Back to results
US 9,680,654 B2Granted
Systems and methods for validated secure data access based on an endorsement provided by a trusted third party
AssigneeLockbox LLC
InventorKevin Lam
Life of this patent
Estimating the term…
Abstract
Methods, systems, and techniques for securing access to stored data are provided. Example embodiments provide a Storage Management System (“SMS”) that is configured to facilitate protected information sharing. The SMS may restrict access to shared information based on one or more criteria that validate an entity's right to access the information. For example, the SMS may restrict access to entities that are located in a particular geographic region, that are using a particular type of hardware or software, that hold particular credentials, or the like. In some cases, the SMS may require that an entity's claim to meet on or more required criteria be validated by a trusted third party.
Claims19
A method for securing access to shared data stored in a storage system, the method comprising:
- restricting, by a storage management computing system, access to the shared data to entities having associated access claims that are endorsed by a trusted third party, by:
- receiving from a first entity an indication of stored data to be shared;
- receiving from the first entity multiple access requirements for validating an access to the stored data;
- receiving from a second entity a request to access the shared data;
- reading access requirements associated with the requested shared data from the storage system, wherein the access requirements include access criteria having associated weights;
- sending to the second entity a challenge with the access requirements and an indication of a trusted third-party endorser, thereby causing the second entity to request an endorsement from the trusted third-party endorser based on the challenge, wherein the request comprises entity-specific data based on the access requirements;
- receiving from the second entity the entity-specific data and a digitally signed endorsed claim provided to the entity by the trusted third-party endorser, the digitally signed endorsed claim verifying that the entity-specific data satisfies a corresponding access requirement;
- validating the digitally signed endorsed claim received from the second entity in response to the challenge;
- determining a score based on an aggregation of the weights applied to indications of whether each of the access criteria have been met by the second entity, wherein a first one of the access criteria requires the second entity to make an attestation regarding compliance with a local storage requirement, the first access criteria not requiring an endorsement from the trusted third-party endorser, wherein a second one of the access criteria requires an endorsement from the trusted third party-endorser;
- when validation succeeds, requesting a temporary shared access uniform resource identifier to the shared data, and transmitting the uniform resource identifier to the second entity only when the determined score is higher than or equal to a specified threshold;
- and
- transmitting the shared data to the second entity only during a time period associated with the temporary shared access uniform resource identifier.
9 more elements
A non-transitory computer-readable medium including contents that are configured, when executed, to cause a computing system to perform a method for securing access to shared data stored in a storage system, the method comprising:
- by a storage management computing system:
- establishing a trust relationship with a third-party endorser;
- receiving from an entity a request to access the shared data;
- reading access requirements associated with the requested shared data from a remote storage system, wherein the access requirements include access criteria having associated weights;
- sending to the entity a challenge with the access requirements and an indication of the trusted third-party endorser, thereby causing the entity to request an endorsement from the trusted third-party endorser based on the challenge, wherein the request comprises entity-specific data based on the access requirements;
- receiving the entity-specific data and a digitally signed endorsed claim provided by the trusted third-party endorser, the digitally signed endorsed claim verifying that the entity-specific data satisfies a corresponding access requirement;
- determining a scored based on an aggregation of the weights applied to indications of whether each of the access criteria have been met by the entity, wherein a first one of the access criteria requires the entity to make an attestation regarding compliance with a local storage requirement, the first access criteria not requiring an endorsement from the trusted third-party endorser, wherein a second one of the access criteria requires an endorsement from the trusted third-party endorser;
- and
- upon validating the digitally signed endorsed claim, requesting a temporary shared access uniform resource identifier to the shared data, and transmitting the uniform resource identifier to the entity only when the determined score is higher than or equal to a specified threshold.
6 more elements
A system for securing access to shared data, the system comprising:
- an entity computing system;
- a cloud storage computing system that stores the shared data;
- and
- a storage management computing system having a processor and a memory that includes instructions that are configured, when executed by the processor, to perform a method comprising:
- establishing a trust relationship with a third-party endorser;
- receiving from the entity computing system a request to access the shared data stored on the cloud storage computing system;
- reading access requirements associated with the requested shared data from the cloud storage computing system, wherein the access requirements include access criteria having associated weights;
- sending to the entity computing system a challenge with the access requirements and an indication of a trusted third-party endorser, thereby causing the entity computing system to request an endorsement from the trusted third-party endorser based on the challenge, wherein the request comprises entity-specific data based on the access requirements;
- receiving from the entity computing system the entity-specific data and a digitally signed endorsed claim provided by the trusted third-party endorser, the digitally signed endorsed claim verifying that the entity-specific data satisfies a corresponding access requirement;
- determining a score based on an aggregation of the weights applied to indications of whether each of the access criteria have been met by the entity, wherein a first one of the access criteria requires the entity to make an attestation regarding compliance with a local storage requirement, the first access criteria not requiring an endorsement from the trusted third-party endorser, wherein a second one of the access criteria requires an endorsement from the trusted third-party endorser;
- and
- upon validating the digitally signed endorsed claim, transmitting to the entity computing system a temporary shared access uniform resource identifier only when the determined score is higher than or equal to a specified threshold, wherein the shared access uniform resource identifier grants time-bound access to the shared data stored by the cloud storage computing system.
9 more elements
Dependencies are inferred from the claim text.