Geofencing of data in a cloud-based environment
AssigneeBox, Inc.
InventorsKirill Minkovich, Pranava ADDURI
Life of this patent
Estimating the term…
Abstract
Disclosed is an approach to incorporate geographical access control features for a cloud-based storage platform. This allows, for example, enterprise administrators to define geographical areas (geofences) with arbitrary precision within which content access can be denied for items of data.
Claims20
A method for managing access to data, the method comprising:
- configuring a geographic region for a data item, wherein the geographic region identifies a geographic location for which access is denied for the data item, and the data item is encrypted in association with location information that corresponds to the geographic region;
- receiving a request to access the data item;
- identifying a location associated with the request to access the data item;
- determining whether to decrypt the data item based at least in part on the location associated with the request to access the data item, wherein the data item is decryptable if the location does not correspond to the geographic location for which access is denied for the data item;
- and
- denying access to the data item if the location corresponds to the geographic location for which access is denied for the data item.
A computer program product, embodied in a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a process, the process comprising:
- configuring a geographic region for a data item, wherein the geographic region identifies a geographic location for which access is denied for the data item, and the data item is encrypted in association with location information that corresponds to the geographic region;
- receiving a request to access the data item;
- identifying a location associated with the request to access the data item;
- determining whether to decrypt the data item based at least in part on the location associated with the request to access the data item, wherein the data item is decryptable if the location does not correspond to the geographic location for which access is denied for the data item;
- and
- denying access to the data item if the location corresponds to the geographic location for which access is denied for the data item.
The computer program product of claim 20, where a set of KEDEKs is stored that corresponds to a set of location units corresponding to the geographic region.
The computer program product of claim 20, where upon receipt of the request, a set of KEDEKs are processed to determine if any KEDEK corresponds to the location associated with the request, and where access is denied to the data item if the location associated with the request does correspond to at least one KEDEK.
A system for managing access to data, the system comprising:
- a processor;
- a memory comprising a computer program product, embodied in a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by the processor causes the processor to execute a process, the process comprising:
- configuring a geographic region for a data item, wherein the geographic region identifies a geographic location for which access is denied for the data item, and the data item is encrypted in association with location information that corresponds to the geographic region;
- receiving a request to access the data item;
- identifying a location associated with the request to access the data item;
- determining whether to decrypt the data item based at least in part on the location associated with the request to access the data item, wherein the data item is decryptable if the location does not correspond to the geographic location for which access is denied for the data item;
- and
- denying access to the data item if the location corresponds to the geographic location for which access is denied for the data item.
Dependencies are inferred from the claim text.