Providing policy tips for data loss prevention in collaborative environments

• US 9,754,098 B2
• Filed: 02/26/2015
• Issued: 09/05/2017
• Est. Priority Date: 10/26/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Li, Yu, Holley, Richard Wesley, Chavali, Srivalli, Kabat, Jack, Brenne, Leif, Martchenko, Serguei, Mullins, Mark, Libman, Mashuri
• Primary Examiner(s): Su, Sarah
• Application Number:
  US14/633,097
• Publication Number:
  US 20160117517A1
• Time in Patent Office: 922 Days
• Field of Search: 726 27, 726 26
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 40/103 Formatting, i.e. changing of presentation of documents automatic justification G06F40/189; automatic line break hyphenation G06F40/191
• CPC Class Codes: G06Q 10/103 Workflow collaboration or project management
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A policy tip or end user notification is provided for data loss prevention in collaborative environments. A document interactivity application detects an action or trigger by an end user that affects a document. The document is processed, through a classification engine and a unified policy engine, with policies based on the action to detect a matched policy. A policy tip associated with the matched policy is identified and displayed on the display device in association with the document.

Claims

1. A computing device to provide a policy tip for data loss prevention in collaborative environments, the computing device comprising:

a display device;

a memory;

a processor coupled to the memory and the display device, the processor executing a document interactivity application in conjunction with instructions stored in the memory, wherein the document interactivity application is configured to;

display a document to an end user on the display device;

detect an action from the end user on the display device, therein the action affects the document;

process the document based on the action with one or more policies to detect a matched policy from the one or more policies;

identify the policy tip associated with the matched policy;

display the policy tip on the display device in association with the document;

detect an override action that includes a justification from the end user to override the matched policy;

identify an override privilege of the end user;

in response to detecting the override privilege of the end user as sufficient to override the matched policy, capture the justification from the end user prior to overriding the matched policy, and execute the override action to share the document with one or more other end users; and

provide an option to the end user to stop display of a future policy tip related to the displayed policy tip or any future policy tip based on a privilege level of the end user.

2. The computing device of claim 1, wherein the document interactivity application is further configured to:

detect the action to include a save action that attempts to save the document;

identify a subset of the one or more policies that are associated with the save action; and

process the document with subset of the one or more policies to detect the matched policy.

3. The computing device of claim 2, wherein the document interactivity application is further configured to:

detect private information within the document; and

identify the matched policy based on a rule within the matched policy that is triggered in relation to the private information.

4. The computing device of claim 2, wherein the document interactivity application is further configured to:

display the policy tip, on the display device, to inform the end user of the matched policy in relation to the save action.

5. The computing device of claim 1, wherein the document interactivity application is further configured to:

detect the action to include a share action that attempts to share the document with one or more other end users;

identify a subset of the one or more policies that are associated with the share action; and

process the document with the subset of the one or more policies to detect the matched policy.

6. The computing device of claim 5, wherein the document interactivity application is further configured to:

process an access privilege of the one or more other end users to access the document; and

identify the matched policy based on a rule within the matched policy that is triggered in relation to the access privilege of the one or more other end users being insufficient to access the document.

7. The computing device of claim 5, wherein the document interactivity application is further configured to:

display the policy tip, on the display device, to inform the end user of the matched policy in relation to the share action.

8. The computing device of claim 1, wherein the document interactivity application is further configured to:

in response to detecting the override privilege of the end user as sufficient to override the matched policy, execute the action on the document.

9. The computing device of claim 1, wherein the document interactivity application is further configured to:

in response to detecting the override privilege of the end user as sufficient to override the matched policy,

execute the action on the document; and

save the justification.

10. A method executed on a computing device to provide a policy tip for data loss prevention in collaborative environments, the method comprising:

displaying a document to an end user on a display device of the computing device;

detecting an action from the end user on the display device, wherein the action affects the document;

processing the document based on the action with one or more policies to detect a matched policy from the one or more policies;

identifying the policy tip associated with the matched policy;

displaying the policy tip on the display device in association with the document to notify the end user of the matched policy;

detecting an override action that includes a justification from the end user to override the matched policy;

identifying an override privilege of the end user;

in response to detecting the override privilege of the end user as sufficient to override the matched policy, capturing the justification from the end user prior to overriding the matched policy, and executing the override action to share the document with one or more other end users; and

providing an option to the end user to stop display of a future policy tip related to the displayed policy tip or any future policy tip based on a privilege level of the end user.

11. The method of claim 10, further comprising:

in response to detecting the override privilege of the end user as sufficient to override the matched policy, executing the action on the document and transmitting the override action to an administrator of the matched policy to inform the administrator to manage the matched policy; and

in response to detecting the override privilege of the end user as insufficient to override the matched policy, blocking the override action.

12. The method of claim 10, further comprising:

detecting a false positive identification from the end user to report the matched policy as a false positive in relation to the document and the action;

storing the false positive identification; and

transmitting the false positive identification to an administrator of the matched policy to inform the administrator to manage the matched policy to prevent a future false positive identification.

13. The method of claim 10, further comprising:

receiving an update to the one or more policies from an authorized policy resource; and

applying the update to the one or more policies to update the one or more policies.

14. The method of claim 10, further comprising:

processing a metadata of the document with the one or more policies to detect the matched policy.

15. The method of claim 14, further comprising:

displaying the policy tip, on the display device, that includes a portion of the metadata associated with the matched policy.

16. A computer-readable memory device with instructions stored thereon to provide a policy tip for data loss prevention in collaborative environments the instructions comprising:

displaying a document to an end user on a display device of the computing device;

detecting an action, from the end user on the display device, wherein the action affects the document;

processing the document based on the action with one or more policies to detect a matched policy from the one or more policies;

identifying the policy tip associated with the matched policy;

displaying the policy tip on the display device in association with the document to notify the end user of the matched policy;

detecting an override action that includes a justification from the end user to override the matched policy;

identifying an override privilege of the end user;

in response to detecting the override privilege of the end user as sufficient to override the matched policy, capturing the justification from the end user prior to overriding the matched policy, and executing the override action to share the document with one or more other end users; and

providing an option to the end user to stop display of a future policy tip related to the displayed policy tip or any future policy tip based on a privilege level of the end user.

17. The computer-readable memory device of claim 16, wherein the instructions further comprise:

detecting the action to include a save action that attempts to save the document;

identifying a subset of the one or more policies that are associated with the save action;

processing the document with the subset of the one or more policies to detect the matched policy;

detecting private information within the document; and

identifying the matched policy based on a rule within the matched policy that is triggered in relation to the private information.

18. The computer-readable memory device of claim 16, wherein the instructions further comprise:

detecting the action to include a share action that attempts to share the document with one or more other end users;

identifying a subset of the one or more policies that are associated with the share action;

processing the document with the subset of the one or more policies to detect the matched policy;

processing an access privilege of the one or more other end users to access the document; and

identifying the matched policy based on a rule within the matched policy that is triggered in relation to the access privilege of the one or more other end users being insufficient to access the document.