Policy enforcement
AssigneeVera
InventorsPrakash Linga, Ajay Arora, Vladimir Buzuev, Maurice C. Evans, Justin Sisley, Nicolas Vautier
Life of this patent
Estimating the term…
Abstract
Data security access and management may require a server dedicated to monitoring document access requests and enforcing rules and policies to limit access to those who are not specifically identified as having access to the data. One example of operation may include selecting data to access via a user device, applying at least one policy to the data that limits access to the data to user profiles assigned privileges to the policy, encrypting the data, generating metadata indicating the policy and pairing the metadata with the data, and storing the data and the metadata in a policy server.
Claims20
A method, comprising:
- generating metadata indicating at least one policy that limits data access;
- creating a file wrapper which appears in a user interface associated with a user device as an original file type and which comprises the metadata and the data as a different file type;
- forwarding the data to the user device responsive to a user device submitted data access operation;
- transmitting a key to the user device issued by a policy server responsive to identifying the user data access rights of the user device;
- and
- inheriting a new policy responsive to a modification to a portion of the data by the user device, wherein the new policy is a different policy than the at least one policy previously applied to the data, and is applied to only the modified portion of the data, and wherein the modification comprises one or more of adding additional data to the data and removing a portion of the data from the data;
- wherein the new policy is stored in the policy server based on the modified portion of the data, and wherein the modified portion of the data is forwarded to the user device based on verified user data access rights.
An apparatus, comprising:
- a processor configured to
- generate metadata indicating at least one policy that limits data access, and
- create a file wrapper which appears in a user interface associated with a user device as an original file type and which comprises the metadata and the data as a different file type;
- a memory configured to store the data,
- wherein the processor is further configured to forward the data responsive to a user device submitted data access operation;
- and
- a transmitter configured to transmit a key to the user device that is issued by a policy server responsive to an identification of the user data access rights of the user device;
- wherein the processor is further configured to inherit a new policy responsive to a modification to a portion of the data by the user device, wherein the new policy is a different policy than the at least one policy previously applied to the data, and is applied to only the modified portion of the data, and wherein the modification comprises one or more of an addition of additional data to the data and a removal of a portion of the data from the data;
- wherein the new policy is stored in the policy server based on the modified portion of the data, and wherein the modified portion of the data is forwarded to the user device based on verified user data access rights.
A non-transitory computer readable storage medium configured to store instructions that when executed causes a processor to perform:
- generating metadata indicating at least one policy that limits data access;
- creating a file wrapper which appears in a user interface associated with a user device as an original file type and which comprises the metadata and the data as a different file type;
- forwarding the data to the user device responsive to a user device submitted data access operation;
- transmitting a key to the user device issued by a policy server responsive to identifying the user data access rights of the user device;
- and
- inheriting a new policy responsive to a modification to a portion of the data by the user device, wherein the new policy is a different policy than the at least one policy previously applied to the data, and is applied to only the modified portion of the data, and wherein the modification comprises one or more of adding additional data to the data and removing a portion of the data from the data;
- wherein the new policy is stored in the policy server based on the modified portion of the data, and wherein the modified portion of the data is forwarded to the user device based on verified user data access rights.
Dependencies are inferred from the claim text.