# US 10,313,394 B2 · Automated multi-level federation and enforcement of information management policies in a device network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,394 B2 - Document ID: US10313394B2 - Status: Granted - Kind: B2 - Application number: 15/072,684 - Filed: 2016-03-17 - Published: 2017-01-26 - Granted: 2019-06-04 - Earliest claimed: 2013-08-02 - Assignees: Cellsec, Inc. - Applicants: CellSec, Inc. - Inventors: David Goldschlag; Karl Ginter; Yoav Weiss; Michael Bartman - Web page: https://patentgrep.com/patent/US10313394B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, apparatus, systems, and non-transitory computer-readable media for managing a plurality of disparate computer application and data control policies on a computing device, especially a computing device connected to a computer network, are described. In one example, at least one policy distribution point is provided that includes least one policy distribution point including at least one information management policy. A plurality of policy enforcement points, including a first policy enforcement point operating at a first policy enforcement level, and a second enforcement point operating at second policy enforcement level, are also provided. A first policy element to the first policy enforcement point, and a second policy element to the second policy enforcement point, are allocated. A management compartment in computer memory in communication with said computing device including one or more computer applications, data, and metadata specified and controlled by the information management policy is also provided. ## Claims ### Claim 1 A method for managing a plurality of disparate computer application and data control policies on a computing device, comprising: receiving under electronic computer control in computer memory an electronic representation of at least one policy distribution point, said at least one policy distribution point including at least one information management policy containing policy information; receiving under electronic computer control in computer memory an electronic representation of a plurality of policy enforcement points, including a first policy enforcement point operating at first policy enforcement level, and a second policy enforcement point operating at second policy enforcement level, each of said plurality of policy enforcement points being in electronic communication with said at least one policy distribution point, and said second policy enforcement point being in electronic communication with at least one of said plurality of policy enforcement points; allocating under electronic computer control in computer memory an electronic representation of a first policy element to said first policy enforcement point, and a second policy element to said second policy enforcement point, at least one of said first and second policy enforcement points being configured to use said policy information to parameterize at least one policy-mandated information control enforced by said at least one of said first and second enforcement points; generating under electronic computer control an electronic representation of a management compartment in computer memory in communication with said computing device, said management compartment including electronic representations in computer memory of one or more computer applications, data, and metadata, said one or more computer applications, data, and metadata being specified and controlled by said at least one information management policy, and controlling the use or operation of said one or more computer applications, data, and metadata using said at least one information management policy under electronic computer control; and defining in computer memory an electronic representation of the management of said one or more computer applications, data, and metadata in said management compartment for any combination of a rest state, a motion state, or a use state. ### Claim 2 (depends on 1) The method of claim 1, further comprising defining in computer memory an electronic representation of the management of computer applications that access data or metadata contained in said management compartment. ### Claim 3 (depends on 1) The method of claim 1, further comprising defining in computer memory an electronic representation of the management of computer applications, data, and metadata contained within said management compartment. ### Claim 4 (depends on 1) The method of claim 1, further comprising defining in computer memory an electronic representation of the management of computer applications, data, and metadata contained in two or more different management compartments. ### Claim 5 (depends on 1) The Method Of claim 1, further comprising defining in computer memory an electronic representation of the management of computer applications, data, and metadata contained in two or more different instances of said management compartment. ### Claim 6 (depends on 1) The method of claim 1, further comprising distributing said at least one information management policy through said one or more policy distribution points. ### Claim 7 A system for managing a plurality of disparate computer application and data control policies on one or more computing devices, comprising: an electronic representation of at least one policy distribution point, said at least one policy distribution point comprising at least one information management policy containing policy information; an electronic representation of a plurality of policy enforcement points, including a first policy enforcement point operating at first policy enforcement level and enforcing at least a first policy element of said at least one information management policy, and a second policy enforcement point operating at second policy enforcement level and enforcing at least a second policy element of said at least one information management policy, each of said plurality of first policy enforcement points being in electronic communication with said at least one policy distribution point, and said second policy enforcement point being in electronic communication with at least one of said plurality of policy enforcement points, at least one of said first and second policy enforcement points being configured to use said policy information to parameterize at least one policy-mandated information control enforced by said at least one of said first and second enforcement points; and an electronic representation of a management compartment in computer memory in communication with said computing device, said management compartment including one or more computer applications, data, and metadata, said one or more computer applications, data, and metadata being specified and controlled by said at least one information management policy, and controlling the use or operation of said one or more computer applications, data, and metadata using said at least one information management policy under electronic computer control, wherein the management of said one or more computer applications, data, and metadata in said management compartment is defined for any combination of a rest state, a motion state, and a use state. ### Claim 8 (depends on 7) The system of claim 7, wherein said management compartment is configured to manage computer applications that access data or metadata contained in said management compartment. ### Claim 9 (depends on 8) The system of claim 8, wherein said management compartment is configured to manage computer applications, data, and metadata contained within said management compartment. ### Claim 10 (depends on 9) The system of claim 9, wherein said management compartment is configured to manage computer applications, data, and metadata contained in two or more different management compartments. ### Claim 11 (depends on 7) The system of claim 7, wherein said management compartment is configured to manage computer applications, data, and metadata contained within said management compartment. ### Claim 12 (depends on 7) The system of claim 7, wherein said management compartment is configured to manage computer applications, data, and metadata contained in two or more different management compartments. ### Claim 13 (depends on 7) The system of claim 7, further comprising defining the management of computer applications, data, and metadata contained in two or more different instances of said management compartment. ### Claim 14 (depends on 7) The system of claim 7, further comprising distributing said at least one information management policy through said one or more policy distribution points. ### Claim 15 A non-transitory computer readable medium containing a computer program product providing data and instructions configured to enable a computer to manage a plurality of disparate computer application and data control policies on at least one computing device, said computer program product comprising instructions to enable said computer to: establish and operate in computer memory an electronic representation of a plurality of policy enforcement points configured to receive at least one information management policy containing policy information provided by one or more policy distribution points, said policy enforcement points further including a first policy enforcement point operating at first policy enforcement level, and a second enforcement point operating at second policy enforcement level, said first policy element being allocated to said first policy enforcement point, and said second policy element being allocated to a second policy enforcement point, each of said plurality of policy enforcement points being in electronic communication with said at least one policy distribution point, and said second policy enforcement point being in electronic communication with at least one of said plurality of policy enforcement points, at least one of said first and second policy enforcement points being configured to use said policy information to parameterize at least one policy-mandated information control enforced by said at least one of said first and second enforcement points; establish and operate in computer memory an electronic representation of at least one management compartment in computer memory in communication with said computing device, said management compartment including one or more computer applications, data, and metadata, said one or more computer applications, data, and metadata being specified and controlled by said at least one information management policy, and controlling the use or operation of said one or more computer applications, data, and metadata using said at least one information management policy under electronic computer control; and define in computer memory an electronic representation of the management of said one or more computer applications, data, and metadata in said management compartment for any combination of a rest state, a motion state, and a use state. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, further comprising defining in computer memory an electronic representation of the management of computer applications that access data or metadata contained in said management compartment. ### Claim 17 (depends on 16) The non-transitory computer readable medium of claim 16, further comprising defining in computer memory an electronic representation of the management of computer applications, data, and metadata contained within said management compartment. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, further comprising defining in computer memory an electronic representation of the management of computer applications, data, and metadata contained two or more different management compartments. ### Claim 19 (depends on 15) The non-transitory computer readable medium of claim 15, further comprising defining in computer memory an electronic representation of the management of computer applications, data, and metadata contained within said management compartment. ### Claim 20 (depends on 15) The non-transitory computer readable medium of claim 15, further comprising defining in computer memory an electronic representation of the management of computer applications, data, and metadata contained in two or more different management compartments. ### Claim 21 (depends on 15) The non-transitory computer readable medium of claim 15, further comprising defining in computer memory an electronic representation of the management of computer applications, data, and metadata contained in two or more different instances of said management compartment. ### Claim 22 (depends on 15) The non-transitory computer readable medium of claim 15, further comprising distributing in computer memory an electronic representation of said at least one information management policy through said one or more policy distribution points.