Tagging documents with security policies

Patent metadata

Field	Value
Publication number	US-10783262-B2
Application number	US-201715424527-A
Country	US
Kind code	B2
Filing date	Feb 3, 2017
Priority date	Feb 3, 2017
Publication date	Sep 22, 2020
Grant date	Sep 22, 2020

Abstract

Embodiments of the present invention provide systems, methods, and computer storage media directed to facilitate identification of security policies for documents. In one embodiment, content features are identified from a set of documents having assigned security policies. The content features and corresponding security policies are analyzed to generate a security policy prediction model. Such a security policy prediction model can then be used to identify a security policy relevant to a document.

First claim

What is claimed is:

1. A computer system comprising:
a model generating means comprising one or more hardware processors and memory storing computer program instructions executable by the one or more hardware processors to generate a security policy prediction model based on a first set of content features and security policies associated with a set of documents, the security policy prediction model comprising a hierarchical tree model comprising a plurality of linear classifiers, wherein each leaf node of the hierarchical tree model is associated with a subset of policy labels that represent corresponding user group-permission tuples and form a corresponding one of the security policies, and wherein generating the security policy prediction model comprises selecting the first set of content features as a set of most informative features based on a threshold information gain being exceeded, wherein the threshold information gain is a function of the user-group permission tuples and quantifies a relevance of a given content feature of the first set of content features to all of the security policies; and
a policy identification means comprising the one or more hardware processors and the memory storing computer program instructions executable by the one or more hardware processors to:
utilize a second set of content features associated with a document and the security policy prediction model to predict a security policy, from the security policies, by passing the document through the plurality of linear classifiers to arrive at a leaf node associated with the security policy,
selecting the security policy from the security policies based on arriving at the leaf node associated with the security policy; and
performing at least one of (i) automatically tagging the document with the security policy, (ii) providing the security policy as a suggested security policy for the document, or (iii) providing a security policy modification recommendation based on security policy.

2. The system of claim 1 , further comprising a feature identifying means comprising the one or more hardware processors and the memory storing computer program instructions executable by the one or more hardware processors to:
identify the first set of content features associated with the set of documents based on an estimate of importance of the first set of content features towards all of the security policies; and
identify the second set of content features associated with the document based on the estimate.

3. The system of claim 1 , wherein the first and second sets of content features comprise textual features indicating content and sensitivity features indicating sensitive information.

4. The system of claim 1 , wherein the model generating means is configured to generate the security policy prediction model by learning a linear classifier at each node of the hierarchical tree model, wherein each linear classifier of the plurality of linear classifiers is configured to divide a feature space associated with the first set of content features into positive and negative partitions.

5. The system of claim 1 , wherein the document comprises a new document created by a user without a previously assigned security policy.

6. The system of claim 1 , wherein the document comprises an existing document previously created, the existing document having an assigned first security policy.

7. The system of claim 6 , wherein the policy identification means is further configured to compare the security policy predicted for the document to the first security policy and provide the security policy modification recommendations based on the comparison.

8. One or more non-transitory computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations to facilitate identification of security policies for documents, the operations comprising:
identifying content features that indicate content of a set of documents previously assigned security policies, the previously assigned security policies including a set of authorized users and corresponding permission settings;
generating a security policy prediction model configured to predict a set of predicted security policies for documents using a hierarchical tree model with a linear classifier at each node, wherein each leaf node of the hierarchical tree model is associated with a subset of policy labels that represent corresponding user group-permission tuples and form a corresponding one of the security policies, the security policy prediction model generated using the previously assigned security policies and the content features indicating content of the set of documents and wherein generating the security policy prediction model comprises selecting the first set of content features as a set of most informative features based on a threshold information gain being exceeded, wherein the threshold information gain is a function of the user-group permission tuples and quantifies a relevance of a given content feature of the first set of content features to all of the security policies;
selecting a security policy for the document, from the security policies, based on passing the document through the hierarchical tree model to arrive at a leaf node associated with the security policy; and
performing at least one of (i) automatically tagging the document with the security policy, (ii) providing the security policy as a suggested security policy for the document, or (iii) providing a security policy modification recommendation based on security policy.

9. The one or more non-transitory computer storage media of claim 8 , wherein the content features comprise textual features that indicate content and sensitivity features that indicate sensitive information.

10. The one or more non-transitory computer storage media of claim 8 , the operations further comprising comparing the predicted security policies with the previously assigned security policies and, based on the comparing, providing a suggestion to modify one or more of the previously assigned security policies.

11. The one or more non-transitory computer storage media of claim 8 , the operations further comprising learning the hierarchical tree model over the feature space based on recursive partitioning of a feature space of a parent node of the hierarchical tree model.

12. The one or more non-transitory computer storage media of claim 11 , the operations further comprising performing the recursive partitioning in accordance with optimization of a ranking loss function that rewards correct prediction and penalizes incorrect predictions.

13. One or more non-transitory computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations to facilitate identification of security policies for documents, the operations comprising:
identifying a set of content features associated with a document;
using a security policy prediction model comprising a hierarchy of linear classifiers and the set of content features to identify a security policy comprising a set of user groups and corresponding permission settings relevant to the document, wherein each leaf node of the hierarchy is associated with a subset of policy labels that represent corresponding user group-permission tuples and form a corresponding one of the security policies and wherein generating the security policy prediction model comprises selecting the first set of content features as a set of most informative features based on a threshold information gain bein

Assignees

• Adobe Inc

Inventors

• Goyal Tanya
• Mehta Sanket Vaibhav
• Srinivasan Balaji Vasan
• Jain Ankur

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F16/355

  Creation or modification of classes or clusters · CPC title

• G06F16/35

  Clustering; Classification · CPC title