Abstract: Methods, systems and computer program products for content management systems. The techniques of the methods, systems and/or computer program products automatically determine activity-based content object access permissions and/or make a recommendation of activity-based content object access permissions. A machine learning model is formed from observations of user interactions over a plurality of content objects. The model is continually updated based on ongoing observation and analysis of user interaction events. When a collaborative relationship is formed between an invitor and one or more invitees, the activity-based permissions model is accessed to determine a set of access permissions to assign to the collaborative relationship. A single collaborative relationship may cover many collaboration objects. In some cases, a set of access permissions are automatically assigned to the collaborative relationship. In other cases, a set of access permissions is presented to the invitor as a recommendation.

Abstract: Various corpora of content objects and other information sources beyond the corpora of content objects are processed to identify personally identifiable information (PII). PII that is associated with a named person is codified into a first portion of a graph-oriented data structure. Also, PII that is associated with an alias that might refer to a named person is codified into a second portion of the graph-oriented data structure. A determination is made that the alias that might refer to a named person is indeed an alias that is a coreference to the named person. Based on that determination then, since the first portion of the graph and the second portion of the graph refer to the same person, then the PII of the second portion of the graph can be deemed to be PII of the same person. PII in common and/or language processing can be used to establish coreferences.

Abstract: Methods, systems and computer program products for content management systems. The techniques of the methods, systems and/or computer program products automatically determine activity-based content object access permissions and/or make a recommendation of activity-based content object access permissions. A machine learning model is formed from observations of user interactions over a plurality of content objects. The model is continually updated based on ongoing observation and analysis of user interaction events. When a collaborative relationship is formed between an invitor and one or more invitees, the activity-based permissions model is accessed to determine a set of access permissions to assign to the collaborative relationship. A single collaborative relationship may cover many collaboration objects. In some cases, a set of access permissions are automatically assigned to the collaborative relationship. In other cases, a set of access permissions is presented to the invitor as a recommendation.

Abstract: Handling user-demanded privacy controls over data of an electronic document collaboration system. A storage facility is configured to store content objects and associated metadata that pertains to the content objects. A user raises a privacy action request that comprises a demand to change how certain content objects that contain personally identifiable information (PII) of the user are handled. A plurality of content objects are classified using a PII classifier that is trained using synthetically-generated training set entries where, rather than reading actual contents from electronic documents of the collaboration system to generate training set entries, instead, the training set entries are generated using words that are randomly selected from a repository of natural language words. When PII corresponding to the user who raised the privacy action request is discovered in content objects, then the content management system modifies those content objects and/or its metadata in accordance with the demand.

Abstract: A collaboration system manages a plurality of content objects that are shared by multiple users at corresponding user devices in corresponding computing environments. Policies that govern interactions over the plurality of content objects are established. A content object upload request from a first user belonging to a first enterprise is processed by the collaboration system and then the content object is shared with a second user of a second enterprise. Security characteristics pertaining to the second user, and/or the second enterprise, and/or the second user's devices are initially unknown or unverified. As such, upon receiving interaction events raised by a user device of the second user, a set of interaction attributes associated with the interaction events are gathered. One or more trust policies are applied to the interaction attributes to evaluate security conditions that correspond to the interaction events. A response is generated based on the evaluated security conditions.

Abstract: Techniques to provide mobile access to content are disclosed. A request from a mobile application running on a mobile device to access content is received at a connector node. A user credential associated with the request is used to identify at the connector node a policy associated with the request. A policy metadata associated with the policy is provided from the connector node to the mobile application running on the mobile device. The mobile application may include application code that is responsive to the policy metadata to perform, with respect to the request to access content, an action indicated by the policy.

Abstract: As a default, a global permissions model is established. The global permissions model serves for applying a first set of resource access permissions to shared content objects. Additionally, a set of context-aware access policies that govern user interactions over the shared content object is established. When a particular user requests an interaction over a shared content object, then interaction attributes associated with the request are gathered. The context-aware access policies are applied to the request by determining a set of extensible access permissions that are derived from the interaction attributes. The context-aware access policies are enforced by overriding the first set of resource access permissions with dynamically-determined access permissions. When a particular access request is denied, a response is generated in accordance with the set of extensible access permissions and the user is notified. In some cases, the access request is permitted, but only after the user provides a justification.

Abstract: A cloud-based content object management system responds to download requests from user devices to provide access to synchronization code. Using the synchronization code, a user device requests, receives, and stores a user-device-local copy of a subject content object. The cloud-based content object management system determines that at least one security-related parameter pertaining to the subject content object has undergone a change and reaches a determination that the user-device-local copy of the subject content object is to be either deleted or quarantined. Upon such determination, the cloud-based content object management system forms eviction instructions and sends them to the user device, which in turn causes deletion or quarantining of the remote content object copy at the user device, while still retaining directory structure metadata that refers to the now evicted subject content object.

Abstract: Leakage of secure content (e.g., unauthorized dissemination of secure content) is prevented even after a user has downloaded a copy of the secure content. In a content management system, the secure content object is accessible by users who access the secure content by downloading copies. While the downloading of a copy to a user device is permitted, further dissemination is not allowed. To enforce this degree of security, the user downloads a virtual file system that is configured to store a local instance of the secure content object in a secure container of the user device. During ongoing operation of the user device, every data movement operation request associated with the local instance of the secure content object is intercepted. Logic implemented in the downloaded a virtual file system will deny any data movement operation request when a target storage location associated with the data movement operation request is other than a location in the secure container.

Abstract: Methods, systems and computer program products for computing system security. Techniques for classifying a potentially unauthorized user as an authorized user involve comparisons of two or more access request times that occur at different computing devices in different geographical locations. Based on those comparisons and the distance between the geographical locations of the different computing devices, a determination is made as to whether or not travel (e.g., via overland travel, via air travel, etc.) between those different geographical locations can be reasonably accomplished within a given time period. If it is determined that the required time for travel between the different geographical locations is greater than the time between the access request times—thus suggesting a spoofing attack or other malfeasance—then the potentially unauthorized (i.e.

Abstract: A collaboration system provides network access to a plurality of content objects. The collaboration system facilitates collaboration interactions between particular users by allowing or denying network access to the plurality of content objects based on user invitations. A computing module observes and records user-to-user or user-to-content collaboration invitations over the plurality of content objects. On an ongoing basis, a collaboration network graph is constructed and maintained, with updates to the collaboration network graph being continually applied based on observed collaboration interactions. On demand, such as upon receipt of a user request for access to a content object, the updated collaboration network graph is consulted so as to generate a then-current sharing boundary.

Abstract: Various corpora of content objects and other information sources beyond the corpora of content objects are processed to identify personally identifiable information (PII). PII that is associated with a named person is codified into a first portion of a graph-oriented data structure. Also, PII that is associated with an alias that might refer to a named person is codified into a second portion of the graph-oriented data structure. A determination is made that the alias that might refer to a named person is indeed an alias that is a coreference to the named person. Based on that determination then, since the first portion of the graph and the second portion of the graph refer to the same person, then the PII of the second portion of the graph can be deemed to be PII of the same person. PII in common and/or language processing can be used to establish coreferences.

Abstract: Various corpora of content objects and other information sources beyond the corpora of content objects are processed to identify personally identifiable information (PII). PII that is associated with a named person is codified into a first portion of a graph-oriented data structure. Also, PII that is associated with an alias that might refer to a named person is codified into a second portion of the graph-oriented data structure. A determination is made that the alias that might refer to a named person is indeed an alias that is a coreference to the named person. Based on that determination then, since the first portion of the graph and the second portion of the graph refer to the same person, then the PII of the second portion of the graph can be deemed to be PII of the same person. PII in common and/or language processing can be used to establish coreferences.

Abstract: Methods, systems and computer program products for managing shared content directory structure metadata stored on client devices. A method embodiment includes identifying a collaboration system that stores one or more content objects that are organized in accordance with a directory structure. Requests pertaining to the content objects are raised by processing entities running on the client device. The requests include instructions to retrieve one or more of multiple types of metadata associated with the directory elements that constitute the directory structure. Based on timing and patterns of requests pertaining to the content objects, a monitoring function detects unwanted runaway retrieval by a runaway process. To prevent further unwanted runaway retrieval of the metadata, the runaway process is blocked from continuing its pattern of unwanted (runaway) retrieval. The collaboration system is notified of characteristics of the runaway process.

Abstract: As a default, a global permissions model is established. The global permissions model serves for applying a first set of resource access permissions to shared content objects. Additionally, a set of context-aware access policies that govern user interactions over the shared content object is established. When a particular user requests an interaction over a shared content object, then interaction attributes associated with the request are gathered. The context-aware access policies are applied to the request by determining a set of extensible access permissions that are derived from the interaction attributes. The context-aware access policies are enforced by overriding the first set of resource access permissions with dynamically-determined access permissions. When a particular access request is denied, a response is generated in accordance with the set of extensible access permissions and the user is notified. In some cases, the access request is permitted, but only after the user provides a justification.

Abstract: Techniques to provide mobile access to content are disclosed. A request from a mobile application running on a mobile device to access content is received at a connector node. A user credential associated with the request is used to identify at the connector node a policy associated with the request. A policy metadata associated with the policy is provided from the connector node to the mobile application running on the mobile device. The mobile application may include application code that is responsive to the policy metadata to perform, with respect to the request to access content, an action indicated by the policy.

Abstract: Methods, systems and computer program products for managing shared content directory structure metadata stored on client devices. A method embodiment includes identifying a collaboration system that stores one or more content objects that are organized in accordance with a directory structure. Requests pertaining to the content objects are raised by processing entities running on the client device. The requests include instructions to retrieve one or more of multiple types of metadata associated with the directory elements that constitute the directory structure. Based on timing and patterns of requests pertaining to the content objects, a monitoring function detects unwanted runaway retrieval by a runaway process. To prevent further unwanted runaway retrieval of the metadata, the runaway process is blocked from continuing its pattern of unwanted (runaway) retrieval. The collaboration system is notified of characteristics of the runaway process.

Abstract: Techniques to provide mobile access to content are disclosed. A request from a mobile application running on a mobile device to access content is received at a connector node. A user credential associated with the request is used to identify at the connector node a policy associated with the request. A policy metadata associated with the policy is provided from the connector node to the mobile application running on the mobile device. The mobile application may include application code that is responsive to the policy metadata to perform, with respect to the request to access content, an action indicated by the policy.

Abstract: Methods, systems and computer program products for computing system security. Techniques for classifying a potentially unauthorized user as an authorized user involve comparisons of two or more access request times that occur at different computing devices in different geographical locations. Based on those comparisons and the distance between the geographical locations of the different computing devices, a determination is made as to whether or not travel (e.g., via overland travel, via air travel, etc.) between those different geographical locations can be reasonably accomplished within a given time period. If it is determined that the required time for travel between the different geographical locations is greater than the time between the access request times—thus suggesting a spoofing attack or other malfeasance—then the potentially unauthorized (i.e.

Abstract: As a default, a global permissions model is established. The global permissions model serves for applying a first set of resource access permissions to shared content objects. Additionally, a set of context-aware access policies that govern user interactions over the shared content object is established. When a particular user requests an interaction over a shared content object, then interaction attributes associated with the request are gathered. The context-aware access policies are applied to the request by determining a set of extensible access permissions that are derived from the interaction attributes. The context-aware access policies are enforced by overriding the first set of resource access permissions with dynamically-determined access permissions. When a particular access request is denied, a response is generated in accordance with the set of extensible access permissions and the user is notified. In some cases, the access request is permitted, but only after the user provides a justification.