METHOD AND SYSTEM FOR POLICY-BASED PROTECTION OF APPLICATION DATA

• US 20080196082A1
• Filed: 02/08/2007
• Published: 08/14/2008
• Est. Priority Date: 02/08/2007
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Blue Coat Systems Incorporated (Gen Digital Inc.)
• Inventors: Lu, Wei, Kaplan, Yariv, Shamir, Roy Israel, Sandoval, Andrew Leonard
• Granted Patent: US 8,095,517 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A method and system for protecting an application'"'"'s operational data are described. According to one aspect of the invention, an administrator interacts with a policy distribution server to generate an operational data protection policy. Next, the policy distribution server generates a data protection application embodying the policy. Various computing devices download and execute the data protection application. The data protection application controls how various applications access data storage objects and data interfaces, based on the operational data protection policy.

Claims

1. A method for protecting operational data, comprising:

downloading, from a distribution server, a data protection application, wherein the data protection application is generated at the distribution server and embodies an operational data protection policy established by an administrator; and

executing the data protection application so as to control an application'"'"'s access to operational data based on rules defined by the data protection policy.

2. The method of claim 1, wherein said downloading a data protection application occurs in response to initially executing the application.

3. The method of claim 2, further comprising, prior to downloading the data protection application, verifying whether the data protection application residing on the distribution server is a more recent version than a currently executing data protection application, and if so, download the more recent version of the data protection application from the distribution server.

4. The method of claim 1, wherein the data protection application controls an application'"'"'s access to operational data by enabling particular data access methods used to access data storage objects and/or data interfaces while disabling other data access methods, wherein the particular data access methods that are enabled are selected based on the data protection policy.

5. The method of claim 1, wherein the data protection application controls an application'"'"'s access to operational data by encrypting data when an application writes the data to a data storage object;

and

decrypting the data when the application reads the data from the data storage object, thereby preventing other applications from accessing the data in an unencrypted form.

6. The method of claim 1, wherein the data protection application controls an application'"'"'s access to operational data by blocking all applications from a particular data storage object.

7. The method of claim 1, wherein the data protection application controls an application'"'"'s access to operational data by blocking one or more applications from a particular data storage object while granting one or more other applications access to the particular data storage object.

8. The method of claim 1, wherein the data protection application controls an application'"'"'s access to operational data by enabling access to a data storage object, monitoring an application'"'"'s use of the data storage object, and cleansing the data storage object when the application is through using the data storage object.

9. The method of claim 1, wherein the data protection application controls an application'"'"'s access to operational data by enabling the application to generate an isolated data storage object so as to prevent other applications from accessing the data storage object.

10. A method for protecting an application'"'"'s operational data, comprising:

facilitating generation of an operational data protection policy by enabling an administrator to define one or more rules controlling an application'"'"'s access to a data storage object and/or a data interface; and

generating a data protection application based on the operational data protection policy, wherein the data protection application, when downloaded and executed on a computing device, controls how applications executing on the computing device access operational data.

11. The method of claim 10 wherein the one or more rules defined in the data protection policy are defined on a per application basis, so as to differ amongst various applications that may be executed on the computing device.

12. The method of claim 10 wherein the one or more rules defined in the data protection policy are defined on a per data access method basis, so as to enable access to one or more data storage objects via a particular data access method while disabling access to the one or more data storage objects via other data access methods.

13. A computer-readable medium storing instructions, which, when executed by a computer, cause the computer to perform a method, said method comprising:

downloading, from a distribution server, a data protection application, wherein the data protection application is generated at the distribution server and embodies an operational data protection policy established by an administrator; and

executing the data protection application so as to control an application'"'"'s access to operational data based on rules defined by the data protection policy.

14. The computer-readable medium of claim 13, wherein said downloading a data protection application occurs in response to initially executing an application.

15. The computer-readable medium of claim 13, wherein said instructions further cause the computer to verify, prior to downloading the data protection application, whether the data protection application residing on the distribution server is a more recent version than a currently executing data protection application.

16. The computer-readable medium of claim 13, wherein the data protection application controls an application'"'"'s access to operational data by enabling particular data access methods used to access data storage objects and/or data interfaces while disabling other data access methods, wherein the particular data access methods that are enabled are selected based on the data protection policy.

17. The computer-readable medium of claim 13, wherein the data protection application controls an application'"'"'s access to operational data by encrypting data when an application writes the data to a data storage object;

and

decrypting the data when the application reads the data from the data storage object, thereby preventing other applications from accessing the data in an unencrypted form.

18. The computer-readable medium of claim 13, wherein the data protection application controls an application'"'"'s access to operational data by blocking all applications from a particular data storage object.

19. The computer-readable medium of claim 13, wherein the data protection application controls an application'"'"'s access to operational data by blocking one or more applications from a particular data storage object while granting one or more other applications access to the particular data storage object.

20. The computer-readable medium of claim 13, wherein the data protection application controls an application'"'"'s access to operational data by enabling access to a data storage object, monitoring an application'"'"'s use of the data storage object, and cleansing the data storage object when the application is through using the data storage object.

21. The computer-readable medium of claim 13, wherein the data protection application controls an application'"'"'s access to operational data by enabling the application to generate an isolated data storage object so as to prevent other applications from accessing the data storage object.