Document management system having context-based access control and related methods

1. A non-transitory machine readable medium having tangibly stored thereon executable instructions for execution by a processor of a computing device, wherein the executable instructions, when executed by the processor, cause the computing device to:

maintain a first set of records relating to a plurality of documents stored by a document management system, each of the first set of records comprising a plurality of document properties, the document properties comprising document-identifying properties, document-access properties and derived document-context properties, wherein the derived document-context properties are weighted measures of the recency of access;

maintain a second set of records relating to the plurality of users of the document management system, each of the second set of records comprising user properties, the user properties comprising user-identifying properties, user-access properties and derived user-context properties, wherein the derived user-context properties are weighted measures of the recency of access;

receive a document access request for a document in the plurality of documents stored by the document management, wherein the document access request is associated with a user in the plurality of users of the document management system, wherein the document access request comprises document properties comprising document-identifying properties identifying the document and document-access properties specifying a type of access;

determine whether the document access request matches access criteria for granting the document access request based on a comparison of the document properties of the requested document and user properties of the user associated with the document access request to the derived document-context properties associated with the requested document and the derived user-context properties associated with the user associated with the document access request; and

in response to determining that the document access request does not match the access criteria, send an authentication request to the user.

2. The non-transitory machine readable medium of claim 1 , wherein the executable instructions, when executed by the processor, cause the computing device to:

in response to successful authentication of the user, permit access to the requested document.

3. The non-transitory machine readable medium of claim 1 , wherein the executable instructions, when executed by the processor, cause the computing device to:

in response to determining that the document access request does match the access criteria, permit access to the requested document.

4. The non-transitory machine readable medium of claim 1 , wherein the derived document-context properties and derived user-context properties are derived from document access over a period of time.

5. The non-transitory machine readable medium of claim 1 , wherein the instances of document access during a more current period of time are assigned proportionately more weight than instances of document access during an older period of time.

6. The non-transitory machine readable medium of claim 1 , wherein the weight given to document access during an older period of time decreases non-linearly over time.

7. The non-transitory machine readable medium of claim 1 , wherein the derived document-context properties are weighted aggregate-measures of one or more of a frequency at which the document is accessed, a type of access taken with respect to the document, a location of the document access, a time at which the document is accessed, an identity of the user accessing the document, a communication type used to access the document, or a value of the document.

8. The non-transitory machine readable medium of claim 1 , wherein the derived document-context properties is a weighted measure of the type of access taken with respect to the document with each type of access being assigned a weight, wherein the at least some of the assigned weights are different, wherein the type of access taken with respect to the document is one of read (R), write (W), delete (X), set a permission designation (S), or clear a permission designation (C) action.

9. The non-transitory machine readable medium of claim 8 , wherein the derived document-context properties is a weighted measure of the type of access taken with respect to the document with a read action being proportionately less weight than a write action.

10. The non-transitory machine readable medium of claim 1 , wherein the derived user-context properties comprises one or more of a measure of user-activity in relation to a user's activity history, a measure of user-activity in relation to an average user in the same user group or business unit, or a measure of user-activity in relation to an average user of the document management system.

11. The non-transitory machine readable medium of claim 1 , wherein the derived user-context properties are weighted aggregate-measures of one or more of a frequency at which a user access documents, a type of access a user utilizes in accessing documents, a location of a user when accessing documents, a time at which a user accesses documents, a communication type used to accesses documents, or a value of the documents accessed by a user.

12. The non-transitory machine readable medium of claim 1 , wherein the executable instructions, when executed by the processor, cause the computing device to:

add the document-access properties of the document access request to the first set of records for the requested document;

add the user-access properties of the document access request to the second set of records for the requesting user;

update the derived document-context properties using the document-access properties; and

update the derived user-context properties using the added user-access properties of the document access request.

13. The non-transitory machine readable medium of claim 1 , wherein the derived document-context properties comprises a document-valuation property representing a measure of value of a particular document and a document shareability property representing a measure of how much a particular document is shared between users, and wherein derived user-context properties comprises a user-cooperation property indicating a measure of how a particular user cooperates with other users.

14. The non-transitory machine readable medium of claim 1 , wherein determining whether the document access request matches access criteria for granting the document access request comprises:

apply a plurality of classifiers for determining whether the document access request matches access criteria for granting the document access request;

determine true positive rates of the plurality of classifiers;

assign weights to the plurality of classifiers based on the true positive rates;

determine whether the document access request matches access criteria for granting the document access request based on the outputs of the plurality of classifiers and the weights assigned to the plurality of classifiers.

15. The non-transitory machine readable medium of claim 14 , wherein determining whether the document access request matches access criteria for granting the document access request further comprises:

determine a performance of each of the plurality of classifiers;

determine a relative performance of each of the plurality of classifiers, wherein the weights assigned to the plurality of classifiers are based on the relative performance.

16. The non-transitory machine readable medium of claim 15 , wherein the relative performance is based on trust scores.

17. The non-transitory machine readable medium of claim 14 , wherein the true positive rates of the plurality of classifiers is based on a weighted measure of the recency of performance with true positive rates for a more current period of time being proportionately more weight than a later period of time.

18. The non-transitory machine readable medium of claim 14 , wherein the weights assigned to the plurality of classifiers during an older period of time decreases non-linearly over time.

19. The non-transitory machine readable medium of claim 14 , wherein determining whether the document access request matches access criteria for granting the document access request further comprises:

assign weights to the derived document-context properties and the derived user-context properties based on the true positive rates;

wherein the determination whether the document access request matches access criteria for granting the document access request is based on the weights assigned to the plurality of classifiers and the weights assigned to the derived document-context properties and the derived user-context properties.

20. The non-transitory machine readable medium of claim 17 , wherein the plurality of classifiers are selected from the group consisting of Random Forest (RF), Naive Bayes (NB) and Support Vector Machines (SVM).

21. A computing device having a processor and a memory coupled to the processor, the memory having tangibly stored thereon executable instructions for execution by the processor, wherein the executable instructions, when executed by the processor, cause the computing device to:

maintain a first set of records relating to a plurality of documents stored by a document management system, each of the first set of records comprising a plurality of document properties, the document properties comprising document-identifying properties, document-access properties and derived document-context properties, wherein the derived document-context properties are weighted measures of the recency of access;

maintain a second set of records relating to the plurality of users of the document management system, each of the second set of records comprising user properties, the user properties comprising user-identifying properties, user-access properties and derived user-context properties, wherein the derived user-context properties are weighted measures of the recency of access;

receive a document access request for a document in the plurality of documents stored by the document management, wherein the document access request is associated with a user in the plurality of users of the document management system, wherein the document access request comprises document properties comprising document-identifying properties identifying the document and document-access properties specifying a type of access;

determine whether the document access request matches access criteria for granting the document access request based on a comparison of the document properties of the requested document and user properties of the user associated with the document access request to the derived document-context properties associated with the requested document and the derived user-context properties associated with the user associated with the document access request; and

in response to determining that the document access request does not match the access criteria, send an authentication request to the user.

22. A method of performing access control in a document management system, comprising:

maintaining a first set of records relating to a plurality of documents stored by the document management system, each of the first set of records comprising a plurality of document properties, the document properties comprising document-identifying properties, document-access properties and derived document-context properties, wherein the derived document-context properties are weighted measures of the recency of access;

maintaining a second set of records relating to the plurality of users of the document management system, each of the second set of records comprising user properties, the user properties comprising user-identifying properties, user-access properties and derived user-context properties, wherein the derived user-context properties are weighted measures of the recency of access;

receiving a document access request for a document in the plurality of documents stored by the document management, wherein the document access request is associated with a user in the plurality of users of the document management system, wherein the document access request comprises document properties comprising document-identifying properties identifying the document and document-access properties specifying a type of access;

determining whether the document access request matches access criteria for granting the document access request based on a comparison of the document properties of the requested document and user properties of the user associated with the document access request to the derived document-context properties associated with the requested document and the derived user-context properties associated with the user associated with the document access request; and

in response to determining that the document access request does not match the access criteria, sending an authentication request to the user.