# US 10,873,574 B2 · Protecting information using policies and encryption

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,574 B2
- Document ID: US10873574B2
- Status: Granted
- Kind: B2
- Application number: 16/168,793
- Filed: 2018-10-23
- Published: 2019-02-21
- Granted: 2020-12-22
- Earliest claimed: 2011-04-04
- Assignees: NextLabs, Inc.
- Applicants: NextLabs, Inc.
- Inventors: Keng Lim
- Web page: https://patentgrep.com/patent/US10873574B2

## CPC

- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/00: {Cryptographic mechanisms or cryptographic} arrangements for secret or secure communications; Network security protocols
- H04L 51/08: Annexed information, e.g. attachments
- H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F 21/60: Protecting data
- H04L 63/0245: {Filtering by information in the payload}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A technique and system protects documents at rest and in motion using declarative policies and encryption. Encryption in the system is provided transparently and can work in conjunction with policy enforcers installed at a system. A system can protect information or documents from: (i) insider theft; (ii) ensure confidentiality; and (iii) prevent data loss, while enabling collaboration both inside and outside of a company.

## Claims

### Claim 1

A method comprising:
providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers;
executing a first policy enforcer program installed on a first client;
at the first client, intercepting by an interceptor code component of the first policy enforcer program a request by an application that is attempting to transfer a selected document, managed by the document management system, to a second client;
after the interceptor code component intercepts the transfer request, not allowing the application to transfer the selected document to the second client, and using a policy engine code component of the first policy enforcer program, evaluating at least one policy associated with the selected document;
as a result of the evaluating, determining that the transfer request is allowed, and encrypting the selected document;
allowing the application to transfer the encrypted document, but not an unencrypted version of the selected document, to the second client;
causing, in response to the allowed application transfer, a second policy enforcer installed on the second client to intercept a request for access to the encrypted document;
causing the second policy enforcer to determine whether the request should be allowed; and
after determining to allow access to the selected document, causing the second client to decrypt the encrypted document.

### Claim 2 (depends on 1)

The method of claim 1 wherein the selected document is unencrypted.

### Claim 3 (depends on 1)

The method of claim 1 wherein the at least one policy associated with the selected document is stored at the first client.

### Claim 4 (depends on 1)

The method of claim 1 wherein the selected document is encrypted by an encryption module executing on the first client, the encryption module is separate from the policy enforcer program.

### Claim 5

A method comprising:
providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers;
executing a first policy enforcer program installed on a first client;
at the first client, intercepting by an interceptor code component of the first policy enforcer program a request by an application that is attempting to transfer a selected document, managed by the document management system, to a second client;
after the interceptor code component intercepts the transfer request, not allowing the application to transfer the selected document to the second client, and using a policy engine code component of the first policy enforcer program, evaluating at least one policy associated with the selected document;
as a result of the evaluating, determining that the transfer request is allowed, and encrypting the selected document;
allowing the application to transfer the encrypted document to the second client;
causing, in response to the allowed application transfer, a second policy enforcer installed on the second client to intercept a request for access to the encrypted document;
causing the second policy enforcer to determine whether the request should be allowed;
causing sending a notification from the second policy enforcer regarding an attempt at the second client to open the encrypted document;
determining that the encrypted document is encrypted;
causing, by the second policy enforcer program, requesting a key that will allow decryption of the encrypted document; and
after determining to allow access to the selected document, causing the second client to decrypt the encrypted document.

### Claim 6 (depends on 5)

The method of claim 5 comprising:
causing using the key to unencrypt the encrypted document to obtain an unencrypted version of the selected document.

### Claim 7

A method comprising:
providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers;
at a first client, executing a first policy enforcer program;
at the first client, trapping by the first policy enforcer program a request by an application that will transmit a selected document, managed by the document management system, to a second client;
after the first policy enforcer program intercepts the transmission request, not allowing the application to transmit the selected document to the second client, and evaluating at least one policy associated with the selected document;
as a result of the evaluating, determining that the transmission request is allowed, and encrypting the selected document, wherein the at least one policy specifies that the selected document is to be encrypted and attached to an e-mail;
allowing the application to transmit the encrypted document to the second client;
causing a second policy enforcer installed on the second client to intercept a request to access the encrypted document;
causing sending a notification from the second policy enforcer regarding an attempt at the second client to open the encrypted document;
determining the encrypted document is encrypted; and
after determining the encrypted document is encrypted, causing the second client to decrypt the encrypted document to allow access to an unencrypted version of the selected document.

### Claim 8

A method comprising:
providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers;
at a first client, executing a first policy enforcer program;
at the first client, trapping by the first policy enforcer program a request by an application that will transmit a selected document, managed by the document management system, to a second client;
after the first policy enforcer program intercepts the transmission request, not allowing the application to transmit the selected document to the second client, and evaluating at least one policy associated with the selected document;
as a result of the evaluating, determining that the transmission request is allowed, and encrypting the selected document;
allowing the application to transmit the encrypted document to the second client;
causing a second policy enforcer installed on the second client to intercept a request to access to the encrypted document;
causing sending a notification from the second policy enforcer regarding an attempt at the second client to open the encrypted document;
determining the encrypted document is encrypted;
after the sending a notification from the second policy enforcer regarding an attempt at the second client to access the encrypted document, causing determining the attempt at the second client is not allowed according to a first policy;
causing, at the second client, disallowing the second client from accessing the encrypted document; and
after determining the encrypted document is encrypted, causing the second client to decrypt the encrypted document to allow access to an unencrypted version of the selected document.

### Claim 9

A method comprising:
providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers;
executing a first policy enforcer program at a first client;
at the first client, intercepting by an interceptor code component a request by an application that will transfer a selected document, managed by the document management system, to a second client;
after the interceptor code component intercepts the transfer request, not allowing the application to transfer the selected document to the second client, and using a policy engine code component, evaluating at least one policy associated with the selected document;
as a result of the evaluating, determining that the transfer request is allowed, and encrypting the selected document using a shared key, wherein the shared key is stored on a separate computing device from the first and second clients;
allowing the application to transfer the encrypted document to the second client;
causing sending a notification from a second policy enforcer regarding an attempt at the second client to access the encrypted document;
determining that the encrypted document is encrypted; and
with the second policy enforcer program, causing the second client to decrypt the encrypted document to allow access to an unencrypted version of the selected document.

### Claim 10 (depends on 9)

The method of claim 9 wherein the selected document is unencrypted.

### Claim 11 (depends on 9)

The method of claim 9 wherein the at least one policy associated with the selected document is stored at the first client.

### Claim 12 (depends on 9)

The method of claim 9 wherein the selected document is encrypted by an encryption module executing on the first client, and the encryption module is separate from the policy enforcer program.

### Claim 13 (depends on 11)

The method of claim 11 wherein after the determining that the transfer request is allowed, but before allowing the transfer request, encrypting the selected document further comprises:
substituting the selected document with the encrypted document.

### Claim 14 (depends on 11)

The method of claim 11 wherein the at least one policy evaluated at the second policy enforcer is different than the at least one policy evaluated at the first policy enforcer.

### Claim 15

A method comprising:
providing a document management system managing a plurality of documents wherein the document management system comprises clients and servers;
executing a first policy enforcer program at a first client;
at the first client, intercepting by an interceptor code component a request by an application that will transfer a selected document, managed by the document management system, to a second client;
after the interceptor code component intercepts the transfer request, not allowing the application to transfer the selected document to the second client, and using a policy engine code component, evaluating at least one policy associated with the selected document;
as a result of the evaluating, determining that the transfer request is allowed, and encrypting the selected document;
allowing the application to transfer the encrypted document to the second client;
causing sending a notification from a second policy enforcer regarding an attempt at the second client to access the encrypted document;
determining that the encrypted document is encrypted;
with the second policy enforcer program, causing the second client to decrypt the encrypted document to allow access to an unencrypted version of the selected document comprises
causing requesting a key that will allow decryption of the encrypted document; and
causing using the key to unencrypt the encrypted document to recover an unencrypted version of the selected document.

### Claim 16 (depends on 15)

The method of claim 15 wherein the encrypting the selected document comprises:
accessing a shared encryption key ring at the first policy enforcer program, wherein the first shared key ring is accessible to the second policy enforcer program;
selecting a first encryption key of the shared encryption key ring; and
encrypting the selected document with the first encryption key.

### Claim 17 (depends on 16)

The method of claim 16 wherein the shared encryption key ring is stored at a key management server.

### Claim 18 (depends on 17)

The method of claim 17 wherein the evaluated at least one policy at the second policy enforcer program comprises a key ring identifier.

### Claim 19 (depends on 18)

The method of claim 18 wherein the at least one policy at the first client is stored separately from the key management server.

### Claim 20 (depends on 15)

The method of claim 15 wherein the at least one policy at the second client comprises an encryption key identifier.