# US 10,372,916 B2 · Data detection and protection policies for electronic file systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,916 B2 - Document ID: US10372916B2 - Status: Granted - Kind: B2 - Application number: 15/064,871 - Filed: 2016-03-09 - Published: 2016-07-14 - Granted: 2019-08-06 - Earliest claimed: 2012-07-10 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Lynn Ayres; Jack Kabat; Raja Charu Vikram Kakumani; Mashuri Libman; Benjamin Stull; Anatoly Koretsky; Andrey Shur; Joseph Schulman - Web page: https://patentgrep.com/patent/US10372916B2 ## CPC - G06F 21/60: Protecting data - H04L 51/212: using filtering or selective blocking - H04L 51/234: for tracking messages - H04L 51/063: Content adaptation, e.g. replacement of unsuitable content - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and/or methods for deploying and implementing data loss prevention (DLP) policy definition that may encapsulate the requirements, control objectives and directives, and/or the definitions of sensitive data types as stipulated directly or indirectly by the regulatory policy are disclosed. In one embodiment, DLP policies may be identified by an organization to run on top of a set of electronic file systems (e.g., email systems, file systems, web servers and the like). Organizations and their administrators may implement a set of DLP policy instance which are derived from DLP policy templates. DLP policy templates may comprise both structure and meaning—and may acquire a given DLP policy by the replacement of parameterized expressions with desired parameter values. In another embodiment, the state of the DLP policy instance may change according to the lifecycle of the policy instance deployment. ## Claims ### Claim 1 A computing system comprising: a processor; and memory storing instructions which, when executed, configure the computing system to: identify a first electronic file system configured to provide a first service to a set of clients that request access to data associated with the first electronic file system, the first electronic file system having a first set of file system characteristics representing operation of the first electronic file system; identify a second electronic file system configured to provide a second service to a set of clients that request access to data associated with the second electronic file system, the second electronic file system having a second set of file system characteristics representing operation of the second electronic file system; receive a data loss prevention (DLP) policy template that comprises a set of template component fields, and is generic to both the first and second electronic file systems; and for the first electronic file system, transform the generic DLP policy template into a first DLP policy instance that is specific to the first electronic file system by parameterizing the set of template component fields based on the first set of file system characteristics, wherein the first DLP policy instance comprises: a policy rule object that defines a DIP action to be performed by the first electronic file system; and a data classification rule object defining a structure of electronic data in the first electronic file system to which the policy rule object is applied; and control operation of the first electronic file system by executing the policy rule object of the first DLP policy instance; and for the second electronic file system, transform the generic DLP policy template into a second DLP policy instance that is specific to the second electronic file system by parameterizing the set of template component fields based on the second set of file system characteristics, wherein the second DLP policy instance comprises: a policy rule object that defines a DLP action to be performed by the second electronic file system; and a data classification rule object defining a structure of electronic data in the second electronic file system to which the policy rule object is applied; and control operation of the second electronic file system by executing the policy rule object of the second DLP policy instance. ### Claim 2 (depends on 1) The computing system of claim 1, wherein each of the first and second electronic file systems comprises a file server in communication with the set of clients that request access to data associated with the file server. ### Claim 3 (depends on 1) The computing system of claim 1, wherein the first service comprises a different type of service than the second service. ### Claim 4 (depends on 3) The computing system of claim 3, wherein each of the first and second file servers comprise one of: an information protection and collaboration system, a web server, an application server, an email server, or an information management and collaboration server. ### Claim 5 (depends on 1) The computing system of claim 1, wherein the set of template component fields of the selected DLP policy template is parameterized with replacement values based on a specification of a substation key comprising a construct within the selected DLP policy template. ### Claim 6 (depends on 1) The computing system of claim 1, wherein the instructions configure the computing system to control a state of each of the first and second DLP policy instances. ### Claim 7 (depends on 6) The computing system of claim 6, wherein the DLP policy instance comprises a state table that stores a state of each of the first and second DLP policy instances. ### Claim 8 (depends on 7) The computing system of claim 7, wherein the state table stores a state comprising at least one of: Audit, Notify, or Enforcement. ### Claim 9 A computing system for creating a data loss prevention (DLP) policy instance for a set of email systems, each email system comprising an email server configured to communicate with a set of email clients, the computing system comprising: a processor; and memory storing instructions executable by the processor, wherein the instructions, when executed, configure the computing system to: receive a DLP policy template that comprises a set of template component fields and is generic to the set of email systems; and for each email system in the set of email systems, transform the generic DLP policy template into a DLP policy instance that is specific to the email system by parameterizing the set of template component fields based on policy data associated with the email system, wherein the DLP policy instance comprises: a policy rule object that defines a DLP action to be performed by the email system; and a data classification rule object defining a structure of electronic data in the email system to which the policy rule object is applied; and control operation of the email system by executing the policy rule object of the DLP policy instance. ### Claim 10 (depends on 9) The computing system of claim 9, wherein the instructions configure the computing system to control a state of the DLP policy instance. ### Claim 11 (depends on 9) The computing system of claim 9, wherein the DLP policy instance comprises a state table that stores a state of the DLP policy instance. ### Claim 12 (depends on 9) The computing system of claim 9, wherein the instructions configure the computing system to: replace values in the DLP policy template based on a specification of a substation key, the substation key comprising a construct within the DLP policy template. ### Claim 13 (depends on 9) The computing system of claim 9, wherein the instructions configure the computing system to: monitor and control a state of the DLP policy instance, wherein the state of the DLP policy instance is stored in a state table associated with the DLP policy instance. ### Claim 14 A method performed by a computing system, the method comprising: identifying a first electronic file system configured to provide a first service to a set of clients that request access to data associated with the first electronic file system, the first electronic file system having a first set of file system characteristics representing operation of the first electronic file system; identifying a second electronic file system configured to provide a second service to a set of clients that request access to data associated with the second electronic file system, the second electronic file system having a second set of file system characteristics representing operation of the second electronic file system; receiving a data loss prevention (DLP) policy template that comprises a set of template component fields, and is generic to both the first and second electronic file systems; for the first electronic file system, transforming the generic DLP policy template into a first DLP policy instance that is specific to the first electronic file system by parameterizing the set of template component fields based on the first set of file system characteristics, wherein the first DLP policy instance comprises: a policy rule object that defines a DLP action to be performed by the first electronic file system; and a data classification rule object defining a structure of electronic data in the first electronic file system to which the policy rule object is applied; and controlling operation of the first electronic file system by executing the policy rule object of the first DLP policy instance; and for the second electronic file system, transforming the generic DLP policy template into a second DLP policy instance that is specific to the second electronic file system by parameterizing the set of template component fields based on the second set of file system characteristics, wherein the second DLP policy instance comprises: a policy rule object that defines a DLP action to be performed by the second electronic file system; and a data classification rule object defining a structure of electronic data in the second electronic file system to which the policy rule object is applied; and controlling operation of the second electronic file system by executing the policy rule object of the second DLP policy instance. ### Claim 15 (depends on 14) The method of claim 14, wherein each of the first and second electronic file systems comprises a file server in communication with the set of clients that request access to data associated with the file server. ### Claim 16 (depends on 14) The implemented method of claim 14, wherein the first service comprises a different type of service than the second service. ### Claim 17 (depends on 16) The method of claim 16, wherein each of the first and second file servers comprise one of: an information protection and collaboration system, a web server, an application server, an email server, or an information management and collaboration server. ### Claim 18 (depends on 17) The method of claim 17, wherein the generic DLP policy template is transformed into the first and second DLP policy instance comprises: translating generic policy constructs into deployment specific objects. ### Claim 19 (depends on 17) The method of claim 17, wherein transforming further comprises: translating generic policy constructs into localized language contexts. ### Claim 20 (depends on 14) The of claim 14, and further comprising: changing the state of each of the first and second DLP policy instances according to a lifecycle of the policy instance deployments.