Secure and control data migrating between enterprise and cloud services

• US 10,027,637 B2
• Filed: 03/12/2015
• Issued: 07/17/2018
• Est. Priority Date: 03/12/2015
• Status: Active Grant

• Current Assignee: Thales DIS CPL USA, Inc. (Thales SA)
• Original Assignee: Vormetric, Inc. (Thales SA)
• Inventors: Coimbatore, Saravanan
• Primary Examiner(s): Lwin, Maung T
• Application Number:
  US14/656,518
• Publication Number:
  US 20160269371A1
• Time in Patent Office: 1,223 Days
• Field of Search: None
• CPC Class Codes: G06Q 2220/10 Usage protection of distributed data files
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method for operating a cloud gateway is provided. The method includes generating a plurality of rules relating users and groups to data access at a plurality of cloud service providers. The method includes encrypting, at one of a plurality of connectors, outgoing data that is moving through a cloud gateway en route from a proxy server to one of the plurality of cloud service providers, responsive to a data write request associated with a first user, the encrypting in accordance to one of the plurality of rules as related to the first user. The method includes decrypting, at one of the plurality of connectors, incoming data that is moving through the cloud gateway en route from one of the plurality of cloud service providers to the server, responsive to a data read request associated with a second user, the decrypting in accordance to one of the plurality of rules as related to the second user.

Claims

1. A method for operating a cloud gateway, comprising:

generating a plurality of rules relating users and groups to data access at a plurality of cloud service providers;

encrypting, at one of a plurality of pass-through connectors, outgoing data that is moving through a cloud gateway en route from a proxy server to one of the plurality of cloud service providers, responsive to a data write request associated with a first user, the encrypting in accordance to one of the plurality of rules as related to the first user,

wherein the plurality of pass-through connectors includes a first pass-through connector that is coupled to the proxy server and associated to a first cloud service provider and has a first encryption/decryption module, and a second pass-through connector that is coupled to the proxy server and associated to a second cloud service provider and has a second encryption/decryption module, there being in the cloud gateway one pass-through connector per cloud service provider,

wherein the first encryption/decryption module and the second encryption/decryption module are implemented in hardware, firmware, software executing on a processor or combination thereof; and

decrypting, at one of the plurality of pass-through connectors, incoming data that is moving through the cloud gateway en route from one of the plurality of cloud service providers to the server, responsive to a data read request associated with a second user, the decrypting in accordance to one of the plurality of rules as related to the second user,

wherein the incoming data includes padding information and encryption status; and

wherein, the encrypting includes encrypting an outgoing file via application of a first key in accordance with the one of the plurality of rules, encrypting the first key or a key name of the first key and file information via application of a master key, and combining the encrypted file and the encrypted first key or key name and file information as the encrypted outgoing data.

2. The method of claim 1, wherein the decrypting and the plurality of rules control which user in a group sees clear data.

3. The method of claim 1, further comprising:

mapping the users and the groups to access roles relative to the plurality of cloud service providers, wherein the plurality of rules are generated in accordance with the mapping and wherein the mapping and the plurality of rules control user and group access to data relative to the plurality of cloud service providers on a basis of individual users and individual groups.

4. The method of claim 1, wherein:

the encrypting includes applying a group key to encrypt the outgoing data;

the decrypting includes applying the group key to decrypt the incoming data on an individual user or an individual group basis in accordance with the one of the plurality of rules.

5. The method of claim 1, further comprising:

obtaining an access token from one of the plurality of cloud service providers, in accordance with a role defined by the one of the plurality of cloud service providers or by an active directory policy; and

sending the encrypted outgoing data and the access token to the one of the plurality of cloud service providers, in order to store the encrypted outgoing data at the one of the plurality of cloud service providers on behalf of the first user.

6. The method of claim 1, further comprising:

obtaining an access token from one of the plurality of cloud service providers, in accordance with a role defined by the one of the plurality of cloud service providers or by an active directory policy; and

sending the access token and a request for data to the one of the plurality of cloud service providers, in order to obtain the incoming data on behalf of the second user.

7. The method of claim 1, wherein:

the decrypting includes decrypting a portion of the incoming data via application of the master key to obtain a second key or a key name of the second key and file information, and decrypting a further portion of the incoming data via application of the second key and the file information to obtain decrypted incoming data.

8. A tangible, non-transitory, computer-readable media having instructions thereupon which, when executed by a processor, cause the processor to perform a method comprising:

mapping users and network groups to access permissions relative to a plurality of cloud service providers;

encrypting a first data, at one of a plurality of pass-through connectors coupled to a proxy server, responsive to a request associated with one of the users or one of the network groups to write the first data to one of the plurality of cloud service providers, the encrypting in accordance with the mapping,

wherein the plurality of pass-through connectors includes a first pass-through connector that is coupled to the proxy server and associated to a first cloud service provider and has a first encryption/decryption module, and a second pass-through connector that is coupled to the proxy server and associated to a second cloud service provider and has a second encryption/decryption module, there being in the cloud gateway one pass-through connector per cloud service provider with keys for the plurality of pass-through connectors managed by the cloud gateway,

wherein the first encryption/decryption module and the second encryption/decryption module are implemented in hardware, firmware, software executing on a processor or combination thereof; and

decrypting a second data, at one of the plurality of pass-through connectors coupled to the proxy server, responsive to a request associated with one of the users or one of the network groups to read the second data from one of the plurality of cloud service providers, the decrypting in accordance with the mapping,

wherein the incoming data includes padding information and encryption status, and

wherein the encrypting includes encrypting an outgoing file via application of a first key in accordance with the one of the plurality of rules, encrypting the first key or a key name of the first key and file information via application of a master key, and combining the encrypted file and the encrypted first key or key name and file information as the encrypted outgoing data.

9. The computer-readable media of claim 8, wherein the method further comprises:

deriving a plurality of policy rules in accordance with the mapping, wherein the plurality of policy rules is further in accordance with active directory policies or cloud service provider access policies, and wherein the encrypting and the decrypting are in accordance with the plurality of policy rules on a basis of individual users and individual network groups.

10. The computer-readable media of claim 8, wherein the method further comprises:

obtaining one or more access tokens from one of the plurality of cloud service providers;

applying an access token when sending the encrypted first data to one of the plurality of cloud service providers; and

applying an access token when requesting the second data from one of the plurality of cloud service providers.

11. The computer-readable media of claim 8, wherein the method further comprises:

applying a group key at one or more of the plurality of pass-through connectors to encrypt outgoing data belonging to one of the network groups, wherein the decrypting the second data applies the group key to control read access on an individual user basis.

12. The computer-readable media of claim 8, wherein the decrypting the second data comprises:

decrypting a first portion of incoming data, via a master key, to obtain a second key or a key name of the second key, and metadata regarding the second data; and

decrypting a second portion of the incoming data via the second key, to obtain the decrypted second data.

13. A mapping and access control system in a cloud gateway, comprising:

a proxy server configured to access a plurality of cloud service providers;

a plurality of pass-through connectors coupled to the proxy server, including a first pass-through connector having a first encryption/decryption module and configured to couple to and associate to a first cloud service provider via a network, and a second pass-through connector having a second encryption/decryption module and configured to couple to and associate to a second cloud service provider via the network;

an administration module, executed by a hardware processor, configured to derive a plurality of access control rules based on users and network groups; and

the plurality of pass-through connectors configured to encrypt data traveling from the proxy server to the plurality of cloud service providers and decrypt data traveling from the plurality of cloud service providers to the server, in accordance with the plurality of access control rules on a basis of individual users and individual network groups, with each pass-through connector for and associated to a specific cloud service provider, there being in the cloud gateway one pass-through connector per cloud service provider,

wherein the first encryption/decryption module and the second encryption/decryption module are implemented in hardware, firmware, software executed on a processor, or combination thereof,

wherein incoming data for the decrypting includes padding information and encryption status, and

wherein the encrypting includes encrypting an outgoing file via application of a first key in accordance with the one of the plurality of rules, encrypting the first key or a key name of the first key and file information via application of a master key, and combining the encrypted file and the encrypted first key or key name and file information as the encrypted outgoing data.

14. The mapping and access control system of claim 13, wherein each of the plurality of pass-through connectors is specific to one of the plurality of cloud service providers.

15. The mapping and access control system of claim 13, further comprising:

a mapping software module configured to map the users and the network groups to one or more roles according to at least one of;

cloud service provider access policies or active directory policies, wherein the plurality of access control rules is in accordance with the one or more roles and mapping thereto.

16. The mapping and access control system of claim 13, further comprising:

a database configured to store encryption and decryption keys for use by the plurality of pass-through connectors, with the database mapping the users and the network groups to the encryption and decryption keys.

17. The mapping and access control system of claim 13, further comprising:

each of the plurality of pass-through connectors configured to inquire to the administration module as to whether a file should be encrypted or decrypted and configured to request a key for encryption or decryption of the file in accordance with the plurality of access control rules on the basis of individual users and individual network groups.

18. The mapping and access control system of claim 13, further comprising:

the proxy server configured to obtain access tokens from the plurality of cloud service providers and to use the access tokens at an individual user level and at an individual network group level for writing data to and reading data from the plurality of cloud service providers.

19. The mapping and access control system of claim 13, further comprising:

the plurality of pass-through connectors configured to encrypt a data key into and decrypt a data key from a portion of a self-contained file, via application of a master key, wherein the data key is applied to encrypt into a portion of a first self-contained file the data traveling to the plurality of cloud service providers and is applied to decrypt from a portion of a second self-contained file the data traveling from the plurality of cloud service providers.