Security policy application through data tagging

Patent metadata

Field	Value
Publication number	US-9576147-B1
Application number	US-201514589824-A
Country	US
Kind code	B1
Filing date	Jan 5, 2015
Priority date	Jan 5, 2015
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

Techniques are described for applying data usage policies through data tagging. A metadata tag may be applied to data to indicate a type of the data. In some cases, the tag may be applied to the data when the data is decrypted, and the tag may propagate with the data as the data is passed between processes. A software module may include control logic that is configured to apply data usage policies based on the type tag of data. When the software module attempts an action on the data, such as storing or communicating the data, the control logic may access policy information. Based on the policy information, the control logic may allow the action, prevent the action, or allow the action to proceed on a modified version of the data.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving encrypted data at a decryption module employing a trusted platform module (TPM) executed by a computing device providing a secure environment for performing cryptographic operations to provide unencrypted data to a software module;
determining the software module is configured to process tagged data using policy information;
processing the encrypted data by the decryption module, including:
decrypting the encrypted data to generate the unencrypted data;
analyzing the unencrypted data to determine its data type; and
generating the tagged data that includes the unencrypted data and a type tag including metadata that propagates with the unencrypted data to identify the data type of the unencrypted data;

determining, by the decryption module based on the data type described by the metadata of the type tag, that the software module is configured to perform an action on the unencrypted data, the action including one or more of:
storing the unencrypted data in a datastore;
communicating the unencrypted data over a network; or
writing the unencrypted data to a file;

propagating the tagged data including the unencrypted data and the type tag to the software module;
accessing, by the software module, the policy information associated with the type tag of the unencrypted data to enforce data usage policies governing performance of the action on the data type;
determining by the software module, from the policy information associated with the data type, the action to be attempted;
examining, by the software module, the policy information associated with the data type to determine a result including one or more of:
preventing the action from being performed by the software module, according to the policy information indicating that the action is disallowed for the data type; or
performing the action on the tagged data by the software module, according to the policy information indicating that the action is allowed for the data type; and

executing, by the software module, the result associated with the data type identified by the policy information.

2. The method of claim 1 , the processing of the encrypted data being performed by the decryption module executing separately from the software module.

3. The method of claim 1 , the processing of the encrypted data being performed by executable logic included in the encrypted data.

4. The method of claim 1 , the processing of the encrypted data further comprising:
determining that the software module is authorized to access the unencrypted data;
determining that the software module is configured to process the tagged data; and
providing the tagged data to the software module, responsive to determining that the software module is authorized to access the unencrypted data and configured to process the tagged data.

5. The method of claim 1 , wherein:
the policy information indicates that the action is disallowed for the data type;
the result further comprises generating a notification indicating that the action is disallowed; and
the notification includes one or more of an alert, an error, an assertion, or an exception.

6. A system, comprising:
at least one computing device comprising:
memory storing computer-executable instructions; and
a processor, coupled to the memory, the processor executing the computer-executable instructions for implementing one or more modules including a decryption module and a software module, the processor operating to:
receive encrypted data at the decryption module for performing cryptographic operations in a secure environment to provide unencrypted data to the software module;
decrypt, by the decryption module, the encrypted data to generate tagged data including the unencrypted data and a data type, including metadata that describes the data type of the unencrypted data, that propagates with the unencrypted data to identify the data type of the unencrypted data;
propagate the tagged data including the unencrypted data and a type tag to the software module;
store the propagated tagged data in data storage for access by the software module;
determine the software module is configured to process the tagged data using policy information;
access, the tagged data from the data storage by the software module, the tagged data including the unencrypted data and the type tag including the metadata that describes the data type of the unencrypted data;
determine, by the software module based on the data type described by the metadata of the type tag, an action to be performed by the software module on the unencrypted data, the action including one or more of:
storing the unencrypted data in a datastore;
communicating the unencrypted data over a network; or
writing the unencrypted data to a file;

access, by the software module, the policy information associated with the type tag of the unencrypted data to enforce data usage policies governing performance of the action on the data type;
examine, by the software module, the policy information associated with the data type to determine a result; and
based on the result, prevent the action from being performed by the software module, according to the policy information indicating that the action is disallowed for the data type.

7. The system of claim 6 , wherein the action comprises one or more of:
encrypting the unencrypted data; or
disassociating the type tag from the unencrypted data.

8. The system of claim 6 , wherein the data type comprises one or more of:
a user identifier;
a user description;
a user address;
sensitive user information;
user behavior information;
a security credential; or
payment instrument information.

9. The system of claim 6 , wherein the decryption module executes on the software module to execute decryption instructions to:
access the policy information using the tagged data that includes the unencrypted data and the type tag corresponding to the data type of the unencrypted data; and
identify a policy associated with the type tag from the policy information.

10. The system of claim 9 , wherein the decryption module further operates to:
determine that one or more of the software module or the at least one computing device is authorized to process the unencrypted data; and
provide the tagged data to the software module, responsive to determining that the one or more of the software module or the at least one computing device is authorized to process the unencrypted data.

11. The system of claim 6 , wherein:
the software module is further configured to access the encrypted data that includes executable logic which operates to:
determine the data type of the unencrypted data; and
access the policy information using the tagged data that includes the unencrypted data and the type tag corresponding to the data type of the unencrypted data to identify a policy associated with the type tag from the policy information.

12. The system of claim 11 , wherein the executable logic further operates to:
determine that one or more of the software module or the at least one computing device is authorized to process the unencrypted data; and
generate the tagged data, responsive to determining that the one or more of the software module or the at least one computing device is authorized to process the unencrypted data.

13. The system of claim 6 , wherein the software module is further configured to:
cause the action to be performed on the tagged data, according to the policy information indicating that the action is allowed for the data type.

14. The system of

Assignees

• Amazon Tech Inc

Inventors

• Mcclintock Jon Arron
• Darrow John Elias
• Denton Patrick Nicholas
• Deodia Assim
• Deshpande Ketan Ramesh
• Vanniarajan Kadirvel Chockalingam

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title