# US 10,375,116 B2 · System and method to provide server control for access to mobile client data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,116 B2 - Document ID: US10375116B2 - Status: Granted - Kind: B2 - Application number: 15/448,220 - Filed: 2017-03-02 - Published: 2017-06-22 - Granted: 2019-08-06 - Earliest claimed: 2012-07-23 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Pau-Chen Cheng; Stephen C. Gates; Lawrence Koved; Wilfried Teiken - Web page: https://patentgrep.com/patent/US10375116B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/14: using a plurality of keys or algorithms - H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/06: Authentication - H04L 2209/80: Wireless - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods for protecting a data item include, upon initiation of transfer of the data item from a server to a client device, determining a sensitivity score and a current protection, level of the data item. A policy is applied to determine an appropriate protection for the data item based upon the sensitivity score and the current protection level. A protected data item is provided to the client device by applying the appropriate protection to the data item. ## Claims ### Claim 1 A method for protecting a data item, comprising: upon initiation of transfer of the data item from a server to a client device, determining a sensitivity score of the data item, a confidence level that a user of the client device is an authorized user, and a current protection level of the data item, the sensitivity score being generated based on a value of the data item to a particular individual or organization and a cost of recreating the data item if destroyed or modified; applying, using a processor, a policy to determine an appropriate protection for the data item based upon the sensitivity score, the confidence level, and the current protection level; and providing a protected data item to the client device by applying the appropriate protection to the data item, wherein a unique encryption key is employed for each application of a protection technique on each of one or more data items. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein determining the sensitivity score includes: determining sensitivity scores for classes of data on the server; determining a class of the data item from the classes of data on the server; and assigning a sensitivity score corresponding to the class of the data item as the sensitivity score of the data item. ### Claim 3 (depends on 1) The method as recited in claim 1, wherein applying the policy includes determining the appropriate protection based upon one or more of features of the data item and features of the client device. ### Claim 4 (depends on 3) The method as recited in claim 3, wherein features of the data item include one or more of type, creator, and indicator of the data item. ### Claim 5 (depends on 3) The method as recited in claim 3, wherein features of the client device include one or more of a history of compromises, an ownership status, an operating system, a version of the operating system, applications stored on the client device, a patch status, suspected malware, a status of a network connected to the client device, and an application of the client device used to access the data item. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein providing the protected data item includes providing a link referring to the protected data item. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein the initiation of transfer includes at least one of a request from the client device and a server initiated transfer of the data item. ### Claim 8 (depends on 7) The method as recited in claim 7, wherein the request from the client device is due to at least one of a user request, a scheduled request, a signal received by a sensor of the client device, and an event external from the client device. ### Claim 9 (depends on 7) The method as recited in claim 7, wherein the server initiated transfer is due to at least one of a request from the client device, a request from a second device, receiving data from the second device, and a scheduled transfer. ### Claim 10 (depends on 1) The method as recited in claim 1, wherein applying the appropriate protection includes at least one of applying encryption, redaction, invertible obfuscation, and non-invertible obfuscation. ### Claim 11 A non-transitory computer readable storage medium comprising a computer readable program for protecting a data item, wherein the computer readable program when executed on a computer causes the computer to perform the steps of: upon initiation of transfer of the data item from a server to a client device, determining a sensitivity score of the data item, a confidence level that a user of the client device is an authorized user, and a current protection level of the data item, the sensitivity score being based on a value of the data item to a particular individual or organization and a cost of recreating the data item if destroyed or modified; applying a policy to determine an appropriate protection for the data item based upon the sensitivity score, the confidence level, and the current protection level; and providing a protected data item to the client device by applying the appropriate protection to the data item, wherein a unique encryption key is employed for each application of a protection technique on each of one or more data items. ### Claim 12 (depends on 11) The non-transitory computer readable storage medium as recited in claim 11, wherein determining the sensitivity score includes: determining sensitivity scores for classes of data on the server; determining a class of the data item from the classes of data on the server; and assigning a sensitivity score corresponding to the class of the data item as the sensitivity score of the data item. ### Claim 13 (depends on 11) The non-transitory computer readable storage medium as recited in claim 11, wherein applying the policy includes determining the appropriate protection based upon one or more of features of the data item and features of the client device. ### Claim 14 (depends on 13) The non-transitory computer readable storage medium as recited in claim 13, wherein features of the data item include one or more of type, creator, and indicator of the data item. ### Claim 15 (depends on 13) The non-transitory computer readable storage medium as recited in claim 13, wherein features of the client device include one or more of a history of compromises, an ownership status, an operating system, a version of the operating system, applications stored on the client device, a patch status, suspected malware, a status of a network connected to the client device, and an application of the client device used to access the data item. ### Claim 16 (depends on 11) The non-transitory computer readable storage medium as recited in claim 11, wherein providing the protected data item includes providing a link referring to the protected data item. ### Claim 17 (depends on 11) The non-transitory computer readable storage medium as recited in claim 11, wherein the initiation of transfer includes at least one of a request from the client device and a server initiated transfer of the data item. ### Claim 18 (depends on 17) The non-transitory computer readable storage medium as recited in claim 17, wherein the request from the client device is due to at least one of a user request, a scheduled request, a signal received by a sensor of the client device, and an event external from the client device. ### Claim 19 (depends on 17) The non-transitory computer readable storage medium as recited in claim 17, wherein the server initiated transfer is due to at least one of a request from the client device, a request from a second device, receiving data from the second device, and a scheduled transfer. ### Claim 20 A method for protecting a data item, comprising: upon initiation of transfer of the data item from a server to a mobile device, determining a sensitivity score of the data item, a confidence level that a user of the client device is an authorized user, and a current protection level of the data item using a data protection server, the sensitivity score being generated based on a value of the data item to a particular individual or organization and a cost of recreating the data item if destroyed or modified; applying a policy to determine an appropriate protection for the data item using the data protection server, wherein the appropriate protection is based upon the sensitivity score, the current protection level, the confidence level, and features of at least one of the data item and the mobile device; and providing a protected data item to the mobile device by applying the appropriate protection to the data item using the data protection server, wherein a unique encryption key is employed for each application of a protection technique on each of one or more data items.