Preserving Data Protection With Policy

摘要

Data files are encrypted based on a key associated with an entity that sets a data protection policy controlling access to the data files. The data protection policy identifies various restrictions on how the plaintext data of the encrypted data in the data files can be used. The data files have corresponding metadata identifying the entity that sets the data protection policy, and processes that are running instances of applications that are allowed to access the plaintext data are also associated with the identifier of the entity. These identifiers of the entity, as well as the data protection policy, are used by an operating system of a computing device to protect the data in accordance with the data protection policy, including having the protection be transferred to other devices with the protected data, or preventing the protected data from being transferred to other devices.

主权项

1. A method implemented in a computing device, the method comprising:
identifying an entity-trusted application on the computing device, the entity-trusted application configured to access data; associating a first process that is a running instance of the entity-trusted application with an identifier of an entity that sets a data protection policy controlling access to the data; and enforcing, by an operating system of the computing device, the data protection policy of the entity, the enforcing including:
automatically encrypting, by the operating system in accordance with the data protection policy, data saved by the first process; andpreventing, by the operating system in accordance with the data protection policy, a second process that is a running instance of an entity-untrusted application from accessing the encrypted data.