Self-destructing smart data container

Patent metadata

Field	Value
Publication number	US-10554663-B2
Application number	US-201715467011-A
Country	US
Kind code	B2
Filing date	Mar 23, 2017
Priority date	Mar 23, 2017
Publication date	Feb 4, 2020
Grant date	Feb 4, 2020

Abstract

According to an embodiment of the present disclosure, a method is disclosed comprising receiving a request to access protected data stored in a smart data container. The method further comprises comparing a first device identifier associated with a first device from which the request to access the protected data stored in the smart data container was received to a second device identifier which uniquely identifies a second device that created the smart data container. The method further comprises allowing access to the protected data stored in the smart data container by the first device based on whether the first device identifier matches the second device identifier.

First claim

What is claimed is:

1. A method, comprising:
storing protected data in an encrypted format in a smart data container, the smart data container comprising a virtual machine running on a computing device, the virtual machine operating as a digital vault storing the protected data and a first identifier associated with a first device that created the smart data container, the virtual machine comprising functionality for performing authentication of the first device before allowing access to the protected data;
receiving a request to access protected data stored in a smart data container, the request comprising a second identifier associated with a second device from which the request to access the protected data is received;
using the functionality of the virtual machine to compare the second device identifier associated with the second device from which the request to access the protected data stored in the smart data container was received to the first device identifier which uniquely identifies the first device that created the smart data container; and
using the functionality of the virtual machine to perform one of:
determine that the second identifier does not match the first identifier; and
modify the smart data container to prevent access to the protected data stored in the smart data container by the second device in response to determining that the second device identifier does not match the first device identifier, wherein modifying the smart data container to prevent access to the protected data comprises destroying an encryption key associated with the protected data stored in the smart data container.

2. The method of claim 1 , wherein the smart data container comprises an interface that exposes at least one operation that may be performed on the protected data after access to the protected data is allowed.

3. The method of claim 2 , wherein the at least one operation is selected from the group consisting of a read request, an update request, a write request, and a delete request.

4. The method of claim 1 , wherein comparing the first device identifier to the second device identifier comprises comparing a first audio waveform created with the creation of the smart data container and being associated with the first device to a second audio waveform associated with the second device.

5. The method of claim 1 , wherein modifying the smart data container to prevent access to the protected data comprises destroying the smart data container and the protected data stored in the smart data container.

6. The method of claim 1 , wherein prior to storing the protected data in a smart data container and receiving the request to access the protected data stored in the smart data container the method comprises:
receiving, from the first device, a request to create the smart data container;
using a client identification protocol to generate the first device identifier which uniquely identifies the first device from which the request to create the smart data container was received.

7. The method of claim 1 , wherein the request to access the protected data is received from a client application and the method further comprises:
authenticating the identity of the client application prior to comparing the first device identifier to the second device identifier.

8. The method of claim 1 , wherein the computing device on which the virtual machine is running and on which the smart data container is stored is different than the first device.

9. A computer comprising:
a processor; and
a non-transitory, computer-readable storage medium storing instructions that when executed by the processor cause the processor to:
store protected data in an encrypted format in a smart data container, the smart data container comprising a virtual machine running on a computing device, the virtual machine operating as a digital vault storing the protected data and a first identifier associated with a first device that created the smart data container, the virtual machine comprising functionality for performing authentication of the first device before allowing access to the protected data;
receive a first request to access protected data stored in a smart data container, the request comprising a second identifier associated with a second device from which the request to access the protected data is received;
using the functionality of the virtual machine to compare the second device identifier associated with the second device from which the first request to access the protected data stored in the smart data container was received to the first device identifier which uniquely identifies the second device that created the smart data container;
using the functionality of the virtual machine to determine that the second identifier associated with the second device from which the first request was received does not match the first identifier which uniquely identifies the first device that created the smart data container; and
using the functionality of the virtual machine to modify the smart data container to prevent access to the protected data stored in the smart data container by the second device in response to determining that the second device identifier does not match the first device identifier, wherein modifying the smart data container to prevent access to the protected data comprises destroying an encryption key associated with the protected data stored in the smart data container.

10. The computer of claim 9 , wherein the smart data container comprises an interface that exposes at least one operation that may be performed on the protected data after access to the protected data is allowed.

11. The method of claim 10 , wherein the at least one operation is selected from the group consisting of a read request, an update request, a write request, and a delete request.

12. The computer of claim 9 , wherein comparing the first device identifier to the second device identifier comprises comparing a first audio waveform created with the creation of the smart data container and being associated with the first device to a second audio waveform associated with the second device.

13. The computer of claim 9 , wherein modifying the smart data container to prevent access to the protected data comprises destroying the smart data container or the protected data stored in the smart data container.

14. The computer of claim 9 , wherein the instructions are further executed by the processor to cause the processor to:
receive from the first device, a request to create the smart data container, the request received prior to receiving the first request to access the protected data stored in the smart data container;
use a client identification protocol to generate the first device identifier which uniquely identifies the first device from which the request to create the smart data container was received; and
store the first device identifier and the protected data within the smart data container.

15. The computer of claim 9 , wherein the first request to access the protected data is received from a client application and the instructions are further executed by the processor to cause the processor to:
authenticating the identity of the client application prior to comparing the first device identifier to the second device identifier.

16. A non-transitory, computer-readable storage medium having instructions stored thereon that are executable by a computing system to:
store protected data in an encrypted format in a smart data container, the smart data container comprising a virtual machine running on a computing device, the

Assignees

• Ca Inc

Inventors

• Ganda Rohit

Classifications

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title