Automated multi-level federation and enforcement of information management policies in a device network
Methods, apparatus, systems, and non-transitory computer-readable media for managing a plurality of disparate computer application and data control policies on a computing device, especially a computing device connected to a computer network, are described. In one example, at least one policy distribution point is provided that includes least one policy distribution point including at least one information management policy. A plurality of policy enforcement points, including a first policy enforcement point operating at a first policy enforcement level, and a second enforcement point operating at second policy enforcement level, are also provided. A first policy element to the first policy enforcement point, and a second policy element to the second policy enforcement point, are allocated. A management compartment in computer memory in communication with said computing device including one or more computer applications, data, and metadata specified and controlled by the information management policy is also provided.
1. A computing device configured as an endpoint device, the computing device comprising:
a data processor, a computer memory and network connection components operating on the endpoint device, wherein the computer memory and the network connection components are in communication with the data processor and the network components are operable to establish network communication sessions with one or more non-local network computing devices over one or more networks;
an operating system operated by the data processor to control the data processor, the computer memory and the network connection components;
a local policy management point comprising a plurality of local policy-mandated control elements stored by the computer memory and operated by the data processor;
a non-local policy management point received from a non-local network computing device and instantiated onto the computer memory comprising a program module executable by the data processor, wherein the non-local network computing device is separate from the endpoint device;
a plurality of local policy enforcement points operated on the endpoint device to enforce the plurality of local policy-mandated control elements, wherein the plurality of local policy mandated control elements are stored in the computer memory of the endpoint device, and wherein the endpoint device generates the plurality of local policy mandated control elements; and
at least one non-local policy enforcement point established by execution of the non-local policy management point wherein the non-local policy enforcement point is established to enforce one or more non-local policy-mandated control elements corresponding with establishing and maintaining at least one memory management compartment on the computer memory, wherein the one or more non-local policy-mandated control elements are received from the one or more-non-local network computing devices.
2. The computing device of claim 1 , wherein the at least one non-local policy management point comprises at least one local policy management point operated by the non-local policy management point to enforce the at least one non-local policy-mandated control element.
3. The computing device of claim 1 , wherein the operating system provides a user mode and the at least one non-local policy enforcement point operates in user mode.
4. The computing device of claim 1 , wherein the at least one non-local policy enforcement point is configured to encapsulate an application in the memory management compartment.
5. The computing device of claim 1 , wherein the non-local policy management point is configured to receive non-local policy enforcement point updates from a non-local network computing device.
6. The computing device of claim 1 , wherein at least one of the non-local policy management point and the local policy management point are configured to:
receive a set of policy elements from a plurality of policy distribution sources within the one or more-non-local network computing devices; and
aggregate and resolve conflicts between the set of policy elements.
7. The computing device of claim 1 , wherein based on the one or more non-local policy-mandated control elements corresponding with establishing and maintaining at least one memory management compartment on the computer memory, the computing device is configured to:
specify that file access policy enforcement is to be done using a policy enforcement point that is configured to encrypt file contents, and
provide access to decrypted file content only to a set of compartment applications listed in a compartment policy as having access to the decrypted file content.