Patent ID: 8627490

Claim:
A method of controlling document access using centrally managed rules, the method comprising: receiving a plurality of rules at a client system from a central rule database, wherein the central rule database is stored externally to the client system and accessible to the client system via a network connection; storing the plurality of rules in a memory of the client system, wherein the rules contain at least one expression used by the client system to perform access control for documents accessed by the client system; after the receiving and storing the plurality of rules at the client system, detecting an attempt by an application program on the client system to access a first document on a server, wherein the first document is stored on the server using a first format; executing an enforcement program module by the client system and installed at the client system to determine whether or not to allow access to documents at the client system, wherein the enforcement program module is separate from the application program, and the enforcement program module is already executing on the client before the application program starts executing on the client system; and at the client system, evaluating using the enforcement program module by the client system at least one rule from the plurality of rules stored at the client system to determine whether or not to allow the access attempt of the first document on the server further comprising: based on the access attempt, identifying at least one call to an operating system library function of an operating system executing on the client system comprising determining a translated command including the at least one call to the operating system library function; when the at least one rule is satisfied, allowing the access attempt, wherein with the allowed access attempt the first document remains in the first format; and when the at least one rule is not satisfied, disallowing the access attempt comprising: preventing the at least one call to the operating system library function.