Methods and apparatus to protect data

• US 7,945,586 B1
• Filed: 03/29/2007
• Issued: 05/17/2011
• Est. Priority Date: 03/29/2007
• Status: Expired due to Fees

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Gu, Yan, Fang, Chao
• Primary Examiner(s): AL HASHEMI, SANA A
• Application Number:
  US11/693,422
• Time in Patent Office: 1,510 Days
• Field of Search: 707785-788
• US Class Current: 707/785
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS

Abstract

A computer-implemented method for providing protection for a data file is disclosed. The method includes employing allowable location information to control access to information of the data file, wherein the allowable location information is associated with the data file The information in the data file is inaccessible if a location of a computer employed to access the data file is not within an allowable geographic area defined by the allowable location information.

Claims

1. A computer-implemented method for providing protection for information of a data file, the method comprising:

decrypting an encrypted file to produce a composite file, said composite file including said information of said data file and allowable location information, wherein said allowable location information defines an allowable geographic area within which said information of said data file is accessible;

ascertaining said allowable location information from said composite file;

after said decrypting, ascertaining a geographic location of a computer, said computer being employed to access said data file;

determining whether to permit access by said computer to said information of said data file based on at least said allowable location information and said geographic location of said computer; and

preventing said access by said computer to said information of said data file if said geographic location of said computer according to said ascertaining is not within said allowable geographic area.

4. The computer-implemented method of claim 1 further comprising comparing said geographic location of said computer with said allowable location information.

5. The method of claim 1 wherein said allowable geographic area is specified by a latitude value, a longitude value, a latitude scope, and a longitude scope.

6. The method of claim 1 further comprising:

transforming said data file into a temporary file by performing invertible transformation on said data file; and

embedding said allowable location information in metadata of said temporary file.

7. The method of claim 1 further comprising tamper-proofing said allowable location information before creating said composite file, to prevent unauthorized modification to said allowable location information.

2. A computer-implemented method for providing protection for information of a data file, the method comprising:

decrypting an encrypted file to produce a composite file;

ascertaining allowable location information from said composite file, said composite file being created from embedding said allowable location information with a temporary file, said temporary file being resulted from performing invertible transformation on said data file, said allowable location information specifying a geographic area within which said protected file is accessible;

after said decrypting, ascertaining a geographic location of a computer, said computer being employed to access said protected file;

determining whether to permit access by said computer to said information of said data file based on at least said allowable location information and said geographic location of said computer; and

permitting said access by said computer to said information of said data file only if said geographic location of said computer according to said ascertaining is within said geographic area.

8. The method of claim 2 further comprising comparing said geographic location of said computer with said allowable location information.

9. The method of claim 2 wherein said allowable geographic area is specified by a latitude value, a longitude value, a latitude scope, and a longitude scope.

10. The method of claim 2 further comprising tamper-proofing said allowable location information before creating said composite file, to prevent unauthorized modification to said allowable location information.

3. A method for providing protection for information in a data file, the method comprising:

embedding said data file with allowable location information to create a composite file, wherein said allowable location information defines an allowable geographic area within which said information of said data file is accessible;

after said embedding, encrypting said composite file to create an encrypted file;

decrypting said encrypted file into said composite file;

ascertaining said allowable location information from said composite file;

after said decrypting, ascertaining a geographic location of a computer, said computer being employed to access said data file;

determining whether to permit access by said computer to said information of said data file based on at least said allowable location information and said geographic location of said computer; and

preventing said access by said computer to said information in said data file if said geographic location of said computer according to said ascertaining is not within said allowable geographic area defined by said allowable location information.

11. The method of claim 3 further comprising comparing said geographic location of said computer with said allowable location information.

12. The method of claim 3 wherein said allowable geographic area is specified by a latitude value, a longitude value, a latitude scope, and a longitude scope.

13. The method of claim 3 further comprising tamper-proofing said allowable location information before creating said composite file, to prevent unauthorized modification to said allowable location information.

14. The method of claim 3 wherein said embedding including embedding said allowable location information in metadata of said temporary file.

15. The method of claim 3 further comprising, after ascertaining that said computer is disposed within said allowable geographic area, invoking an invertible transformation engine to transform a temporary file into said data file.

16. The method of claim 3 further comprising monitoring for a save operation on said data file, said save operation being performed by a user who opened said data file earlier.

17. The method of claim 3 further comprising including Global Positioning System (GPS) information in said allowable location information.

18. The method of claim 3 further comprising specifying said allowable geographic area using at least one of a latitude value, a longitude value, a latitude scope, and a longitude scope.

19. The method of claim 16 further comprising performing said embedding upon detecting said save operation.