Methods And Devices For Protecting Private Data

• US 20150026465A1
• Filed: 07/18/2013
• Published: 01/22/2015
• Est. Priority Date: 07/18/2013
• Status: Abandoned Application

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Cucinotta, Tommaso, Sala, Alessandra
• Application Number:
  US13/944,964
• Publication Number:
  US 20150026465A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Private data in a cloud-based network may be protected by insuring that inadvertent, malicious, or suspicious access to such data is minimized. Reachability analyses may generate directed graphs that can be displayed as paths on a graphical user interface. If a displayed component of a path indicates that inadvertent, malicious or suspicious access may occur corrective action may be taken to prevent such access.

Claims

1. A method for protecting private data comprising:

identifying one or more permissions associated with private data; and

controlling, through operation of a stored operating system (OS) at a device within a cloud-based network, a directional flow of data associated with the private data based on the identified permissions.

2. The method as in claim 1 further comprising:

controlling, through operation of the OS, a mode of access based on the identified permissions.

3. The method as in claim 2, further comprising granting or denying access to a function of the device, a process associated with the device or service associated with the device based on the identified permissions.

4. The method as in claim 1, further comprising granting or denying access to one or more portions of the private data based on the identified permissions.

5. The method as in claim 1, further comprising granting or denying access to modify the one or more portions of the private data based on the identified permissions.

6. The method as in claim 1 further comprising encrypting, through operation of the OS, the directional flow of data based on the identified permissions.

7. The method as in claim 1 further comprising encrypting, through operation of the OS, substantially all directional flows of data associated with the private data using a same encryption key for each flow based on the identified permissions.

8. The method as in claim 1 further comprising encrypting, through operation of the OS, one or more directional flows of data associated with the private data using a different encryption key for each of the one or more flows based on the identified permissions.

9. The method as in claim 1 further comprising decrypting, through operation of the OS, the directional flow of data based on the identified permissions.

10. The method as in claim 1 further comprising decrypting, through operation of the OS, substantially all directional flows of data associated with the private data using a same decryption key for each flow based on the identified permissions.

11. The method as in claim 1 further comprising decrypting, through operation of the OS, one or more directional flows of data associated with the private data using a different decryption key for each of the one or more flows based on the identified permissions.

12. The method as in claim 1, wherein the OS comprises an operating system selected from the group consisting of at least a Linux-based OS, a UNIX-based OS, a Microsoft-based OS, and an Apple-based OS.

13. The method as in claim 1, wherein the the data comprises content.

14. The method as in claim 1 further comprising:

identifying one or more permissions associated with an application; and

controlling, through operation of the OS, the directional flow of data based on the identified permissions associated with the application.

15. The method as in claim 14, wherein the application comprises a content distribution application.

16. The method as in claim 1 further comprising:

identifying one or more permissions associated with an application; and

controlling, through operation of the OS, a mode of access based on the identified permissions associated with the application.

17. The method as in claim 14 further comprising encrypting, through operation of the OS, substantially all directional flows of data associated with the application using a same encryption key for each flow based on the identified permissions.

18. The method as in claim 14 further comprising encrypting, through operation of the OS, one or more directional flows of data associated with the application using a different encryption key for each of the one or more flows based on the identified permissions.

19. The method as in claim 14 further comprising decrypting, through operation of the OS, substantially all directional flows of data associated with the application using a same decryption key for each flow based on the identified permissions.

20. The method as in claim 14 further comprising decrypting, through operation of the OS, one or more directional flows of data associated with the application using a different decryption key for each of the one or more flows based on the identified permissions.

21. The method as in claim 1, wherein the device comprises a wireless device.

22. The method as in claim 1 further comprising:

specifying a set of rules associated with one or more permissions;

reviewing the permissions; and

cancelling an attempted action based upon a determination that one or more of the rules or permissions has been violated.

23. The method as in claim 1, wherein the permission comprises a READ or WRITE operation.

24. The method as in claim 1 further comprising generating one or more directed graphs based on information input through a user interface (UI).

25. The method as in claim 24 further comprising displaying the one or more directed graphs on a display of the UI.

26. The method as in claim 24 further comprising visually highlighting a portion of a graph on the UI.

27. The method as in claim 1, wherein the permissions are associated with a flow of data, a user, an application or a device.

28. The method as in claim 24 further comprising:

displaying a problem with a component of the graph using the UI; and

correcting the problem.

29. A device within a cloud-based network for protecting private data operable to:

identify one or more permissions associated with private data; and

control, through operation of a stored operating system (OS), a directional flow of data associated with the private data based on the identified permissions.

30. The device as in claim 29 further operable to:

control, through operation of the OS, a mode of access based on the identified permissions.

31. The device as in claim 30 further operable to grant or deny access to a function of the device, a process associated with the device or service associated with the device based on the identified permissions.

32. The device as in claim 29 further operable to grant or deny access to one or more portions of the private data based on the identified permissions.

33. The device as in claim 29 further operable to grant or deny access to modify the one or more portions of the private data based on the identified permissions.

34. The device as in claim 29 further operable to encrypt, through operation of the OS, the directional flow of data based on the identified permissions.

35. The device as in claim 29 further operable to encrypt, through operation of the OS, substantially all directional flows of data associated with the private data using a same encryption key for each flow based on the identified permissions.

36. The device as in claim 29 further operable to encrypt, through operation of the OS, one or more directional flows of data associated with the private data using a different encryption key for each of the one or more flows based on the identified permissions.

37. The device as in claim 29 further operable to decrypt, through operation of the OS, the directional flow of data based on the identified permissions.

38. The device as in claim 29 further operable to decrypt, through operation of the OS, substantially all directional flows of data associated with the private data using a same decryption key for each flow based on the identified permissions.

39. The device as in claim 29 further operable decrypt, through operation of the OS, one or more directional flows of data associated with the private data using a different decryption key for each of the one or more flows based on the identified permissions.

40. The device as in claim 29, wherein the OS comprises an operating system selected from the group consisting of at least a Linux-based OS, a UNIX-based OS, a Microsoft-based OS, and an Apple-based OS.

41. The device as in claim 29, wherein the the data comprises content.

42. The device as in claim 29 further operable to:

identify one or more permissions associated with an application; and

control, through operation of the OS, the directional flow of data based on the identified permissions associated with the application.

43. The device as in claim 42, wherein the application comprises a content distribution application.

44. The device as in claim 29 further operable to:

identify one or more permissions associated with an application; and

control, through operation of the OS, a mode of access based on the identified permissions associated with the application.

45. The device as in claim 42 further operable to encrypt, through operation of the OS, substantially all directional flows of data associated with the application using a same encryption key for each flow based on the identified permissions.

46. The device as in claim 42 further operable to encrypt, through operation of the OS, one or more directional flows of data associated with the application using a different encryption key for each of the one or more flows based on the identified permissions.

47. The device as in claim 42 further operable to decrypt, through operation of the OS, substantially all directional flows of data associated with the application using a same decryption key for each flow based on the identified permissions.

48. The device as in claim 42 further operable to decrypt, through operation of the OS, one or more directional flows of data associated with the application using a different decryption key for each of the one or more flows based on the identified permissions.

49. The device as in claim 29, wherein the device comprises a wireless device.

50. The device as in claim 29, wherein the device comprises a local device.

51. The device as in claim 50, wherein the local device comprises a laptop, desktop, tablet, smartphone, or phone.

52. The device as in claim 29, wherein the device comprises a network device.

53. The device as in claim 52, wherein the network device comprises a server.

54. The device as in claim 29 further operable to:

specify a set of rules associated with one or more permissions;

review the permissions; and

cancel an attempted action based upon a determination that one or more of the rules or permissions has been violated.

55. The device as in claim 29, wherein the permission comprises a READ or WRITE operation.

56. The device as in claim 29, further comprising a user interface (UI) operable to input information into the device, and the device further operable to generate one or more directed graphs based on the information input through the UI.

57. The device as in claim 56, wherein the UI comprises a display, and the UI is further operable to display the one or more directed graphs on the display.

58. The device as in claim 57, wherein the UI is further operable to visually highlight a portion of a graph on the display.

59. The device as in claim 29 wherein the permissions are associated with a flow of data, a user, an application or a device.

60. The device as in claim 57, wherein the device is further operable to:

display a problem with a component of the graph using the UI; and

correct the problem.