Methods and systems for context-aware policy determination and enforcement

• US 20020124067A1
• Filed: 12/22/2000
• Published: 09/05/2002
• Est. Priority Date: 12/22/2000
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Reus, Edward F., Parupudi, Gopal, Evans, Stephen S.
• Granted Patent: US 7,072,956 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Context aware computing systems and methods are described. In one described embodiment, devices and methods are provided that are context-aware (in one example—location-aware) in that they provide for the application and enforcement of various policies as a function of context. Specifically, various computing devices, through the described methodologies and structures, are able to automatically determine their context. Once context is determined, a collection of policies can be evaluated to provide a resultant set of policies that apply to the given context. The resultant set of policies are then enforced, typically via the device'"'"'s operating system. Policy enforcement can involve promulgating new settings or state to applications that are executing on or off the device. Advantageously, the devices and methodologies can adapt the resultant set of policies as the device'"'"'s context changes so that the policies can be dynamically determined and enforced automatically as the device'"'"'s context changes.

Claims

1. A computing device comprising:

one or more processors;

memory operably associated with the one or more processors;

one or more applications loadable in the memory and executable on the one or more processors; and

the one or more processors being configured to;

receive context information from externally of the device, the context information pertaining to one or more current device contexts;

automatically determine one or more current contexts from the context information;

locally evaluate a collection of policies in connection with the one or more current contexts to provide a resultant set of policies; and

enforce the resultant set of policies on the one or more applications.

2. The device of claim 1, wherein the device is configured to receive context information from multiple different context providers that provide different types of context information.

3. The device of claim 1 further comprising one or more hierarchical traversable tree structures on the device, the tree structures comprising individual nodes each of which being associated with a device context, the device being configured to automatically determine one or more current contexts by traversing at least one node on at least one of the tree structures.

4. The device of claim 3, wherein the one or more hierarchical tree structures comprise at least one primary tree structure, at least one secondary tree structure, and at least one link between the primary and secondary tree structures, the link being traversable to determine the one or more current contexts.

5. The device of claim 3, wherein the one or more hierarchical tree structures provide a common abstract representation of context.

6. The device of claim 1, wherein the device is configured to determine the one or more current contexts dynamically.

7. The device of claim 1, wherein the device is configured to receive policies from different policy sources.

8. The device of claim 1, wherein the device is configured to receive policies from different policy sources, the policies from the different policy sources being defined in terms of a common abstract representation of context.

9. The device of claim 1 embodied as an enterprise device, the collection of policies comprising at least enterprise policies that are defined in terms of a common abstract representation of context.

10. The device of claim 1 embodied as a portable device.

11. The device of claim 1 embodied as a wireless device.

12. The device of claim 1 embodied as a handheld device.

14. The computing device of claim 13, wherein the one or more processors are configured to determine the current context from the context information.

15. The computing device of claim 13, wherein the one or more processors are configured to locally evaluate a collection of policies, in connection with the received context information, to provide the set of policies.

17. The method of claim 16, wherein said evaluating comprises locally evaluating the collection of policies using the computing device.

18. The method of claim 16, wherein said evaluating comprises evaluating the collection of policies remote from the computing device.

19. The method of claim 16, wherein said receiving comprises receiving context information from multiple different context providers that provide different types of context information.

20. The method of claim 16, wherein said receiving comprises wirelessly receiving the context information.

21. The method of claim 16, wherein said automatically determining comprises:

providing one or more hierarchical traversable tree structures on the device, the tree structures comprising individual nodes each of which being associated with a device context; and

traversing at least one node on at least one of the tree structures to provide the current context.

22. The method of claim 21, wherein the one or more hierarchical tree structures comprise at least one primary tree structure, at least one secondary tree structure, and at least one link between the primary and secondary tree structures, the link being traversable to determine the device'"'"'s current context.

23. The method of claim 21, wherein the one or more hierarchical tree structures provide a common abstract representation of context.

24. The method of claim 16 further comprising receiving policies from multiple different policy sources.

25. The method of claim 16 further comprising receiving policies from multiple different policy sources, the policies being defined in terms of a common abstract representation of context.

26. The method of claim 16, wherein the computing device comprises an enterprise computing device and further comprising receiving policies from an enterprise policy source, the policies being defined in terms of a common abstract representation of context.

27. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, cause the computer to implement the method of claim 16.

29. The method of claim 28 further comprising determining, on the computing device, a context that is associated with the context information.

30. The method of claim 28 further comprising locally evaluating a collection of policies responsive to receiving the context information, said evaluating providing a resultant set of policies.

31. The method of claim 28 further comprising receiving one or more policies from externally of the computing device, said one or more policies being associated with a context which is, in turn, associated with the context information.

13. A computing device comprising:

one or more processors;

memory operably associated with the one or more processors;

one or more applications loadable in the memory and executable on the one or more processors; and

the one or more processors being configured to;

receive context information from externally of the device, the context information pertaining to a current device context; and

enforce a set of policies on the one or more applications, the set of policies pertaining to a current context that is associated with the context information.

16. A method of operating a computing device comprising:

receiving context information from externally of a computing device, the context information pertaining to a current device context;

automatically determining, with the computing device, a current context using the context information;

evaluating a collection of policies in connection with the current context to provide a resultant set of policies; and

enforcing the resultant set of policies on one or more applications that are executable by the computing device.

28. A method of operating a computing device comprising:

receiving context information from externally of a computing device, the context information pertaining to a current device context; and

enforcing the resultant set of policies on one or more applications that are executable by the computing device, the resultant set of policies pertaining to a context that is associated with the context information that is received.

32. A computing device comprising:

one or more processors;

memory operably associated with the one or more processors;

one or more applications loadable in the memory and executable on the one or more processors; and

the one or more processors being configured to;

receive context information from externally of the device, the context information pertaining to a current device context;

automatically determine a current context from the context information;

locally evaluate a collection of policies in connection with the current context to provide a resultant set of policies;

enforce the resultant set of policies on the one or more applications; and

responsive to receiving context information that indicates a change of current context;

locally re-evaluate the collection of policies to provide a new resultant set of policies; and

enforce the new resultant set of policies on the one or more applications.

33. The device of claim 32, wherein the device is configured to receive context information from multiple different context providers that provide different types of context information.

34. The device of claim 32 further comprising one or more hierarchical traversable tree structures on the device, the tree structures comprising individual nodes each of which being associated with a device context, the device being configured to automatically determine its current context by traversing at least one node on at least one of the tree structures.

35. The device of claim 34, wherein the one or more hierarchical tree structures comprise at least one primary tree structure, at least one secondary tree structure, and at least one link between the primary and secondary tree structures, the link being traversable to determine the device'"'"'s current context.

36. The device of claim 34, wherein the one or more hierarchical tree structures provide a common abstract representation of context.

37. The device of claim 32, wherein the device is configured to determine current context dynamically.

38. The device of claim 32, wherein the device is configured to receive policies from different policy sources.

39. The device of claim 32, wherein the device is configured to receive policies from different policy sources, all of the policies being defined in terms of a common abstract representation of context.

40. A method of operating a computing device comprising:

wirelessly receiving context information from externally of a computing device, the context information pertaining to a current device context;

automatically determining, with the computing device, a current context using the context information;

locally evaluating, with the computing device, a collection of policies in connection with the current context to provide a resultant set of policies;

enforcing the resultant set of policies on one or more applications that are executable by the computing device;

determining whether the device'"'"'s current context has changed and if so, automatically determining a new current context using received context information;

responsive to determining the new current context, locally re-evaluating, with the computing device, the collection of policies to provide a new resultant set of policies for the new current context; and

enforcing the new resultant set of policies on the one or more applications.

41. The method of claim 40, wherein said receiving comprises receiving context information from multiple different context providers that provide different types of context information.

42. The method of claim 40, wherein said acts of automatically determining comprise:

providing one or more hierarchical traversable tree structures on the device, the tree structures comprising individual nodes each of which being associated with a device context; and

traversing at least one node on at least one of the tree structures to provide the current context.

43. The method of claim 42, wherein the one or more hierarchical tree structures comprise at least one primary tree structure, at least one secondary tree structure, and at least one link between the primary and secondary tree structures, the link being traversable to determine the device'"'"'s current context.

44. The method of claim 42, wherein the one or more hierarchical tree structures provide a common abstract representation of context.

45. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, cause the computer to implement the method of claim 40.

47. The computing device of claim 46, wherein said one or more processors are configured to receive location information from externally of the device.

48. The computing device of claim 46, wherein the device is configured to receive location information from multiple different location providers that provide different types of location information.

49. The computing device of claim 46, further comprising one or more hierarchical traversable tree structures on the device, the tree structures comprising individual nodes each of which being associated with a device location, the device being configured to automatically determine its current location by traversing at least one node on at least one of the tree structures.

50. The computing device of claim 49, wherein the one or more hierarchical tree structures comprise at least one primary tree structure, at least one secondary tree structure, and at least one link between the primary and secondary tree structures, the link being traversable to determine the device'"'"'s current location.

51. The computing device of claim 49, wherein the one or more hierarchical tree structures provide a common abstract representation of location.

52. The computing device of claim 46, wherein the device is configured to determine the current location dynamically.

53. The computing device of claim 46, wherein the device is configured to receive policies from different policy sources.

54. The computing device of claim 46, wherein the device is configured to receive policies from different policy sources, the policies from the different policy sources being defined in terms of a common abstract representation of location.

46. A computing device comprising:

one or more processors;

memory operably associated with the one or more processors;

one or more applications loadable in the memory and executable on the one or more processors; and

the one or more processors being configured to;

receive location information pertaining to a current device location;

automatically determine a current location from the location information;

locally evaluate a collection of policies in connection with the current location to provide a resultant set of policies; and

enforce the resultant set of policies on the one or more applications.

55. A method of operating a computing device comprising:

receiving location information pertaining to a current device location;

automatically determining, with the computing device, a current location using the location information;

locally evaluating, with the computing device, a collection of policies in connection with the current location to provide a resultant set of policies; and

enforcing the resultant set of policies on one or more applications that are executable by the computing device.

56. The method of claim 55, wherein said receiving comprises receiving the location information from externally of the device.

57. The method of claim 55, wherein said receiving comprises receiving location information from multiple different location providers that provide different types of location information.

58. The method of claim 55, wherein said receiving comprises wirelessly receiving location information from multiple different location providers that provide different types of location information.

59. The method of claim 55, wherein said automatically determining comprises:

providing one or more hierarchical traversable tree structures on the device, the tree structures comprising individual nodes each of which being associated with a device location; and

traversing at least one node on at least one of the tree structures to provide the current location.

60. The method of claim 59, wherein the one or more hierarchical tree structures comprise at least one primary tree structure, at least one secondary tree structure, and at least one link between the primary and secondary tree structures, the link being traversable to determine the device'"'"'s current location.

61. The method of claim 59, wherein the one or more hierarchical tree structures provide a common abstract representation of location.

62. The method of claim 55 further comprising receiving policies from multiple different policy sources.

63. The method of claim 55 further comprising receiving policies from multiple different policy sources, the policies being defined in terms of a common abstract representation of location.

64. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, cause the computer to implement the method of claim 55.

65. A computing device comprising:

one or more processors;

memory operably associated with the one or more processors;

one or more applications loadable in the memory and executable on the one or more processors; and

the one or more processors being configured to;

receive location information pertaining to a current device location;

automatically determine a current location from the location information;

locally evaluate a collection of policies in connection with the current location to provide a resultant set of policies;

enforce the resultant set of policies on the one or more applications; and

responsive to receiving location information that indicates a change of current location;

locally re-evaluate the collection of policies to provide a new resultant set of policies; and

enforce the new resultant set of policies on the one or more applications.

66. The computing device of claim 65, wherein the one or more processors are configured to receive location information from externally of the device.

67. The computing device of claim 65, wherein the device is configured to receive location information from multiple different location providers that provide different types of location information.

68. The computing device of claim 65 further comprising one or more hierarchical traversable tree structures on the device, the tree structures comprising individual nodes each of which being associated with a device location, the device being configured to automatically determine its current location by traversing at least one node on at least one of the tree structures.

69. The computing device of claim 68, wherein the one or more hierarchical tree structures comprise at least one primary tree structure, at least one secondary tree structure, and at least one link between the primary and secondary tree structures, the link being traversable to determine the device'"'"'s current location.

70. The computing device of claim 68, wherein the one or more hierarchical tree structures provide a common abstract representation of context.

71. The computing device of claim 65, wherein the device is configured to receive policies from different policies sources.

72. The computing device of claim 65, wherein the device is configured to receive policies from different policies sources, all of the policies being defined in terms of a common abstract representation of location.

73. A method of operating a computing device comprising:

wirelessly receiving location information from externally of a computing device, the location information pertaining to a current device location;

automatically determining, with the computing device, a current location using the location information;

locally evaluating, with the computing device, a collection of policies in connection with the current location to provide a resultant set of policies;

enforcing the resultant set of policies on one or more applications that are executable by the computing device;

determining whether the device'"'"'s current location has changed and if so, automatically determining a new current location using received location information;

responsive to determining the new current location, locally re-evaluating, with the computing device, the collection of policies to provide a new resultant set of policies for the new current location; and

enforcing the new resultant set of policies on the one or more applications.

74. The method of claim 73, wherein said receiving comprises receiving location information from multiple different location providers that provide different types of location information.

75. The method of claim 73, wherein said acts of automatically determining comprise:

providing one or more hierarchical traversable tree structures on the device, the tree structures comprising individual nodes each of which being associated with a device location; and

traversing at least one node on at least one of the tree structures to provide the current location.

76. The method of claim 75, wherein the one or more hierarchical tree structures comprise at least one primary tree structure, at least one secondary tree structure, and at least one link between the primary and secondary tree structures, the link being traversable to determine the device'"'"'s current location.

77. The method of claim 75, wherein the one or more hierarchical tree structures provide a common abstract representation of location.

78. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, cause the computer to implement the method of claim 73.

80. The device of claim 79, wherein the device is configured to:

automatically determine when its context has changed;

locally re-evaluate the collection of policies to provide a new resultant set of policies responsive to a context change; and

enforce the new resultant set of policies.

81. The device of claim 79, wherein the context comprises location.

79. A computing device comprising:

one or more processors;

memory operably associated with the one or more processors;

one or more applications loadable in the memory and executable on the one or more processors; and

the one or more processors being configured to;

collect policies from multiple different policy sources to provide a collection of policies, the policies being expressed in terms of context dependencies associated with multiple different device contexts;

receive context information from externally of the device, the context information pertaining to a current device context;

automatically determine a current context from the context information;

locally evaluate the collection of policies in connection with the current context to provide a resultant set of policies; and

enforce the resultant set of policies on the one or more applications.

82. A method of operating a computing device comprising:

collecting policies from multiple different policy sources to provide a collection of policies, the policies being expressed in terms of context dependencies associated with multiple different device contexts;

receiving context information from externally of a computing device, the context information pertaining to a current device context;

automatically determining a current context from the context information;

locally evaluating the collection of policies in connection with the current context to provide a resultant set of policies; and

enforcing the resultant set of policies on the device.

83. The method of claim 82 further comprising:

automatically determining when a device context has changed;

determining a new device context;

locally re-evaluating the collection of policies in connection with the new device context to provide a new resultant set of policies; and

enforcing the new resultant set of policies on the device.

84. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, cause the computer to implement the method of claim 82.

85. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, cause the computer to implement the method of claim 83.

86. A programmable computing device programmed with instructions that implement the method of claim 82.

87. A programmable computing device programmed with instructions that implement the method of claim 83.

88. A method of providing policies for enforcement on computing devices comprising:

providing a representation of location using multiple hierarchical tree structures each of which comprising multiple nodes, each node representing a location that can be either a physical location or a logical location, the tree structures comprising at least one link between them that can serve as a basis for a traversal operation that traverses the multiple tree structures to derive a computing device location; and

expressing multiple policies as a function of the representation of location.

89. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, cause the computer to implement the method of claim 88.

90. A method of providing policies for enforcement on computing devices comprising:

expressing multiple policies as a function of an abstract representation of location that uses multiple hierarchical tree structures each of which comprising multiple nodes, each node representing a location that can be either a physical location or a logical location, the tree structures comprising at least one link between them that can serve as a basis for a traversal operation that traverses the multiple tree structures to derive a computing device location; and

making the multiple policies available to computing devices.

91. A computer architecture comprising:

a context service that provides context information or context change events that pertain to the context of a computing device; and

a policy engine communicatively linked with the context service and configured to;

receive context information or context change events from the context service;

evaluate a collection of policies to provide a resultant set of policies responsive to the context information or context change events; and

enforce the resultant set of policies on a computing device.

92. The computer architecture of claim 91, wherein the policy engine is configured to enforce the resultant set of policies by promulgating new settings for one or more applications that are executable by the computing device.

93. The computer architecture of claim 91, wherein the policy engine is configured to enforce the resultant set of policies by promulgating new state for one or more applications that are executable by the computing device.

94. The computer architecture of claim 91, wherein the policy engine is configured to receive policies from multiple different policy sources.

95. A computing device embodying the computer architecture of claim 91.

96. An enterprise computing device embodying the computer architecture of claim 91.

97. A computer system comprising:

a context service that provides context information or context change events that pertain to the context of a computing device; and

a policy engine communicatively linked with the context service, but remote from the computing device, and configured to;

receive context information or context change events from the context service;

evaluate a collection of policies to provide a resultant set of policies responsive to the context information or context change events; and

provide the resultant set of policies to the computing device.