Environment-aware security tokens

• US 9,590,971 B2
• Filed: 08/15/2016
• Issued: 03/07/2017
• Est. Priority Date: 08/11/2014
• Status: Active Grant

• Current Assignee: Document Dynamics, LLC
• Original Assignee: Document Dynamics, LLC
• Inventors: Caffary, Robert G. Jr.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/236,649
• Publication Number:
  US 20160352718A1
• Time in Patent Office: 204 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Abstract

The technology described in this document can be embodied in a computer implemented method that includes receiving, at a processing device, information about one or more assets associated with a network of devices. The method also includes generating, for at least one of the assets, a security token that is based at least on a portion of the received information about the corresponding asset. The security token can be configured to identify a home network defined for the asset, and to restrict access to the corresponding asset upon detecting an occurrence of an unauthorized activity involving the asset. The method further includes storing, in a storage device, information about the security token and information linking the security token to the corresponding asset, and initiating integration of the security token with the corresponding asset.

Claims

1. A computer implemented method comprising:

storing a copy of an electronic file at a first storage location that is authenticated to be a part of a home network associated with the electronic file, wherein the electronic file includes a security token, and the security token is configured to;

authenticate an attempt to access the electronic file,

restrict access to the electronic file upon determining the attempt to be originating from outside the home network, and

allow access to the electronic file in accordance with a security policy upon determining the attempt to be originating from within the home network;

obtaining, at one or more computing devices communicably coupled to the home network, information about changes to the electronic file as a result of the attempt;

updating, by the one or more computing devices, another copy of the electronic file stored at a second storage location; and

storing, by the one or more computing devices on a storage device of a file system, data representing the attempt to access the electronic file.

2. The method of claim 1, wherein the first storage location is a part of a distributed storage system.

3. The method of claim 1, wherein the first storage location is a part of a virtual machine of a cloud-based system.

4. The method of claim 1, wherein the security token is configured to authenticate the attempt by determining that at least one of (i) a user-profile or (ii) a device profile associated with the attempt is associated with the home network.

5. The method of claim 1, wherein information about the security policy is encoded into the security token, the security policy comprising information about access privileges associated with the electronic file.

6. The method of claim 5, wherein the access privileges are specific to a user-profile or device-profile associated with the home network.

7. The method of claim 1, wherein the security token comprises information about a global unit identifier (GUID) associated with the electronic file.

8. The method of claim 1, wherein the security token comprises an object generated in accordance with Component Object Model (COM).

9. The method of claim 1, wherein the security token is generated in accordance with one or more security policies associated with the corresponding asset.

10. The method of claim 1, wherein the security token is configured to restrict access to the electronic file by deleting content of the electronic file upon determining the attempt to be originating from outside the home network.

11. The method of claim 1, wherein the security token is configured to restrict access to the electronic file upon determining a dissociation of the electronic file from the home network.

12. The method of claim 1, wherein the security token is included in a header portion of the electronic file or encapsulated with the electronic file in an executable file.

13. The method of claim 1, wherein the electronic file comprises an electronic document, and the security token is embedded into a page description language of the document.

14. The method of claim 1, wherein the copy at the second storage location is updated upon receiving an approval for the changes.

15. A system comprising:

memory; and

one or more processors configured to;

store a copy of an electronic file at a first storage location authenticated to be a part of a home network associated with the electronic file, wherein the electronic file includes a security token configured to;

authenticate an attempt to access the electronic file,

restrict access to the electronic file upon determining the attempt to be originating from outside the home network, and

allow access to the electronic file in accordance with a security policy upon determining the attempt to be originating from within the home network;

obtain information about changes to the electronic file as a result of the attempt;

update another copy of the electronic file stored at a second storage location; and

storing on a storage device of a file system, data representing the attempt to access the electronic file,

wherein the one or more processors are communicably coupled to the home network.

16. The system of claim 15, wherein the first storage location is a part of a distributed storage system.

17. The system of claim 15, wherein the first storage location is a part of a virtual machine of a cloud-based system.

18. The system of claim 15, wherein the security token is configured to authenticate the attempt by determining that at least one of (i) a user-profile or (ii) a device profile associated with the attempt is associated with the home network.

19. The system of claim 15, wherein information about the security policy is encoded into the security token, the security policy comprising information about access privileges associated with the electronic file.

20. The system of claim 19, wherein the access privileges are specific to a user-profile or device-profile associated with the home network.

21. The system of claim 15, wherein the security token comprises information about a global unit identifier (GUID) associated with the electronic file.

22. The system of claim 15, wherein the security token comprises an object generated in accordance with Component Object Model (COM).

23. The system of claim 15, wherein the security token is generated in accordance with one or more security policies associated with the corresponding asset.

24. The system of claim 15, wherein the security token is configured to restrict access to the electronic file by deleting content of the electronic file upon determining the attempt to be originating from outside the home network.

25. The system of claim 15, wherein the security token is configured to restrict access to the electronic file upon determining a dissociation of the electronic file from the home network.

26. The system of claim 15, wherein the security token is included in a header portion of the electronic file or encapsulated with the electronic file in an executable file.

27. The system of claim 15, wherein the electronic file comprises an electronic document, and the security token is embedded into a page description language of the document.

28. The system of claim 15, wherein the copy at the second storage location is updated upon receiving an approval for the changes.

29. One or more machine-readable storage devices storing instructions that are executable by one or more processing devices to perform operations comprising:

storing a copy of an electronic file at a first storage location authenticated to be a part of a home network associated with the electronic file, wherein the electronic file includes a security token configured to;

authenticate an attempt to access the electronic file,

restrict access to the electronic file upon determining the attempt to be originating from outside the home network, and

allow access to the electronic file in accordance with a security policy upon determining the attempt to be originating from within the home network;

obtaining information about changes to the electronic file as a result of the attempt;

updating another copy of the electronic file stored at a second storage location; and

storing on a storage device of a file system, data representing the attempt to access the electronic file,

wherein the one or more processing devices are communicably coupled to the home network.

30. The one or more machine-readable storage devices of claim 29, wherein the first storage location is a part of a distributed storage system, or a part of a virtual machine of a cloud-based system.