Secure smart containers for controlling access to data

Abstract

A computer system controls access to data. A secure container based on an image file is instantiated at an endpoint device of a user, wherein the secure container includes encrypted data corresponding to the user. A request for access to the secure container is authenticated by verifying the credentials of the user. Access to the data is granted in response to verifying the credentials of the user. Access to the data is controlled by decrypting and allowing access to a portion of the data, wherein additional portions of the data are decrypted and made accessible based on user behavior.

Description

Background Art

[0001] Embodiments of the present disclosure relate to data access, and more particularly, to secure smart containers that store data and control access to the stored data.

[0002] Users often exchange data that is considered sensitive, confidential, or otherwise worthy of protection from others. Traditional solutions for controlling access to data, such as public key cryptography and user-based access control, have various advantages and disadvantages. However, traditional approaches fail to account for security threats that arise when unauthorized individuals gain access to data or when authorized users begin to perform illegal actions. For example, a member of an organization may decide to disclose the organization's password-protected trade secrets, or a hacker may gain access to encrypted data through illegal means. Therefore, there is a need to control access to data in a way that not only prevents unauthorized access but also extends protection to accessible data. Summary of the invention

[0003] According to one embodiment of the present disclosure, a computer system controls access to data. A secure container based on an image file is instantiated at a user's endpoint device, wherein the secure container includes encrypted data corresponding to the user. An access request to the secure container is authenticated by verifying the user's credentials. In response to verifying the user's credentials, access to the data is granted. Access to the data is controlled by decrypting and allowing access to a portion of the data, wherein an additional portion of the data is decrypted and becomes accessible based on user behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Generally, the same reference numerals are used to denote the same components in the various drawings.

[0005] Figure 1 is a block diagram depicting a computing environment for controlling access to data according to an embodiment of the present disclosure;

[0006] Figure 2 is a block diagram depicting a computing system for controlling access to data according to an embodiment of the present disclosure;

[0007] Figure 3 is a flowchart depicting a method of creating a data container according to an embodiment of the present disclosure;

[0008] Figure 4 is a flowchart depicting a method of accessing data stored in a data container according to an embodiment of the present disclosure;

[0009] Figure 5 is a flow chart illustrating a method of detecting data access violations according to an embodiment of the present disclosure; and

[0010] Figure 6is a block diagram depicting a computing device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0011] Embodiments of the present disclosure relate to data access, and more specifically, to secure intelligent containers that store data and control access to the stored data. A container is a software package that can include code for applications and other data. Containers are designed for portability and typically include dependencies on any included applications, enabling containerized applications to execute quickly and reliably across a variety of computing environments. In addition to supporting the execution of applications, containers can also store any desired data. For example, a container can include data in a proprietary format that can be accessed by a user through an application also included in the container.

[0012] The container may be instantiated from an image file that may be transferred between computing devices, for example, via email. Instantiating the container at the computing device presents a virtual file system and virtual files to the user. The virtual file system may store any data that needs to be protected in encrypted form, and additionally include executable code of an implementation engine that enables authorized users to access the data while monitoring access. The implementation engine may control access to the data based on various factors, such as the nature of the access, the computing environment, the identity of the user, and / or the user's behavior.

[0013] Thus, the disclosed embodiments enable secure sharing and access of data while extending protection of the data during access events. Specifically, data that is not currently being accessed remains encrypted, and even authorized users can only access a portion of the data that the user is allowed to access at a time. In addition, when a user accesses data, the user's behavior is monitored to identify any suspicious behavior, such as attempts to Figure 1 Accessing more data than is reasonably necessary to support a particular use case, or searching for suspicious keywords in the data. Thus, the disclosed embodiments provide improvements to data access control, where practical applications extend protection not only to the initial access point, but also to the entire time period during which a user accesses the data.

[0014] It should be noted that references to features, advantages, or similar language throughout the specification do not mean that all features and advantages that can be achieved using the embodiments disclosed herein should be any single embodiment of the disclosure or in any single embodiment of the disclosure. Rather, language referring to features and advantages is understood to mean that a particular feature, advantage, or characteristic described in conjunction with an embodiment is included in at least one embodiment of the disclosure. Therefore, throughout the specification, discussions of features, advantages, and similar language may, but do not necessarily, refer to the same embodiment.

[0015] In addition, the described features, advantages and characteristics of the present disclosure may be combined in any suitable manner in one or more embodiments. Those skilled in the relevant art will recognize that the present disclosure may be practiced without one or more specific features or advantages of a particular embodiment. In other cases, additional features and advantages that may not be present in all embodiments of the present disclosure may be recognized in certain embodiments.

[0016] These features and advantages will become more fully apparent from the following drawings, description, and appended claims, or may be learned by the practice of the embodiments of the disclosure as set forth hereinafter.

[0017] Embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. Figure 1 1 is a block diagram depicting a computing environment 100 for controlling access to data according to an embodiment of the present disclosure. As shown, the computing environment 100 includes a first client device 105A, one or more additional client devices 105B-105N, and a network 150. It should be understood that the functional division between the components of the computing environment 100 is selected for the purpose of explaining the embodiments of the present disclosure and should not be construed as a limiting example.

[0018] Each client device 105A-105N includes a network interface (I / F) 106, at least one processor 107, and a memory 110 including a host application 115. Each client device 105A-105N may include a laptop computer, a tablet computer, a netbook computer, a personal computer (PC), a desktop computer, a personal digital assistant (PDA), a smart phone, a thin client, or any programmable electronic device capable of executing computer-readable program instructions. The network interface 106 enables the components of each client device 105A-105N to send and receive data over a network such as network 150. Generally, the client devices 105A-105N enable users to share data containers and access data in a controlled manner. For example, a user of client device 105A can add data to a container, which is securely saved as an image file and transmitted to another device, such as client device 105B, for access by another user. Each client device 105A-105N may include internal and external hardware components, such as reference Figure 6 further depicted and described in detail.

[0019] The host application 115 may include one or more modules or units to perform various functions of the embodiments of the present disclosure described below. The host application 115 may be implemented by any combination of any number of software and / or hardware modules or units, and may reside in the memory 110 of any one of the client devices 105A-105N so as to be executed by a processor such as the processor 107.

[0020] In some embodiments, the host application 115 enables a user to create a secure container and add data to the container. A user of the client device 105A can define a container based on one or more parameters, such as the size of the container, the file system type of the container, the type of data encryption for data securely stored in the container, and the like. In addition, when a user creates a container via the host application 115, the user can select options to define which actions or occurrences constitute data access violations. For example, when a container is instantiated in an unauthorized computing environment, when a user attempts to query data using a specific word or phrase, or when a user attempts to access data at a rate that exceeds any legitimate usage, the container's implementation engine can detect an access violation and subsequently prevent the user from accessing the data. Once the user finalizes the configuration of the container, data can be added to the container and user access permissions can be defined for the data. For example, the data can be encrypted so that different users can access different parts of the data using unique passwords or access keys. When a container is finalized, an image file corresponding to the container can be saved to a non-volatile storage medium such as a storage device 120. Container creation will be discussed below with reference to Figure 3 Describe and depict in more detail.

[0021] Once the image file of the container is created, the user of client device 105A can share the image file with other users and / or devices such as client devices 105B-105N. The image file of the container can be transmitted via any conventional or other data transmission technology, such as file transfer facilitated by a communication network (e.g., network 150) or by using a removable storage device to physically transfer the image file. When the image file is received at another computing device such as client devices 105B-105N, the image file can be instantiated as a container and once the user is authenticated, the secure data can be accessed at the computing device. Client devices 105B to 105N may include client devices of other users and / or other client devices associated with the creator of the container (e.g., the user of client device 105A). When the data access session is completed, any changes to the data can be saved to the image file, which can then be distributed to additional users and / or computing devices. In some embodiments, users can collaborate by sharing a link to the image file, which is stored in a network accessible location. Refer to the following Figure 2 and Figure 4 Access to data in a data container is depicted and described in greater detail.

[0022] The storage device 120 may include any non-volatile storage medium known in the art. For example, the storage device 120 may be implemented with a tape library, an optical library, one or more independent hard disk drives, or multiple hard disk drives in a redundant array of independent disks (RAID). Similarly, the data in the storage device 120 may conform to any suitable storage architecture known in the art, such as a file, a relational database, an object-oriented database, and / or one or more tables. In some embodiments, the storage device 120 stores data related to image files, computing environment data (e.g., operating system data, program data, metadata such as version information, etc.), data added to or obtained from a container, and the like.

[0023] The network 150 may include a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of both, and may include wired, wireless, or fiber optic connections. In general, the network 150 may be any combination of connections and protocols known in the art that will support communication between the client devices 105A-105N via their respective network interfaces according to embodiments of the present disclosure.

[0024] Figure 2 2 is a block diagram depicting a computing system 200 for controlling access to data according to an embodiment of the present disclosure. As depicted, computing system 200 includes client device 205, network interface 206, processor 207, memory 210, and storage 240. Memory 210 may include operating system 212, host application 215, container 220 with implementation engine 225 and encrypted data 230, and accessible data 235. Storage 240 may include one or more image files, such as image file 245.

[0025] The client device 205 may be configured to Figure 1 The client device 205 may be implemented with any of the client devices 105A-105N of the computing environment 100 depicted and described in further detail. The client device 205 may include a laptop computer, a tablet computer, a netbook computer, a personal computer (PC), a desktop computer, a personal digital assistant (PDA), a smart phone, a thin client, or any programmable electronic device capable of executing computer-readable program instructions. The network interface 106 enables the components of the client device 205 to send and receive data over a network. Typically, the client device 205 enables a user to access a secure data container. The client device 205 may include internal and external hardware components, such as those described in reference Figure 6 Depicted and described in more detail.

[0026] The operating system 212, the host application 215, the container 220, and the implementation engine 225 may include one or more modules or units to perform various functions of the embodiments of the present disclosure described below. The operating system 212, the host application 215, the container 220, and the implementation engine 225 may be implemented by any combination of any number of software and / or hardware modules or units, and may reside in the memory 210 of the client device 205 so as to be executed by a processor such as the processor 207.

[0027] Operating system 212 may include any conventional or other operating system software for a computing device, such as or The host application 215 may be installed in the operating system 212 so that the instantiated container may be integrated into the operating system 212 and presented as a virtual file system.

[0028] The host application 215 enables the generation of image files and enables image files to be instantiated as containers. The host application 215 can be a daemon process that utilizes one or more application programming interfaces (APIs) to enable the containerized application to interact with software external to the container (such as the operating system 212 of the client device 205 and / or any applications installed on the client device 205). When the host application 215 instantiates a container such as container 220, the container can be integrated into the operating system 212 of the client device 205 as a virtual file system or virtual folder, a network drive, or any conventional or other form of data media. In some embodiments, the host application 215 uses a driver such as a driver (e.g., for An operating system integration component of FUSE) may present accessible data to a user of the client device 205, or a virtual file system may be similarly exposed to a mounted drive.

[0029] Container 220 is a secure data container that is instantiated by host application 215 into memory 210 of client device 205 so that a user can access executable files and data stored in container 220. Container 220 is instantiated based on an image file such as image file 245. Container 220 may include encrypted data 230, as well as a portion that is not encrypted and includes implementation engine 225. In some embodiments, container 220 includes an operating system separate from operating system 212 and / or any dependencies that implementation engine 225 requires in order to execute various aspects of embodiments of the present disclosure. For example, container 220 may include an operating system such as CentOS 212. TM Lightweight operating systems such as Resilient File System or encryption software like VeraCrypt.

[0030] The enforcement engine 225 resides in the non-encrypted portion of the container 220 and includes executable code for authenticating a user to access data residing in the encrypted data 230. In addition, the enforcement engine 225 can monitor the user, control access to the data, and perform security actions if necessary. The enforcement engine 225 can access components of the client device 205 that are external to the container 220 via the host application 215. For example, the enforcement engine 225 can access peripherals of the client device 205 to track user input, can access other portions of the memory 210 to detect malware or other software executing on the client device 205, can access the storage 240 to identify stored data, etc.

[0031] When an authorized user submits a key to access the encrypted data, the implementation engine 225 can verify the key and process the encrypted data 230, decrypting some or all of the data and providing the decrypted data to the memory as accessible data 235. In some embodiments, the accessible data 235 is presented to the operating system 212 of the client device 205 by virtualizing the accessible data 235 as a network connection or data stream. The accessible data 235 can be presented as a virtual drive separate from the virtual drive of the container 220, or the accessible data 235 can be presented in the same virtual drive as the container 220. The implementation engine 225 can place only a portion of the encrypted data 230 in the accessible data 235 at a time, thereby preventing the user from accessing all of the data included in the encrypted data 230. When the user finishes accessing the current portion of the data, the accessible data 235 can be refreshed with the next portion of the data by decrypting the next portion from the encrypted data 230 and transferring it to the accessible data 235.

[0032] When a user submits a key to request access to data, the implementation engine 225 may also verify other circumstances of the access request. In some embodiments, the implementation engine 225 authenticates the request based on the computing environment of the client device 205. For example, the access control settings of the container may indicate that the container can only be accessed by certain devices, which may be defined by a host name, a media access control (MAC) address, an Internet Protocol (IP) address, or other unique software-based or hardware-based identifier. In some embodiments, the implementation engine 225 may allow access to secure data based on the geographic location of the client device 205, which may be obtained using a global positioning system (GPS), radio tower triangulation, etc. For example, data in a container may be accessed only when the user is in a particular city, state, or country, or the presence of the client device 205 in certain locations may prevent the data from being accessed. In some embodiments, the implementation engine 225 compares the current access location with the previous access location, which may include a comparison of the geographic location, the logical location (e.g., the computing environment), or both. Thus, for example, when the current access location exceeds the previous access location by a threshold amount of distance and / or when the container was previously accessed using a different operating system, the implementation engine 225 may prevent access.

[0033] The enforcement engine 225 can monitor the user's interaction with the accessible data 235 in order to control access to the data. When the enforcement engine 225 determines that an access violation (e.g., any unauthorized access to the data) has occurred, the enforcement engine 225 can perform actions to block subsequent user access to the accessible data 235. In various embodiments, the enforcement engine 225 can determine that an access violation has occurred when a user searches for a specific word or phrase included in a list, when a user attempts to access data too quickly, and so on. The enforcement engine 225 can employ rule-based user behavior scoring to determine that an access violation has occurred when the user's behavior causes the total risk score to exceed a predetermined threshold.

[0034] Storage device 240 may include any non-volatile storage medium known in the art. For example, storage device 240 may be implemented with a tape library, an optical library, one or more independent hard disk drives, or multiple hard disk drives in a redundant array of independent disks (RAID). Similarly, the data in storage device 240 may conform to any suitable storage architecture known in the art, such as a file, a relational database, an object-oriented database, and / or one or more tables. In some embodiments, storage device 240 stores data associated with one or more image files such as image file 245. When a user removes container 220, any changes to the protected data are saved and image file 245 is updated accordingly. When a user removes container 220, an access log corresponding to the protected data may be updated, including timestamps for any read and write operations. Version control may be implemented to provide a version number when a container changes.

[0035] Figure 3 is a flow chart depicting a method 300 of creating a data container according to an embodiment of the present disclosure.

[0036] Generation of an image file is initiated at operation 310. A user may request generation of a new image file by defining properties of the resulting container, such as the data size of the container, encryption settings for the encrypted data portion of the container, operating system settings for the container (if any), the name of the container, and other settings such as optional executable files to be included in the container. The user may also define file system settings for any virtual file system presented by the container.

[0037] In operation 320, data is added to the image file. The user may include any data that is desired to be protected in the image file. In some embodiments, the user may add data that is organized into a directory, which may include multiple files and folders.

[0038] Access control settings are configured at operation 330, including user credentials, user permissions, and / or access violation settings. The creator of the image file can add user accounts that can access the container, as well as corresponding access keys for each account. In some embodiments, each user account can include one or more of a user account name, a user name (e.g., a legal name or nickname), a job or role in an organization, a time limit or deadline for data access, and a unique access key. Rules can be established for user account permissions on a file-by-file basis. For example, if a container includes two hundred files numbered sequentially, a first user may be able to access files one to one hundred, a second user may only be able to access files six to nine, and a third user may be able to access all two hundred files. In some embodiments, rules about the nature of access to files can be established. For example, a first user may have read access, while a second user may have read and write access. In some embodiments, documents can be classified according to escalating levels of sensitivity, and access levels can be defined for each user account, so that users can access any data at or below their access level.

[0039] At operation 340, the data is encrypted and the finalized image is saved. The data that needs to be protected is encrypted, and the image is finalized by adding executable code, such as code for implementing the engine 225 and any dependencies, operating system code, etc. The resulting image file can be saved to a non-volatile storage device for subsequent transmission and / or use.

[0040] Figure 4 is a flow chart depicting a method 400 of accessing data stored in a data container according to an embodiment of the present disclosure.

[0041] The container is instantiated at operation 410. A user of a computing device, such as any of client devices 105A-105N, may obtain or receive an image file that may be instantiated into a container via a host application installed on the user's computing device. In some embodiments, the image file is stored locally at the computing device, and in other embodiments, the image file may be located at a network accessible location.

[0042] An access key is received at operation 420. Initially, an access key may be created when a new image file is generated and / or when a new authorized user is added to a container. The creator or other authorized individual may provide the access key to the authorized user. For example, the user may be provided his or her access key via a communication channel that is different from how the user accesses the image file. When the user instantiates the container, the virtual file system is mounted on the user's computing device, and the implementation engine 225 may begin execution, prompting the user to provide the access key. Additionally or alternatively, the implementation engine 225 may obtain details related to the local environment in which the access request is located, such as the operating system of the computing device, the geographic location of the computing device, etc.

[0043] Operation 430 determines whether the access request satisfies all access requirements. In some embodiments, the user's access key is verified. Additionally or alternatively, the collected information about the local environment can be verified by the implementation engine 225. For example, the implementation engine 225 can verify that the container has been instantiated on the same computing device that previously accessed the container, or the implementation engine 225 can verify that the container has not been instantiated by a computing device in another country.

[0044] If the access request, including the access key and any other requirements, satisfies the access requirements, then access to the data is granted at operation 440. The implementation engine 225 may decrypt some or all of the encrypted data, thereby making the data available to the authenticated user. The accessible data may be created in an ad hoc manner as a file presented in a virtual file system. When the data is accessible to the user, the activity of the computing device and the user's behavior may be monitored and analyzed by the implementation engine 225 to protect the protected data.

[0045] In some embodiments, portions of encrypted data are made accessible at one time, and when a user completes a particular portion, subsequent portions may be made available. Thus, at any given time, the entirety of the protected data will not be exposed to the memory. For example, a user reading or editing a text file may reach the end of a portion of the file and may be instructed to close and reopen the file. When the user closes the file, the implementation engine 225 may rewrite the file in the virtual file system with data corresponding to subsequent portions of the protected data. In some embodiments, the implementation engine 225 may virtualize the source of accessible data into a network data stream, enabling an application to access and present data where the application would otherwise be unable to open an incomplete file.

[0046] If the access requirements are not met, then access to the data is denied at operation 450. In some embodiments, the user may be prevented from attempting to access the data after one or more failed attempts. In some embodiments, when access to the data is denied, the container may be unloaded from the computing device. The enforcement engine 225 may perform additional security actions, such as deleting encrypted data, or causing the image file to be deleted when the container is unloaded. Thus, the container may self-destruct in order to protect the data.

[0047] In some embodiments, the user may provide an alternative key at operation 420 that is not an access key, but a distress code or other distress indicator. For example, instead of entering the user's access key, the user may enter a string of zeros indicating that the user is under duress. Upon receiving the distress indicator, the implementation engine 225 may display counterfeit data that appears to be real, but is not actually the data being protected by the container. The counterfeit data may be completely different from the actual data, or may be based on the actual data. By inserting a secret phrase or watermark, the counterfeit data may be uniquely identified, so that when the counterfeit data is leaked, the identity of the source and / or perpetrator may be identified.

[0048] Figure 5 is a flow chart illustrating a method 500 of detecting data access violations according to an embodiment of the present disclosure.

[0049] Access to data is monitored at operation 510. When a user's access to a container is authenticated, the enforcement engine 225 can monitor user behavior by accessing the operating system of the user's computing device or by tracking the user's read and / or write operations on accessible data. The enforcement engine 225 can continuously monitor for any suspicious or potentially suspicious activity as long as the user has access to protected data.

[0050] Operation 520 determines whether an unauthorized access event has occurred. A rule-based approach can be used so that the implementation engine 225 can determine when an unauthorized access event has occurred. Rules can be defined when creating an image file, and can include rules for any activity, such as a user search for a word or phrase that appears on a suspicious query list, copy and paste operations, saving accessed data to a hard drive, forwarding accessed data in an email, executing certain applications, etc. In some embodiments, conventional or other machine learning techniques can be applied by training models to detect suspicious user behavior and correspondingly generate rules for detecting unauthorized access events. If no unauthorized access event has occurred, the implementation engine 225 continues to monitor at operation 510.

[0051] At operation 530, a risk sub-score corresponding to the access event is determined. In some embodiments, different risk sub-score values ​​may be associated with different unauthorized access events, so that the events may be scored according to the severity of the events. For example, the risk sub-scores may be provided according to Table 1.

[0052]

[0053]

[0054] Table 1

[0055] Operation 540 determines whether the total risk score meets a predetermined threshold. Specifically, the total risk score is calculated by summing each risk sub-score, and the total risk score is compared to the predetermined threshold. If the total risk score does not meet the threshold, the enforcement engine 225 continues to monitor access to the data, and if further unauthorized access events are detected, the total risk score is updated again after each unauthorized access event. In some embodiments, the total risk score decays over time.

[0056] Where the total risk score meets the threshold, further access to the data is blocked at operation 550. In various embodiments, the user may be presented with counterfeit data, the container may be removed and the user's access keys revoked, or the image file may be automatically destroyed.

[0057] Figure 6 1 is a block diagram depicting components of a computer 10 suitable for performing the methods disclosed herein. The computer 10 may implement client devices 105A-105N and / or client device 205 according to embodiments of the present disclosure. It should be understood that Figure 6 This merely provides an illustration of one embodiment and does not imply any limitation with respect to the environments in which different embodiments may be implemented.Many modifications to the described environments may be made.

[0058] As shown, the computer 10 includes a communication structure 12, which provides communication between a computer processor 14, a memory 16, a permanent storage device 18, a communication unit 20, and an input / output (I / O) interface 22. The communication structure 12 can be implemented with any architecture designed to transfer data and / or control information between a processor (e.g., a microprocessor, a communication and network processor, etc.), a system memory, peripheral devices, and any other hardware components within the system. For example, the communication structure 12 can be implemented with one or more buses.

[0059] Memory 16 and permanent storage 18 are computer-readable storage media. In the depicted embodiment, memory 16 includes random access memory (RAM) 24 and cache memory 26. In general, memory 16 may include any suitable volatile or non-volatile computer-readable storage media.

[0060] One or more programs may be stored in permanent storage 18 for execution by one or more corresponding computer processors 14 via one or more memories of memory 16. Permanent storage 18 may be a magnetic hard drive, a solid-state hard drive, a semiconductor memory device, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information.

[0061] The media used by persistent storage 18 also may be removable. For example, a removable hard drive may be used for persistent storage 18. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer to another computer-readable storage medium that is also part of persistent storage 18.

[0062] Communications unit 20, in these examples, provides communications with other data processing systems or devices. Communications unit 20, in these examples, includes one or more network interface cards. Communications unit 20 may provide communications using one or both of physical and wireless communication links.

[0063] The I / O interface 22 allows for input and output of data with other devices that may be connected to the computer 10. For example, the I / O interface 22 may provide a connection to an external device 28 such as a keyboard, a keypad, a touch screen, and / or some other suitable input device. The external device 28 may also include portable computer-readable storage media such as thumb drives, portable optical or magnetic disks, and memory cards.

[0064] Software and data used to practice embodiments of the present disclosure may be stored on such portable computer-readable storage media and loaded onto persistent storage device 18 via I / O interface(s) 22. I / O interface 22 may also be connected to display 30, which provides a mechanism for displaying data to a user and may be, for example, a computer monitor.

[0065] The programs described herein are identified based on the applications in which they are implemented in the specific embodiments of the present disclosure. However, it should be understood that any specific program naming herein is used only for convenience, and therefore the present invention should not be limited to use only in any specific application identified and / or implied by such naming.

[0066] Data related to the secure smart container that controls access to data (e.g., image file data, container data, protected data, user permission data, rules for suspicious access events, access history data, etc.) can be stored in any conventional or other data structure (e.g., file, array, list, stack, queue, record, etc.) and can be stored in any desired storage unit (e.g., database, data or other repository, queue, etc.). Data transmitted between client devices 105A-105N can include any desired format and arrangement and can include any number of fields of any size of any type to store data. The definition and data model of any data set can indicate the overall structure in any desired manner (e.g., computer-related language, graphical representation, list, etc.).

[0067] Data related to a security intelligence container that controls access to data (e.g., image file data, container data, protected data, user permission data, rules for suspicious access events, access history data, etc.) may include any information provided to or generated by a client device 105A-105N. Data related to a security intelligence container that controls access to data may include any desired format and arrangement, and may include any number of fields of any size of any type to store any desired data. Data related to a security intelligence container that controls access to data may include any data about an entity collected through any collection mechanism, any combination of collected information, and any information derived from analysis of the collected information.

[0068] The disclosed embodiments may employ any number of any type of user interfaces (e.g., graphical user interfaces (GUIs), command lines, prompts, etc.) to obtain or provide information (e.g., data related to secure smart containers that control access to data), wherein the interface may include any information arranged in any manner. The interface may include any number of any type of input or actuation mechanisms (e.g., buttons, icons, fields, boxes, links, etc.) arranged in any location to input / display information and initiate desired actions via any suitable input device (e.g., mouse, keyboard, etc.). Interface screens may include any suitable actuators (e.g., links, tabs, etc.) to navigate between screens in any manner.

[0069] It should be understood that the embodiments described above and shown in the accompanying figures represent only some of the many ways to increase data security by preventing unauthorized data access and extending protection during legitimate or other access events.

[0070] The environment of the disclosed embodiments may include any number of computers or other processing systems (e.g., client or end-user systems, server systems, etc.) and databases or other repositories arranged in any desired manner, wherein the disclosed embodiments may be applied to any desired type of computing environment (e.g., cloud computing, client-server, network computing, mainframe, stand-alone system, etc.). The computers or other processing systems used in the disclosed embodiments may be implemented by any number of any personal or other type of computer or processing system (e.g., desktop, laptop, PDA, mobile device, etc.), and may include any commercially available operating system and any combination of commercially available and customized software (e.g., communication software, operating system software, host application 115, host application 215, implementation engine 225, etc.). These systems may include any type of monitor and input device (e.g., keyboard, mouse, voice recognition, etc.) to input and / or view information.

[0071] It should be understood that the software of the disclosed embodiments (e.g., communication software, operating system software, host application 115, host application 215, implementation engine 225, etc.) can be implemented in any desired computer language and can be developed by a person of ordinary skill in the computer field based on the functional descriptions contained in the specification and the flow charts shown in the accompanying drawings. In addition, any reference herein to software that performs various functions generally refers to a computer system or processor that performs these functions under software control. The computer system of the disclosed embodiments can alternatively be implemented by any type of hardware and / or other processing circuits.

[0072] The various functions of a computer or other processing system can be distributed in any manner among any number of software and / or hardware modules or units, processing or computer systems and / or circuits, wherein the computers or processing systems can be arranged locally or remotely from each other and communicate via any suitable communication medium (e.g., LAN, WAN, intranet, Internet, hardware lines, modem connections, wireless, etc.). For example, the functions of the disclosed embodiments can be distributed in any manner among various end-user / client and server systems and / or any other intermediate processing devices. The software and / or algorithms described above and shown in the flow charts can be modified in any manner to achieve the functions described herein. In addition, the functions in the flow charts or descriptions can be performed in any order to achieve the desired operations.

[0073] The software of the disclosed embodiments (e.g., communication software, operating system software, host application 115, host application 215, implementation engine 225, etc.) may be available on a non-transitory computer-usable medium (e.g., magnetic or optical medium, magneto-optical medium, floppy disk, CD-ROM, DVD, memory device, etc.) of a fixed or portable program product apparatus or device for use with a stand-alone system or a system connected via a network or other communication medium.

[0074] The communication network can be implemented by any number of any type of communication networks (e.g., LAN, WAN, Internet, intranet, VPN, etc.). The computer or other processing system of the disclosed embodiment may include any conventional or other communication device to communicate through the network via any conventional or other protocol. The computer or other processing system can access the network using any type of connection (e.g., wired, wireless, etc.). The local communication medium can be implemented by any suitable communication medium (e.g., local area network (LAN), hardware line, wireless link, intranet, etc.).

[0075] The system may employ any number of any conventional or other databases, data stores, or storage structures (e.g., files, databases, data structures, data or other repositories, etc.) to store information (e.g., data related to a secure smart container that controls access to data). The database system may be implemented by any number of any conventional or other databases, data stores, or storage structures (e.g., files, databases, data structures, data or other repositories, etc.) to store information (e.g., data related to a secure smart container that controls access to data). The database system may be included within or coupled to a server and / or client system. The database system and / or storage structures may be remote from or local to a computer or other processing system and may store any desired data (e.g., data related to a secure smart container that controls access to data).

[0076] The disclosed embodiments may employ any number of any type of user interfaces (e.g., graphical user interfaces (GUIs), command lines, prompts, etc.) to obtain or provide information (e.g., data related to secure smart containers that control access to data), wherein the interface may include any information arranged in any manner. The interface may include any number of any type of input or actuation mechanisms (e.g., buttons, icons, fields, boxes, links, etc.) arranged in any location to input / display information and initiate desired actions via any suitable input device (e.g., mouse, keyboard, etc.). Interface screens may include any suitable actuators (e.g., links, tabs, etc.) to navigate between screens in any manner.

[0077] The disclosed embodiments are not limited to the specific tasks or algorithms described above, but may be used for any number of applications in related fields, including but not limited to controlling access to data to prevent unauthorized access.

[0078] The terms used herein are only used for the purpose of describing specific embodiments and are not intended to limit the present disclosure. As used herein, the singular forms "a", "an" and "the" are intended to also include plural forms unless the context clearly indicates otherwise. It should also be understood that the terms "include", "comprise", "contain", "have", "with", etc., when used in this specification, specify the presence of the features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or combinations thereof.

[0079] The corresponding structures, materials, actions, and equivalents of all parts or steps plus function elements in the following claims are intended to include any structure, material, or action for performing a function in combination with other claimed elements as specifically claimed. The description of the present disclosure has been presented for the purpose of illustration and description, but it is not intended to be exhaustive or limited to the disclosure of the disclosed form. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the present disclosure. The embodiments are selected and described in order to best explain the principles and practical applications of the present disclosure, and to enable other persons of ordinary skill in the art to understand the disclosure of various embodiments with various modifications suitable for the specific purposes contemplated.

[0080] The description of various embodiments of the present disclosure has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements over existing technologies on the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

[0081] The present disclosure may be a system, method and / or computer program product at any possible level of technical detail integration. A computer program product may include a computer-readable storage medium (or multiple media) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform aspects of the present disclosure.

[0082] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punch card or a raised structure in a groove on which instructions are recorded, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be interpreted as a temporary signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (e.g., a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0083] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0084] The computer-readable program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of an integrated circuit, or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages, such as Smalltalk, C++, etc.) and procedural programming languages ​​(such as "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or may be connected to an external computer (e.g., using an Internet service provider via the Internet). In some embodiments, an electronic circuit including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer-readable program instructions to personalize the electronic circuit by utilizing the state information of the computer-readable program instructions, so as to perform aspects of the present disclosure.

[0085] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It will be understood that each block of the flowchart and / or block diagram and the combination of blocks in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0086] These computer-readable program instructions can be provided to a processor of a computer or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device create components for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can guide the computer, programmable data processing device and / or other equipment to work in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0087] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes of the flowchart and / or block diagram.

[0088] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each frame in the flow chart or block diagram can represent a module, segment or part of an instruction, which includes one or more executable instructions for realizing a specified logical function. In some alternative embodiments, the functions noted in the frame may not occur in the order noted in the figure. For example, the two frames shown in succession can actually be implemented as a step, and are executed simultaneously, substantially simultaneously, in a partially or fully time-overlapping manner, or these frames can sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each frame of the block diagram and / or flow chart illustration and the combination of frames in the block diagram and / or flow chart illustration can be implemented by a dedicated hardware-based system that performs a specified function or action or performs a combination of dedicated hardware and computer instructions.

Claims

1. A computer-implemented method for controlling access to a secure container, comprising: receiving an image file at an endpoint device; instantiating a secure container based on the image file at the endpoint device of the user, wherein the secure container includes encrypted data corresponding to a plurality of users including the user and a fulfillment engine, and wherein the encrypted data is encrypted such that different users can access different portions of the data; authenticating a request for access to the secure container by verifying the credentials of the user; responsive to verifying the credentials of the user, granting access to data that the user is authorized to access; as well as controlling access to the data using the enforcement engine stored in the secure container by decrypting and enabling access to a portion of the data also stored in the secure container, wherein additional portions of the data are decrypted and made accessible based on user behavior, and wherein each additional portion of the data is provided by providing an instruction to the user to close a file including the portion of the data, in response to the user closing the file, overwriting the file with the additional portion of the data, providing an instruction to the user to reopen the file, and in response to the user reopening the file, providing the additional portion of the data to the user; receiving one or more edits by the user to the data to which the user is authorized to access; providing a modified image file including the one or more edits made by the user; as well as The modified image file is sent to a device of an additional user having different access permissions to the data than the user.

2. The computer-implemented method of claim 1 , further comprising: analyzing said user behavior to determine that an access violation has occurred; as well as In response to determining that the access violation has occurred, suspending the user's access to the data.

3. The computer-implemented method of claim 2, wherein the user behavior is analyzed to identify one or more events, and wherein the access violation is determined by: calculating an overall risk score based on one or more risk sub-scores corresponding to the identified one or more events; and It is determined that the total risk score satisfies a predetermined threshold. The computer-implemented method of claim 1 , wherein the user behavior comprises a rate of access to the data. 5 . The computer-implemented method of claim 1 , wherein the user behavior comprises the user using one or more unauthorized query terms to query the data.

6. The computer-implemented method of claim 1, wherein authenticating the access request is also based on one or more from the group consisting of: a computing environment of the endpoint device, a current location of the endpoint device, and a previously accessed location of the secure container.

7. The computer-implemented method of claim 1 , further comprising: The counterfeit data is presented in response to determining that an access violation has occurred or in response to an access request including a distress indicator.

8. A computer system for controlling access to a secure container, the computer system comprising: one or more computer processors; one or more computer-readable storage media; Program instructions stored on the one or more computer-readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising instructions for respectively executing the steps of the method according to any one of claims 1-7.

9. A computer program product for controlling access to a secure container, the computer program product comprising program instructions, the program instructions being executable by a computer to cause the computer to respectively perform the steps of the method according to any one of claims 1-7.

Images