Applying rights management policies to protected files
View Patent ↗Examples of the present disclosure relate to protecting files with an information rights policy. Files can be protected as specified by a content policy associated with the file. The content policy can specify whether the file should be protected while at rest on a device as well as when the file is shared with another user of an enterprise.
1. A method, comprising:
receiving, from a client device, a request to obtain a file from a data store on behalf of a user account;
determining that a content policy specifies that the file must be protected at rest on the client device using a first information rights policy;
causing a configuration profile to be installed on the client device, the configuration profile comprising an administrator credential, wherein the administrator credential is accessible by a file management application of the client device, and wherein the administrator credential is inaccessible by a user of the client device;
applying the first information rights policy to the file to generate a protected file, wherein access to the file is permitted based on the administrator credential; and
transmitting the protected file and the content policy to the client device once the first information rights policy is applied to the file, wherein the content policy further specifies a second information rights policy to apply to the file in order to share the file from the client device.
2. The method of claim 1 , wherein the file is stored in third party repository external to the data store.
3. The method of claim 1 , wherein the second information rights policy permits access to the file based on at least one user credential.
4. The method of claim 1 , wherein the first information rights policy references a third party information rights server, wherein the third party information rights server maintains an activity log with respect to the file.
5. The method of claim 1 , wherein the first information rights policy is applied using the administrator credential, wherein the administrator credential is separate from a user credential associated with the user.
6. The method of claim 1 , further comprising:
obtaining a request on behalf of the user account to share the file with a second user, the second user associated with a second user account;
determining that the content policy specifies a particular information rights policy in order to share the file;
applying the particular information rights policy in response to a determination that the content policy specifies the particular information rights policy in order to share the file; and
transmitting the file with the particular information rights policy applied to a second client device associated with the second user.
7. The method of claim 1 , further comprising:
obtaining a request to store a new file in association with the user account from the client device;
determining whether one of a plurality of content policies applies to the request to store the new file based upon at least one of: the user account, a file type of the new file, or a content of the new file; and
storing the new file in a data store, the new file being associated with the user account and the one of the plurality of content policies.
8. The method of claim 7 , wherein a new file is stored on the client device with an information rights policy specified by the one of the plurality of content policies applied to the new file.
9. A non-transitory computer-readable medium embodying program instructions executable in at least one computing device, the program instructions being configured to cause at least one computing device to at least:
receive, from a client device, a request to obtain a file from a data store on behalf of a user account;
determine that a content policy specifies that the file must be protected at rest on the client device using a first information rights policy;
cause a configuration profile to be installed on the client device, the configuration profile comprising an administrator credential, wherein the administrator credential is accessible by a file management application of the client device, and wherein the administrator credential is inaccessible by a user of the client device;
apply the first information rights policy to the file to generate a protected file wherein access to the file is permitted based on the administrator credential; and
transmit the protected file and the content policy to the client device once the first information rights policy is applied to the file, wherein the content policy further specifies a second information rights policy to apply to the file in order to share the file from the client device.
10. The non-transitory computer-readable medium of claim 9 , wherein the file is stored in a third party repository external to the data store.
11. The non-transitory computer-readable medium of claim 9 , wherein the second information rights policy permits access to the file based on at least one user credential.
12. The non-transitory computer-readable medium of claim 9 , wherein the first information rights policy references an information rights server, wherein the information rights server maintains an activity log with respect to the file.
13. The non-transitory computer-readable medium of claim 9 , wherein the first information rights policy is applied using the administrator credential, wherein the administrator credential is separate from a user credential associated with the user.
14. The non-transitory computer-readable medium of claim 9 , wherein the program instructions are further configured to cause the at least one computing device to at least:
obtain a request on behalf of the user account to share the file with a second user; the second user associated with a second user account;
determine that the content policy specifies a particular information rights policy in order to share the file;
apply the particular information rights policy in response to a determination that the content policy specifies the particular information rights policy in order to share the file; and
transmit the file with the particular information rights policy applied to a second client device associated with the second user.
15. The non-transitory computer-readable medium of claim 9 , wherein the program instructions are further configured to cause the at least one computing device to at least:
obtain a request to store a new file in association with the user account from the client device;
determine that one of a plurality of content policies applies to the request to store the new file based upon at least one of: the user account, a file type of the new file, or a content of the new file; and
store the new file in a data store, the new file being associated with the user account and the one of the plurality of content policies.
16. The non-transitory computer-readable medium of claim 15 , wherein a new file is stored on the client device with an information rights policy specified by the one of the plurality of content policies applied to the new file.
17. A system, comprising:
at least one computing device; and
a file management service executed by the at least one computing device, the file management service configured to cause the at least one computing device to at least:
receive, from a client device, a request to obtain a file from a data store on behalf of a user account;
determine that a content policy specifies that the file must be protected at rest on the client device using a first information rights policy;
cause a configuration profile to be installed on the client device, the configuration profile comprising an administrator credential, wherein the administrator credential is accessible by a file management application of the client device, and wherein the administrator credential is inaccessible by a user of the client device;
apply the first information rights policy to the file to generate a protected file, wherein access to the file is permitted based on the administrator credential; and
transmit the protected file and the content policy to the client device once the first information rights policy is applied to the file, wherein the content policy further specifies a second information rights policy to apply to the file in order to share the file from the client device.
18. The system of claim 17 , wherein the file is stored in a third party repository external to the data store.
19. The system of claim 17 , wherein the second information rights policy permits access to the file based on at least one user credential.
20. The system of claim 17 , wherein the first information rights policy references a third party information rights server, wherein the third party information rights server maintains an activity log with respect to the file.
21. The system of claim 17 , wherein the first information rights policy is applied using the administrator credential, wherein the administrator credential is separate from a user credential associated with the user.
22. The system of claim 17 , wherein the file management service is further configured to cause the at least one computing device to at least:
obtain a request on behalf of the user account to share the file with a second user; the second user associated with a second user account;
determine that the content policy specifies a particular information rights policy in order to share the file;
apply the particular information rights policy in response to a determination that the content policy specifies the particular information rights policy in order to share the file; and
transmit the file with the particular information rights policy applied to a second client device associated with the second user.
23. The system of claim 17 , wherein the file management service is further configured to cause the at least one computing device to at least:
obtain a request to store a new file in association with the user account from the client device;
determine that one of a plurality of content policies applies to the request to store the new file based upon at least one of: the user account, a file type of the new file, or a content of the new file; and
store the new file in a data store, the new file being associated with the user account and the one of the plurality of content policies.