Geo-positionally based data access security

• US 8,095,656 B2
• Filed: 11/16/2009
• Issued: 01/10/2012
• Est. Priority Date: 11/16/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: McCormack, Robert J.
• Primary Examiner(s): Duong, Oanh
• Application Number:
  US12/619,011
• Publication Number:
  US 20110119379A1
• Time in Patent Office: 785 Days
• Field of Search: 709224-225, 709/229, 726/2, 726/4, 726/27
• US Class Current: 709/225
• CPC Class Codes: G06F 16/29 Geographical information databases
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

Methods, systems, and computer program products for implementing geo-positionally based data access security is provided. A method includes receiving a request at a computer to verify a geographic location of a segment of data stored in a storage device. The method further includes receiving, at the computer, an actual geographic location of the storage device from a geographic location device connected to the storage device. The method additionally includes accessing, at the computer, a location tag including an expected geographic location of the segment of data, and comparing, at the computer, the expected geographic location to the actual geographic location. The method also includes returning a value indicating that an error has occurred when the comparing indicates that the expected geographic location does not match the actual geographic location.

Claims

1. A computer implemented method for implementing geo-positionally based data access security, the method comprising:

receiving a request at a computer to verify a geographic location of a segment of data stored in a storage device;

receiving, at the computer, an actual geographic location of the storage device from a geographic location device connected to the storage device;

accessing, at the computer, a location tag including an expected geographic location of the segment of data, the expected geographic location of the segment of data comprising a geographic location of the storage device at the time that the location tag was created;

comparing, at the computer, the expected geographic location to the actual geographic location; and

returning a value indicating that an error has occurred when the comparing indicates that the expected geographic location does not match the actual geographic location.

2. The method of claim 1, further comprising verifying that the geographic location device connected to the storage device is an expected geographic location device, the verifying comprising:

accessing an expected identifier of the geographic location device; and

comparing the expected identifier to a unique serial number of the storage device, wherein the verifying is successful when the expected identifier is equal to the unique serial number.

3. The method of claim 2, wherein the expected identifier of the geographic location device is located in an extended attribute of a certificate associated with the storage device and wherein the verifying further comprises determining that the certificate is valid.

4. The method of claim 1, wherein the receiving is in response to a request to retrieve the segment of data.

5. The method of claim 4, wherein the comparing indicates that the expected geographic location matches the actual geographic location and the method further comprises returning the segment of data.

6. The method of claim 1, wherein the receiving is in response to a request to audit a location.

7. The method of claim 6, wherein the comparing indicates that the expected geographic location matches the actual geographic location and the method further comprises returning the actual location.

8. The method of claim 1, further comprising storing a new data segment, the storing comprising:

receiving a request to store the new segment of data at the actual geographic location of the storage device;

creating a new location tag, the new location tag including the actual geographic location of the storage device;

associating the new location tag to the new segment of data; and

storing the new segment of data and the new location tag on the storage device.

9. A system for implementing geo-positionally based data access security comprising:

a computer; and

a geo-positionally based data access security system executable by the computer, the geo-positionally based data access security system capable of performing a method comprising;

receiving a request to verify a geographic location of a segment of data stored in a storage device;

receiving an actual geographic location of the storage device from a geographic location device connected to the storage device;

accessing a location tag including an expected geographic location of the segment of data, the expected geographic location of the segment of data comprising a geographic location of the storage device at the time that the location tag was created;

comparing the expected geographic location to the actual geographic location; and

returning a value indicating that an error has occurred when the comparing indicates that the expected geographic location does not match the actual geographic location.

10. The system of claim 9, wherein the method further comprises verifying that the geographic location device connected to the storage device is an expected geographic location device, the verifying comprising:

accessing an expected identifier of the geographic location device; and

comparing the expected identifier to an unique serial number of the storage device, wherein the verifying is successful when the expected identifier is equal to the unique serial number.

11. The system of claim 9, wherein the receiving is in response to a request to retrieve the segment of data.

12. The system of claim 9, wherein the comparing indicates that the expected geographic location matches the actual geographic location and the method further comprises returning the segment of data.

13. The system of claim 9, wherein the receiving is in response to a request to audit a location.

14. The system of claim 13, wherein the comparing indicates that the expected geographic location matches the actual geographic location and the method further comprises returning the actual location.

15. The system of claim 9, wherein the method further comprises storing a new data segment, the storing comprising:

receiving a request to store the new segment of data at the actual geographic location of the storage device;

creating a new location tag, the new location tag including the actual geographic location of the storage device;

associating the new location tag to the new segment of data; and

storing the new segment of data and the new location tag on the storage device.

16. A computer program product for implementing geo-positionally based data access security, the computer program product comprising:

a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

receiving a request to verify a geographic location of a segment of data stored in a storage device;

receiving an actual geographic location of the storage device from a geographic location device connected to the storage device;

accessing a location tag including an expected geographic location of the segment of data, the expected geographic location of the segment of data comprising a geographic location of the storage device at the time that the location tag was created;

comparing the expected geographic location to the actual geographic location; and

returning a value indicating that an error has occurred when the comparing indicates that the expected geographic location does not match the actual geographic location.

17. The computer program product of claim 16, wherein the method further comprises verifying that the geographic location device connected to the storage device is an expected geographic location device, the verifying comprising:

accessing an expected identifier of the geographic location device; and

comparing the expected identifier to an unique serial number of the storage device, wherein the verifying is successful when the expected identifier is equal to the unique serial number.

18. The computer program product of claim 16, wherein the receiving is in response to a request to retrieve the segment of data, the comparing indicates that the expected geographic location matches the actual geographic location, and the method further comprises returning the segment of data.

19. The computer program product of claim 16, wherein the receiving is in response to a request to audit a location, the comparing indicates that the expected geographic location matches the actual geographic location, and the method further comprises returning the actual location.

20. The computer program product of claim 16, wherein the method further comprises storing a new data segment, the storing comprising:

receiving a request to store the new segment of data at the actual geographic location of the storage device;

creating a new location tag, the new location tag including the actual geographic location of the storage device;

associating the new location tag to the new segment of data; and

storing the new segment of data and the new location tag on the storage device.