Techniques for preventing prohibited access to secure content
Systems and methods for improving access to and control of secure content. To prevent undesired data sharing/access (e.g., prohibited downloads, 4th, 5th-party sharing), access rules can be assigned to documents upon creation. These access rules specify the operations that can be performed to a document, who can perform those operations, and when those documents can be accessed to perform the operations. For each document, a separate container instance may be generated which can store the document comprising the private data. Each authorized user may be provided with their own container instance. Unique cryptographic keys may be generated for each container instance to allow those authorized users to securely connect to their respective container instances. This additional layer of protection (i.e., access rules linked to documents and unique keys for each document/client) allows for granular monitoring of the private data to prevent prohibited access attempts.
1 . A system for preventing unauthorized access to a document, the system comprising:
a secure file database that stores encrypted documents;
a user device associated with an authorized user; and
a computing system programmed with computer program instructions to:
receive a request to upload a document and access control rules to the secure file database, wherein the access control rules specify (i) actions that are permitted to be performed with the document and (ii) a set of user devices that are permitted to access the document;
encrypt the document and the access control rules to obtain an encrypted document and encrypted access control rules;
store, using the secure file database, the encrypted document and the encrypted access control rules;
receive, from the user device, a request to share the document with an unauthorized user device associated with an unauthorized user;
responsive to receiving the request to share the document, retrieve the encrypted access control rules to determine whether the authorized user is permitted to share the document with the unauthorized user device;
based on a determination that the encrypted access control rules permit the authorized user to share the document, generate and send, to the user device, a link to a container instance storing the encrypted document, wherein the container instance comprises software providing a virtual runtime environment for accessing the document;
receive, via the container instance, a notification that a request to download the document was made by the unauthorized user device; and
based on a determination that the encrypted access control rules comprise a rule that downloads of the document by the unauthorized user are impermissible, disabling a document download functionality of the container instance to prevent the unauthorized user device from downloading the document.
2 . A method for controlling access to private data, the method being implemented using one or more processors of a computing system, the method comprising:
receiving, from a user device, a request to provide access to private data, wherein a set of access control rules for accessing the private data are stored with the private data;
generating a link to a container instance storing an accessible version of the private data;
sending the link to the user device;
detecting, via the container instance, an operation being performed to the accessible version of the private data, the operation comprising a download operation to download, for an unauthorized user device, a copy of at least some of the private data; and
disabling, based on the operation and the set of access control rules, a feature of the container instance to prevent the download operation from being performed to the accessible version of the private data for the unauthorized user device.
3 . The method of claim 2 , further comprising:
generating a document comprising the private data, wherein the set of access control rules specify how to access the private data via the document;
encrypting the document and the set of access control rules; and
storing the encrypted document using a secure file database.
4 . The method of claim 2 , further comprising:
inserting an event tracker into the private data, wherein the event tracker tracks at least one of interactions with the private data stored via the container instance or actions performed by a device attempting to access the private data.
5 . The method of claim 4 , wherein the interactions with the private data comprise at least one of: editing at least some of the private data, downloading the private data, or sharing the private data, and the actions performed by the device attempting to access the private data comprise at least one of: keystrokes executed, touchscreen inputs, mouse inputs, pointer inputs, or screen shots.
6 . The method of claim 4 , further comprising:
obtaining, from the container instance, event tracker data comprising a set of interactions with the private data detected using the event tracker; and
analyzing, using one or more trained artificial intelligence models, the set of interactions to identify one or more patterns of interactions with the private data.
7 . The method of claim 6 , further comprising:
adding each interaction of the set of interactions to a digital ledger tracking interactions with the private data.
8 . The method of claim 2 , wherein the request comprises a first request, the accessible version comprises a first accessible version, and the operation comprises a first operation, detecting the operation comprises:
receiving, from the user device, a second request to generate a new link to a new container instance storing a second accessible version of the private data;
sending the new link to the user device;
detecting, via the new container instance, a second operation being performed to the second accessible version of the private data; and
causing, based on the second operation and the set of access control rules, the second operation to be performed to the second accessible version of the private data.
9 . The method of claim 2 , further comprising:
receiving a modification to one or more access control rules of the set of access control rules; and
providing an updated set of access control rules comprising the modification to the container instance, wherein the operation is performed or prevented based on the updated set of access control rules.
10 . The method of claim 9 , wherein the modification comprises an update to at least one of: a number of access attempts permitted, a number of share attempts permitted, download rules, printing rules, sharing rules, or viewing rules.
11 . The method of claim 9 , wherein the request is received from an authorized user, the set of access control rules comprise resource locators of a set of user devices that the private data is permissible to be shared with.
12 . The method of claim 11 , further comprising:
generating a container instance for each user device of the set of user devices;
generating a link to each container instance, wherein the link is specific to one of the resource locators of a corresponding user device from the set of user devices; and
sending each link to the corresponding user device.
13 . The method of claim 2 , wherein receiving the request comprises:
receiving a request to upload a document comprising the private data to a secure file database, wherein the secure file database stores an encrypted version of the document, and wherein the set of access control rules are defined with the document.
14 . The method of claim 13 , wherein the set of access control rules specify actions that are permitted to be performed with the document and (ii) user devices that are permitted to access the document.
15 . The method of claim 2 , wherein the accessible version of the private data comprises an encrypted version of the private data, and the link comprises a secure link.
16 . The method of claim 2 , wherein the link is specific to the user device and the container instance is specific to an authorized user associated with the user device.
17 . The method of claim 2 , wherein the link comprises a Hypertext Transfer Protocol Secure (HTTPS) link to provide a first layer of encryption and the private data is encrypted using one or more encryption algorithms to provide a second layer of encryption.
18 . The method of claim 2 , wherein disabling comprises:
generating a downloadable version of the private data including a digital signature; and
providing the downloadable version of the private data to the unauthorized user device.
19 . One or more non-transitory computer-readable media storing computer program instructions that, when executed by one or more processors of a computing system, effectuate operations comprising:
receiving, from a user device, a request to provide access to private data, wherein a set of access control rules for accessing the private data are stored with the private data;
generating a link to a container instance storing an accessible version of the private data;
sending the link to the user device;
detecting, via the container instance, an operation being performed to the accessible version of the private data, the operation comprising a download operation to download, for an unauthorized user device, a copy of at least some of the private data; and
disabling, based on the operation and the set of access control rules, a feature of the container instance to prevent the download operation from being performed to the accessible version of the private data for the unauthorized user device.