Microsoft Technology Licensing, LLC

Jack Kabat

Mashuri R Libman

Anatoly Victor Koretsky

Lynn Ayres

Benjamin Travis Stull

Andrey Shur

Alexander Thomas Weinert

Krishna Kumar Parthasarathy

Hao Zhang

Neelamadhaba Mahapatro

Vadim Meleshuk

Sowmy Srinivasan

Lucy Chao

Vikram Kakumani

Sridharan Ramanathan

Joseph Schulman

Yu Meng Li

Vidyaraman Sankaranarayanan

Raja Charu Vikram Kakumani

Serguei Martchenko

Srivalli Chavali

Leif Christian Brenne

Jasjeet Gill

Richard Wesley Holley

Mark Alan Mullins

Systems and/or methods for deploying and implementing data loss prevention (DLP) policy definition that may encapsulate the requirements, control objectives and directives, and/or the definitions of sensitive data types as stipulated directly or indirectly by the regulatory policy are disclosed. In one embodiment, DLP policies may be identified by an organization to run on top of a set of electronic file systems (e.g., email systems, file systems, web servers and the like). Organizations and their administrators may implement a set of DLP policy instance which are derived from DLP policy templates. DLP policy templates may comprise both structure and meaning&#x2014;and may acquire a given DLP policy by the replacement of parameterized expressions with desired parameter values. In another embodiment, the state of the DLP policy instance may change according to the lifecycle of the policy instance deployment.

Data detection and protection policies for electronic file systems

User input mechanisms are displayed for defining a compliance policy update. A unified compliance policy update is generated according to a unified schema that is consistent across different workloads. The unified compliance policy update is sent to a workload where it is deployed.

Unified generation of policy updates

A policy tip or end user notification is provided for data loss prevention in collaborative environments. A document interactivity application detects an action or trigger by an end user that affects a document. The document is processed, through a classification engine and a unified policy engine, with policies based on the action to detect a matched policy. A policy tip associated with the matched policy is identified and displayed on the display device in association with the document.

Providing policy tips for data loss prevention in collaborative environments

System and methods for the implementation and/or enforcement of an email policy for an organization's email system are presented. A Data Loss Prevention (DLP) policy may be implemented on top of the email system. In one embodiment, the DLP policy may comprise modules and/or processing that tests emails for such sensitive data within emails. If an email comprises such sensitive data, then the DLP policy directives may specify processing to be applied as part of each stage of mail processing, from authoring to mail processing on the server and delivery. A single policy may be authored and managed that will apply the policy directives uniformly across all aspects of the message lifecycle. Each of the message policy enforcement systems may evaluate the single policy definition and apply the policy directives in a manner consistent with the contextual evaluation of the policy.

Uniform policy for security and information protection

Data detection and protection policies for e-mail

Defining a unified access management policy expression that unifies access control policy with events or workflows. Unified management policy information is stored. The unified management policy information defines permissions for access to resources together with events or workflows. A request is received to execute the one or more operations on one or more objects. The requested operation is verified against the unified management rules. Verifying includes performing a single retrieval, retrieving both the access control information and the events or workflows and calculating the applicability of the rule to the conditions represented by the request. Matching rules are applied, access control decisions performed and associated workflows are executed.

Unified management policy

Enforcing access control based on resource state. A method includes receiving a request for an operation on one or more objects stored on computer readable media. One or more pre-operation states of the one or more objects are determined. One or more post-operation states of the one or more objects are determined. One or more access control rules are referenced. The access control rules control access to resources based on pre-operation state and post operation state. It can then be determined that the one or more access control rules allow the operation to succeed based on the one or more pre-operation states and the one or more post operation states. Based on determining that the one or more access control rules allow the operation to succeed, the operation is allowed to succeed.

Resource state transition based access control system

Growing community of inventors

Sammamish, WA, United States of America

Jack Kabat