Context-aware delegation engine
View Patent ↗A context-aware delegation engine can enable an account owner to identify granular criteria (or context) that will be used to determine what content a delegate will have access to. The account owner can therefore leverage a wide range of information to dynamically determine whether a delegate will receive access to particular content. The delegation engine can be configured to provide a delegation policy to be evaluated to determine whether a delegate should receive access to particular content. Such a delegation policy can be generated based on input provided by the delegator thereby providing the delegator with fine-grained control over which content will be accessible to a particular delegate. The delegation policy can be structured in accordance with an authorization protocol schema such as XACML, SAML, OAuth 2.0, OpenID, etc. to allow the evaluation of the delegation policy to be performed by a policy decision point in such authorization architectures.
1. A method for creating and applying a delegation policy comprising:
in a system that includes content storage in which the content is stored, an access control system that the content storage employs to determine whether to grant access to the content, a delegation engine by which delegation policies are created, and a delegation policy store in which the delegation policies are stored;
receiving, by the delegation engine and from a client computing device employed by an account owner, one or more delegation conditions, each delegation condition defining one or more contexts to be used to limit a delegate's access to the account owner's content, the account owner's content including one or both of emails or files;
creating, by the delegation engine, and storing, within the delegation policy store, a delegation policy based on the one or more delegation conditions to thereby enable the delegation policy to be used to govern the delegate's access to the account owner's content;
after the delegation policy has been created and stored in the delegation policy store and in response to a request received from a client computing device employed by a delegate to access the account owner's content that is stored in the content storage, retrieving, by the access control system, the delegation policy from the delegation policy store;
identifying, by the access control system, the one or more defined contexts of each delegation condition in the delegation policy;
sending, by the access control system and to the delegation engine, a request to retrieve the one or more defined contexts;
retrieving, by the delegation engine, the one or more defined contexts from one or more context providers;
sending, by the delegation engine and to the access control system, the one or more retrieved contexts;
evaluating, by the access control system, the account owner's content in view of the one or more retrieved contexts to thereby identify items of the account owner's content that are to be made accessible to the delegate as well as items of the account owner's content that are not to be made accessible to the delegate; and
instructing the content storage to provide, to the client computing device employed by the delegate, only items of the account owner's content that were identified as items that are to be made accessible to the delegate.
2. The method of claim 1 , wherein the one or more contexts comprise a context of the account owner's content.
3. The method of claim 1 , wherein the one or more contexts comprise a context of the delegate.
4. The method of claim 1 , wherein the access control system retrieves the delegation policy in response to a request from the content storage that identifies the account's content.
5. The method of claim 1 , wherein the one or more content providers comprise multiple content providers.
6. The method of claim 1 , wherein the account owner's content comprises emails and the one or more contexts comprise one or more of a source or classification of the emails.
7. The method of claim 1 , wherein the account owner's content comprises files and the one or more contexts comprise a classification of the files.
8. The method of claim 1 , wherein identifying items of the account owner's content that are to be made accessible to the delegate comprises identifying items that match each of the one or more retrieved contexts.
9. The method of claim 1 , wherein identifying items of the account owner's content that are not to be made accessible to the delegate comprises identifying items that do not match at least one of the one or more retrieved contexts.
10. The method of claim 8 , wherein the one or more contexts comprise a business organization structure associated with the items and the delegate.
11. The method of claim 8 , wherein the one or more contexts comprise a role of the delegate.
12. The method of claim 8 , wherein the one or more contexts comprise a trust level of the delegate.
13. The method of claim 1 , wherein the request received from the client computing device employed by the delegate comprises a request to load the account owner's inbox.
14. The method of claim 1 , wherein the delegation policy is structured in accordance with one of XACML, SAML, OAuth 2.0, or OpenID.
15. One or more non-transitory computer storage media storing computer-executable instructions which when executed by one or more processors implement a method for creating and applying a delegation policy comprising:
in a system that includes content storage in which the content is stored, an access control system that the content storage employs to determine whether to grant access to the content, a delegation engine by which delegation policies are created, and a delegation policy store in which the delegation policies are stored;
receiving, by the delegation engine and from a client computing device employed by an account owner, one or more delegation conditions, each delegation condition defining one or more contexts to be used to limit a delegate's access to the account owner's content, the account owner's content including one or both of emails or files;
creating, by the delegation engine, and storing, within the delegation policy store, a delegation policy based on the one or more delegation conditions to thereby enable the delegation policy to be used to govern the delegate's access to the account owner's content;
after the delegation policy has been created and stored in the delegation policy store and in response to a request received from a client computing device employed by a delegate to access the account owner's content that is stored in the content storage, retrieving, by the access control system, the delegation policy from the delegation policy store;
identifying, by the access control system, the one or more defined contexts of each delegation condition in the delegation policy;
sending, by the access control system and to the delegation engine, a request to retrieve the one or more defined contexts;
retrieving, by the delegation engine, the one or more defined contexts from one or more context providers;
sending, by the delegation engine and to the access control system, the one or more retrieved contexts;
evaluating, by the access control system, the account owner's content in view of the one or more retrieved contexts to thereby identify items of the account owner's content that are to be made accessible to the delegate as well as items of the account owner's content that are not to be made accessible to the delegate; and
instructing the content storage to provide, to the client computing device employed by the delegate, only items of the account owner's content that were identified as items that are to be made accessible to the delegate.
16. The computer storage media of claim 15 , wherein the one or more contexts comprise a context of the account owner's content.
17. The computer storage media of claim 15 , wherein the one or more contexts comprise a context of the delegate.
18. The computer storage media of claim 15 , wherein the access control system retrieves the delegation policy in response to a request from the content storage that identifies the account owner's content.
19. The computer storage media of claim 15 , wherein the one or more context providers comprise multiple context providers.
20. A method for creating and applying a delegation policy governing a delegate's access to an inbox, the method comprising:
in a system that includes content storage in which content of an inbox is stored, an access control system that the content storage employs to determine to which items in the inbox a delegate should have access, a delegation engine by which delegation policies are created, and a delegation policy store in which the delegation policies are stored;
receiving, by the delegation engine and from a client computing device employed by an account owner, one or more delegation conditions, each delegation condition defining one or more contexts to be used to limit a delegate's access to the account owner's inbox;
creating, by the delegation engine, and storing, within the delegation policy store, a delegation policy based on the one or more delegation conditions to thereby enable the delegation policy to be used to govern the delegate's access to items in the account owner's inbox, the items including emails;
after the delegation policy has been created and stored in the delegation policy store and in response to a request received from a client computing device employed by a delegate to load the account owner's inbox, retrieving, by the access control system, the delegation policy from the delegation policy store;
identifying, by the access control system, the one or more defined contexts of each delegation condition in the delegation policy;
sending, by the access control system and to the delegation engine, a request to retrieve the one or more defined contexts;
retrieving, by the delegation engine, the one or more defined contexts from one or more context providers;
sending, by the delegation engine and to the access control system, the one or more retrieved contexts;
evaluating, by the access control system, items in the account owner's inbox in view of the one or more retrieved contexts to thereby identify items of the account owner's inbox that are to be made accessible to the delegate as well as items of the account owner's inbox that are not to be made accessible to the delegate; and
instructing the content storage to provide, to the client computing device employed by the delegate, only items of the account owner's inbox that were identified as items that are to be made accessible to the delegate.