US 7,599,907 B2Granted

Method and system applying policy on screened files

AssigneeMicrosoft Corporation

InventorsSarosh Cyrus Havewala, Neal R. Christiansen, Ran Kalach, Ravinder S. Thind, Jeremiah J. Moon

Life of this patent

Estimating the term…

Loading patent…

Abstract

Described is a mechanism comprising a data screening filter and user mode service that applies (enforces) policies regarding allowing or blocking file content of a directory, based on matching the filename against patterns associated with that directory. An administrator configures a screening policy, such as the types of files to allow in a particular directory and the types of files to block. File groups of member patterns and non-member exclusion patterns are defined and selectively collected in directory screening objects (DSOs). A directory screening object (DSO) is associated with a directory. When an I/O create request specifying a filename and a target directory is received, the filename is evaluated against the member/non-member patterns in the file groups referenced by the DSO for that directory to make for an allow or block policy decision. If not matched, DSOs on parent directories are evaluated upwards seeking a policy decision.

Claims15

Dependent claims

At least one computer storage medium having computer-executable instructions, which are executed by at least one processor to perform:

(a) receiving a request to create a file, the request including data corresponding to a filename and a target directory;
(b) setting the target directory as a current directory;
(c) determining that the current directory is not associated with either a first set of data corresponding to a first set of policy, or a second set of data corresponding to a second set of policy, wherein each set of data corresponds to a set of one or more patterns;
(d) in response to determining step (c), determining that the current directory has a parent directory and changing the current directory to the parent directory;
(e) determining that the current directory that was changed to the parent directory in step (d) is associated with at least the first set of data corresponding to the first set of policy;
(f) determining that the filename is a member of the first set of data by comparing the filename to a pattern corresponding to the first set of data;
(g) applying the first set of policy;
and
(h) exiting, wherein the current directory that was changed to the parent directory in step (d) is also associated with the second set of data corresponding to the second set of policy, the filename is a member of the second set of data, and the step of exiting comprises exiting without applying the second set of policy.

6 more elements

A method for applying policy to a request to create a file, the method comprising:

(a) receiving, in a computer system, a request to create a file, the request including data corresponding to a filename and a target directory;
(b) setting the target directory of the computer system as a current directory;
(c) determining by the computer system that the current directory is not associated with either a first set of data corresponding to a first set of policy, or a second set of data corresponding to a second set of policy, wherein each set of data corresponds to a set of one or more patterns;
(d) in response to determining step (c), determining by the computer system that the current directory has a parent directory in the computer system and changing the current directory to the parent directory;
(e) determining by the computer system that the current directory that was changed to the parent directory in step (d) is associated with at least the first set of data corresponding to the first set of policy;
(f) determining by the computer system that the filename is a member of the first set of data by comparing the filename to a pattern corresponding to the first set of data;
(g) applying by the computer system the first set of policy;
and
(h) exiting by the computer system, wherein the current directory that was changed to the parent directory in step (d) is also associated with the second set of data corresponding to the second set of policy, the filename is a member of the second set of data, and the step of exiting comprises exiting without applying the second set of policy.

6 more elements

A system for applying a set of policy to a request to create a file, comprising:

a processor;
a memory, communicatively coupled to the processor, containing instructions that are executed by the processor to perform:
(a) receiving a request to create a file, the request including data corresponding to a filename and a target directory;
(b) setting the target directory as a current directory;
(c) determining that the current directory is not associated with either a first set of data corresponding to a first set of policy, or a second set of data corresponding to a second set of policy, wherein each set of data corresponds to a set of one or more patterns;
(d) in response to determining step (c), determining that the current directory has a parent directory and changing the current directory to the parent directory;
(e) determining that the current directory that was changed to the parent directory in step (d) is associated with at least the first set of data corresponding to the first set of policy;
(f) determining that the filename is a member of the first set of data by comparing the filename to a pattern corresponding to the first set of data;
(g) applying the first set of policy;
and
(h) exiting, wherein the current directory that was changed to the parent directory in step (d) is also associated with the second set of data corresponding to the second set of policy, the filename is a member of the second set of data, and the step of exiting comprises exiting without applying the second set of policy.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 10/999,537Filed 30 Nov 2004
Published: US 2006/0117063 A11 Jun 2006
Granted: 6 Oct 2009
Term ends: Not estimatedThe source records don’t support an estimate.

Classification3 codes

G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
G06F 21/6281
To a system of files or objects, e.g. local or distributed file system or database: at program execution time, where the protection is within the…
G06F
Computing and data processing