Enforcement mitigations for a protected file

Patent metadata

Field	Value
Publication number	US-10089482-B2
Application number	US-201514975474-A
Country	US
Kind code	B2
Filing date	Dec 18, 2015
Priority date	Aug 5, 2015
Publication date	Oct 2, 2018
Grant date	Oct 2, 2018

Abstract

Aspects of the present invention provide the ability to enforce access methods on data based upon a policy or policies identified within the metadata of a file. The data is self-protected by including or being wrapped with one or more policy/rule identifiers that act as a form of body armor to the data when in transit or in different situations. In embodiments, access is only granted upon successful authentication and compliance with the identified policy or policies. In embodiments, depending upon the conditions and policies, varying level access may be granted. In embodiments, depending upon the conditions and policies, the system may take one or more mitigations or remedial access levels, such as containerizing, sandboxing, granting limited access, or erasing the data.

First claim

What is claimed is:

1. A computer-implemented method for accessing a file on a computing device, the method comprising:
receiving a request to access a payload of the file, the file comprising the payload in an encrypted format and metadata, the metadata comprising information related to one or more policies regarding one or more enforcement mitigations under which usable access to the payload is granted and mitigates security risks to the payload and which granting access to the payload via an enforcement mitigation is determined by the computing device independent of any third-party computing device, the metadata further comprising a set of operations in a set order that is associated with one or more extensible content transformation modules, the one or more extensible content transformation modules providing one or more extensible transformative capabilities that are used by a secure data format processor according to the set order to decode the encrypted payload into a user-accessible format;
using one or more components of the computing device to obtain situational data about the file that is relevant to the one or more policies;
applying at least one or more data of the situational data to the one or more policies to identify one or more enforcement mitigations that are available to be used to grant usable access to the payload; and
granting, via the computing device, usable access to the payload using at least one of the identified enforcement mitigations.

2. The computer-implemented method of claim 1 wherein the step of using one or more components of the computing device to obtain situational data about the file that is relevant to the one or more policies comprises:
collecting one or more situational data as indicated by the one or more policies, the situational data comprising at least one or more of clock data, location data, BIOS data, operating system data, file system data, network data, connectivity data, security features data, user data, authentication data, user privileges data, software data of the computing device, and hardware data of the computing device.

3. The computer-implemented method of claim 1 wherein the metadata comprising the information related to one or more policies regarding one or more enforcement mitigations under which access to the payload in an unencrypted format is granted and mitigates security risks to the payload comprises:
the one or more policies or one or more identifiers for accessing the one or more policies from a policy dataset.

4. The computer-implemented method of claim 3 further comprising:
obtaining from a data storage the one or more policies.

5. The computer-implemented method of claim 4 wherein the step of obtaining from a data storage the one or more policies comprises:
obtaining the one or more policies from the metadata of the file, from a policy dataset, or both.

6. The computer-implemented method of claim 5 wherein the policy dataset is obtained from at least one of:
a policy module on the computing device; and
a secure data access system management server that is communicatively coupled to the computing device.

7. The computer-implemented method of claim 1 wherein:
the step of applying at least one or more data of the situational data to the one or more policies to identify one or more enforcement mitigations that are available to be used to grant usable access to the payload comprises determining that no access is appropriate given the situational data and the one or more policies associated with the file; and
the step of granting, via the computing device, usable access to the payload using at least one of the identified enforcement mitigations comprises not granting access to the payload in the unencrypted format.

8. The computer-implemented method of claim 1 wherein the step of granting, via the computing device, usable access to the payload using at least one of the identified enforcement mitigations further comprising:
taking one or more actions, according to the at least one of the identified enforcement mitigations, to affect one or more conditions of the computing device to increase security for accessing the payload.

9. The computer-implemented method of claim 8 further comprising:
responsive to the payload comprising a nested payload and additional metadata identifying one or more additional policies related to conditions under which access are available to be granted to the nested payload, analyzing the one or more additional policies;
collecting, if needed for the one or more additional policies, additional situational data relevant to the one or more additional policies; and
applying at least one or more data of the situational data, additional situational data, or both to the one or more additional policies to identify one or more enforcement mitigations that are available to be used to grant access to the nested payload.

10. A system for applying an enforcement mitigation for accessing a protected file, the system comprising:
a memory that stores the protected file, the protected file comprising a payload that has been encrypted and metadata, the metadata comprising information related to one or more policies regarding one or more enforcement mitigations under which usable access to the payload is granted and which granting access to the payload via an enforcement mitigation is determined by the system independent of any third-party computing device, the metadata further comprising a set of operations in a set order;
a secure data format processor that coordinates system components to determine which of one or more enforcement mitigations are available for the protected file and applies an identified enforcement mitigation;
an access control engine that is communicatively coupled to the secure data format processor and identifies one or more enforcement mitigations that are appropriate based, at least in part, upon applying a set of situational data regarding the protected file to the one or more policies;
one or more extensible content transformation modules, communicatively coupled to the secure data format processor that are associated with the set of operations included in the metadata and provide one or more extensible transformative capabilities to the secure data format processor, the one or more transformative capabilities being used by the secure data format processor according to the set order as identified in the metadata to decode the payload into a usable format;
a policy/rules module, communicatively coupled a secure data access system management server and to the access control engine, that stores or acquires the one or more policies; and
an access environmental controls module, communicatively coupled to the access control engine, that applies one or more access control directives of the one or more enforcement mitigations determined to be appropriate by the access control engine for granting usable access to the payload.

11. The system of claim 10 wherein the set of situational data regarding the protected file comprises a set of access controls available on the system which are received by the access controls engine from the access environmental controls module.

12. The system of claim 11 wherein the access control engine identifies the one or more enforcement mitigations that are appropriate based, at least in part, upon applying a set of situational data regarding the protected file by performing the steps comprising:
obtaining the set of situational data regarding the protected file comprising the set of access controls from the access environmental controls module that are available for the system;
determining the one or more enforcement m

Assignees

• Dell Products Lp
• Dell Products Lp

Inventors

• Skipper Chad
• Lewis Elliot D
• Konetski David
• Burchett Christopher
• Schuckle Richard William
• Burke James Michael
• Robbins Warren Wade
• Gates Carrie Elaine

Classifications

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/6209 Primary

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title