Back to results
US 10,592,683 B1Granted
Applying an authorization policy across multiple application programs with requests submitted through an HTTP-based API
AssigneeNextLabs, Inc.
InventorsKeng Lim, Poon Fung
Life of this patent
Estimating the term…
Abstract
A technique and system provide protection to information or documents via an authorization policy that is applied to multiple application programs and authorization requests are submitted through a REST API over HTTP or HTTPS. Methods, techniques, and systems control access to protected information or documents and use of content in protected information or documents to support information management policies.
Claims28
A method comprising:
- providing a document repository having a plurality of protected documents;
- providing a policy server having a first plurality of policies, wherein the first plurality of policies controls access to the plurality of protected documents;
- providing a secured viewing server having access to the document repository, wherein the secured viewing server provides access to the plurality of protected documents from a web browser;
- providing a content access governor having a second plurality of policies, wherein the second plurality of policies comprises a subset of the first plurality of policies;
- providing a data protection client having a third plurality of policies, wherein the data protection client has access to the document repository, wherein the third plurality of policies comprises a subset of the first plurality of policies;
- at the policy server, sending a policy in the first plurality of policies to the content access governor, wherein the policy controls access to a protected document in the document repository;
- at the policy server, sending the policy to the data protection client;
- at a web browser, logging on to the secured viewing server by a first user;
- at the web browser, opening the protected document by the first user;
- at the secured viewing server, receiving a first request to open the protected document;
- at the secured viewing server, sending a query to the content access governor with information relevant to the first request, wherein the secured viewing server invokes a content access governor application programming interface to send the query, wherein the information relevant to the first request comprises information about the open action, the protected document and the first user;
- at the content access governor, selecting a first subset of policies from the second plurality of policies relevant to the open action, the protected document and the first user;
- at the content access governor, evaluating the first subset of policies to produce a first decision on whether the first request is allowed;
- at the content access governor, sending the first decision to the secured viewing server in response to the query;
- at the secured viewing server, when the first request is allowed, obtaining a plurality of rights granted to the first user on the protected document from the content access governor;
- at the secured viewing server, when the first request is allowed, sending the protected document to the web browser in response to the first request according to the plurality of rights granted;
- at the web browser, when the first request is allowed, loading the protected document in the web browser, wherein loading the protected document implements the plurality of rights granted to the first user on the protected document;
- at the secured viewing server, when the first request is not allowed, sending a message in response to the first request to the web browser indicating the first user is not allowed to open the protected document;
- at the web browser, when the first request is not allowed, not rendering the protected document in the web browser;
- at the data protection client, receiving a second request to open the protected document, wherein the second request comprises an open action and information about the protected document and a second user;
- at the data protection client, selecting a second subset of policies from the third plurality of policies relevant to the open action, the protected document and the second user;
- at the data protection client, evaluating the second subset of policies to produce a second decision on whether the second request is allowed;
- and
- at the data protection client, responding to the second request with the second decision, wherein the second decision is used to control access to the protected document by the second user, wherein the policy is applied to control access to the protected document.
21 more elements
A method comprising:
- providing a document repository having a plurality of protected documents;
- providing a policy server having a first plurality of policies, wherein the first plurality of policies controls access to the plurality of protected documents;
- providing a rights managed application running on a mobile computing device, wherein the rights managed application having a second plurality of policies, wherein the second plurality of policies comprises a subset of the first plurality of policies;
- providing a rights management server having access to the document repository, wherein the rights management server provides access to the plurality of protected documents from the rights managed application;
- providing a data protection client having a third plurality of policies, wherein the data protection client has access to the document repository, wherein the third plurality of policies comprises a subset of the first plurality of policies;
- at the policy server, sending a policy in the first plurality of policies to the rights managed application, wherein the policy controls access to a protected document in the document repository;
- at the policy server, sending the policy to the data protection client;
- at the rights managed application, opening the protected document by a first user, wherein the opening the protected document invokes an open operation;
- at the rights managed application, selecting a first subset of policies from the second plurality of policies relevant to the open operation, the protected document and the first user;
- at the rights managed application, evaluating the first subset of policies to produce a first decision on whether the open operation is allowed;
- at the rights managed application, when the open operation is allowed, analyzing the first subset of policies to produce a plurality of rights granted to the first user on the protected document;
- at the rights managed application, when the open operation is allowed, opening the protected document in the rights managed application;
- at the rights managed application, when the open operation is allowed,
- implementing an application program feature consistent with the plurality of rights granted;
- at the rights managed application, when the open operation is allowed, rendering content of the protected document on the rights managed application;
- at the rights managed application, when the open operation is not allowed, denying the open operation, wherein the protected document is not opened in the rights managed application;
- at the data protection client, receiving a request to open the protected document, wherein the request comprises an open action and information about the protected document and a second user;
- at the data protection client, selecting a second subset of policies from the third plurality of policies relevant to the open action, the protected document and the second user;
- at the data protection client, evaluating the second subset of policies to produce a second decision on whether the request is allowed;
- and
- at the data protection client, responding to the request with the second decision, wherein the second decision is used to control access to the protected document by the second user, wherein the policy is applied to control access to the protected document.
18 more elements
Dependencies are inferred from the claim text.