System for context-based data protection

• US 10,192,039 B2
• Filed: 06/27/2014
• Issued: 01/29/2019
• Est. Priority Date: 06/27/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Huang, Jerry, Liu, Zhen, Li, QingHu, Liu, Howard
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US14/402,280
• Publication Number:
  US 20160283698A1
• Time in Patent Office: 1,677 Days
• Field of Search: 726 26
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 3/015 Input arrangements based on nervous system activity detection, e.g. brain waves [EEG] detection, electromyograms [EMG] detection, electrodermal response detection
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04883 for inputting data by handwriting, e.g. gesture or text
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption

Abstract

Methods, systems, and computer program products are provided for protecting stored data. A user interface module enables a data sensitivity level, a data protection response, and a contextual trigger to be associated with data stored in a computing device. The user interface is configured to enable the data protection response to be selected from a plurality of data protection responses that includes a soft delete and a hard delete. A contextual trigger monitor is configured to monitor for an occurrence of the contextual trigger. A data protection enactor is configured to enact the data protection response associated with the data when an occurrence of the contextual trigger is detected.

Claims

1. A method in a computing device, comprising:

storing data in a storage device of the computing device, the stored data stored with assigned parameters including sensitivity level, an associated data protection response selected from a plurality of data protection responses that includes a soft delete and a hard delete, and a contextual trigger configured to cause the assigned data protection response to be enacted;

subsequent to said storing, monitoring for an occurrence of the assigned contextual trigger;

comparing the occurred contextual trigger to the assigned contextual trigger to determine a match; and

enacting the data protection response associated with the data in response to the determined match.

2. The method of claim 1, wherein the contextual trigger is a location, said monitoring comprises:

determining a location of the computing device;

said comparing comprises;

comparing the determined location of the computing device to the contextual trigger location; and

said enacting comprises;

enacting the data protection response when the determined location of the computing device is the contextual trigger location.

4. The method of claim 1, wherein the contextual trigger is a biometric condition of a user associated with the computing device.

5. The method of claim 4, wherein said monitoring for an occurrence of the assigned contextual trigger comprises:

monitoring for at least one of;

a heart rate greater than a predetermined threshold high heart rate value;

a heart rate lower than a predetermined threshold low heart rate value;

a sweat level greater than a predetermined threshold high sweat level value;

a sweat level lower than a predetermined threshold low sweat level value;

a temperature greater than a predetermined threshold high temperature level value;

a temperature lower than a predetermined threshold low temperature level value;

a blood pressure greater than a predetermined threshold high blood pressure value;

or

a blood pressure lower than a predetermined threshold low blood pressure value.

6. The method of claim 1, wherein the data protection response is the soft delete, and said enacting the data protection response associated with the data in response to the determined match comprises:

concealing the data on the computing device from view by a user.

7. The method of claim 6, further comprising:

restoring the data on the computing device to being visible to the user.

8. The method of claim 1, further comprising:

providing a user interface that enables the data sensitivity level, the contextual trigger, and the associated data protection response to be assigned to the data.

9. The method of claim 8, wherein said providing a user interface that enables the data sensitivity level, the contextual trigger, and the assigned data protection response to be assigned to the data comprises:

enabling the data protection response to be at least one of

broadcasting an alert,

disabling a file from being able to be opened,

closing an open data display window, or

hiding an open data display window behind at least one other window.

3. A method in a computing device to protect stored data, comprising:

monitoring for an occurrence of a contextual trigger, the contextual trigger being a location associated with data stored by the computing device, the data having an assigned sensitivity level and having an associated data protection response selected from a plurality of data protection responses that includes a soft delete and a hard delete, the monitoring comprising predicting a future location of the computing device and comparing the predicted future location of the computing device to the contextual trigger location; and

enacting the data protection response associated with the data when the occurrence of the contextual trigger is detected, the enacting comprising enacting the data protection response when the predicted future location of the computing device is the contextual trigger location.

10. A method in a server, comprising:

providing a user interface that enables a data sensitivity level to be assigned to data stored in a storage device on a computing device that is separate from the server;

enabling a data protection response to be selected through the user interface to be associated with the stored data, the data protection response selected from a plurality of data protection responses that includes a soft delete and a hard delete, the stored data stored in the storage device with assigned parameters including the sensitivity level, the associated data protection response, and a contextual trigger configured to cause the assigned data protection response to be enacted; and

enabling the contextual trigger to be assigned to the stored data through the user interface, the data protection response enacted to protect the stored data in response to detecting an occurrence of the assigned contextual trigger and determining a match of the occurred contextual trigger and the assigned contextual trigger.

11. The method of claim 10, wherein said enabling a data protection response to be selected through the user interface to be associated with the stored data comprises:

enabling the data protection response to be selected to be at least one of

broadcasting an alert,

disabling a file from being able to be opened,

closing an open data display window, or

hiding an open data display window behind at least one other window.

12. The method of claim 10, wherein said enabling a contextual trigger to be assigned to the stored data through the user interface comprises:

enabling a location to be assigned to the data, the data protection response enacted to protect the data when the computing device is detected at the location.

14. The method of claim 10, wherein said enabling the contextual trigger to be assigned to the stored data through the user interface comprises:

enabling a biometric condition of a user associated with the computing device to be assigned to the data.

13. A method in a server, comprising:

providing a user interface that enables a data sensitivity level to be assigned to data stored on a computing device that is separate from the server;

enabling a data protection response to be selected through the user interface to be associated with the data, the data protection response enabled to be selected from a plurality of data protection responses that includes a soft delete and a hard delete; and

enabling a contextual trigger to be assigned to the data through the user interface, the data protection response enacted to protect the data when an occurrence of the contextual trigger is detected, the enabling a contextual trigger to be assigned to the data through the user interface comprising enabling a location to be assigned to the data, the data protection response enacted to protect the data when the computing device is predicted to be at the location in the future.

15. A system in a computing device, comprising:

a user interface module that enables a data sensitivity level, a data protection response, and a contextual trigger to be associated with data stored on the computing device, the stored data stored with assigned parameters including a sensitivity level, an associated data protection response selected from a plurality of data protection responses that includes a soft delete and a hard delete, and a contextual trigger configured to cause the assigned data protection response to be enacted;

a contextual trigger monitor configured to monitor, subsequent to the stored data being stored, for an occurrence of the assigned contextual trigger; and

a data protection enactor configured to enact the data protection response associated with the data in response to a determined match of the occurred contextual trigger and the assigned contextual trigger.

16. The system of claim 15, wherein the contextual trigger is a location, the contextual trigger monitor comprises:

a location determiner configured to determine a location of the computing device; and

a location comparator configured to compare the determined location of the computing device to the contextual trigger location; and

the data protection enactor is configured to enact the data protection response when the determined location of the computing device is the contextual trigger location.

18. The system of claim 15, wherein the contextual trigger is a biometric condition of a user associated with the computing device.

19. The system of claim 15, wherein the data protection response is the soft delete;

and

the data protection enactor is configured to conceal the data on the computing device from view by a user.

20. The system of claim 19, wherein the data protection enactor is configured to restore the data on the computing device to being visible to the user.

17. A system in a computing device to protect stored data, comprising:

a user interface module that enables a data sensitivity level, a data protection response, and a contextual trigger to be associated with data stored on the computing device, the user interface configured to enable the data protection response to be selected from a plurality of data protection responses that includes a soft delete and a hard delete;

a contextual trigger monitor configured to monitor, subsequent to the data being stored, for an occurrence of the contextual trigger, the contextual trigger being a location, the contextual trigger monitor comprising;

a location predictor configured to predict a future location of the computing device; and

a location comparator configured to compare the predicted future location of the computing device to the contextual trigger location; and

a data protection enactor configured to enact the data protection response associated with the data when an occurrence of the contextual trigger is detected, the data protection enactor configured to enact the data protection response when the predicted future location of the computing device is the contextual trigger location.