Data classification for digital rights management

• US 9,323,901 B1
• Filed: 09/28/2007
• Issued: 04/26/2016
• Est. Priority Date: 09/28/2007
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Nair, Manoj, Perrin, Stephen R.
• Primary Examiner(s): Popham, Jeffrey D
• Application Number:
  US11/864,764
• Time in Patent Office: 3,133 Days
• Field of Search: 713/167
• US Class Current: 1/1
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]

Abstract

Information management is used to enforce and control rights associated with data through the use of policies implemented by a digital rights management (“DRM”) server. An information management system collects information about data objects in a computer system and classifies the data objects into one or more categories. The categories are mapped to service level objectives that include or request encryption and identify DRM policies to associate with data objects within each category. Each DRM policy identifies one or more users authorized to access data objects the DRM policy is associated with. Encryption is orchestrated, in one embodiment, by identifying a data object to the DRM server in an encryption request, and identifying a DRM policy to associate with the data object. The DRM server encrypts the data object and only allows it be decrypted by authorized users.

Claims

1. A method of using information management to provide digital rights management (DRM), the method comprising:

discovering an environment in which DRM can be performed, wherein discovering the environment includes discovering data objects residing in a computer system, and wherein discovery of the data objects is performed using one or more adapters;

repeating part of the discovery process, wherein repeating part of the discovery process includes monitoring the computer system for a change to one or more of the data object;

collecting metadata from each of a plurality of the data objects and generating additional metadata from each data object, wherein the data objects are stored on storage devices in a computer system, wherein at least the additional metadata is generated by applying rules to each of the data objects;

recognizing different groupings associated with the data objects including a first grouping of data objects and a second grouping of data objects;

selecting categorization rules for the data objects, the categorization rules including first rules for the first grouping of data objects and second rules for the second grouping of data objects;

classifying each data object into one or more categories by assigning at least some of the one or more categories based on at least the metadata and the additional metadata, wherein each data object is classified independently of other data objects, wherein a first category included in the one or more categories requires digital rights management, wherein at least some of the data objects are classified in different categories, wherein assigning categories includes applying the categorization rules to each of the data objects by applying the first rules to the first grouping of data objects and by applying the second rules to the second grouping of data objects, and wherein a classification of a data object is used as a basis to evaluate a cost associated with implementation of a desired service level for that data object;

mapping the data objects to service level objectives based on the categories associated with the data objects, wherein the service level objectives include first and second DRM service level objectives that are different from each other, wherein data objects associated with the first category are mapped to one or more of the DRM service level objectives and the data objects classified in categories other than the first category are mapped to service level objectives different from the DRM service level objectives;

mapping the first and second DRM service level objectives to selected respective first and second DRM policies so that objects which have been mapped to a DRM service level objective are also mapped to a DRM policy, wherein selection of one or the other of the first and second DRM policies for mapping is based on a difference between the first and second DRM service level objectives;

mapping the first DRM service level objective and the second DRM service level objective to services that are actually available from service providers that best match the first DRM service level objectives and the second DRM service level objectives, wherein a service gap is present when the first DRM service level objective or the second DRM service level objective does not match or is not satisfied by the services to which the first DRM service level objective is mapped or to which the second DRM service level objective is mapped; and

orchestrating services associated with the DRM service level objectives such that a first data object receives DRM services associated with the first DRM service level objective and second data object receives DRM services associated with the second DRM service level objective, wherein the DRM services provided to the first data object are different from the DRM services provided to the second data object.

2. The method of claim 1, wherein the first DRM policy to which the DRM service level objective is mapped identifies a first set of one or more users authorized to perform one or more file operations on data objects associated with the first DRM policy.

3. The method of claim 2, wherein the second DRM policy to which the DRM service level objective is mapped identifies a second set of one or more users authorized to perform one or more file operations on data objects associated with the second DRM policy.

4. The method of claim 3, wherein the first set of one or more users is different from the second set of one or more users.

5. The method of claim 2, wherein a file operation comprises accessing, changing, or deleting a data object.

6. The method of claim 1, wherein orchestrating DRM services for the first data object classified into the first category comprises providing an encryption request to a digital rights management server, wherein the encryption request identifies the first data object and a DRM policy to which the DRM service level objective for the first data object has been mapped.

7. The method of claim 6, wherein the digital rights management server encrypts the first data object and enforces the DRM policy by preventing the first data object from being decrypted except by the one or more users authorized to perform the one or more file operations on data objects associated with the DRM policy.

8. The method of claim 1, wherein mapping the data objects to service level objectives includes:

mapping a single data object to two or more conflicting policies; and

resolving the conflict based on a priority.

9. A physical storage device having stored therein computer-executable instructions which, when executed by a computing system, provide digital rights management (DRM) for objects, wherein digital rights management comprises:

discovering an environment in which DRM can be performed, wherein discovering the environment includes discovering a server, service, application, and data objects residing in a computer system, and wherein discovery of the server, service, application and data objects is performed using one or more adapters;

repeating part of the discovery process, wherein repeating part of the discovery process includes monitoring the computer system for a change to one or more of a server, service, application or data object;

collecting metadata from each of a plurality of data objects and generating additional metadata from each data object, wherein the data objects are stored on storage devices in a computer system, wherein at least the additional metadata is generated by applying rules to each of the data objects;

recognizing different groupings associated with the data objects including a first grouping of data objects and a second grouping of data objects;

selecting categorization rules for the data objects, the categorization rules including first rules for the first grouping of data objects and second rules for the second grouping of data objects;

classifying each data object into one or more categories by assigning at least some of the one or more categories based on at least the metadata and the additional metadata, wherein each data object is classified independently of other data objects, wherein a first category included in the one or more categories requires digital rights management, wherein at least some of the data objects are classified in different categories;

applying categorization rules to each of the data objects to assign categories by applying the first rules to the first grouping of data objects and by applying the second rules to the second grouping of data objects, and wherein a classification of a data object is used as a basis to evaluate a cost associated with implementation of a desired service level for that data object;

mapping the data objects to service level objectives based on the categories associated with the data objects, wherein the service level objectives include first and second DRM service level objectives that are different from each other, wherein data objects associated with the first category are mapped to one or more of the DRM service level objectives and the data objects classified in categories other than the first category are mapped to service level objectives different from the DRM service level objectives;

mapping the first and second DRM service level objectives to selected respective first and second DRM policies so that objects which have been mapped to a DRM service level objective are also mapped to a DRM policy, wherein selection of one or the other of the first and second DRM policies for mapping is based on a difference between the first and second DRM service level objectives;

mapping the first DRM service level objective and the second DRM service level objective to services that are actually available from service providers that best match the first DRM service level objectives and the second DRM service level objectives, wherein a service gap is present when the first DRM service level objective or the second DRM service level objective does not match or is not satisfied by the services to which the first DRM service level objective is mapped or to which the second DRM service level objective is mapped; and

orchestrating services associated with the DRM service level objectives such that a first data object receives DRM services associated with the first DRM service level objective and a second data object receives DRM services associated with the second DRM service level objective, wherein the DRM services provided to the first data object are different from the DRM services provided to the second data object.

10. The physical storage device of claim 9, wherein the first DRM policy to which the DRM service level objective is mapped identifies a first set of one or more users authorized to perform one or more file operations on data objects associated with the first DRM policy.

11. The physical storage device of claim 10, wherein the second DRM policy to which the DRM service level objective is mapped identifies a second set of one or more users authorized to perform one or more file operations on data objects associated with the second DRM policy.

12. The physical storage device of claim 11, wherein the first set of one or more users is different from the second set of one or more users.

13. The physical storage device of claim 10, wherein a file operation comprises accessing, changing, or deleting a data object.

14. The physical storage device of claim 9, wherein orchestrating DRM services for the first data object classified into the first category comprises providing an encryption request to a digital rights management server, wherein the encryption request identifies the first data object and a DRM policy to which the DRM service level objective for the first data object has been mapped.

15. The physical storage device of claim 14, wherein the digital rights management server encrypts the first data object and enforces the DRM policy by preventing the first data object from being decrypted except by the one or more users authorized to perform the one or more file operations on data objects associated with the DRM policy.

16. The physical storage device of claim 9, wherein mapping the data objects to service level objectives includes:

mapping a single data object to two or more conflicting policies; and

resolving the conflict based on a priority.