Multi-stage protection for data center objects

Abstract

Aspects of the present invention include protecting data objects in a computing environment based on physical location. Aspects include receiving, by a computing system, a request from an authenticated user to access encrypted data, wherein the encrypted data includes information about an encryption key used to encrypt the encrypted data. Aspects also include providing, by the computing system, the encrypted data to a computer system authenticated by the user, the computer system including a set of decryption keys protected by a master key stored in a hardware security module associated with a location of the hardware security module. Aspects also include decrypting, by the hardware security module, the encrypted data based on determining that the data encryption key corresponds to a decryption key in a set of decryption keys, wherein the set of decryption keys is determined based on the location of the hardware security module.

Description

Background Art

[0001] The present invention relates generally to data protection, and more particularly to protecting data objects in a computing environment based on physical location.

[0002] Enterprises often use data protection systems that include trust boundaries to protect their data. In such systems, data protected within the trust boundary cannot be moved to another destination. Summary of the invention

[0003] Embodiments of the present invention relate to methods for protecting data objects in a computing environment based on physical location. A non-limiting example computer-implemented method includes receiving, by a computing system of a computing environment, a request from an authenticated user to access encrypted data, wherein the encrypted data includes information about a data encryption key used to encrypt the encrypted data. The method also includes providing, by the computing system, the encrypted data to a computer system authenticated by the user, the computer system including a set of decryption keys protected by a master key stored in a hardware security module associated with a location of the hardware security module. The method also includes decrypting, by the hardware security module, the encrypted data based on determining that the data encryption key corresponds to a decryption key in a set of decryption keys, wherein the set of decryption keys is determined based on the location of the hardware security module.

[0004] Embodiments of the present invention relate to systems for protecting data objects in a computing environment based on physical location. A non-limiting example system includes a first computing system, a second computing system, and a data storage device that communicate with each other. The first computing system is arranged at a first location and includes a first hardware security module that contains a first master key that protects a first decryption key set. The second computing system is arranged at a second location and includes a second hardware security module that contains a second master key that protects a second decryption key set. The first decryption key set is determined based on the first location, and the second decryption key set is determined based on the second location.

[0005] Embodiments of the present invention relate to computer program products for protecting data objects in a computing environment based on physical location. A non-limiting example computer program product includes a computer-readable storage medium having program instructions specifically implemented therein, the program instructions being executable by a processor to cause the processor to perform an operation, the operation comprising receiving, by a computing system of the computing environment, a request for access to encrypted data from an authenticated user, wherein the encrypted data includes information about an encryption key used to encrypt the encrypted data. The operation also includes providing, by the computing system, the encrypted data to a computer system authenticated by the user, the computer system including a set of decryption keys protected by a master key stored in a hardware security module associated with a location of the hardware security module. The method also includes decrypting, by the hardware security module, the encrypted data based on determining that the data encryption key corresponds to a decryption key in a set of decryption keys, wherein the set of decryption keys is determined based on the location of the hardware security module.

[0006] Additional technical features and benefits are achieved through the technology of the present invention. Embodiments and aspects of the present invention are described in detail herein and are considered to be part of the subject matter claimed. For a better understanding, reference is made to the specific implementation and the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The details of the exclusive rights described herein are particularly pointed out and distinctly claimed in the claims at the end of the specification. The foregoing and other features and advantages of the embodiments of the present invention will become apparent from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0008] Figure 1 depicts a block diagram of a computing environment including a system for protecting data objects based on physical location in accordance with one or more embodiments of the present invention;

[0009] Figure 2 depicts a flow chart of a method for protecting data objects in a computing environment based on physical location according to one or more embodiments of the present invention;

[0010] Figure 3 Depicted are computing systems according to one or more embodiments of the present invention;

[0011] Figure 4 depicts a cloud computing environment according to one or more embodiments of the present invention; and

[0012] Figure 5 Abstract model layers in accordance with one or more embodiments of the invention are depicted.

[0013] The diagrams described herein are illustrative. Without departing from the spirit of the present invention, many changes may be made to the diagrams or operations described therein. For example, actions may be performed in different orders, or actions may be added, deleted or modified. In addition, the term "coupled" and variations thereof describe having a communication path between two elements, and do not imply a direct connection between elements without an intermediate element / connection between them. All of these changes are considered to be part of the specification. DETAILED DESCRIPTION

[0014] Embodiments include methods, systems, and computer program products for protecting data objects in a computing environment based on physical location. In an exemplary embodiment, a computing system at each location is associated with a hardware security module (HSM) for protecting a master key that acts as a wrapping key for protecting keys stored in the computing system. As a result, the keys stored in the computing system are then bound to the HSM. In an exemplary embodiment, access to encrypted data is restricted to users with access to the HSM and access to the computing system, which is controlled through traditional enterprise technologies such as Lightweight Directory Access Protocol (LDAP).

[0015] In one embodiment, the master secret is used to unlock the entire key hierarchy. In some embodiments, the master secret is stored in a file in the computing system, which is then protected by n randomly generated values, which are used to derive the encryption key used to encrypt the master secret. In one embodiment, the creation of the master key is performed in a trusted computing environment without direct physical access to the computing system. The n randomly generated values ​​themselves can then be protected by utilizing HSM encryption. This then binds those randomly generated values ​​to a specific HSM. These randomly generated values ​​are used to control access to the remaining encryption / decryption keys in the computing system. When data is encrypted, information about the keys used during encryption is embedded in the data.

[0016] Now turn to Figure 1 , shows a block diagram of a computing environment 100 including a system for protecting data objects based on physical location according to one or more embodiments of the present invention. In an exemplary embodiment, the computing environment 100 includes a plurality of computing systems 110, each of which includes a hardware security module (HSM) 112. In an exemplary embodiment, one or more of the computing systems 110 may be in a physical location such as Figure 3In other embodiments, one or more of the computing systems in computing system 110 may be implemented in a mainframe computing system, such as a Z / ARCHITECTURE MAINFRAME computer sold by IBM. In another embodiment, one or more of the computing systems in computing system 110 may be implemented in a cloud computing system, such as Figure 4 and Figure 5 In the cloud computing system shown in , HSM 112 is a physical computing device configured to protect and manage digital keys and perform encryption, decryption and other cryptographic functions. In one embodiment, HSM 112 is a CRYPTOEXPRESS card sold by IBM.

[0017] The computing environment 100 also includes a network 120 configured to facilitate communications between the computing system 110, the authentication system 130, and the data storage system 140. The network 120 may be one or more of public (e.g., the Internet), private (e.g., a local area network, a wide area network, a virtual private network), or a combination thereof, and may include wireless and wired transmission systems (e.g., satellite, cellular networks, terrestrial networks, etc.). In an exemplary embodiment, the authentication system 130 is a centralized identity management system that is configured to authenticate users of the computing system by using traditional enterprise technologies such as the Lightweight Directory Access Protocol (LDAP). The authentication system 130 may be implemented on a server such as a server. Figure 3 The computer system shown in the figure may be specifically implemented in a Figure 4 and Figure 5 The invention is specifically implemented in the cloud computing system shown.

[0018] The computing environment 100 also includes a data storage system 140 that is configured to store data objects accessible by any computing system 110 in the computing environment. In an exemplary embodiment, one or more data objects are stored in an encrypted format. The data storage system 140 may be stored in a storage medium such as a computer system 110. Figure 3 embodied in a computing system such as Figure 4 and Figure 5 The cloud computing system shown in FIG.

[0019] In an exemplary embodiment, each HSM 112 contains a unique master key 116a, 116n that acts as a wrapping key for protecting a key 114. The key 114 is used to unlock a keystore 118. The keystore 118 and its contents are bound to the HSM 112 using the HSM 112 and the unique master key 116a, 116n, thereby limiting access to encrypted data objects to users of the computing systems 110 that have access to the HSM 112 and associated access privileges. In an exemplary embodiment, the keystore 118 includes a hierarchy of keys, each key being used to decrypt a data object encrypted by the data storage system 140. In an exemplary embodiment, the key 114 on each computing system 110 is configured to unlock a different portion or subset of the hierarchy of keys in the keystore 118.

[0020] Reference now Figure 2 , a flow chart of a method 200 for protecting data objects in a computing environment based on physical location according to one or more embodiments of the present invention is shown. As shown in block 202, method 200 includes receiving a request for accessing encrypted data from an authenticated user. In an exemplary embodiment, the encrypted data includes information about a data encryption key used to encrypt the encrypted data. Next, as shown in block 204, method 200 includes providing the encrypted data to a computer system to which the user is authenticated. In an exemplary embodiment, the authenticated user is authenticated by an authentication system of the computing environment, which is configured to verify the identity of a user of the computer system.

[0021] In an exemplary embodiment, a computer system includes a set of decryption keys protected by a master key stored in a hardware security module, the master key being associated with a location of the hardware security module. The set of decryption keys is configured to decrypt a subset of encrypted data objects in an encrypted data storage device of a computing environment. In an exemplary embodiment, the master key is unique to the hardware security module. In an exemplary embodiment, the master key is loaded into the hardware security module by a security administrator of the computing environment.

[0022] The method 200 also includes decrypting, by the hardware security module, the encrypted data based on determining that the data encryption key corresponds to a decryption key in a decryption key set, wherein the decryption key set is determined based on a location of the hardware security module. In an exemplary embodiment, the method 200 includes denying access to the encrypted data based on determining that the data encryption key does not correspond to a decryption key in the decryption key set. In an exemplary embodiment, the identification of the hardware security module associated with the location includes determining one or more attributes of the authenticated user. The one or more attributes of the authenticated user include one or more of a physical location of the authenticated user, an access group of the authenticated user, and an organizational role of the authenticated user.

[0023] In an exemplary embodiment, when a user wants to access protected data within a computing environment, multiple authentication checks are performed. First, the user must authenticate using an authentication system. Next, the user presents the protected data to a computing system in the computing environment, the protected data including embedded information about a data encryption key (DEK) used to protect the data. The DEK will then be found in the computing system and will be used to decrypt the protected data. The decryption of the protected data will only work in an environment where the HSM can be used to decrypt the key material for use. As a result, physical boundaries can be created that allow users to log into different computing systems across computing environments, but the user will only be able to access specific types of protected data in each computing system based on the HSM associated with the computing system.

[0024] One or more embodiments of the present invention provide technical improvements over current data protection methods. In an exemplary embodiment, a computing environment provides a separation of duties between a system administrator and a security administrator, which allows for a higher level of protection and control of sensitive data in a geographically dispersed computing environment. In an exemplary embodiment, a security administrator can remove access to protected data from a computing system by removing HSM access to the computing system without any interaction with the system administrator of the computing system. In addition, while a system administrator can replicate a computing system in a computing environment at one location to a second location, the security administrator will need to provide an HSM at the second location so that users at the second location can access the protected data.

[0025] Now go to Figure 3 , a computer system 300 is generally shown according to an embodiment. The computer system 300 can be an electronic computer architecture that includes and / or employs any number of computing devices and networks and combinations thereof, the computing devices and networks utilizing various communication technologies, as described herein. The computer system 300 can be easily scalable, extensible, and modular, with the ability to change to different services or reconfigure some features independently of other features. The computer system 300 can be, for example, a server, a desktop computer, a laptop computer, a tablet computer, or a smart phone. In some examples, the computer system 300 can be a cloud computing node. The computer system 300 can be described in the general context of computer system executable instructions, such as program modules executed by the computer system. Generally, program modules can include routines, programs, objects, components, logic, data structures, etc. that perform specific tasks or implement specific abstract data types. The computer system 300 can be practiced in a distributed cloud computing environment, where tasks are performed by remote processing devices linked through a communication network. In a distributed cloud computing environment, program modules can be located in local and remote computer system storage media including memory storage devices.

[0026] like Figure 3As shown, the computer system 300 has one or more central processing units (CPUs) 301a, 301b, 301c, etc. (collectively or collectively referred to as processors 301). Processor 301 can be a single-core processor, a multi-core processor, a computing cluster, or any number of other configurations. Processor 301, also known as a processing circuit, is coupled to system memory 303 and various other components via system bus 302. System memory 303 may include read-only memory (ROM) 304 and random access memory (RAM) 305. ROM 304 is coupled to system bus 302 and may include a basic input / output system (BIOS), which controls certain basic functions of computer system 300. RAM is a read-write memory coupled to system bus 302 for use by processor 301. System memory 303 provides temporary memory space for the operation of instructions during operation. System memory 303 may include random access memory (RAM), read-only memory, flash memory, or any other suitable memory system.

[0027] Computer system 300 includes an input / output (I / O) adapter 306 and a communication adapter 307 coupled to system bus 302. I / O adapter 306 may be a small computer system interface (SCSI) adapter that communicates with hard disk 308 and / or any other similar components. I / O adapter 306 and hard disk 308 are collectively referred to herein as mass storage 310.

[0028] Software 311 for execution on computer system 300 may be stored in mass storage device 310. Mass storage 310 is an example of a tangible storage medium readable by processor 301 in which software 311 is stored as instructions executed by processor 301 to cause computer system 300 to operate, such as described below with reference to the various figures. Examples of computer program products and execution of such instructions are discussed in greater detail herein. Communications adapter 307 interconnects system bus 302 with network 312, which may be an external network, to enable computer system 300 to communicate with other such systems. In one embodiment, a portion of system memory 303 and mass storage 310 together store an operating system, which may be any suitable operating system, such as z / OS or AIX operating systems from IBM Corporation, to coordinate Figure 3 The functions of the various components are shown in .

[0029] Additional input / output devices are shown connected to the system bus 302 via a display adapter 315 and an interface adapter 316. In one embodiment, adapters 306, 307, 315, and 316 may be connected to one or more I / O buses that are connected to the system bus 302 via an intermediate bus bridge (not shown). A display 319 (e.g., a screen or display monitor) is connected to the system bus 302 via a display adapter 315, which may include a graphics controller and a video controller to improve performance of graphics-intensive applications. A keyboard 321, mouse 322, speaker 323, and the like may be interconnected to the system bus 302 via an interface adapter 316, which may include, for example, a super I / O chip that integrates multiple device adapters into a single integrated circuit. Suitable I / O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include a common protocol, such as the Peripheral Component Interconnect (PCI). Thus, as shown in FIG. Figure 3 As configured, computer system 300 includes processing capabilities in the form of processor 301, as well as storage capabilities including system memory 303 and mass storage 310, input devices such as keyboard 321 and mouse 322, and output capabilities including speakers 323 and display 319.

[0030] In some embodiments, the communication adapter 307 can use any suitable interface or protocol to transmit data, such as an Internet Small Computer System Interface, etc. The network 312 can be a cellular network, a radio network, a wide area network (WAN), a local area network (LAN), or the Internet, etc. An external computing device can be connected to the computer system 300 through the network 312. In some examples, the external computing device can be an external network server or a cloud computing node.

[0031] It should be understood that Figure 3 The block diagram is not intended to indicate that the computer system 300 will include Figure 3 Instead, the computer system 300 may include all components shown in Figure 3 Any suitable fewer or additional components not shown in the computer system 300 (e.g., additional memory components, embedded controllers, modules, additional network interfaces, etc.) may be omitted. In addition, the embodiments described herein with respect to the computer system 300 may be implemented with any suitable logic, wherein the logic as mentioned herein may include any suitable hardware (e.g., a processor, an embedded controller or an application-specific integrated circuit, etc.), software (e.g., an application, etc.), firmware, or any suitable combination of hardware, software, and firmware in various embodiments.

[0032] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings set forth herein is not limited to cloud computing environments. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0033] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with the service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0034] Features are as follows:

[0035] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed without requiring manual interaction with the service provider.

[0036] Wide Area Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0037] Resource pooling: Computing resources on the provider side are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically allocated and reallocated based on demand. There is a sense of location independence, as consumers typically do not control or know the exact location of the provided resources, but are able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0038] Rapid elasticity: In some cases, the ability to scale out quickly and in quickly can be provisioned quickly and elastically. To the consumer, the capacity available for provisioning often appears to be unlimited and can be purchased in any quantity at any time.

[0039] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0040] The service model is as follows:

[0041] Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running on the cloud infrastructure. The applications are accessible from a variety of client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0042] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired by consumers on cloud infrastructure, where the applications are created using programming languages ​​and tools supported by the provider. Consumers do not manage or control the underlying cloud infrastructure including networks, servers, operating systems or storage, but have control over the deployed applications and possible configuration of the application hosting environment.

[0043] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which may include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0044] The deployment model is as follows:

[0045] Private Cloud: The cloud infrastructure is operated only for the organization. It can be managed by the organization or a third party and can exist inside or outside the building.

[0046] Community cloud: The cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0047] Public cloud: Cloud infrastructure is available to the general public or large industrial groups and is owned by an organization that sells cloud services.

[0048] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0049] The cloud computing environment is service-oriented, with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure consisting of a network of interconnected nodes.

[0050] Reference now Figure 4, depicts an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which a local computing device used by a cloud consumer can communicate, such as a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automobile computer system 54N. The nodes 10 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as a private cloud, community cloud, public cloud, or hybrid cloud, or a combination thereof, as described above. This allows the cloud computing environment 50 to provide infrastructure, platform, and / or software as a service for which the cloud consumer does not need to maintain resources on a local computing device. It should be understood that Figure 4 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network addressable connection (eg, using a web browser).

[0051] Reference now Figure 5 , showing the cloud computing environment 50 ( Figure 4 ) provides a set of functional abstraction layers. It should be understood in advance that Figure 5 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0052] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: host 61; server 62 based on RISC (Reduced Instruction Set Computer) architecture; server 63; blade server 64; storage device 65; and network and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0053] Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71; virtual storage 72; virtual networks 73, including virtual private networks; virtual applications and operating systems 74; and virtual clients 75.

[0054] In one example, the management layer 80 may provide the functionality described below. Resource provisioning 81 provides dynamic procurement of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 82 provides cost tracking when resources are utilized in a cloud computing environment, as well as billing or invoicing for consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-scheduling and procurement of cloud computing resources, where future demand is anticipated based on the SLA.

[0055] The workload layer 90 provides examples of functions that can take advantage of the cloud computing environment. Examples of workloads and functions that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis processing 94; transaction processing 95; and data protection 96.

[0056] Various embodiments of the present invention are described herein with reference to the accompanying drawings. Without departing from the scope of the present invention, alternative embodiments of the present invention may be designed. In the following description and accompanying drawings, various connections and positional relationships (e.g., above, below, adjacent, etc.) are described between elements. Unless otherwise indicated, these connections and / or positional relationships may be direct or indirect, and the present invention is not intended to be limited in this respect. Therefore, the coupling of entities may refer to direct or indirect coupling, and the positional relationship between entities may be direct or indirect positional relationship. In addition, various tasks and process steps herein may be incorporated into a more comprehensive program or process with additional steps or functionality not described in detail herein.

[0057] One or more methods herein may be implemented using any one or a combination of the following technologies known in the art: a discrete logic circuit having logic gates for implementing logic functions according to data signals, an application specific integrated circuit (ASIC) having appropriate combination of logic gates, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0058] For the sake of brevity, conventional techniques related to making and using aspects of the present invention may or may not be described in detail herein. In particular, various aspects of computing systems and specific computer programs for implementing the various technical features described herein are well known. Therefore, for the sake of brevity, many conventional implementation details are only briefly mentioned or omitted entirely herein without providing well-known system and / or process details.

[0059] In some embodiments, various functions or actions can occur at a given location and / or in conjunction with the operation of one or more devices or systems. In some embodiments, a portion of a given function or action can be performed at a first device or location, and the remainder of the function or action can be performed at one or more additional devices or locations.

[0060] The terms used herein are for the purpose of describing specific embodiments only and are not intended to be limiting. As used herein, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that the terms "comprises" and / or "comprising", when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, element components, and / or groups thereof.

[0061] The corresponding structures, materials, actions, and equivalents of all means or step-plus-function elements in the following claims are intended to include any structure, material, or action for performing a function in combination with other claimed elements as specifically claimed. The present disclosure is presented for the purpose of illustration and description, but is not intended to be exhaustive or limited to the disclosed forms. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the present disclosure. The embodiments are selected and described in order to best explain the principles and practical applications of the present disclosure, and to enable other persons of ordinary skill in the art to understand the present disclosure of various embodiments with various modifications that are suitable for the specific purposes contemplated.

[0062] The figures described here are illustrative. Without departing from the spirit of the present disclosure, there may be many variations of the figures or steps (or operations) described therein. For example, actions may be performed in different orders, or actions may be added, deleted or modified. In addition, the term "coupled" describes having a signal path between two elements, and does not imply a direct connection between elements without an intermediate element / connection therebetween. All of these variations are considered to be a part of the present disclosure.

[0063] The following definitions and abbreviations are used to interpret the claims and specification. As used herein, the terms "comprises," "including," "having," "containing," or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a composition, mixture, process, method, article, or apparatus that includes a list of elements is not necessarily limited to only those elements but may include other elements not expressly listed or inherent to such composition, mixture, process, method, article, or apparatus.

[0064] Additionally, the term "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. The terms "at least one" and "one or more" are understood to include any integer greater than or equal to one, i.e., one, two, three, four, etc. The term "plurality" should be understood to include any integer greater than or equal to two, i.e., two, three, four, five, etc. The term "connected" may include both indirect "connections" and direct "connections."

[0065] The terms "about", "substantially", "approximately" and variations thereof are intended to include the degree of error associated with the measurement of a particular quantity based on the equipment available at the time the application was filed. For example, "about" may include a range of ±8% or 5% or 2% of a given value.

[0066] The present invention may be a system, method and / or computer program product at any possible level of technical detail integration. The computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, and the computer-readable program instructions are used to cause a processor to perform various aspects of the present invention.

[0067] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0068] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium in the corresponding computing / processing device.

[0069] The computer-readable program instructions for performing the operation of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of an integrated circuit, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Smalltalk, C++, etc.) and process programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider through the Internet). In some embodiments, in order to perform various aspects of the present invention, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute a computer-readable program instruction by utilizing the state information of the computer-readable program instructions to personalize the electronic circuit.

[0070] Various aspects of the present invention are described herein with reference to the flow chart and / or block diagram of the method, device (system) and computer program product according to embodiments of the present invention. It will be understood that each frame of the flow chart and / or block diagram and the combination of frames in the flow chart and / or block diagram can be implemented by computer-readable program instructions.

[0071] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0072] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0073] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention.In this regard, each frame in the flow chart or block diagram can represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing the specified logical function.In some alternative embodiments, the function noted in the frame may not occur in the order noted in the figure.For example, the two frames shown in succession can actually be performed substantially simultaneously, or these frames can sometimes be performed in reverse order, depending on the function involved.It will also be noted that the combination of each frame of the block diagram and / or flow chart illustration and the frame in the block diagram and / or flow chart illustration can be realized by a dedicated hardware-based system that performs a specified function or action or performs a combination of special hardware and computer instructions.

[0074] The description of various embodiments of the present invention has been given for the purpose of illustration, but it is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements existing in the market, or to enable other persons of ordinary skill in the art to understand the embodiments described herein.

Claims

1. A system for protecting a data object based on physical location, the system comprising: A computing environment, comprising a first computing system, a second computing system, an authentication system, and a data storage device in communication with each other, wherein: A first computing system is disposed at a first location and includes a first hardware security module containing a first master key that acts as a wrapping key for protecting a first set of decryption keys; The second computing system is disposed at a second location and includes a second hardware security module containing a second master key that serves as a wrapping key for protecting a second set of decryption keys; The first set of decryption keys is determined based on the first position; and The second set of decryption keys is determined based on a second position, wherein the authentication system controls user access to the first computing system and the second computing system, wherein the first computing system is configured to receive encrypted data from an authenticated user at the first location, wherein the encrypted data includes embedded information regarding a data encryption key that was used to encrypt the encrypted data, and The first set of decryption keys is configured to unlock a key store of the first computing system, wherein the key store includes a hierarchy of keys, each key being used to decrypt a data object encrypted by the data storage device. 2 . The system of claim 1 , wherein the first set of decryption keys is configured to decrypt a first subset of encrypted data objects in the data storage device.

3. The system of claim 2, wherein the second set of decryption keys is configured to decrypt a second subset of encrypted data objects in the data storage device, and wherein the first subset is different from the second subset. 4 . The system of claim 1 , wherein the first computing system is further configured to: decrypt the encrypted data based on determining that the data encryption key corresponds to a decryption key in the first set of decryption keys.

5. A method for protecting data objects in a computing environment based on physical location, the method comprising: receiving, by a computing system of the computing environment, from an authenticated user, a request to access encrypted data, wherein the encrypted data includes information regarding an encryption key used to encrypt the encrypted data; providing, by the computing system, the encrypted data to a computer system in which the user is authenticated, the computer system comprising a set of decryption keys protected by a master key, the master key being stored in a hardware security module, wherein the set of decryption keys is determined based on a location of the hardware security module; decrypting, by the hardware security module, the encrypted data based on a determination that the data encryption key corresponds to one of the set of decryption keys, wherein the set of decryption keys is determined based on a location of the hardware security module, wherein the computing system is configured to receive encrypted data from the authenticated user, wherein the encrypted data includes embedded information regarding a data encryption key used to encrypt the encrypted data, and The set of decryption keys is configured to unlock a key store of the computing system, wherein the key store includes a hierarchy of keys, each key being used to decrypt an encrypted data object.

6. The method of claim 5, wherein the authenticated user is authenticated by an authentication system of the computing environment, the authentication system being configured to verify the identity of a user of the computer system. The method of claim 5 , wherein the master key is unique to the hardware security module.

8. The method of claim 5, wherein the set of decryption keys is configured to decrypt a subset of encrypted data objects in a data storage device of the computing environment.

9. The method according to claim 5, further comprising: Based on determining that the data encryption key does not correspond to a decryption key in the set of decryption keys, access to the encrypted data is denied.

10. The method of claim 5, wherein the identification of the hardware security module associated with the location comprises determining one or more attributes of the authenticated user.

11. The method of claim 5, wherein the one or more attributes of the authenticated user include one or more of a physical location of the authenticated user, an access group of the authenticated user, and an organizational role of the authenticated user.

12. A computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions being executable by a processor to cause the processor to perform the operations of the method according to any one of claims 5 to 11.

Images