Item sharing based on information boundary and access control list settings

• US 9,384,337 B1
• Filed: 04/27/2015
• Issued: 07/05/2016
• Est. Priority Date: 04/27/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Pasch, Mary David, Burst, Alexandru, Rayson, Steve, Van Waardhuizen, Michael, Sirbu, Alin, DeMaris, John Lincoln, Shallcross, Zachary
• Primary Examiner(s): Morrison, Jay
• Application Number:
  US14/697,540
• Time in Patent Office: 435 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

An item is shared based on an information boundary and access control settings. An application such as a document management application detects a selection of an information boundary to manage a sharing action associated with the item. The information boundary includes rules to define how the item is shared. A selection of an access control list is also detected to manage recipients who have an access to the item. The access control list allows a recipient in the list an ability to search and discover the item. In response to a detection of the sharing action to share the item, the information boundary and the access control list is applied to the item. The item is then shared based on the information boundary and the access control list through a link of the item transmitted to a recipient.

Claims

1. A computing device configured to share an item based on information boundary and access control list settings, the computing device comprising:

a memory configured to store one or more instructions; and

a processor coupled to the memory and configured to execute an item management application, wherein the item management application is configured to;

detect a first selection of an information boundary to manage a sharing action associated with the item;

provide a user interface of the item management application to enable selection of one or more access rules associated with the information boundary to define the information boundary, wherein the one or more access rules are displayed through the user interface in a sorted format from a most restrictive access rule to a least restrictive access rule;

detect a second selection of an access control list to manage recipients who have an access to the item;

detect the sharing action to share the item;

apply the information boundary and the access control list to the item;

share the item based on the information boundary and the access control list by transmitting a link to the item to the recipients in the access control list; and

in response to a determination that the link was transmitted to an additional recipient that is not in the access control list;

detect an attempt by the additional recipient to access the item through the link;

determine whether the additional recipient is allowed to access the item based on the information boundary; and

in response to a determination that the additional recipient is allowed to access the item based on the information boundary, add the additional recipient to the access control list such that the additional recipient is enabled to search and discover the item through a user interface of the item management application.

2. The computing device of claim 1, wherein the item management application is further configured to:

in response to a detection of a creation of the item, assign default information boundaries to the item.

3. The computing device of claim 2, wherein the item management application is further configured to:

provide a user interface to allow an administrator of the default information boundaries to one or more of create and manage one or more rules of the default information boundaries.

4. The computing device of claim 1, wherein the item management application is further configured to:

identify a new recipient in the sharing action;

in response to a detection of the new recipient in the access control list, determine whether the new recipient is within the information boundary of the item; and

in response to a detection that the new recipient is within the information boundary of the item, grant the new recipient an access to the item.

5. The computing device of claim 1, wherein the item management application is further configured to:

identify a new recipient in the sharing action;

in response to a failure to detect the new recipient in the access control list, determine whether the new recipient is within the information boundary of the item; and

in response to a detection that new recipient is within the information boundary of the item, grant the new recipient an access to the item and add the new recipient to the access control list.

6. The computing device of claim 1, wherein the item management application is further configured to:

allow a sharer of the item to select the information boundary from a number of information boundaries, wherein the number of information boundaries include one or more access rules associated with the item.

7. The computing device of claim 6, wherein the item management application is further configured to:

allow the sharer to manage the one or more access rules, wherein the one or more access rules include one or more of a read access rule, a write access rule, and an execute access rule.

8. The computing device of claim 1, wherein the item management application is further configured to:

receive organizational instructions to store the recipients in groups; and

add the groups to the access control list.

9. The computing device of claim 1, wherein the item management application is further configured to:

detect a third selection of a group to grant the group an access to the item, wherein the group includes a subset of the recipients; and

add one or more rules to the information boundary to grant the group the access to the item.

10. The computing device of claim 9, wherein the item management application is further configured to:

provide a user interface to allow an administrator of the information boundary to define the group and the access, wherein the access includes one or more of a read access, a write access, and an execute access to the item.

11. The computing device of claim 9, wherein the item management application is further configured to:

provide a user interface to allow a sharer of the item to edit the group and the access, wherein the access includes one or more of a read access, a write access, and an execute access to the item.

12. A method to employ context-based inference to share an item based on information boundary and access control list settings, the method comprising:

detecting a first selection of an information boundary to manage a sharing action associated with the item, wherein the information boundary includes one or more access rules associated with the item;

providing a user interface of an item management application to enable selection of one or more access rules associated with the information boundary to define the information boundary, wherein the one or more access rules are displayed through the user interface in a sorted format from a most restrictive access rule to a least restrictive access rule;

detecting a second selection of an access control list to manage recipients who have an access to the item;

detecting the sharing action to share the item;

applying the information boundary and the access control list to the item;

sharing the item based on the information boundary and the access control list by transmitting a link to the item to a selected recipient that is in the access control list; and

in response to a determination that the link was transmitted to an additional recipient that is not in the access control list;

detecting an attempt by the additional recipient to access the item through the link;

determining whether the additional recipient is allowed to access the item based on the information boundary; and

in response to a determination that the additional recipient is allowed to access the item based on the information boundary, adding the additional recipient to the access control list such that the additional recipient is enabled to search and discover the item through a user interface of the item management application.

13. The method of claim 12, further comprising:

detecting an execution of a search for the item by the selected recipient; and

maintaining an invisible status of the item to the search.

14. The method of claim 13, further comprising:

detecting an access to the item through the link by the selected recipient.

15. The method of claim 14, further comprising:

detecting an execution of another search for the item by the selected recipient; and

providing the item within a results list for the other search.

16. The method of claim 12, further comprising:

allowing an administrator of the information boundary to define a number of information boundaries to a sharer of the item for the first selection; and

allowing the administrator of the access control list to define the recipients to the sharer of the item for the second selection.

17. A computer-readable memory device with instructions stored thereon to share an item based on information boundary and access control list settings, the instructions comprising:

detecting a first selection of an information boundary to manage a sharing action associated with the item, wherein the information boundary includes one or more access rules associated with the item;

providing a user interface of an item management application to enable selection of at least one of the one or more access rules to define the information boundary, wherein the one or more access rules are displayed through the user interface in a sorted format from a most restrictive access rule to a least access restrictive rule;

detecting a second selection of an access control list to manage recipients who have an access to the item;

detecting the sharing action to share the item;

applying the information boundary and the access control list to the item;

sharing the item based on the information boundary and the access control list by transmitting a link to the item to a selected recipient that is in the access control list; and

in response to a determination that the link was transmitted to an additional recipient that is not in the access control list;

detecting an attempt by the additional recipient to access the item through the link;

determining whether the additional recipient is allowed to access the item based on the information boundary; and

in response to a determination that the additional recipient is allowed to access the item based on the information boundary, adding the additional recipient to the access control list such that the additional recipient is enabled to search and discover the item through a user interface of the item management application.

18. The computer-readable memory device of claim 17, wherein the instructions further comprise:

detecting an execution of a search for the item by the selected recipient; and

maintaining an invisible status of the item to the search.

19. The computer-readable memory device of claim 18, wherein the instructions further comprise:

detecting an execution of another search for the item by the selected recipient; and

providing the item within a results list for the other search.