Back to results
US 7,584,502 B2Granted
Policy engine and methods and systems for protecting data
AssigneeMicrosoft Corporation
InventorsJames M. Alkove, Kirt A. Debique, Alexandre V. Grigorovitch, William C. Powell, Jeffrey Richard McKune
Life of this patent
Estimating the term…
Abstract
The described embodiments relate to data security. One exemplary system includes a first component associated with data on which an action can be performed and a second component configured to perform the action on the data. The system also includes a third component configured to ascertain the action and determine, as a function of the action, at least one policy to be implemented prior to allowing the second component to access the data.
Claims33
A method comprising:
- ascertaining an action to be performed on data obtained from a data source, wherein ascertaining is from a sink trust authority associated with a data sink;
- retrieving content policies associated with the action, wherein retrieving content policies is from a source trust authority and at least one other component;
- ranking the policies in a ranked order, wherein the ranking comprises creating an array which ranks the policies from highest priority to lowest priority;
- inquiring whether individual policies are supported by the data sink;
- and,
- directing the data sink to implement one of the ranked policies supported by the data sink along a trusted media path, wherein the trusted media path comprises the sink trust authority, the source trust authority and the at least one other component, wherein the at least one other component is a policy component negotiating one or more policies between the source trust authority and the sink trust authority.
3 more elements
A method comprising:
- ascertaining at least one action to be performed with data associated with a first component;
- determining conditions associated with the action, wherein the determining comprises acquiring the conditions from the first component and a third component and creating an array which ranks the conditions;
- and,
- confirming that a second component which will perform the action is configured to support at least one of the conditions, wherein the first component and the second component maintain trust along a media path, wherein the media path comprises at least the first component, the second component, and the third component, the sink trust authority, the source trust authority and the at least one other component, wherein the third component is a policy component negotiating one or more policies between the first component and the second component.
1 more element
A method comprising:
- establishing trust with a downstream component based at least in part on policy obtained from an upstream component;
- ascertaining an action to be performed by the downstream component on data derived from the upstream component;
- receiving conditions, from the upstream component and a universal component, associated with allowing the downstream component to access the data, wherein the receiving comprises aggregating the conditions from the upstream component and the conditions from the universal component into a ranked array;
- and
- establishing trust between the upstream component and a policy component by calling the upstream component and passing a pointer to an IMFTrustHost interface to request a certificate.
2 more elements
A system embodied on a computer-readable storage medium, the system comprising:
- a memory;
- a processor coupled to the memory;
- a first component operable by the processor associated with data on which an action can be performed;
- a second component configured to perform the action on the data;
- and,
- a third component configured to ascertain the action and determine, as a function of the action, at least one policy to be implemented prior to allowing the second component to access the data, wherein the third component is configured to negotiate, on behalf of the first component, implementation of the at least one policy with the second component;
- and
- wherein the third component is configured to:
- establish trust before allowing the second component into a protected environment where processing of data can occur thereby maintaining trust along a media path;
- form an aggregated exclusion list from a first exclusion list obtained from the first component and a second exclusion list obtained from a fourth global component that is not directly associated with the first component and is not directly associated with the second component;
- and,
- load a list of components to be allowed into the protected environment utilizing at least the aggregated exclusion list.
9 more elements
A system comprising:
- a memory;
- a processor coupled to the memory;
- means for ascertaining an action to be performed on data obtained from a data source and retrieving content policies associated with the action, wherein ascertaining is from a sink trust authority associated with a data sink;
- means for retrieving content policies associated with the action, wherein retrieving content policies is from a source trust authority and at least one other component;
- means for ranking the policies in a ranked order and inquiring whether individual policies are supported by the data sink, wherein means for ranking comprises means for creating an array which ranks the policies from highest priority to lowest priority;
- and,
- means for directing the data sink to implement one of the ranked policies supported by the data sink along a trust media path, wherein the trusted media path comprises the sink trust authority, the source trust authority, and the at least one other component, wherein the at least one other component is a policy component negotiating one or more policies between the source trust authority and the sink trust authority.
4 more elements
Dependencies are inferred from the claim text.