Data security in a disconnected environment

• US 20090089591A1
• Filed: 09/27/2007
• Published: 04/02/2009
• Est. Priority Date: 09/27/2007
• Status: Active Grant

• Current Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Original Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Inventors: Mattsson, Ulf
• Granted Patent: US 8,826,449 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2135 Metering
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use

Abstract

Systems and methods are provided for the detection and prevention of intrusions in data at rest systems such as file systems and web servers. The systems and methods regulate access to sensitive data with minimal dependency on a communications network. Data access is quantitatively limited to minimize the data breaches resulting from, e.g., a stolen laptop or hard drive.

Claims

1. A method for data protection comprising:

receiving a request for data encrypted with an encryption key;

granting the request if an indicator value is within a threshold; and

modifying the indicator value.

2. The method according to claim 1, wherein advancing the indicator value comprises modifying the indicator value by one.

3. The method according to claim 1, wherein advancing the indicator value comprises modifying the indicator value for each record in the request.

4. The method according to claim 1, wherein advancing the indicator value comprises modifying the indicator value for each record in a result of the request.

5. The method according to claim 1 further comprising:

denying the request if the indicator value exceeds the threshold.

6. The method according to claim 1 further comprising:

receiving instructions from an access control system to modify the indicator value.

7. The method according to claim 1 further comprising:

receiving instructions from an access control system to modify the threshold.

8. The method according to claim 1 further comprising:

notifying the access control system of the indicator value.

9. The method according to claim 1 further comprising:

notifying the access control system that the indicator value exceeds the threshold.

10. The method according to claim 1 further comprising:

prompting a user to connect to a network if the indicator value exceeds the threshold.

11. The method according to claim 1 further comprising:

sending information on data requests to the access control system.

12. The method according to claim 1 wherein the indicator value is specific to the encryption key.

13. The method according to claim 1 wherein the request is a request to move the data from a first location to a second location.

14. The method according to claim 1 wherein the request is a request to move the data from a first application to a second application.

15. The method according to claim 1 wherein the request is a request to print the data.

16. The method according to claim 1 further comprising:

reencrypting the data.

17. The method according to claim 1 further comprising:

masking the data.

18. A computer-readable medium whose contents cause a computer to perform a method for data protection comprising:

receiving a request for data encrypted with an encryption key;

granting the request if an indicator value is less than a threshold; and

advancing the indicator value.