Policy-based data management
AssigneeHewlett-Packard Development Company, L.P.
InventorsSiani Pearson, Archie Reed, Marco Casassa Mont, Gina Kounga, Liqun Chen
Life of this patent
Estimating the term…
Abstract
Compliance to a policy about how to treat data in a computer network environment is ensured by checking that conditions in the policy are satisfied by the entity before access to the data is provided.
Claims21
1-15. (canceled)
A non-transitory computer-readable storage medium having computer program instructions recorded thereon for managing data in a computer network environment, the computer program instructions being executable by at least one processor of a trust authority to:
- receive, from a service provider in the computer network environment, a policy specifying how a piece of data should be treated and a first encryption of a cryptographic key;
- receive, from the service provider, a message stating that the policy will be followed by the service provider in treating the piece of data;
- decrypt the first encryption of the cryptographic key;
- encrypt the cryptographic key into a second encryption of the cryptographic key;
- and
- transmit, to the service provider and in response to receiving the message from the service provider, the second encryption of the cryptographic key.
A method for managing data in a computer network environment, comprising:
- receiving, from a service provider, a policy specifying how a piece of data should be treated and a first encryption of a cryptographic key;
- transmitting, to the service provider, a request for assurance that the policy will be followed by the service provider in treating the piece of data;
- receiving, from the service provider, a message indicating that the service provider will follow the policy in treating the piece of data;
- decrypting the first encryption of the cryptographic key;
- encrypting the cryptographic key in a second encryption;
- and
- transmitting, to the service provider, the second encryption.
An apparatus for managing data in a computer network environment, comprising:
- at least one data processor;
- and
- a data storage device storing instructions that, when executed, cause the at least one data processor to:
- receive, from a service provider, a policy specifying how a piece of data should be treated;
- transmit, to the service provider, a request for assurance that the policy will be followed by the service provider in treating the piece of data;
- receive, from the service provider, a message indicating that the service provider will follow the policy in treating the piece of data;
- encrypt a cryptographic key in a first encryption;
- and
- transmit, to the service provider, the first encryption.
Dependencies are inferred from the claim text.