DISTRIBUTION OF INFORMATION PROTECTION POLICIES TO CLIENT MACHINES

• US 20090158384A1
• Filed: 12/18/2007
• Published: 06/18/2009
• Est. Priority Date: 12/18/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ren, Li, Waxman, Peter D., Mehdi, Syed A., Priest, Patricia, Kanade, Abhijat A., Zhong, Yuhui, Cottrille, Scott C., Kostal, Gregory, Malaviarachchi, Rushmi U., Parambir, Kumar B.
• Granted Patent: US 8,156,538 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

One embodiment includes a method which may be practiced in a computing environment where resources are distributed. The method includes acts for obtaining policy information defining restrictions on resources distributed in the computing environment. The method includes sending a request to a server for metadata about one or more resource protection policies at the server. In response to the request, metadata about one or more resource protection polices at the server is received from the server. The metadata from the server is analyzed. Based on analyzing the metadata, one or more resource protection policies stored at the client are updated.

Claims

1. In a computing environment where resources are distributed, a method of obtaining policy information defining restrictions on resources distributed in the computing environment, the method comprising:

sending a request to a server for metadata about resource protection policies at the server;

in response to the request, receiving from the server metadata about one or more resource protection polices at the server;

analyzing the metadata from the server; and

based on analyzing the metadata, updating one or more resource protection policies stored at the client.

2. The method of claim 1, wherein updating one or more resource protection policies stored at the client comprises obtaining a different version of a policy previously stored at the client from the server.

3. The method of claim 1, wherein updating resource protection policies stored at the client comprises obtaining a new policy not previously stored at the client from the server.

4. The method of claim 1, wherein updating one or more resource protection policies stored at the client comprises deleting a policy previously stored at the client.

5. The method of claim 1, wherein the server functions as a known location where a user can obtain policy information.

6. The method of claim 1, wherein sending a request to a server for metadata about resource protection policies at the server is performed in response to receiving a request from a task, wherein the task is configured to cause the client to obtain metadata about resource protection policies according to a predetermined schedule.

7. The method of claim 6, wherein the predetermined schedule comprises a predetermined interval.

8. The method of claim 1, wherein sending a request to a server for metadata about resource protection policies at the server is performed in response to receiving a request from an application requiring one or more resource protection policies to access a resource.

9. The method of claim 8, further comprising:

providing an indication to the application that one or more resource protection policies at the client have been updated;

in response to providing an indication to the application that one or more resource protection policies at the client have been updated, receiving a request from the application for metadata about resource protection policies at the client;

in response to receiving a request from the application for metadata about resource protection policies at the client, sending metadata to the application about resource protection policies at the client;

in response to sending metadata to the application about resource protection policies at the client, receiving a request for one or more resource protection policies from the application; and

in response to receiving a request for one or more resource protection policies from the application sending one or more resource protection policies to the application.

10. The method of claim 1, wherein the client comprises an application programming interface (API), and wherein the request to a server for metadata about resource protection policies at the server is performed in response to receiving a request at the API.

11. In a computing environment where resources are distributed, a method of providing policy information defining restrictions on resources distributed in the computing environment, the method comprising:

receiving a request from a client for metadata about resource protection policies at a server; and

in response to the request for metadata about resource protection polices at the server, sending metadata about one or more resource protection polices at the server to the client.

12. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on user identity information provided by the client.

13. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on role information provided by the client.

14. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on group membership information.

15. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on physical location information provided by the client.

16. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on administrator marked policies at the server.

17. The method of claim 11, further comprising:

in response to sending metadata about resource protection polices at the server to the client, receiving a request for one or more policies stored at the server; and

in response to receiving a request for one or more policies stored at the server, sending one or more policies to the client.

18. In a computing environment where resources are distributed, a method of providing policy information defining restrictions on resources distributed in the computing environment, the method comprising:

receiving a request from an application for metadata about one or more resource protection policies at a client;

in response to receiving a request from the application for metadata about one or more resource protection policies at the client, sending metadata to the application about one or more resource protection policies at the client;

in response to sending metadata to the application about one or more resource protection policies at the client, receiving a request for one or more resource protection policies from the application; and

in response to receiving a request for one or more resource protection policies from the application, sending one or more resource protection policies to the application.

19. The method of claim 18, further comprising providing an indication to the application that resource protection policies at the client have been updated, and wherein receiving a request from an application for metadata about one or more resource protection policies at a client is performed in response to a request from the application as a result of providing an indication to the application that one or more resource protection policies at the client have been updated.

20. The method of claim 19, wherein providing an indication to the application that resource protection policies at the client have been updated is performed in response to a request from an application or task sent to the client.