Distribution of information protection policies to client machines

• US 8,156,538 B2
• Filed: 12/18/2007
• Issued: 04/10/2012
• Est. Priority Date: 12/18/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kanade, Abhijat A., Malaviarachchi, Rushmi U., Waxman, Peter D., Zhong, Yuhui, Kostal, Gregory, Cottrille, Scott C., Mehdi, Syed A., Priest, Patricia, Parambir, Kumar B., Ren, Li
• Primary Examiner(s): El Hady, Nabil
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US11/959,115
• Publication Number:
  US 20090158384A1
• Time in Patent Office: 1,575 Days
• Field of Search: 726/1
• US Class Current: 726/1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems

Abstract

One embodiment includes a method which may be practiced in a computing environment where resources are distributed. The method includes acts for obtaining policy information defining restrictions on resources distributed in the computing environment. The method includes sending a request to a server for metadata about one or more resource protection policies at the server. In response to the request, metadata about one or more resource protection polices at the server is received from the server. The metadata from the server is analyzed. Based on analyzing the metadata, one or more resource protection policies stored at the client are updated.

Claims

1. In a computing environment where resources are distributed, a method of obtaining policy information defining restrictions on resources distributed in the computing environment, the method comprising:

sending a request to a server for metadata about resource protection policies at the server;

in response to the request, receiving from the server metadata about one or more resource protection polices at the server;

analyzing the metadata from the server;

based on analyzing the metadata, updating one or more resource protection policies stored at the client;

providing an indication to an application that one or more resource protection policies at the client have been updated; and

in response to providing an indication to the application that one or more resource protection policies at the client have been updated, receiving a request from the application for metadata about resource protection policies at the client.

2. The method of claim 1, wherein updating one or more resource protection policies stored at the client comprises obtaining a different version of a policy previously stored at the client from the server.

3. The method of claim 1, wherein updating resource protection policies stored at the client comprises obtaining a new policy not previously stored at the client from the server.

4. The method of claim 1, wherein updating one or more resource protection policies stored at the client comprises deleting a policy previously stored at the client.

5. The method of claim 1, wherein the server functions as a known location where a user can obtain policy information.

6. The method of claim 1, wherein sending a request to a server for metadata about resource protection policies at the server is performed in response to receiving a request from a task, wherein the task is configured to cause the client to obtain metadata about resource protection policies according to a predetermined schedule.

7. The method of claim 6, wherein the predetermined schedule comprises a predetermined interval.

8. The method of claim 1, wherein sending a request to a server for metadata about resource protection policies at the server is performed in response to receiving a request from the application requiring one or more resource protection policies to access a resource.

9. The method of claim 8, further comprising:

in response to receiving a request from the application for metadata about resource protection policies at the client, sending metadata to the application about resource protection policies at the client;

in response to sending metadata to the application about resource protection policies at the client, receiving a request for one or more resource protection policies from the application; and

in response to receiving a request for one or more resource protection policies from the application sending one or more resource protection policies to the application.

10. The method of claim 1, wherein the client comprises an application programming interface (API), and wherein the request to a server for metadata about resource protection policies at the server is performed in response to receiving a request at the API.

11. In a computing environment where resources are distributed, a method of providing policy information defining restrictions on resources distributed in the computing environment, the method comprising:

receiving a first request from a client for metadata about resource protection policies at a server;

in response to the request for metadata about resource protection polices at the server, sending metadata about one or more resource protection polices at the server to the client;

in response to sending metadata about resource protection polices at the server to the client, receiving a second request for one or more policies stored at the server; and

in response to receiving the second request for one or more policies stored at the server, sending the one or more policies to the client, which thereby causes an update of a policy store of the client to be updated as well as notification to be provided to an application of the client that the policy store of the client has been updated.

12. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on user identity information provided by the client.

13. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on role information provided by the client.

14. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on group membership information.

15. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on physical location information provided by the client.

16. The method of claim 11, wherein metadata about resource protection policies are sent to the client based on administrator marked policies at the server.

17. The method of claim 11, wherein the notification causes the application to request metadata from the client regarding the update.

18. In a computing environment where resources are distributed, a method of providing policy information defining restrictions on resources distributed in the computing environment, the method comprising:

a client providing an indication to an application that one or more resource protection policies at the client have been updated;

receiving a request from an application for metadata about one or more resource protection policies at a client, which is provided from application in response to the indication to the application that the one or more resource protection policies at the client have been updated;

in response to receiving a request from the application for metadata about one or more resource protection policies at the client that have been updated, sending metadata to the application about one or more resource protection policies at the client that have been updated;

in response to sending metadata to the application about one or more resource protection policies at the client that have been updated, receiving a request for the one or more resource protection policies from the application; and

in response to receiving the request for the one or more resource protection policies from the application, sending the one or more resource protection policies to the application.

19. The method of claim 18, wherein providing an indication to the application that the one or more resource protection policies at the client have been updated is performed in response to a request from an application or task sent to the client.