Item sharing based on information boundary and access control list settings

Patent metadata

Field	Value
Publication number	US-9384337-B1
Application number	US-201514697540-A
Country	US
Kind code	B1
Filing date	Apr 27, 2015
Priority date	Apr 27, 2015
Publication date	Jul 5, 2016
Grant date	Jul 5, 2016

Abstract

An item is shared based on an information boundary and access control settings. An application such as a document management application detects a selection of an information boundary to manage a sharing action associated with the item. The information boundary includes rules to define how the item is shared. A selection of an access control list is also detected to manage recipients who have an access to the item. The access control list allows a recipient in the list an ability to search and discover the item. In response to a detection of the sharing action to share the item, the information boundary and the access control list is applied to the item. The item is then shared based on the information boundary and the access control list through a link of the item transmitted to a recipient.

First claim

What is claimed is:

1. A computing device configured to share an item based on information boundary and access control list settings, the computing device comprising:
a memory configured to store one or more instructions; and
a processor coupled to the memory and configured to execute an item management application, wherein the item management application is configured to:
detect a first selection of an information boundary to manage a sharing action associated with the item;
provide a user interface of the item management application to enable selection of one or more access rules associated with the information boundary to define the information boundary, wherein the one or more access rules are displayed through the user interface in a sorted format from a most restrictive access rule to a least restrictive access rule;
detect a second selection of an access control list to manage recipients who have an access to the item;
detect the sharing action to share the item;
apply the information boundary and the access control list to the item;
share the item based on the information boundary and the access control list by transmitting a link to the item to the recipients in the access control list; and
in response to a determination that the link was transmitted to an additional recipient that is not in the access control list:
detect an attempt by the additional recipient to access the item through the link;
determine whether the additional recipient is allowed to access the item based on the information boundary; and
in response to a determination that the additional recipient is allowed to access the item based on the information boundary, add the additional recipient to the access control list such that the additional recipient is enabled to search and discover the item through a user interface of the item management application.

2. The computing device of claim 1 , wherein the item management application is further configured to:
in response to a detection of a creation of the item, assign default information boundaries to the item.

3. The computing device of claim 2 , wherein the item management application is further configured to:
provide a user interface to allow an administrator of the default information boundaries to one or more of create and manage one or more rules of the default information boundaries.

4. The computing device of claim 1 , wherein the item management application is further configured to:
identify a new recipient in the sharing action;
in response to a detection of the new recipient in the access control list, determine whether the new recipient is within the information boundary of the item; and
in response to a detection that the new recipient is within the information boundary of the item, grant the new recipient an access to the item.

5. The computing device of claim 1 , wherein the item management application is further configured to:
identify a new recipient in the sharing action;
in response to a failure to detect the new recipient in the access control list, determine whether the new recipient is within the information boundary of the item; and
in response to a detection that new recipient is within the information boundary of the item, grant the new recipient an access to the item and add the new recipient to the access control list.

6. The computing device of claim 1 , wherein the item management application is further configured to:
allow a sharer of the item to select the information boundary from a number of information boundaries, wherein the number of information boundaries include one or more access rules associated with the item.

7. The computing device of claim 6 , wherein the item management application is further configured to:
allow the sharer to manage the one or more access rules, wherein the one or more access rules include one or more of a read access rule, a write access rule, and an execute access rule.

8. The computing device of claim 1 , wherein the item management application is further configured to:
receive organizational instructions to store the recipients in groups; and
add the groups to the access control list.

9. The computing device of claim 1 , wherein the item management application is further configured to:
detect a third selection of a group to grant the group an access to the item, wherein the group includes a subset of the recipients; and
add one or more rules to the information boundary to grant the group the access to the item.

10. The computing device of claim 9 , wherein the item management application is further configured to:
provide a user interface to allow an administrator of the information boundary to define the group and the access, wherein the access includes one or more of a read access, a write access, and an execute access to the item.

11. The computing device of claim 9 , wherein the item management application is further configured to:
provide a user interface to allow a sharer of the item to edit the group and the access, wherein the access includes one or more of a read access, a write access, and an execute access to the item.

12. A method to employ context-based inference to share an item based on information boundary and access control list settings, the method comprising:
detecting a first selection of an information boundary to manage a sharing action associated with the item, wherein the information boundary includes one or more access rules associated with the item;
providing a user interface of an item management application to enable selection of one or more access rules associated with the information boundary to define the information boundary, wherein the one or more access rules are displayed through the user interface in a sorted format from a most restrictive access rule to a least restrictive access rule;
detecting a second selection of an access control list to manage recipients who have an access to the item;
detecting the sharing action to share the item;
applying the information boundary and the access control list to the item;
sharing the item based on the information boundary and the access control list by transmitting a link to the item to a selected recipient that is in the access control list; and
in response to a determination that the link was transmitted to an additional recipient that is not in the access control list:
detecting an attempt by the additional recipient to access the item through the link;
determining whether the additional recipient is allowed to access the item based on the information boundary; and
in response to a determination that the additional recipient is allowed to access the item based on the information boundary, adding the additional recipient to the access control list such that the additional recipient is enabled to search and discover the item through a user interface of the item management application.

13. The method of claim 12 , further comprising:
detecting an execution of a search for the item by the selected recipient; and
maintaining an invisible status of the item to the search.

14. The method of claim 13 , further comprising:
detecting an access to the item through the link by the selected recipient.

15. The method of claim 14 , further comprising:
detecting an execution of another search for the item by the selected recipient; and
providing the item within a results list for the other search.

16. The method of claim 12 , further comprising:
allowing an administrator of the information boundary to define a number of information boundaries to a sharer of the item for t

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Sirbu Alin
• Demaris John Lincoln
• Pasch Mary David
• Shallcross Zachary
• Burst Alexandru
• Rayson Steve
• Van Waardhuizen Michael

Classifications

• G06F21/6236 Primary

  between heterogeneous systems · CPC title

• G06F17/30165

  Physics · mapped topic

• G06F21/31 Primary

  User authentication · CPC title

• H04L63/101

  Access control lists [ACL] · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title