DATA MANAGEMENT

• US 20120290850A1
• Filed: 05/12/2011
• Published: 11/15/2012
• Est. Priority Date: 05/12/2011
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Brandt, Marc, Cummins, Fred A., Singhal, Sharad, Pearson, Siani
• Granted Patent: US 8,850,593 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

In one implementation, encrypted data and a virtual machine are stored together as a virtual machine-data image, wherein the virtual machine is configured to EXERT management control over the data based on policies set by an owner of the data. In another implementation, metadata defining or tagging policies for usage of data is associated with the data. Control capabilities of service providers are mapped to the policies, wherein those service provider environments that best satisfy the controls mapped to the policies are identified.

Claims

1. A method comprising:

encrypting data;

managing the encrypted data using a virtual machine;

storing the encrypted data and a virtual machine together as a virtual machine-data image, wherein the virtual machine is configured to exert management control over the encrypted data based on policies set by an owner of the data;

transferring the virtual machine-data image as a mobile agent from a first web-based service provider to a second web-based service provider; and

controlling usage or movement of the data at the second web-based service provider using the virtual machine of the machine-data image.

2. The method of claim 1, wherein the virtual machine is configured to provide a file server interface that facilitates booting up of the virtual machine in a plurality of different service provider or customer environments.

3. The method of claim 1, wherein the virtual machine is configured to maintain keys to decrypt the data.

4. The method of claim 1, wherein the virtual machine is configured to manage access policies, authentication and audit logs.

5. The method of claim 1 further comprising encrypting the virtual machine, wherein the virtual machine is stored as part of the virtual machine-data image.

6. The method of claim 5, wherein the virtual machine is configured to determine whether the virtual machine is running in a trusted environment.

7. The method of claim 6, wherein the virtual machine is configured to contact a source of the data and obtain permission to decrypt the data or allow access to the data if the virtual machine is not running in a trusted environment.

8. The method of claim 1, further comprising metadata associated with the data, the metadata being configured to define policies for usage and movement of the data.

9. The method of claim 8 further comprising comparing capabilities of a service provider and policies set forth in the metadata to determine whether the service provider is capable of satisfying the policies.

10. A method comprising:

associating metadata with data, the metadata identifying policies for usage and movement of the data;

mapping controls for satisfying the policies to the policies; and

comparing control capabilities of a service provider environment to the controls mapped to the policies.

11. The method of claim 10, wherein the policies are external to the metadata, wherein the metadata comprises tags and wherein the tags are mapped the policies.

12. The method of claim 10, wherein the metadata comprises the policies.

13. The method of claim 10, wherein the metadata includes a plurality of different policies for a plurality of different virtual environments.

14. The method of claim 10, wherein the requirements for controls vary from one service provider to another service provider.

15. The method of claim 10 further comprising:

comparing control capabilities to the controls mapped to the policies for each of a plurality of service provider environments; and

identifying those service provider environments from the plurality of service provider environments that best satisfy the controls mapped to the policies based on the comparisons.

16. The method of claim 10 further comprising storing the data and metadata with a virtual machine as a virtual machine-data image, wherein the virtual machine is configured to perform said step of comparing control capabilities of a service provider environment to the controls mapped to the policies.

18. The apparatus of claim 16, wherein the management software is configured to provide a file server interface that facilitates booting up of the virtual machine in a plurality of different service provider or customer environments.

19. The apparatus of claim 16, wherein the virtual machine is configured to manage access policies, authentication and audit logs for the encrypted data.

20. The apparatus of claim 16, wherein the virtual machine is encrypted.

17. An apparatus comprising:

a persistent memory storage device;

a virtual image stored on the persistent memory storage device, the virtual image comprising;

encrypted data; and

a virtual machine configured to exert management control over the encrypted data based on policies set by an owner of the data.