterprise data from the enterprise portion of the device to a non-enterprise portion of the device, the non-enterprise portion of the device lacking the association with at least one enterprise policy or permission; determining whether a propagation permission associated with the enterprise portion of the device indicates that the enterprise portion of the device is permitted to propagate the enterprise data to the non-enterprise portion of the device; and based at least on a determination that the enterprise portion of the device lacks permission to propagate the enterprise data to the non-enterprise portion of the device, preventing the enterprise data from being propagated from the enterprise portion of the device to the non-enterprise portion of the device.