# US 2023/0056471 A1 · Method for data protection across sharing platforms

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0056471 A1
- Document ID: US20230056471A1
- Status: Published application
- Kind: A1
- Application number: 17/891,448
- Filed: 2022-08-19
- Published: 2023-02-23
- Earliest claimed: 2021-08-20
- Assignees: ArmorBlox, Inc.
- Applicants: ArmorBlox, Inc.
- Inventors: Arjun Sambamoorthy; Prashanth Arun; Dhananjay Sampath; Sanjay Singh; Salil Kanetkar
- Web page: https://patentgrep.com/patent/US20230056471A1

## CPC

- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 40/40: Processing or translation of natural language (natural language analysis G06F40/20; semantic analysis G06F40/30)
- H04L 51/08: Annexed information, e.g. attachments
- G06F 40/279: Recognition of textual entities
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method includes: accessing a corpus of messages previously sent from a user account; correlating sequences of words, in the corpus of messages, with behavior signals; aggregating the behavior signals into a behavioral model representing combinations of behavior signals characteristic of behavior in messages sent from the user account; later, accessing a message outbound from the user account to a recipient account, the message including a document associated with a document tag; correlating sequences of words, in the message, with behavior signals; retrieving a data access policy including a threshold at which access to a document associated with the document tag is restricted; and in response to detecting a difference between the behavioral signals from the message and the behavioral model exceeding the threshold, restricting access, by the recipient account, to the document in the message.

## Claims

### Claim 1

A method comprising:
during a first time period:
accessing a first corpus of messages sent from a first user account;
correlating sequences of words, in messages of the first corpus of messages, with a first set of behavior signals;
aggregating the first set of behavior signals into a first behavioral model representing combinations of behavior signals, in the first set of behavior signals, characteristic of behavior in messages sent from the first user account;
associating the first behavioral model with the first user account; and
during a second time period succeeding the first time period:
accessing a first message outbound from the first user account to a first recipient account, the first message comprising a first document as an attachment to the first message;
correlating sequences of words, in the first message, with a second set of behavior signals;
accessing a first set of document tags associated with the first document;
retrieving a first data access policy:
associated with a first document tag in the first set of document tags; and
comprising a first threshold at which access to a document associated with the first document tag is restricted; and
in response to detecting a difference between the second set of behavioral signals and the first behavioral model exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message.

### Claim 2 (depends on 1)

The method of claim 1, further comprising, during the second period:
calculating a risk score for the first message based on the difference between the second set of behavior signals and the first behavioral model;
in response to detecting the risk score exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message;
in response to detecting the risk score falling below the first threshold, permitting access, by the first recipient account, to the first document in the first message.

### Claim 3 (depends on 1)

The method of claim 1:
wherein the first data access policy further comprises a second threshold at which a notification to an administrator of a document associated with the first document tag is generated; and
further comprising, in response to detecting the difference between the second set of behavioral signals and the first behavioral model exceeding the second threshold, generating a notification, to an administrator of the first document, comprising an indication of the first message, from the first user account, comprising the first document.

### Claim 4 (depends on 1)

The method of claim 1:
wherein the first data access policy further comprises a rule requiring encryption of an outbound message comprising a document, associated with the first document tag, as an attachment to the outbound message;
further comprising, in response to detecting the difference between the second set of behavioral signals and the first behavioral model falling below the first threshold, encrypting the first message, to the first recipient account, comprising the first document as an attachment to the first message.

### Claim 5 (depends on 1)

The method of claim 1, further comprising, during the second time period:
aggregating the second set of behavior signals into the first behavioral model representing combinations of behavior signals, in the first set of behavior signals and the second set of behavior signals, characteristic of behavior in messages sent from the first user account; and
associating the first behavioral model with the first user account.

### Claim 6 (depends on 1)

The method of claim 1, wherein accessing a first set of document tags associated with the first document comprises accessing the first document tag representing a first sensitive information signal in the first document.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
during a third time period succeeding the second time period:
accessing a second message outbound from the first user account to a second recipient account, the second message comprising the first document as an attachment to the second message;
correlating sequences of words, in the second message, with a third set of behavior signals;
accessing the first set of document tags associated with the first document;
retrieving the first data access policy; and
in response to detecting a difference between the third set of behavioral signals and the first behavioral model falling below the first threshold, permitting transmission of the second message to the second recipient account.

### Claim 8 (depends on 1)

The method of claim 1:
wherein the first data access policy further comprises a first set of identities permitted to access a document associated with the first document tag, the first set of identities comprising the first user account; and
further comprising, in response to detecting the difference between the second set of behavioral signals and the first behavioral model exceeding the first threshold, modifying the first data access policy excluding the first recipient account from the first set of identities.

### Claim 9 (depends on 1)

The method of claim 1:
wherein the first data access policy comprises a first set of identity characteristics, comprising a first identity characteristic, of a user account permitted to access a document associated with the first document tag;
further comprising, during the second period:
retrieving a second set of identity characteristics, comprising the first identity characteristic, associated with the first user account;
in response to detecting the difference between the second set of behavioral signals and the first behavioral model exceeding the first threshold:
generating a second data access policy comprising a set of identities, comprising the first user account, restricted from accessing a document associated with a document tag representing a sensitive information signal; and
associating the second data access policy with the first document tag;
in response to detecting the difference between the second set of behavioral signals and the first behavioral model falling below the first threshold, and in response to detecting an intersection between the first set of identity characteristics and the second set of identity characteristics, permitting access, by the first user account, to the first document;
further comprising, during a third period succeeding the second period, restricting access, by the first user account, to the first document based on the second data access policy.

### Claim 10 (depends on 1)

The method of claim 1:
wherein correlating sequences of words in messages of the first corpus of messages, with a first set of behavior signals comprises:
scanning bodies of messages, in the first corpus of messages, for the first set of behavior signals comprising:
financial signals;
sensitive information signals;
action signals;
urgency signals;
deadline signals;
keyword signals; and
syntax signals
wherein aggregating the first set of behavior signals into the first behavioral model comprises:
calculating a first n-dimensional vector representing average frequencies of financial signals, sensitive information signals, action signals, urgency signals, deadline signals, keyword signals, and syntax signals in each message in the first corpus of messages; and
associating the first n-dimensional vector with the first behavioral model;
wherein correlating sequences of words in the first message with the second set of behavior signals comprises:
scanning the first message for the second set of behavior signals comprising:
financial signals;
sensitive information signals;
action signals;
urgency signals;
deadline signals;
keyword signals; and
syntax signals; and
further comprising, during the second time period:
calculating a second n-dimensional vector representing frequencies of financial signals, sensitive information signals, action signals, urgency signals, deadline signals, keyword signals, and syntax signals in the first message; and
in response to detecting a difference between the second n-dimensional vector and the first n-dimensional vector exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message.

### Claim 11 (depends on 10)

The method of claim 10, further comprising:
recalculating the first n-dimensional vector based on the second n-dimensional vector; and
in response to recalculating the first n-dimensional vector, associating the first n-dimensional vector with the first behavioral model.

### Claim 12 (depends on 1)

The method of claim 1, further comprising:
during the second time period:
detecting a first workflow based on:
the first user account;
the second set of behavior signals;
the first set of document tags; and
the first recipient account; and
wherein retrieving the first set of data access policies comprises retrieving the first set of data access policies:
associated with the first set of document tags; and
corresponding to the first workflow.

### Claim 13 (depends on 1)

The method of claim 1, further comprising:
during the first time period:
accessing a second corpus of messages sent from a group of user accounts comprising the first user account;
correlating sequences of words, in messages of the second corpus of messages, with a third set of behavior signals;
aggregating the third set of behavior signals into a group behavioral model representing combinations of behavior signals, in the third set of behavior signals, characteristic of behavior in messages sent from the group of user accounts; and
associating the group behavioral model with the group of user accounts; and
during the second time period, in response to detecting a difference between the second set of behavioral signals and the group behavioral model exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message.

### Claim 14 (depends on 1)

The method of claim 1, further comprising:
during the first time period, in response to detecting a number of messages in the first corpus of messages falling below a second threshold quantity:
accessing a second corpus of messages sent from a group of user accounts, comprising the first user account, each user account in the group of user accounts exhibiting a particular identity characteristic;
correlating sequences of words, in messages of the second corpus of messages, with a third set of behavior signals;
aggregating the third set of behavior signals into the first behavioral model representing combinations of behavior signals, in a combination of the first set of behavior signals and the third set of behavior signals, characteristic of behavior in messages sent from the group of user accounts; and
associating the first behavioral model with the first user account.

### Claim 15 (depends on 14)

The method of claim 14, further comprising:
during a third time period succeeding the second time period, in response to detecting the number of messages in the first corpus of messages exceeding a third threshold quantity:
accessing the first corpus of messages;
correlating sequences of words, in messages of the first corpus of messages, with a fourth set of behavior signals; and
aggregating the fourth set of behavior signals into the first behavioral model representing combinations of behavior signals, in the fourth set of behavior signals, characteristic of behavior in messages sent from the first user account; and
associating the first behavioral model with the first user account.

### Claim 16 (depends on 14)

The method of claim 14, wherein accessing a second corpus of messages sent from a group of user accounts comprises accessing the second corpus of messages sent from the group of user accounts exhibiting the particular identity characteristic comprising finance department membership within an organization.

### Claim 17 (depends on 1)

The method of claim 1, further comprising:
during the first time period:
accessing a first subset of messages, of the first corpus of messages, sent from the first user account to the first recipient account;
correlating sequences of words, in messages of the first subset of messages, with a third set of behavior signals;
aggregating the third set of behavior signals into a second behavioral model representing combinations of behavior signals, in the first set of behavior signals, characteristic of behavior in messages sent from the first user account to the first recipient account; and
associating the second behavioral model with the first user account; and
during the second time period, in response to detecting a difference between the second set of behavior signals and the second behavioral model exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message.

### Claim 18 (depends on 1)

The method of claim 1, wherein restricting access, by the first recipient account, to the first document in the first message comprises restricting transmission of the first message to the first recipient account.

### Claim 19

A method comprising:
during a first time period:
accessing a first corpus of messages sent from a first user account;
correlating sequences of words, in messages of the first corpus of messages, with a first set of behavior signals;
aggregating the first set of behavior signals into a first behavioral model representing combinations of behavior signals, in the first set of behavior signals, characteristic of behavior in messages sent from the first user account; and
associating the first behavioral model with the first user account; and
during a second time period succeeding the first time period:
accessing a first message outbound from the first user account to a first recipient account, the first message comprising a hyperlink to a location of a first document;
correlating sequences of words, in the first message, with a second set of behavior signals;
accessing a first set of document tags associated with the first document;
retrieving a first data access policy:
associated with a first document tag in the first set of document tags; and
comprising a first threshold at which access to a document associated with the first document tag is restricted; and
in response to detecting a difference between the second set of behavioral signals and the first behavioral model exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message.

### Claim 20

A method comprising:
during a first time period:
accessing a first corpus of messages sent from a first user account;
correlating sequences of words, in messages of the first corpus of messages, with a first set of behavior signals;
aggregating the first set of behavior signals into a first behavioral model representing combinations of behavior signals, in the first set of behavior signals, characteristic of behavior in messages sent from the first user account; and
associating the first behavioral model with the first user account; and
during a second time period succeeding the first time period:
accessing a first message from the first user account, the first message comprising a first document as an attachment to the first message;
correlating sequences of words in the first message with a second set of behavior signals;
correlating sequences of words in the first document with a first set of language signals comprising a sensitive information signal;
generating a first set of document tags representing the third set of language signals;
retrieving a first data access policy:
associated with a first document tag, in the first set of document tags, representing the sensitive information signal; and
comprising a first threshold at which access to a document associated with the first document tag is restricted; and
in response to detecting a difference between the second set of behavioral signals and the first behavioral model exceeding the first threshold, restricting access, by the first recipient account, to the first document in the first message.