Policy-based secure information disclosure

• US 9,063,897 B2
• Filed: 06/26/2008
• Issued: 06/23/2015
• Est. Priority Date: 06/26/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Hamilton, James R., Sadovsky, Vladimir G.
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): LAVELLE, GARY E
• Application Number:
  US12/146,721
• Publication Number:
  US 20090328130A1
• Time in Patent Office: 2,553 Days
• Field of Search: 726/1, 726/2, 726 4- 6, 726/9, 726/20, 726/27, 713/159, 713/171, 713/172
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G16H 10/65 stored on portable record carriers, e.g. on smartcards, RFID tags or CD
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

Systems and methods for storing data and retrieving data from a smart storage device is provided, where smart storage includes processing capabilities along with the ability to store information. In one aspect, a method includes detecting via bidirectional settings one or more capabilities of rules enforcement logic associated with a storage device and selecting a set of criteria and policies to be downloaded from a host or a management server that are to be downloaded onto the storage device. This includes dynamically generating conditional context aware policies syntax based on user settings or network policy and downloading a set of policies onto the storage device for future policy enforcement.

Claims

1. A data storage system for creating and utilizing access policies for stored information related to a user, the system comprising:

an identification component, utilizing one or more processors, to create the access policies based at least in part on one or more conditions including at least one of a current state of the user, a current environment of the user, or specific information withheld by the user;

a communication component, utilizing a communication network, to obtain an override request from the user, the override request indicating a requisite number of digital keys to apply to an access policy of the access policies;

an overrider component, utilizing the one or more processors, to change the access policy of the access policies to indicate the requisite number of digital keys in response to obtaining the override request from the user;

the communication component, utilizing the communication network, to obtain a request from a requestor to view the stored information, the request including one or more valid keys;

a policy component, utilizing the communication network, to regulate access to the stored information in response to the request and based at least in part upon a particular access policy that corresponds to the one or more conditions present at a time of obtaining the request, the policy component to deny access in response to determining that a count of the one or more valid keys included in the request is fewer than the requisite number of digital keys; and

the policy component to generate a response including at least one of granting access to at least a portion of the stored information or requesting more information from the requestor.

2. The system of claim 1, further comprising:

a graphical user interface (GUI) for the user to modify the access policies.

3. The system of claim 1, wherein the identification component creates a new access policy based on at least one of the digital keys and the current state of the user.

4. The system of claim 1, wherein the policy component generates the response by:

granting access to the requestor based in part on the user being in a first current state;

denying access to the requestor based in part on the user being in a second current state; and

partially granting access and partially denying access to the stored information based in part on the user being in a third current state.

5. The system of claim 1, wherein the requisite number of digital keys specified by the access policy is based at least in part upon a type of data requested by the requestor.

6. The system of claim 1 further comprising, a management component to:

aggregate repetitive information utilizing the one or more processors;

disregard collected information redundant with the stored information;

delete a part of the stored information based at least in part on an age of the part of the stored information; and

in response to determining that the response includes granting access to the information, utilizing the one or more processors, prioritize an order that the information is disclosed to the requestor.

7. A method of retaining information and storing the information on a storage device utilizing a processor, the method comprising:

gathering a continuous record of contextual information relating to a user, environmental information, and a response of the user to an environment;

selecting a portion of the contextual information for storing by determining whether measurements of the contextual information are within a tolerance, wherein one or more portions of the contextual information associated with the measurements within the tolerance are selected and one or more disregarded portions of the contextual information associated with the measurements outside of the tolerance are disregarded;

storing the one or more selected portions of the contextual information to the storage device;

creating an access policy based at least partly on the contextual information, the access policy including at least a key and a current state of the user; and

obtaining, using a communication network, an override request from the user, the override request indicating a requisite number of digital keys to apply to the access policy.

8. The method of claim 7, further comprising modifying the gathering of the contextual information based at least in part upon a user selection or automatic starting, stopping, or deleting of the contextual information.

9. The method of claim 7, further comprising determining whether the contextual information is accurate, and in response to the contextual information being inaccurate, gathering a second contextual information.

10. The method of claim 9, wherein determining whether the contextual information is accurate further comprises gathering the contextual information multiple times and determining whether the contextual information gathered at the multiple times matches within the tolerance.

11. The method of claim 7, further comprising:

identifying, utilizing the one or more processors, a discrepancy between two or more values for an identified portion of the contextual information;

calculating, utilizing the one or more processors, an expected value for the portion of the contextual information; and

storing, to a memory, at least one of the two or more values for the portion of the contextual information that is closest to the expected value.

12. The method of claim 7, further comprising:

determining, utilizing one or more sensors, the current state of the user; and

based at least in part on the current state of the user, stopping the gathering of a first type of contextual information and increasing a rate of gathering a second type of contextual information.

13. The method of claim 7, further comprising:

determining, utilizing one or more sensors, the current state of the user;

based at least in part on the current state of the user, identifying a second type of contextual information to gather; and

gathering the type of the contextual information.

14. The method of claim 7, further comprising managing the contextual information, the managing including:

aggregating, utilizing the one or more processors, repetitive contextual information; and

deleting, from a memory, the repetitive contextual information based at least in part on an age of the contextual information.

15. The method of claim 7, wherein the selecting the portion of the contextual information is based at least in part upon a uniqueness of the contextual information.

16. The method of claim 7, wherein the selecting the portion of the contextual information is based at least in part upon an available storage size of the storage device and an optimal operating efficiency of the storage device.

17. The method of claim 7, further comprising:

determining, utilizing the one or more processors, a level of redundancy between the contextual information and the portion of the contextual information;

in response to determining that the level of redundancy is above a first level, disregarding the contextual information;

in response to determining that the level of redundancy is below the first level and above a second level, storing, to the storage device, average, high and low values of the contextual information and a number of instances of the contextual information from a memory;

in response to determining that the level of redundancy is below the second level, storing, to the storage device, the contextual information from the memory.

18. The method of claim 7, wherein the environmental information includes at least one of:

a decibel level in a room or a number of people in the room.

19. The method of claim 7, wherein the response of the user to the environment includes at least one of a change in a level of stress of the user or a level of perspiration of the user.

20. One or more computer-readable storage devices containing instructions that, when executed by one or more processors, cause the one or more processors to perform acts comprising:

gathering a continuous record of contextual information relating to a user, the contextual information including location information, environmental information, a response of the user to an environment, an input of the user, and actions of the user;

creating an access policy based at least in part on the contextual information, the contextual information including at least a key and current state of the user;

obtaining, using a communication network, an override request from the user, the override request indicating a requisite number of digital keys to apply to the access policy;

changing the requisite number of digital keys specified by the access policy in response to a change to at least one of the key or the current state of the user;

obtaining a request from a requestor to view information utilizing the communication network, the request including one or more valid keys;

determining whether to release the stored information to the requestor based at least in part upon the access policy that corresponds to one or more existing conditions present at a time of the request, the determining based, at least in part, on whether the one or more valid keys equals or exceeds the requisite number of digital keys; and

generating a response for the requestor, including at least one of granting access to at least a portion of the stored information or requesting more information from the requestor.