Methods and apparatus to process data based on automatically detecting a security environment

Patent metadata

Field	Value
Publication number	US-2016248809-A1
Application number	US-201514628016-A
Country	US
Kind code	A1
Filing date	Feb 20, 2015
Priority date	Feb 20, 2015
Publication date	Aug 25, 2016
Grant date	—

Abstract

Methods and apparatus to process data based on automatically detecting a security environment are disclosed. An example apparatus includes an input device, an environment identifier, a security level selector, and a secure data processor. The input device captures information indicating a physical environment in which the computing device is located. The environment identifier identifies a security environment based on the captured information and a security policy, the security policy defining the security environment and security levels. The security level selector selects, based on the security environment, one of the security levels to be authorized at the computing device within the security environment. The secure data processor processes data based on the selected security level.

First claim

1 . A computing device to process data, comprising:
an input device to capture information indicating a physical environment in which the computing device is located; an environment identifier to identify a security environment based on the captured information and a security policy, the security policy defining the security environment and security levels; a security level selector to select, based on the security environment, one of the security levels to be authorized at the computing device within the security environment; and a secure data processor to process data based on the selected security level.

2 . A computing device as defined in claim 1 , wherein the environment identifier is to identify the security environment by determining whether the information matches a definition of the security environment in the security policy.

3 . A computing device as defined in claim 1 , wherein the secure data processor comprises:
a key manager to manage a set of keys corresponding to the security levels; and a secure execution environment to process the data using one of the keys that corresponds to the selected security level.

4 . A computing device as defined in claim 3 , wherein the secure execution environment is to encrypt the data using the one of the keys when the data is not previously protected at the selected security level.

5 . A computing device as defined in claim 3 , wherein the secure execution environment is to decrypt the data using the one of the keys when the data is protected at the selected security level, and is to permit use of the decrypted data within the secure execution environment.

6 . A computing device as defined in claim 1 , wherein the input device comprises at least one of a communications network interface, a close proximity communications interface, a location sensor, or a clock.

7 . A computing device as defined in claim 1 , further comprising an application data processor to access application data corresponding to an application executing on the computing device, the environment identifier to determine the security environment based on the application data.

8 . A method to process data, comprising:
obtaining a set of inputs at a first device; determining a security environment based on the set of inputs and a security policy, the security policy defining the security environment and security levels; determining, based on the security environment, one of the security levels to be authorized at the first device within the security environment; and processing data at the first device based on the one of the security levels.

9 . A method as defined in claim 8 , wherein the data comprises at least one of a video captured via an image sensor, a still image captured by the image sensor, text data captured via a text input device, or audio captured by an audio sensor.

10 . A method as defined in claim 9 , wherein processing the data comprises tagging the data with metadata indicating that access to the data is to be restricted based on the determined security level.

11 . A method as defined in claim 9 , wherein processing the data comprises encrypting the data using an encryption key corresponding to the determined security level.

12 - 19 . (canceled)

20 . A tangible computer readable storage medium comprising computer readable instructions which, when executed, cause a processor of a first device to at least:
securely access a set of inputs collected via respective sensors; determine a security environment based on the set of inputs and a security policy, the security policy defining the security environment and security levels; determine, based on the security environment, one of the security levels to be authorized within the security environment; and process data based on the determined security level.

21 . A storage medium as defined in claim 20 , wherein the data comprises at least one of a video captured via an image sensor of the first device, a still image captured by the image sensor of the first device, text data captured via a text input device of the first device, or audio captured by an audio sensor of the first device.

22 . A storage medium as defined in claim 21 , wherein the instructions are to cause the processor to process the data by tagging the data with metadata indicating that access to the data is to be restricted based on the determined security level.

23 . A storage medium as defined in claim 21 , wherein the instructions are to cause the processor to process the data by encrypting the data using an encryption key corresponding to the determined security level.

24 . A storage medium as defined in claim 20 , wherein the set of inputs comprises at least one of a physical location, an identification of a communication network to which the first device is connected, an identification of a second device that is within a threshold physical distance of the first device.

25 . A storage medium as defined in claim 24 , wherein the instructions are to cause the processor to access the set of inputs by executing an instruction within a trusted execution environment.

26 . A storage medium as defined in claim 20 , wherein the instructions are to cause the processor to determine the security environment by identifying a physical boundary specified in the security policy.

27 . A storage medium as defined in claim 20 , wherein the instructions are further to cause the processor to identify a selection of a second security level to override the determined security level, and process second data at the first device based on the second security level.

28 . A storage medium as defined in claim 20 , wherein the instructions are further to cause the processor to determine a default classification level corresponding to the security environment, the instructions to cause the processor to determine the one of the security levels based on the default classification level.

29 . A storage medium as defined in claim 20 , wherein the instructions are further to cause the processor to provision a secure processing environment with information necessary to process resources at the determined security level in response to determining the one of the security levels to be authorized.

30 . A storage medium as defined in claim 29 , wherein the instructions are further to cause the processor to de-provision the secure processing environment in response to identifying a change in the security environment.

31 . A storage medium as defined in claim 20 , wherein the instructions are further to cause the processor to:
securely access a set of second inputs at the first device; determine a second security environment based on the set of second inputs and the security policy; and determine, based on applying the security policy to the set of second inputs, a second one of the security levels to be authorized within the security environment.

32 . A storage medium as defined in claim 20 , wherein the instructions are to cause the processor to process the data within a trusted execution environment based on a key that is released by a trusted platform module for use within the trusted execution environment.

33 . A storage medium as defined in claim 20 , wherein the instructions are to cause the processor to process the data by restricting access to the data when the data is protected at a more restrictive security level than the one of the secu

Assignees

• Intel Corp

Inventors

• Smith Ned M
• Bhargav-Spantzel Abhilasha
• Bar-El Oded

Classifications

• H04W12/08

  Access security · CPC title

• H04L63/06 Primary

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/107

  wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title