Systems and Methods for Providing and Managing Distributed Enclaves

• US 20130312117A1
• Filed: 03/14/2013
• Published: 11/21/2013
• Est. Priority Date: 05/16/2012
• Status: Active Grant

• Current Assignee: Okta Incorporated
• Original Assignee: SpydrSafe Mobile Security, Inc. (Okta Incorporated)
• Inventors: Sapp, Kevin Eugene II, Ronin, Victor
• Granted Patent: US 9,009,858 B2
• Time in Patent Office: Days
• US Class Current: 726/30
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A method for operating a distributed data management and control enclave comprises providing a policy that identifies a set of data to be managed and controlled. The policy further identifies devices upon which the data may be transferred and the conditions under which that data may be transferred to the identified devices. A first data management and control system to be used on a first device is then defined in the policy. A second management and control system to be used on a second device is then defined in the policy. The second data management and control system can be distinct from the first data management and control system. The specified data management and control system is then instantiated on a device. The specified data management and control system is then used to manage and control data on the device in accordance with the policy.

Claims

1. A method for operating a device to manage and control data, comprising:

(a) identifying controlled data using a first local enclave instance (LEI) on a first electronic device, said first LEI having one or more policies regulating usage and/or access rights to said controlled data;

(b) receiving a request to transfer said controlled data from said first LEI to a destination residing in (i) an application external to said first LEI and on said first electronic device, (ii) a second LEI, or (iii) a second electronic device;

(c) determining, with the aid of a processor, one or more attributes of said destination;

(d) permitting or denying the request of (b) based upon a processor-assisted comparison of said one or more attributes determined in (c) against one or more attributes for permitting data transfer provided in said one or more policies.

2. The method of claim 1, wherein said second LEI is on said second electronic device.

3. The method of claim 1, wherein said second LEI has one or more policies for regulating usage and/or access rights that are different from said one or more policies of said first LEI.

4. The method of claim 1, wherein (b) comprises receiving a request to transfer said controlled data from said first LEI to a destination residing in an application external to said first LEI and on said first electronic device.

5. The method of claim 1, wherein said one or more attributes determined in (c) do not comply with said one or more attributes for permitting data transfer provided in said one or more policies, and wherein in (d) said request is denied.

6. The method of claim 1, wherein said one or more attributes determined in (c) comply with said one or more attributes for permitting data transfer provided in said one or more policies, and wherein in (d) said request is permitted.

7. The method of claim 1, wherein said request received in (b) is a trigger event associated with an application on said device.

8. The method of claim 1, wherein said controlled data is in a non-transitory, tangible computer readable storage medium.

9. A method for enabling a user to manage and control data, comprising:

(a) identifying controlled data using a first local enclave instance (LEI) on a first electronic device, said first LEI having one or more policies regulating usage and/or access rights to said controlled data;

(b) identifying, with the aid of a processor, a destination location residing in (i) an application external to said first LEI and on said first electronic device, (ii) a second LEI, and/or (iii) a second electronic device;

(c) determining one or more attributes of said location;

(d) performing, with the aid of a processor, a comparison of said one or more attributes determined in (c) against one or more attributes for permitting data transfer provided in a policy; and

(e) permitting transfer of said controlled data to said destination location based upon said comparison of (d).

10. The method of claim 9, wherein said second LEI is on said second electronic device.

11. The method of claim 9, wherein said second LEI has one or more policies for regulating usage and/or access rights that are different from said one or more policies of said first LEI.

12. The method of claim 9, wherein said second LEI is on said second electronic device.

13. The method of claim 9, further comprising, prior to (d), receiving a request to transfer said controlled data from said first LEI to a destination residing in an application external to said first LEI and on said first electronic device.

14. The method of claim 9, wherein said controlled data is in a non-transitory, tangible computer readable storage medium.

15. A method for enabling a user to use and/or access data, comprising:

(a) identifying controlled data on an electronic device of said user;

(b) determining, with the aid of a computer processor, a first set of attributes of said electronic device and/or storage location of said electronic device having said controlled data;

(c) performing, with the aid of a computer processor, a comparison of said first set of attributes determined in (b) against a second set of attributes for permitting usage of and/or access to said controlled data, wherein said second set of attributes is provided in a policy that is associated with the use and/or access of said controlled data on said electronic device; and

(d) permitting the user to use and/or access said controlled data based upon said comparison of (c).

16. The method of claim 15, wherein said controlled data resides in a local enclave instance (LEI) on said electronic device, and wherein said LEI is instantiated from an enclave.

17. The method of claim 16, wherein said enclave resides in a data management and control system coupled to said electronic device.

18. The method of claim 15, wherein said first set of attributes comprises one or more attributes.

19. The method of claim 15, wherein said second set of attributes comprises one or more attributes.

20. The method of claim 15, wherein said controlled data is in a non-transitory, tangible computer readable storage medium.

21-40. -40. (canceled)