Secure data synchronization

Patent metadata

Field	Value
Publication number	US-11301575-B2
Application number	US-201816153623-A
Country	US
Kind code	B2
Filing date	Oct 5, 2018
Priority date	Sep 12, 2011
Publication date	Apr 12, 2022
Grant date	Apr 12, 2022

Abstract

Techniques for secure data synchronization are described. In one or more implementations, a determination is made as to whether enterprise data is stored locally on a first device corresponding to an enterprise device. Based on a determination that the second device is a non-enterprise device, a determination is made as to whether a permission associated with the first device indicates that the first device is permitted to propagate the enterprise data to non-enterprise devices. If the first device lacks permission to propagate the enterprise data to non-enterprise devices, the enterprise data is prevented from being propagated to the second device.

First claim

What is claimed is:

1. A method comprising:
determining data comprising enterprise data and non-enterprise data is stored locally on a first device, the first device corresponding to an enterprise device;
receiving a request to synchronize the data from the first device to a second device;
determining whether the second device is an enterprise device or a non-enterprise device; and
based at least on a determination that the second device is an enterprise device:
preventing the non-enterprise data from being synchronized from the first device to the second device; and
enabling the enterprise data to be synchronized from the first device to the second device.

2. The method as recited in claim 1 , further comprising identifying the enterprise data based on at least one of a device type of the first device, a type of application that generates the enterprise data, or a nature of the enterprise data itself.

3. The method as recited in claim 1 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission associated with the first device includes a data synchronization policy that indicates that the non-enterprise data is not to be synchronized to an enterprise device.

4. The method as recited in claim 1 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission associated with the first device permits the non-enterprise data to be synchronized to a particular enterprise device when the first device has previously synchronized other non-enterprise data to the particular enterprise device.

5. The method as recited in claim 1 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission associated with the first device permits the non-enterprise data to be synchronized to a particular enterprise device when the non-enterprise data includes a first type of data that is a same type as a second type of data that was previously transmitted from the first device to the particular enterprise device.

6. The method as recited in claim 1 , wherein the enterprise data includes one or more of business data or work-related data.

7. The method as recited in claim 1 , wherein a determination that the first device lacks permission to synchronize the non-enterprise data to enterprise devices includes a determination that an additional permission associated with the non-enterprise data indicates that the non-enterprise data is not permitted to be synchronized to enterprise devices.

8. The method as recited in claim 1 , wherein the synchronization of the enterprise data is controlled based on a type of the enterprise data.

9. The method as recited in claim 1 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission specifies a type of storage to which the enterprise data may be synchronized.

10. A system comprising:
one or more processors; and
one or more computer-readable hardware storage media storing computer-executable instructions which are executable by the one or more processors to cause the system to perform operations including:
determining data mining comprising enterprise data and non-enterprise data is stored locally on a first device, the first device corresponding to an enterprise device;
receiving a request to synchronize the data from the first device to a second device;
determining whether the second device is an enterprise device or a non-enterprise device; and
based at least on a determination that the second device is an enterprise device:
preventing the non-enterprise data from being synchronized from the first device to the second device; and
enabling the enterprise data to be synchronized from the first device to the second device.

11. The system as recited in claim 10 , wherein: the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and the permission specifies that when a particular type of data was previously transmitted from the enterprise device to the first device, additional data of a same type as the particular type of data is permitted to be synchronized from the first device to the enterprise device.

12. The system as recited in claim 10 , wherein the operations further comprise identifying the enterprise data based on at least one of a device type of the first device, a type of application that generates the enterprise data, or a nature of the enterprise data itself.

13. The system as recited in claim 10 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission specifies a type of storage to which the enterprise data is permitted to be synchronized.

14. The system as recited in claim 10 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission includes a data synchronization policy that indicates that the non-enterprise data is not to be synchronized to the enterprise device.

15. The system as recited in claim 10 , wherein the synchronization of the enterprise data is controlled based on a type of the enterprise data, the type including at least one of sensitive personal data or sensitive work-related data.

16. One or more computer-readable storage devices comprising computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
determining data comprising enterprise data and non-enterprise data is stored locally on a first device, the first device corresponding to an enterprise device;
receiving a request to synchronize the data from the first device to a second device;
determining whether the second device is an enterprise device or a non-enterprise device; and
based at least on a determination that the second device is an enterprise device:
preventing the non-enterprise data from being synchronized from the first device to the second device; and
enabling the enterprise data to be synchronized from the first device to the second device.

17. The one or more computer-readable storage devices as recited in claim 16 , further comprising identifying the enterprise data based on at least one of a device type of the first device, a type of application that generates the enterprise data, or a nature of the enterprise data itself.

18. The one or more computer-readable storage devices as recited in claim 16 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission includes a data synchronization policy that indicates that the non-enterprise data is not to be synchronized to an enterprise device.

19. The one or more computer-readable storage devices as recited in claim 16 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission permits the non-enterprise data to be synchronized to a particular enterprise device when the first device has previously synchronized other non-enterprise data to the particular enterprise device.

20. The one or more computer-readable storage devices as recited in claim 16 , wherein the first device lacks permission to synchronize the non-enterprise data to an enterprise device, and wherein the permission permits the non-enterprise data to be synchronized

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Tamayo-Rios Matthew Z
• Sinha Saurav
• Ovechkin Ruslan
• Kannan Gopinathan
• Bharadwaj Vijay G
• Macaulay Christopher R
• Fleischman Eric
• Ide Nathan J
• Liu Kun

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F21/6272

  by registering files or documents with a third party · CPC title