US 8,938,775 B1 · Dynamic data loss prevention in a multi-tenant environment

Abstract

The usage of data in a multi-tenant environment can be controlled by utilizing functionality at the hypervisor level of various resources in the environment. Data can be associated with various tags, security levels, and/or compartments. The ability of resources or entities to access the data can depend at least in part upon whether the resources or entities are also associated with the tags, security levels, and/or compartments. Limitations on the usage of the data can be controlled by one or more policies associated with the tags, security levels, and/or compartments. A control service can monitor traffic to enforce the appropriate rules or policies, and in some cases can prevent encrypted traffic from passing beyond a specified egress point unless the encryption was performed by a trusted resource with the appropriate permissions.

Claims24

Dependent claims

A computer-implemented method of managing access to a resource in a multi-tenant environment, comprising:

receiving, at a virtual machine manager of a resource in a multi-tenant environment, a request for access to the resource, the resource having an associated security level of a hierarchy of security levels, wherein the associated security level of the resource includes at least one security tag, the security tag indicating the resource is able to perform one or more types of processing with respect to data objects of a type associated with the security tag;
analyzing security information associated with the request to determine whether a source of the request has a security level that is compatible with the associated security level of the resource;
and
enabling access to the resource when the source of the request has a security level that is compatible with the associated security level of the resource,
wherein the virtual machine manager includes a hypervisor component executing on a host machine in the multi-tenant environment.

2 more elements

A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing system, enable the computing device to:

monitor communications in a multi-tenant environment using a virtual machine manager in the multi-tenant environment;
detect a communication with a resource, wherein the resource is associated with a data tag and a source of the communication is not associated with the data tag, the data tag indicating the resource is able to perform one or more types of processing with respect to data objects of a type associated with the data tag;
associate the data tag with the communication and the source of the communication;
and
enforce at least one policy, associated with the data tag, on at least one of the communication, the source of the communication, and a recipient of the communication,
wherein the virtual machine manager includes a hypervisor component executing on a host machine in the multi-tenant environment.

3 more elements

Dependencies are inferred from the claim text.

Dynamic data loss prevention in a multi-tenant environment

Life of this patent

Dynamic data loss prevention in a multi-tenant environment

Life of this patent

Abstract

Claims24