CONTENT CRYPTOGRAPHIC FIREWALL SYSTEM

• US 20100058072A1
• Filed: 05/15/2006
• Published: 03/04/2010
• Est. Priority Date: 05/13/2005
• Status: Active Grant

• Current Assignee: Cryptomill Incorporated
• Original Assignee: Cryptomill Incorporated
• Inventors: Thanos, Daniel, Dainow, Ernest, Teow, Kha Sin, Nikolaev, Leonid
• Granted Patent: US 8,464,354 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A system and method that regulates the various operations between computing stations and storage or content. Any operation that involves or may lead to the exchange or accessing of content (data) between storage or hosting content container and computing station may be regulated by means of a policy which comprise a set of rules. Rules may be defined according to specific criteria, including the type of storage, the type of content, the attributes of the content, and other attributes associated with the storage device and/or the content. The policy will be dynamically installed/updated upon a computing station for specific User(s) and will regulate the data operations that may take place between the computing stations and storage or content based on evaluation of the policy. Based on the evaluation of the policy, the requested operation is permitted, restricted in some areas, or denied.

Claims

1. ) A method of regulating the interaction between the storage or content of a mobile storage device and a computer station, the method comprising:

a) determining whether a request has been made for an operation to be performed between the storage or content of a mobile storage device and the computer station;

b) retrieving from storage or content provisioning information;

c) comparing security domain information associated with the storage or content and the computer station; and

d) evaluating one or more rules associated with the computer station to determine an action to implement based on the requested operation.

2. ) The method of claim 1, wherein the requested operation may be selected from the group consisting of:

mount operations, copy operations, delete operations, secure delete operations, read operations, write operations, transmit operations, and execute operations.

3. ) The method of claim 1, wherein the provisioning information includes a unique identifier.

4. ) The method of claim 1, wherein the provisioning information includes security domain information.

5. ) The method of claim 4, wherein the provisioning information may include security sub domain information.

6. ) The method of claim 1, wherein evaluation of the one or more rules comprises determining the type of storage or content.

7. ) The method of claim 1, wherein evaluation of the one or more rules comprises determining a content type stored on the storage or content.

8. ) The method of claim 7, wherein evaluation of the one or more rules comprises determining metadata information associated with the content type stored on the storage or content.

9. ) The method of claim 1, wherein evaluation of the one or more rules comprises determining an interface type associated with the storage or content.

10. ) The method of claim 1, wherein the action to implement may be to permit the requested operation.

11. ) The method of claim 1, wherein the action to implement may be to deny the requested operation.

12. ) The method of claim 1, wherein the action to implement may to permit the requested operation on a read-only basis.

13. ) The method of claim 1, wherein the provisioning information is cryptographically protected upon the storage or content.

14. ) A method of deploying a policy that governs the interaction between a computing station and the storage or content, the method comprising:

a) defining one or more rules to be associated with a policy, wherein the one or more rules are defined based on requested operations, one or more control criteria, one or more logical operations and one or more actions;

b) creating a policy module based on the one or more rules defined; and

c) installing the policy module upon the computing station.

15. ) The method of claim 14, wherein the requested operations may be selected from the group comprising mount operations, copy operations, delete operations, secure delete operations, read operations, write operations, transmit operations, and execute operations.

16. ) A method of provisioning a storage or content upon a mobile storage device the method comprising:

a) specifying a policy comprised of one or more rules to be associated with the storage or content;

b) generating an encryption key and a signature; and

c) generating provisioning information, and writing the encryption key, signature, and provisioning information on storage or content.

17. ) The method of claim 16, wherein the provisioning information includes security domain information.

18. ) The method of claim 16, wherein the provisioning information includes security sub domain information.

19. ) The method of claim 16, wherein the provisioning information includes expiry information.