# US 10,454,944 B2 · Geofencing of data in a cloud-based environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,944 B2 - Document ID: US10454944B2 - Status: Granted - Kind: B2 - Application number: 15/856,984 - Filed: 2017-12-28 - Published: 2018-05-03 - Granted: 2019-10-22 - Earliest claimed: 2015-11-02 - Assignees: Box, Inc. - Applicants: Box, Inc. - Inventors: Kirill Minkovich; Pranava Adduri - Web page: https://patentgrep.com/patent/US10454944B2 ## CPC - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/0872: {using geo-location information, e.g. location data, time, relative position or proximity to other entities} - H04L 9/3236: {using cryptographic hash functions} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04W 4/021: Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences - H04W 12/086: using security domains - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed is an approach to incorporate geographical access control features for a cloud-based storage platform. This allows, for example, enterprise administrators to define geographical areas (geofences) with arbitrary precision within which content access can be denied for items of data. ## Claims ### Claim 1 A method for managing access to data, the method comprising: configuring a geographic region for a data item, wherein the geographic region is represented by a plurality of grid squares that is definable by a single coordinate location, the plurality of grid squares defines an area of protection for the data item; encrypting the data item with a key (DEK), wherein the DEK is encrypted by using the plurality of grid squares to generate a set of encrypted encryption key (EDEK); receiving a request to access the data item; identifying a location associated with the request to access the data item; determining whether to decrypt the data item based at least in part on the location associated with the request to access the data item, wherein the data item is decryptable if the location associated with the request corresponds to at least one EDEK from among the set of EDEK; and allowing or denying access to the data item based at least in part on if the location corresponds to a geographic location for which access is denied for the data item. ### Claim 2 (depends on 1) The method of claim 1, wherein the location associated with the request is identified using a GPS mechanism at a mobile device that sends the request. ### Claim 3 (depends on 2) The method of claim 2, wherein the information pertaining to the location comprises a one-way hashed value of location data for the mobile device. ### Claim 4 (depends on 1) The method of claim 1, where boundaries of the area are defined by incrementing or decrementing a digit of the coordinate. ### Claim 5 (depends on 4) The method of claim 4, wherein the location information comprises a hash of a value corresponding to the geographic region. ### Claim 6 (depends on 4) The method of claim 4, wherein the DEK can be decrypted only if the location information does not correspond to the location associated with the request to access the data item, where the data item is not decryptable unless the DEK can be decrypted, where the EDEK is encrypted to generate a double-encrypted key (KEDEK) that is stored in a cloud-based storage system. ### Claim 7 (depends on 6) The method of claim 6, where a set of KEDEKs is stored that corresponds to a set of location units corresponding to the geographic region, where upon receipt of the request, a set of KEDEKs are processed to determine if any KEDEK corresponds to the location associated with the request, and where access is denied to the data item if the location associated with the request does correspond to at least one KEDEK. ### Claim 8 A computer program product, embodied in a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a process, the process comprising: configuring a geographic region for a data item, wherein the geographic region is represented by a plurality of grid squares that is definable by a single coordinate location, the plurality of grid squares defines an area of protection for the data item; encrypting the data item with a key (DEK), wherein the DEK is encrypted by using the plurality of grid squares to generate a set of encrypted encryption key (EDEK); receiving a request to access the data item; identifying a location associated with the request to access the data item; determining whether to decrypt the data item based at least in part on the location associated with the request to access the data item, wherein the data item is decryptable if the location associated with the request corresponds to at least one EDEK from among the set of EDEK; and allowing or denying access to the data item based at least in part on if the location corresponds to a geographic location for which access is denied for the data item. ### Claim 9 (depends on 8) The computer program product of claim 8, wherein the location associated with the request is identified using a GPS mechanism at a mobile device that sends the request. ### Claim 10 (depends on 9) The computer program product of claim 9, wherein the information pertaining to the location comprises a one-way hashed value of location data for the mobile device. ### Claim 11 (depends on 8) The computer program product of claim 8, where boundaries of the area are defined by incrementing or decrementing a digit of the coordinate. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein the location information comprises a hash of a value corresponding to the geographic region. ### Claim 13 (depends on 11) The computer program product of claim 11, wherein the DEK can be decrypted only if the location information does not correspond to location associated with the request to access the data item, where the data item is not decryptable unless the DEK can be decrypted. ### Claim 14 (depends on 13) The computer program product of claim 13, where the EDEK is encrypted to generate a double-encrypted key (KEDEK) that is stored in a cloud-based storage system with the data item. ### Claim 15 (depends on 13) The computer program product of claim 13, where a set of KEDEKs is stored that corresponds to a set of location units corresponding to the geographic region. ### Claim 16 (depends on 15) The computer program product of claim 15, where upon receipt of the request, a set of KEDEKs are processed to determine if any KEDEK corresponds to the location associated with the request, and where access is denied to the data item if the location associated with the request does correspond to at least one KEDEK. ### Claim 17 A system for managing access to data, the system comprising: a processor; a memory comprising a computer program product, embodied in a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by the processor causes the processor to execute a process, the process comprising: configuring a geographic region for a data item, wherein the geographic region is represented by a plurality of grid squares that is definable by a single coordinate location, the plurality of grid squares defines an area of protection for the data item; encrypting the data item with a key (DEK), wherein the DEK is encrypted by using the plurality of grid squares to generate a set of encrypted encryption key (EDEK); receiving a request to access the data item; identifying a location associated with the request to access the data item; determining whether to decrypt the data item based at least in part on the location associated with the request to access the data item, wherein the data item is decryptable if the location associated with the request corresponds to at least one EDEK from among the set of EDEK; and allowing or denying access to the data item based at least in part on if the location corresponds to a geographic location for which access is denied for the data item. ### Claim 18 (depends on 17) The system of claim 17, wherein the location associated with the request is identified using a GPS mechanism at a mobile device that sends the request.