Context-aware content object security
As a default, a global permissions model is established. The global permissions model serves for applying a first set of resource access permissions to shared content objects. Additionally, a set of context-aware access policies that govern user interactions over the shared content object is established. When a particular user requests an interaction over a shared content object, then interaction attributes associated with the request are gathered. The context-aware access policies are applied to the request by determining a set of extensible access permissions that are derived from the interaction attributes. The context-aware access policies are enforced by overriding the first set of resource access permissions with dynamically-determined access permissions. When a particular access request is denied, a response is generated in accordance with the set of extensible access permissions and the user is notified. In some cases, the access request is permitted, but only after the user provides a justification.
1. A method for context-aware content object security, the method comprising:
applying a first set of resource access permissions to a shared content object;
maintaining one or more context-aware access policies that govern user interactions over the shared content object;
gathering one or more interaction attributes associated with a particular user interaction over the shared content object;
applying the one or more context-aware access policies to the one or more interaction attributes to determine and store, in computer memory, a set of extensible access permissions associated with the particular user interaction over the shared content object; and
overriding the first set of resource access permissions to the shared content object with the set of extensible access permissions retrieved from the computer memory and associated with the particular user interaction over the shared content object, in response to a determination that the set of extensible access permissions conflicts with the first set of resource access permissions.
2. The method of claim 1 , further comprising:
generating a response to the particular user interaction, the response being generated in accordance with the set of extensible access permissions.
3. The method of claim 2 , wherein the response corresponds to at least one of taking no action, allowing an interaction, allowing the interaction with a justification, or blocking the interaction.
4. The method of claim 3 , wherein at least a portion of the response is presented to a user at a user interface.
5. The method of claim 1 , wherein the one or more context-aware access policies comprise extensible permissions rules.
6. The method of claim 5 , wherein the extensible permissions rules are evaluated against at least a portion of the one or more interaction attributes to determine the set of extensible access permissions.
7. The method of claim 1 , wherein a context associated with the particular user interaction is characterized by one or more of the one or more interaction attributes, wherein the one or more interaction attributes are retrieved by parsing an interaction event message received in response to the particular user interaction over the shared content object.
8. The method of claim 1 , wherein the one or more interaction attributes comprise at least one of one or more event attributes, one or more object attributes, or one or more user attributes.
9. The method of claim 1 , wherein at least one of the one or more context-aware access policies is specified by a user at a user interface.
10. A non-transitory computer readable medium having stored thereon a sequence of instructions which, when stored in memory and executed by one or more processors causes the one or more processors to perform a set of acts for context-aware content object security, the set of acts comprising:
applying a first set of resource access permissions to a shared content object;
maintaining one or more context-aware access policies that govern user interactions over the shared content object;
gathering one or more interaction attributes associated with a particular user interaction over the shared content object;
applying the one or more context-aware access policies to the one or more interaction attributes to determine and store, in computer memory, a set of extensible access permissions associated with the particular user interaction over the shared content object; and
overriding at least some of the first set of resource access permissions to the shared content object with the set of extensible access permissions retrieved from the computer memory and associated with the particular user interaction over the shared content object, in response to a determination that the set of extensible access permissions conflict with the first set of resource access permissions.
11. The non-transitory computer readable medium of claim 10 , further comprising instructions which, when stored in memory and executed by the one or more processors causes the one or more processors to perform acts of:
generating a response to the particular user interaction, the response being generated in accordance with the set of extensible access permissions.
12. The non-transitory computer readable medium of claim 11 , wherein the response corresponds to at least one of taking no action, allowing an interaction, allowing the interaction with a justification, or blocking the interaction.
13. The non-transitory computer readable medium of claim 12 , wherein at least a portion of the response is presented to a user at a user interface.
14. The non-transitory computer readable medium of claim 10 , wherein the one or more context-aware access policies comprise extensible permissions rules.
15. The non-transitory computer readable medium of claim 14 , wherein the extensible permissions rules are evaluated against at least a portion of the one or more interaction attributes to determine the set of extensible access permissions.
16. The non-transitory computer readable medium of claim 10 , wherein a context associated with the particular user interaction is characterized by one or more of the one or more interaction attributes, wherein the one or more interaction attributes are retrieved by parsing an interaction event message received in response to the particular user interaction over the shared content object.
17. The non-transitory computer readable medium of claim 10 , wherein the one or more interaction attributes comprise at least one of one or more event attributes, one or more object attributes, or one or more user attributes.
18. A system for context-aware content object security, the system comprising:
a storage medium having stored thereon a sequence of instructions; and
one or more hardware-based processors that execute the sequence of instructions to cause the one or more hardware-based processors to perform a set of acts, the set of acts comprising,
applying a first set of resource access permissions to a shared content object;
maintaining one or more context-aware access policies that govern user interactions over the shared content object;
gathering one or more interaction attributes associated with a particular user interaction over the shared content object;
applying the one or more context-aware access policies to the one or more interaction attributes to determine and store, in computer memory, a set of extensible access permissions associated with the particular user interaction over the shared content object; and
overriding at least some of the first set of resource access permissions to the shared content object with the set of extensible access permissions retrieved from the computer memory and associated with the particular user interaction over the shared content object, in response to a determination that the set of extensible access permissions conflict with the first set of resource access permissions.
19. The system of claim 18 , further comprising instructions which, when stored in memory and executed by the one or more hardware-based processors causes the one or more hardware-based processors to perform acts of:
generating a response to the particular user interaction, the response being generated in accordance with the set of extensible access permissions.
20. The system of claim 19 , wherein the response corresponds to at least one of taking no action, allowing an interaction, allowing the interaction with a justification, or blocking the interaction.