Microsoft Technology Licensing, LLC

Andrey Shur

Jerry Jay Dunietz

David Ornstein

Oliver H Foehr

Daniel Emerson

Sarjana Sheth

Josh Pollock

Brian M Jones

Jean Paoli

Edward George Essey

Irina Gorbach

Wei Zhu

Venkatesh Krishnan

Kamaljit S Bath

Lars Kuhtz

Prakash Sikchi

Sriram Subramanian

Alessandro Catorcini

Arungundram C Narendran

Charles Lamanna

Lynn Ayres

Joshua Michael Pollock

Anatoly Victor Koretsky

Mashuri R Libman

Isaac E Nichols

Joseph Spencer King

Jonathan David Perlow

Roy Peter D'Souza

Shiraz Jitendra Cupala

Michael John Hillberg

Bruce A MacKenzie

Jean-Marie H Larcheveque

Mike Hillberg

Dmitry Denisov

Constantin Stanciu

Adriana Ardeleanu

Patrick H Halstead

Joe King

Alexei Levenkov

Nora S Selim

Young Gah Kim

Michael Entin

Mauktik Gandhi

Jack Kabat

Benjamin Travis Stull

Jeffrey G Brown

Joseph Schulman

Abhijat A Kanade

Robledo Pontes-Filho

Sumant Mehta

Marina Galata

Michael Ray Clark

Scott C Cottrille

Jesse D McGatha

David C Brown

Robert A Relyea

Arthur Charles Leonard

Brian G O'Connor

Charles Scott Walker

Mikhail V Leonov

Raja Charu Vikram Kakumani

Zhenbin Xu

Vikram Kakumani

Kirk Shoop

Nathaniel Stott

Alexandru Croicu

Dan Knudson

Pankaj Mohan Kamat

Kevin J Boske

Marcio Mello

Alexei Vopilov

Charels S Walker

Igor Belianski

Sumalatha Adabala

Gitika Aggarwal Saubhasik

Eugene Savchenko

Arungudnram Narendran

Daniel F Microsoft Corporation Emerson

Bruce Allan Mackenzie

Jean D Paoli

Systems and/or methods for deploying and implementing data loss prevention (DLP) policy definition that may encapsulate the requirements, control objectives and directives, and/or the definitions of sensitive data types as stipulated directly or indirectly by the regulatory policy are disclosed. In one embodiment, DLP policies may be identified by an organization to run on top of a set of electronic file systems (e.g., email systems, file systems, web servers and the like). Organizations and their administrators may implement a set of DLP policy instance which are derived from DLP policy templates. DLP policy templates may comprise both structure and meaning&#x2014;and may acquire a given DLP policy by the replacement of parameterized expressions with desired parameter values. In another embodiment, the state of the DLP policy instance may change according to the lifecycle of the policy instance deployment.

Data detection and protection policies for electronic file systems

Embodiments are directed to securing data in the cloud, securely encrypting data that is to be stored in the cloud and to securely decrypting data accessed from the cloud. In one scenario, an instantiated trust service receives information indicating that a trust server is to be instantiated. The trust service instantiates the trust server, which is configured to store key references and encrypted keys. The trust service receives the public key portion of a digital certificate for each publisher and subscriber that is to have access to various specified portions of encrypted data. A data access policy is then defined that specifies which encrypted data portions can be accessed by which subscribers.

Trust services for securing data in the cloud

Embodiments include method, systems, and computer program products for filtering trust services records. Embodiments include receiving a trust services record that includes a plurality of security components and that is usable to secure data that is stored in an untrusted location. It is determined whether the trust services record has been tampered with, including verifying each of the plurality of security components of the trust services record. The trust services record is filtered based on the determination of whether the trust services record has been tampered with. The filtering includes, when the trust services record is determined to have not been tampered with, allowing performance of at least one task with respect to the secured data; and, when the trust services record is determined to have been tampered with, disallowing performance of any task with respect to the secured data.

Securely filtering trust services records

A classification application identifies patterns and evidences within representative documents. The application constructs a classification rule according to an entity and an affinity determined from the patterns and evidences. The application processes the representative documents with the classification rule to evaluate whether the rules meet acceptance requirements. Subsequent to a successful evaluation, the application identifies confidence levels for patterns and evidences within other documents.

Determining document classification probabilistically through classification rule analysis

Data detection and protection policies for e-mail

Determining correspondence, association, and/or correlation between nodes of electronic forms based on schemas of those forms is described. Importing, merging, and/or annotating data from one electronic form into another electronic form based on correspondence, association, and/or correlation between nodes is also described.

Correlation, association, or correspondence of electronic forms

A system and method validating entry of data into a structured data file in real-time is described. The system and method also described a real-time validation tool that enables a developer to create custom validation rules. These custom validation rules can include preset validation rules, which the real-time validation tool enables a developer to create in an easy-to-use way.

Electronic form user interfaces

Embodiments are directed to mapping encryption policies to data stored in a database using a policy identifier, and to accessing data stored in a database using a policy identifier. In one scenario, a computer system receives an indication that identifies which type of encryption is to be applied when encrypting a specified portion of data stored in a database. The database has a database schema identified by a database schema identifier, where the database schema defines relationships for data stored in the database. The computer system then accesses a namespace that identifies a set of databases in which the specified portion of data is accessed in the same manner. The computer system also generates a policy identifier, which contains information including the namespace and the database schema identifier.

Data mapping using trust services

Embodiments are directed to securely filtering trust services records. In one scenario, a client computer system receives at least one of the following trust services records: a trust services certificate, a principal certificate, a group certificate and a trust services policy. The client computer system performs a time validity check to validate the trust services record's timestamp, performs an integrity check to validate the integrity of the trust services record and performs a signature validity check to ensure that the entity claiming to have created the trust services record is the actual creator of the trust services record. The client computer system then, based on the time validity check, the integrity check and the signature validity check, determines that the trust services record is valid and allows a client computer system user to perform a specified task using the validated trust services record.

This document describes tools capable of validating and enabling validation of a package's structure. To do so, constraint grammar is provided that is capable of enabling a person to build a set of machine-readable constraints for a package's structure. Based on this set of constraints, a package validator module may accurately and automatically validate that a package's structure meets these constraints.

Validating and enabling validation of package structures

Embodiments are directed to mapping encryption policies to user data stored in a database using a policy column uniform resource identifier (URI). In one scenario, a computer system receives the following: a database schema name that identifies the name of a specified schema within a relational database in which user data is stored, a table name that identifies a specified table within the relational database, a column name that identifies a specified column in the specified table and a namespace identifier that identifies a set of relational databases. The computer system also receives an indication that identifies which type of encryption is to be applied when encrypting the column of data specified by the column name. The computer system then generates a policy column URI that includes a hierarchical string comprising the namespace identifier, the database schema name, the table name and the column name.

A system and method that enables promotion of data from within a structured data file to a library is described. This system and method can also enable demotion of data from a library to within a structured data file. Further, this system and method can copy data from a structured data file, perform a function on the copied data, and promote a result of the performed function to a library.

Promoting data from structured data files

A file may contain an unencrypted and an encrypted portion. The unencrypted portion may contain a layout section that may point to a published license, metadata, and a contents section, where the contents section is in the encrypted portion. The encrypted portion may contain the contents section which may act as a directory for one or more included files that may be compressed and stored in the encrypted portion. When the file is opened by a receiver, the receiver may read the published license and communicate with a security server to establish access rights and receive at least one key for decrypting at least a portion of the encrypted portion of the file. The receiver may then gain access to the included files.

Generic file protection format

Growing community of inventors

Redmond, WA, United States of America

Andrey Shur