SYSTEMS AND METHODS FOR CONTROLLING ACCESS TO DATA THROUGH APPLICATION VIRTUALIZATION LAYERS

• US 20100064340A1
• Filed: 06/27/2008
• Published: 03/11/2010
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Sobel, William E., McCorkendale, Bruce
• Granted Patent: US 8,060,940 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/16 Implementing security features at a particular protocol layer

Abstract

A computer-implemented method for controlling access to data is. A request to access data is received. A determination is made that an access-control policy of the data is satisfied. A virtualization layer is activated to allow access to the data after determining that the access-control policy is satisfied. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for controlling access to data, the computer-implemented method comprising:

receiving a request to access data;

determining that an access-control policy of the data is satisfied;

activating a virtualization layer to allow access to the data after determining that the access-control policy is satisfied.

2. The computer-implemented method of claim 1, wherein determining that the access-control policy of the data is satisfied comprises:

detecting the state of a computing device, the computing device comprising the virtualization layer;

determining that the state of the computing device satisfies the access-control policy.

3. The computer-implemented method of claim 2, wherein:

the access-control policy requires at least one of the following conditions to be met before access to the data is allowed;

the computing device is connected to a virtual private network;

the computing device is in a predetermined location;

a security application is running on the computing device;

the security application is up to date;

a prohibited application is not running on the computing device;

the prohibited application is not installed on the computing device;

the computing device is not connected to an unsecured network;

the computing device is not connected to a public network.

4. The computer-implemented method of claim 1, wherein:

the virtualization layer comprises the data;

the data is encrypted;

allowing access to the data comprises decrypting the data.

5. The method of claim 1, wherein:

allowing access to the data comprises streaming the data from a remote computing device to a local computing device, the local computing device comprising the virtualization layer.

6. The method of claim 5, wherein:

the remote computing device is on a protected network;

determining that an access-control policy of the data is satisfied comprises determining that the local computing device is connected to the protected network via a virtual private network connection.

7. The computer-implemented method of claim 1, wherein:

a computing device comprises the virtualization layer;

determining that an access-control policy of the data is satisfied comprises determining that a user of the computing device has a right to access the data.

8. The computer-implemented method of claim 1, wherein:

the request to access data comprises a request to change a setting of an application.

9. The computer-implemented method of claim 1, wherein:

a request to access data is received from a first application;

determining that an access-control policy of the data is satisfied comprises determining that the first application has a right to access the data;

activating a virtualization layer to allow access to the data comprises allowing the first application to access the data.

10. The computer-implemented method of claim 1, wherein:

a request to access data comprises a request to start an application.

11. A computer-implemented method for controlling access to data, the computer-implemented method comprising:

receiving a request to access data, the request being received from a first application;

determining that the first application has a right to access the data;

activating a virtualization layer to allow the first application access to the data.

12. The computer-implemented method of claim 11, wherein determining that the first application has a right to access the data comprises:

detecting a state of a computing device on which the first application is running;

determining that the state of the computing device satisfies an access-control policy for the data.

13. The computer-implemented method of claim 12, wherein:

the access-control policy requires at least one of the following conditions to be met before the first application is allowed to access the data;

the computing device is connected to a virtual private network;

the computing device is in a predetermined location;

a security application is running on the computing device;

the security application is up to date;

a prohibited application is not running on the computing device;

the prohibited application is not installed on the computing device;

the computing device is not connected to an unsecured network;

the computing device is not connected to a public network.

14. The computer-implemented method of claim 11, wherein determining that the first application has a right to access the data comprises:

determining that an access-control policy indicates that the first application is authorized to access the data.

15. The computer-implemented method of claim 11, wherein:

the virtualization layer comprises the data;

the data is encrypted;

allowing the first application access to the data comprises decrypting the data.

16. The method of claim 11, wherein:

allowing the first application to access the data comprises streaming the data from a remote computing device to the first application.

17. The computer-implemented method of claim 11, wherein:

a computing device comprises the virtualization layer;

determining that the first application has a right to access the data comprises determining that a user of the computing device has a right to access the data.

18. A computer-program product for controlling access to data, the computer-program product comprising a computer-readable medium having instructions thereon, the instructions comprising:

code programmed to receive a request to access data;

code programmed to determine that an access-control policy of the data is satisfied;

code programmed to activate a virtualization layer to allow access to the data after determining that the access-control policy is satisfied.

19. The computer-program product of claim 18, wherein the code programmed to determine that the access-control policy of the data is satisfied comprises:

code programmed to detect the state of a computing device, the computing device comprising the virtualization layer;

code programmed to determine that the state of the computing device satisfies the access-control policy.

20. The computer-program product of claim 19, wherein:

the access-control policy requires at least one of the following conditions to be met before access to the data is allowed;

the computing device is connected to a virtual private network;

the computing device is in a predetermined location;

a security application is running on the computing device;

the security application is up to date;

a prohibited application is not running on the computing device;

the prohibited application is not installed on the computing device;

the computing device is not connected to an unsecured network;

the computing device is not connected to a public network.