# US 9,438,547 B2 · Uniform policy for security and information protection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,438,547 B2
- Document ID: US9438547B2
- Status: Granted
- Kind: B2
- Application number: 13/545,854
- Filed: 2012-07-10
- Published: 2014-01-16
- Granted: 2016-09-06
- Earliest claimed: 2012-07-10
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Lynn Ayres; Jack Kabat; Vikram Kakumani; Mashuri Libman; Benjamin Stull; Anatoly Koretsky; Vidyaraman Sankaranarayanan
- Inventors: Lynn Ayres; Jack Kabat; Vikram Kakumani; Mashuri Libman; Benjamin Stull; Anatoly Koretsky; Vidyaraman Sankaranarayanan
- Web page: https://patentgrep.com/patent/US9438547B2

## CPC

- H04L 51/212: using filtering or selective blocking
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- H04L 51/234: for tracking messages
- H04L 51/063: Content adaptation, e.g. replacement of unsuitable content
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

System and methods for the implementation and/or enforcement of an email policy for an organization's email system are presented. A Data Loss Prevention (DLP) policy may be implemented on top of the email system. In one embodiment, the DLP policy may comprise modules and/or processing that tests emails for such sensitive data within emails. If an email comprises such sensitive data, then the DLP policy directives may specify processing to be applied as part of each stage of mail processing, from authoring to mail processing on the server and delivery. A single policy may be authored and managed that will apply the policy directives uniformly across all aspects of the message lifecycle. Each of the message policy enforcement systems may evaluate the single policy definition and apply the policy directives in a manner consistent with the contextual evaluation of the policy.

## Claims

### Claim 1

A method for providing a data loss prevention (DLP) policy on an organizational file system, said organizational file system comprising a plurality of electronic data subsystems, on a single policy directive basis, said organizational file system comprising a server and a set of clients, said clients in communication with said server, said DLP policy comprising a set of modules, the steps of said method comprising:
defining a set of single policy definitions, said single policy definition comprising a directive and an associate action, said single policy definitions capable of applying to a file stored within at least one of the electronic data subsystems throughout an entire lifecycle of said file;
disseminating said set of single policy definitions;
processing the file within at least one of the electronic data subsystems, said file authored by a user; and
if one of the single policy directive is triggered at two or more times during the lifecycle of said file, applying an action associated with said single policy action;
sending to end-users an indication of actions and contextual information regarding the policy being triggered; and
sending the user a Non Delivery Report (NDR) message, if a policy directive that identifies sensitive information may allow user override of the policy before sending the sensitive information;
sending a business justification text submitted by the sender, if the sender overrides the policy.

### Claim 2 (depends on 1)

The method of claim 1 wherein the step of defining a set of single policy definitions further comprises:
defining a set of policies to be applied to said electronic data subsystems; and
selecting a set of common directive and associated actions from said set of policies.

### Claim 3 (depends on 1)

The method of claim 1 wherein said step of defining a set of single policy definitions further comprises:
defining a set of policies to be applied to a set of electronic file systems within an organization; and
selecting a set of common directive and associated actions from said set of policies.

### Claim 4 (depends on 1)

The method of claim 1 wherein said step of disseminating said set of single policy definitions further comprises:
disseminating said set of single policy definitions to said at least one of the electronic data subsystems via a policy dissemination module.

### Claim 5 (depends on 1)

The method of claim 1 wherein said step of processing the file within at least one of the electronic data subsystems, said email authored by a user further comprises:
sending the file to a DLP policy evaluation module.

### Claim 6 (depends on 1)

The method of claim 1 wherein said actions comprise one of a group, said group comprising: NotifyOnly, RejectMessage, RejectUnlessFalsePositiveOverride, RejectUnlessSilentOverride, RejectUnlessExplicitOverride.

### Claim 7 (depends on 1)

The method of claim 1 wherein the step of sending the user a Non Delivery Report (NDR) message further comprises:
requiring the user to acknowledge an override prior to sending the file.

### Claim 8 (depends on 7)

The method of claim 7 wherein the step of requiring the user to acknowledge an override prior to sending the file further comprises:
reporting one of a group of details, said group comprising: (1) if sender override was specified, (2) any business justification text submitted by the sender, (3) if sender marked the mail as false positive and (4) client-supplied content.

### Claim 9 (depends on 8)

The method of claim 8 wherein the step of reporting one of a group of details further comprises:
sending an incident report to an auditing module within said DLP Policy.

### Claim 10

An email system for affecting a data loss prevention (DLP) policy, said email system comprising:
an email server;
a set of email clients, said email clients in communication with said email server;
a DLP policy module, said DLP policy module capable of enforcing a set of policy rules upon emails authored by users of said email system, said DLP policy module capable of enforcing said set of policy rules upon said email throughout an entire lifecycle of said email; and
wherein said DLP policy module further comprising a set of single policy definitions, said single policy definitions comprising a directive and an associate action, and further wherein said DLP policy module capable of testing said emails for sensitive data as defined in a directive and capable of taking the associated action;
wherein further said DLP policy module is applied to a plurality of electronic data subsystems in addition to said email server; and
further wherein said DLP policy module is capable of sending to end-users an indication of actions and contextual information regarding the policy being triggered by end-users interaction; and
sending the user a Non Delivery Report (NDR) message, if a policy directive that identifies sensitive information may allow user override of the policy before sending the sensitive information;
sending a business justification text submitted by the sender, if the sender overrides the policy.

### Claim 11 (depends on 10)

The system of claim 10 wherein said system further comprises:
a single policy enforcement module, said single policy enforcement module capable of making available information regarding actions taken for said email system to other electronic file systems and their associated policy modules.

### Claim 12 (depends on 10)

The system of claim 10 wherein said DLP policy module further comprises:
an incident reporting module, said incident reporting module capable of reporting the triggering of single policy definitions.

### Claim 13 (depends on 10)

The system of claim 10 wherein said incident reporting module is capable of sending a report comprising one of a group of details, said group comprising: (1) if sender override was specified, (2) any business justification text submitted by the sender, (3) if sender marked the mail as false positive and (4) client-supplied content.

### Claim 14 (depends on 10)

The system of claim 10 wherein said DLP policy module further comprises:
an auditing module, said auditing module providing performance data of said DLP policy module over a specified period of time.

### Claim 15

One or more computer-readable storage devices comprising executable instructions by a processor, and said processor executing said instructions is capable of performing a method, the method comprising:
disseminating said set of single policy definitions, said single policy definition comprising a directive and an associate action, said single policy definitions capable of applying to a file stored within at least one of a plurality of electronic data subsystems, wherein said plurality of electronic data subsystems comprise an organizational file system throughout an entire lifecycle of said file;
processing said file stored within at least one of a plurality of electronic data subsystems, said file authored by a user;
if one of the single policy directive is triggered at two or more times during the lifecycle of said file, applying an action associated with said single policy action;
sending to end-users an indication of actions and contextual information regarding the policy being triggered; and
sending the user a Non Delivery Report (NDR) message, if a policy directive that identifies sensitive information may allow user override of the policy before sending the sensitive information;
sending a business justification text submitted by the sender, if the sender overrides the policy.

### Claim 16 (depends on 15)

The one or more computer-readable storage devices of claim 15 wherein said step of defining a set of single policy definitions further comprises:
defining a set of policies to be applied to said at least one of a plurality of electronic data subsystems; and
selecting a set of common directive and associated actions from said set of policies.

### Claim 17 (depends on 15)

The one or more computer-readable storage devices of claim 15 wherein said step of disseminating said set of single policy definitions further comprises:
disseminating said set of single policy definitions to said at least one of a plurality of electronic data subsystems via a policy dissemination module.