Back to results
US 10,387,665 B2Granted
Policy enforcement
AssigneeVera
InventorsPrakash Linga, Ajay Arora, Vladimir Buzuev, Maurice C. Evans, Justin Sisley, Nicolas Vautier
Life of this patent
Estimating the term…
Abstract
Data security access and management may require a server dedicated to monitoring document access requests and enforcing rules and policies to limit access to those who are not specifically identified as having access to the data. One example of operation may include selecting data to access via a user device, applying at least one policy to the data that limits access to the data to user profiles assigned privileges to the policy, encrypting the data, generating metadata indicating the policy and pairing the metadata with the data, and storing the data and the metadata in a policy server.
Claims11
A method comprising:
- selecting data to access via a user device;
- applying at least one policy to the data that limits access to the data to user profiles assigned privileges to the at least one policy;
- converting the data to a different file type than an original file type associated with the data;
- encrypting the data;
- generating metadata indicating the at least one policy;
- creating a file wrapper which appears in a user interface associated with the user device as the original file type and which comprises the metadata and the data as the different file type, and wherein the metadata comprises the at least one policy;
- retrieving and forwarding the data to the user device responsive to a user device submitted data access operation;
- verifying user data access rights associated with the user device;
- transmitting a key to the user device issued by a policy server responsive to identifying the user data access rights of the user device;
- and
- inheriting a new policy responsive to a modification to a portion of the data by the user device, wherein the new policy is a different policy than the at least one policy previously applied to the data, and is applied to only the modified portion of the data, and wherein the modification comprises one or more of adding additional data to the data and removing a portion of the data from the data;
- wherein the new policy is stored in the policy server based on the modified portion of the data, and wherein the modified portion of the data is forwarded to the user device based on the verified user data access rights.
9 more elements
An apparatus comprising:
- a processor configured to
- select data to access via a user device,
- convert the data to a different file type than an original file type associated with the data,
- apply at least one policy to the data that limits access to the data to user profiles assigned privileges to the at least one policy,
- encrypt the data,
- generate metadata indicating the at least one policy, and
- create a file wrapper which appears in a user interface associated with the user device as the original file type and which comprises the metadata and the data as the different file type, and wherein the metadata comprises the at least one policy;
- and
- a memory configured to store the data,
- wherein the processor is further configured to
- retrieve and forward the data responsive to a user device submitted data access operation
- verify user data access rights associated with the user device;
- and
- a transmitter configured to transmit a key to the user device that is issued by a policy server responsive to identifying the user data access rights of the user device;
- wherein the processor is further configured to inherit a new policy responsive to a modification to a portion of the data by the user device, wherein the new policy is a different policy than the at least one policy previously applied to the data, and is applied to only the modified portion of the data, and wherein the modification comprises one or more of adding additional data to the data and removing a portion of the data from the data;
- wherein the new policy is stored in the policy server based on the modified portion of the data, and wherein the modified portion of the data is forwarded to the user device based on the verified user data access rights.
13 more elements
A non-transitory computer readable storage medium configured to store instructions that when executed causes a processor to perform:
- selecting data to access via a user device;
- applying at least one policy to the data that limits access to the data to user profiles assigned privileges to the at least one policy;
- converting the data to a different file type than an original file type associated with the data;
- encrypting the data;
- generating metadata indicating the at least one policy;
- creating a file wrapper which appears in a user interface associated with the user device as the original file type and which comprises the metadata and the data as the different file type, and wherein the metadata comprises the at least one policy;
- retrieving and forwarding the data to the user device responsive to a user device submitted data access operation;
- verifying user data access rights associated with the user device;
- transmitting a key to the user device issued by a policy server responsive to identifying the user data access rights of the user device;
- and
- inheriting a new policy responsive to a modification to a portion of the data by the user device, wherein the new policy is a different policy than the at least one policy previously applied to the data, and is applied to only the modified portion of the data, and wherein the modification comprises one or more of adding additional data to the data and removing a portion of the data from the data;
- wherein the new policy is stored in the policy server based on the modified portion of the data, and wherein the modified portion of the data is forwarded to the user device based on the verified user data access rights.
9 more elements
Dependencies are inferred from the claim text.