Access control to files based on source information

• US 9,197,668 B2
• Filed: 01/11/2006
• Issued: 11/24/2015
• Est. Priority Date: 02/28/2003
• Status: Active Grant

• Current Assignee: Novell Incorporated (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Boucher, Peter, Wright, Michael, Cranny, Tim, Nault, Gabe, Smith, Merrill
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US11/330,530
• Publication Number:
  US 20060120526A1
• Time in Patent Office: 3,604 Days
• Field of Search: 713/189, 713/193, 713/200, 726 27- 30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

The present invention is a security tool for protection of data on a mobile computing device. The security tool provides a plurality of security policies to be enforced based on source information for the data and a location associated with a network environment in which a mobile device is operating. The security tool may be either located at the mobile computing device or at the server. The security tool includes a file access module for determining whether files are visible or accessible. The file access module comprises a tag generator, an association module, and a policy enforcement module. The tag generator creates source information for the file being accessed and the policy enforcement module determines what actions, if any, can be performed on the file and under what conditions such as location and network environment, type of file and other factors.

Claims

1. A method for making data accessible by a mobile computing device, comprising:

determining one of a plurality of network environments in which the mobile computing device is operating without regard to a physical geographic location of the mobile computing device;

receiving a request to access a file;

determining source information for the file including identifying privilege information relating to data in the file, wherein the privilege information defines specific access control limitations on the file including the limitations of whether the file can be stored and/or viewed on the mobile computing device and what persons have access rights to the file, wherein the identifying privilege information includes identifying a group or groups of persons with whom a user requesting to access the file is associated;

controlling access to the data in the file based on the determined one network environment in which the mobile computing device is operating and the determined source information for the file; and

allowing access to the data in the file provided only if the privilege information satisfies a predetermined security policy for the determined one network environment.

2. The method of claim 1 wherein the allowing access to the data in the file further includes allowing access based on determining whether a security feature associated with the determined one network environment complies with the predetermined security policy.

3. The method of claim 1 wherein the source information includes a file name and a source address.

4. The method of claim 1 wherein the identifying privilege information relating to data in the file further includes identifying a person or group of persons that can or cannot access the data in the file and identifying actions the person or group of persons may take with the data in the file including the actions of file viewing, file storing or both.

5. The method of claim 3 wherein the source address includes one from the group of a subnet identifier, a server identifier, a folder name, and a file type.

6. The method of claim 5 wherein the source address includes one from the group of an owner of the file, version control information, a hash value, a cyclical redundancy check, and a digital signature.

7. The method of claim 1 wherein the request for file access is one from the group of reading a file, writing a file, viewing a file, emailing a file, transferring a file, and accessing a file using a universal serial bus, a serial port, a parallel port or an infrared interface.

8. The method of claim 1 wherein the step of determining the source information further comprises:

determining the file name;

assigning a unique identification number in a name space to the file;

collecting source information about the file;

creating a record in source data storage; and

storing the unique identification number and the source information in the record.

9. A method for making a file visible on a mobile computing device, comprising:

determining a network location of the mobile computing device based on a network environment in which the mobile computing device is operating without regard to a physical geographic location of the mobile computing device;

identifying at least one security feature associated with the determined network location of the mobile computing device;

retrieving a file name for the file;

determining source information for the file including a source address and privilege information relating to data in the file, wherein the privilege information defines specific access control limitations on the file including the limitations of whether the file can be stored and/or viewed on the mobile computing device and what persons have access rights to the file, wherein the determining privilege information includes determining a group or groups of persons with whom a user requesting to view the file is associated;

setting a security policy for the mobile computing device based on the privilege information at the determined network location and the identified at least one security feature associated with the determined network location; and

making the file visible on the mobile computing device only if the privilege information at the determined network location and the identified at least one security feature associated with the determined network location satisfies the security policy.

10. The method of claim 9 wherein the identifying the at least one security feature associated with the determined network location further includes determining by a server computing system remote from the mobile computing device whether the determined network location is behind a firewall or not.

11. The method of claim 9 wherein the identifying the at least one security feature associated with the determined network location further includes determining whether the mobile computing device has a wired or wireless connection type.

12. The method of claim 9 wherein the source address includes one from the group of a subnet identifier, a server identifier, a folder name, and a file type.

13. The method of claim 12 wherein the source address includes one from the group of an owner of the file, version control information, a hash value, a cyclical redundancy check, and a digital signature.

14. The method of claim 9 wherein the step of determining the source information further comprises:

determining the file name;

assigning a unique identification number in a name space to the file;

collecting source information about the file creating a record in source data storage; and

storing the unique identification number and the source information in the record.

15. The method of claim 9, further comprising retrieving a second file name for a second file, and determining source information for the second file, and making the second file visible on the mobile computing device based on the determined network location and the determined source information for the second file.

16. An apparatus for protection of data accessible by a mobile computing device operating in one of a plurality of network environments, comprising:

a tag generator for generating source information for a file in response to a request for access to the file, the source information including a file name, a source address and privilege information wherein the privilege information defines specific access control limitations on the file including the limitations of whether the file can be stored and/or viewed on the mobile computing device and what persons have access rights to the file, wherein the privilege information includes an identification of a group or groups of persons with whom a user requesting to access the file is associated;

an association module for managing a name space and providing an unique identification number that identifies a file in response to a signal from the tag generator, the association module coupled to the tag generator; and

a controller coupled to the tag generator and the association module, the controller coupled to a policy enforcement module to provide source information useable by the policy enforcement module to control access to the file, wherein the policy enforcement module operates on a server and controls access to files on the server by the mobile computing device based on the privilege information and a security feature associated with the one of the plurality of network environments in which the mobile computing device is operating complying with a predetermined security policy, without regard to a physical geographic location of the mobile computing device;

whereby the mobile computing device is granted access to the file only if the privilege information and the security feature comply with the predetermined security policy.

17. The apparatus of claim 16 further comprising a file request log for storing source information about files that have been accessed by the mobile computing device, the file request log coupled to the tag generator to receive the source information about the files that have been accessed by the mobile computing device.

18. The apparatus of claim 16 further comprising a source data storage for storing a record of source information, the source data storage coupled to the tag generator to receive the record of source information.