Granted Patent B2

US 12,229,288 · App. 18/231,623 · Granted Feb 18, 2025

Inventors: Arjun Sambamoorthy (Sunnyvale, CA); Prashanth Arun (Sunnyvale, CA); Dhananjay Sampath (Sunnyvale, CA); Sanjay Singh (Sunnyvale, CA); Salil Kanetkar (Sunnyvale, CA)

Assignee: ArmorBlox LLC

G06F21/6209G06F21/604G06F40/40H04L51/08G06F2221/2141

Abstract

Claims (89)

1. A method comprising:

storing a set of documents at a computing system, individual documents in the set of documents being associated with document tags that represent language included in the individual documents;

receiving first input indicating of a document of the set of documents;

identifying a document tag associated with the document;

obtaining a data access policy associated with the document tag, the data access policy indicating a set of identities of user accounts that are permitted to access the document associated with the document tag;

receiving second input indicating a recipient account for the document;

determining, using the data access policy, that a particular identity of the recipient account is included in the set of identities of the user accounts that are permitted to access the document;

based on the particular identity of the recipient account being not included in the set of identities, restricting access to the document by the recipient account; or

based on the particular identity of the recipient account being included in the set of identities, allowing access to the document by the recipient account;

receiving third input indicating a second document for the recipient account;

identifying a second document tag associated with the second document;

obtaining a second data access policy associated with the second document tag, the second data access policy indicating a second set of identities of user accounts that are permitted to access the second document associated with the second document tag;

determining, using the second data access policy, that the particular identity of the recipient account is not included in the second set of identities of the user accounts that are permitted to access the second document; and

based on the particular identity of the recipient account being not included in the second set of identities, restricting access to the document and the second document by the recipient account.

2. The method of claim 1 , further comprising:

determining that the document is at least one of an attachment to an outbound message or associated with a link included in the outbound message, the outbound message being destined to the recipient account; and

detecting a workflow associated with the document being the at least one of the attachment or the link,

wherein the workflow indicates that the data access policy is required to evaluate access to the document by the recipient account prior to the outbound message being delivered to the recipient account.

3. The method of claim 1 , further comprising:

receiving fourth input indicating a second recipient account of the document; and

in response to determining that the set of identities includes the second recipient account, encrypting an outbound message, to the second recipient account, comprising the document as an attachment to the outbound message.

4. The method of claim 3 , further comprising determining that the data access policy includes a rule that requires encryption of then outbound message comprising the document, associated with the document tag, as an attachment the outbound message.

5. The method of claim 1 , further comprising:

restricting access to the document by the recipient account;

receiving fourth input indicating authorization of the access to the document by the recipient account;

permitting access to the document by the recipient account; and

modifying the data access policy adding the recipient account to the set of identities.

6. The method of claim 1 , further comprising:

in response to accessing the document tag by a first user account included in the set of identities, generating a first prompt comprising a name of the document tag; and

in response to accessing the document tag by a second user account excluded from the set of identities, generating a second prompt comprising an alternate identifier of the document tag.

7. A computing system comprising:

one or more processors; and

one or more non-transitory computer-readable memory storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

storing a set of documents at a computing system, individual documents in the set of documents being associated with document tags that represent language included in the individual documents;

receiving first input indicating of a document of the set of documents;

identifying a document tag associated with the document;

obtaining a data access policy associated with the document tag, the data access policy indicating a set of identities of user accounts that are permitted to access the document associated with the document tag;

receiving second input indicating a recipient account for the document;

determining, using the data access policy, that a particular identity of the recipient account is included in the set of identities of the user accounts that are permitted to access the document;

based on the particular identity of the recipient account being not included in the set of identities, restricting access to the document by the recipient account; or

based on the particular identity of the recipient account being included in the set of identities, allowing access to the document by the recipient account;

in response to accessing the document tag by a first user account included in the set of identities, generating a first prompt comprising a name of the document tag; and

in response to accessing the document tag by a second user account excluded from the set of identities, generating a second prompt comprising an alternate identifier of the document tag.

8. The computing system of claim 7 , the operations further comprising:

determining that the document is at least one of an attachment to an outbound message or associated with a link included in the outbound message, the outbound message being destined to the recipient account; and

detecting a workflow associated with the document being the at least one of the attachment or the link,

wherein the workflow indicates that the data access policy is required to evaluate access to the document by the recipient account prior to the outbound message being delivered to the recipient account.

9. The computing system of claim 7 , the operations further comprising:

receiving third input indicating a second document for the recipient account;

identifying a second document tag associated with the second document;

obtaining a second data access policy associated with the second document tag, the second data access policy indicating a second set of identities of user accounts that are permitted to access the second document associated with the second document tag;

determining, using the second data access policy, that the particular identity of the recipient account is not included in the second set of identities of the user accounts that are permitted to access the second document; and

based on the particular identity of the recipient account being not included in the second set of identities, restricting access to the document and the second document by the recipient account.

10. The computing system of claim 7 , the operations further comprising:

receiving third input indicating a second recipient account of the document; and

in response to determining that the set of identities includes the second recipient account, encrypting an outbound message, to the second recipient account, comprising the document as an attachment to the outbound message.

11. The computing system of claim 10 , the operations further comprising determining that the data access policy includes a rule that requires encryption of then outbound message comprising the document, associated with the document tag, as an attachment the outbound message.

12. The computing system of claim 7 , the operations further comprising:

restricting access to the document by the recipient account;

receiving third input indicating authorization of the access to the document by the recipient account;

permitting access to the document by the recipient account; and

modifying the data access policy adding the recipient account to the set of identities.

13. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause a network orchestrator to perform operations comprising:

storing a set of documents at a computing system, individual documents in the set of documents being associated with document tags that represent language included in the individual documents;

receiving first input indicating of a document of the set of documents;

identifying a document tag associated with the document;

obtaining a data access policy associated with the document tag, the data access policy indicating a set of identities of user accounts that are permitted to access the document associated with the document tag;

receiving second input indicating a recipient account for the document;

determining, using the data access policy, that a particular identity of the recipient account is included in the set of identities of the user accounts that are permitted to access the document;

based on the particular identity of the recipient account being not included in the set of identities, restricting access to the document by the recipient account; or

based on the particular identity of the recipient account being included in the set of identities, allowing access to the document by the recipient account;

receiving third input indicating a second document for the recipient account;

identifying a second document tag associated with the second document;

obtaining a second data access policy associated with the second document tag, the second data access policy indicating a second set of identities of user accounts that are permitted to access the second document associated with the second document tag;

determining, using the second data access policy, that the particular identity of the recipient account is not included in the second set of identities of the user accounts that are permitted to access the second document; and

based on the particular identity of the recipient account being not included in the second set of identities, restricting access to the document and the second document by the recipient account.

14. The one or more non-transitory computer-readable media of claim 13 , the operations further comprising:

determining that the document is at least one of an attachment to an outbound message or associated with a link included in the outbound message, the outbound message being destined to the recipient account; and

detecting a workflow associated with the document being the at least one of the attachment or the link,

wherein the workflow indicates that the data access policy is required to evaluate access to the document by the recipient account prior to the outbound message being delivered to the recipient account.

15. The one or more non-transitory computer-readable media of claim 13 , wherein

receiving fourth input indicating a second recipient account of the document; and

in response to determining that the set of identities includes the second recipient account, encrypting an outbound message, to the second recipient account, comprising the document as an attachment to the outbound message.

16. The one or more non-transitory computer-readable media of claim 13 , the operations further comprising determining that the data access policy includes a rule that requires encryption of then outbound message comprising the document, associated with the document tag, as an attachment the outbound message.

17. The one or more non-transitory computer-readable media of claim 13 , the operations further comprising:

restricting access to the document by the recipient account;

receiving fourth input indicating authorization of the access to the document by the recipient account;

permitting access to the document by the recipient account; and

modifying the data access policy adding the recipient account to the set of identities.

Assignments (2)

Continuity (3)

References Cited (11)