Method and apparatus for securing documents using a position dependent file system
View Patent ↗Access to information or a document is secured by a central global positioning authority that evaluates access requests in accordance with predefined policies. One component of an access request includes location information regarding at least one of the requesting entity and location of the requested resource. Access is either allowed or denied as a function of at least the requesting entity, position information and the applicable policy or policies. An encryption/decryption scheme is implemented where the encryption key is a function of the resource's position.
1. A method of controlling access to a secure file located on a first system, the method comprising:
receiving by a Global Positioning Authority (GPA) system connected to the first system over a network, from a requesting entity on the first system, a request packet comprising a request for access to the secure file located on the first system, the request packet including at least location information of the requesting entity, wherein the location information of the requesting entity is a function of a Global Positioning System signal;
determining, as a function of information within the request packet, whether the request for access is allowed; and
if it is determined that access is allowed, returning a request response packet to the requesting entity from the GPA system, the request response packet comprising a decryption key for decrypting the secure file.
2. The method of claim 1 , wherein the determining comprises:
parsing the request packet to identify at least one data portion comprising at least one of:
an identity of the requesting entity;
a type of access being requested;
location information regarding the secure file;
an attribute of the secure file;
location information regarding the requesting entity;
a date of the request;
a time of the request;
information regarding a location of the first system from which the request is being sent; and
accessing a policy store to determine, as a function of one or more of the parsed data portions, if the access request will be granted.
3. The method of claim 2 , further comprising:
if it is determined that the access request will be granted, accessing an encryption key store to return the decryption key to decrypt the secure file,
wherein accessing the encryption key store is a function of at least one of:
the identity of the requesting entity; and
an attribute of the protected resource secure file.
4. The method of claim 2 , wherein at least one of a) the location information regarding the secure file, and b) the information regarding the location of the first system comprises location data that is a function of a Global Positioning System signal.
5. An apparatus comprising a processor and a memory for controlling access to a secure file located on a first system, the apparatus comprising:
means for receiving by a Global Positioning Authority (GPA) system connected to the first system over a network, from a requesting entity on the first system, a request packet comprising a request for access to the secure file located on the first system, the request packet including at least location information of the requesting entity, wherein the location information of the requesting entity is a function of a Global Positioning System signal;
means for determining, as a function of information within the request packet, whether the request for access is allowed; and
means for returning a request response packet to the requesting entity from the GPA system if it is determined that access is allowed, the request response packet comprising a decryption key for decrypting the secure file.
6. The apparatus of claim 5 , wherein the means for determining comprises:
means for parsing the request packet to identify at least one data portion comprising at least one of:
an identity of the requesting entity;
a type of access being requested;
location information regarding the secure file;
an attribute of the secure file;
location information regarding the requesting entity;
a date of the request;
a time of the request;
information regarding a location of the first system from which the request is being sent; and
means for accessing a policy store to determine, as a function of one or more of the parsed data portions, if the access request will be granted.
7. The apparatus of claim 6 , further comprising:
means for accessing, if it is determined that the access request will be granted, an encryption key store to return the decryption key to decrypt the secure file,
wherein the accessing means accessing the encryption key store is a function of at least one of: the identity of the requesting entity; and an attribute of the secure file.
8. The apparatus of claim 6 , wherein at least one of: a) the location information regarding the secure file, and b) the information regarding the location of the first system comprises location data that is a function of a Global Positioning System signal.
9. A computer program product for controlling access to a secure file located on a first system, the computer program product comprising a nontransitory computer usable storage medium having computer readable program code thereon, including:
program code for receiving by a Global Positioning Authority (GPA) system connected to the first system over a network, from a requesting entity on the first system, a request packet comprising a request for access to the secure file located on the first system, the request packet including at least location information of the requesting entity, wherein the location information of the requesting entity is a function of a Global Positioning System signal;
program code for determining, as a function of information within the request packet, whether the request for access is allowed; and
program code for returning a request response packet to the requesting entity if it is determined that access is allowed from the GPA system, the request response packet comprising a decryption key for decrypting the secure file.
10. The computer program product of claim 9 , wherein the program code for determining comprises:
program code for parsing the request packet to identify at least one data portion comprising at least one of:
an identity of the requesting entity;
a type of access being requested;
location information regarding the secure file;
an attribute of the secure file;
location information regarding the requesting entity;
a date of the request;
a time of the request;
information regarding a location of the first system from which the request is being sent;
program code for accessing a policy store to determine, as a function of one or more of the parsed data portions, if the access request will be granted; and
program code for accessing an encryption key store to return the decryption key to decrypt the secure file once it is determined that the access request will be granted
wherein accessing the encryption key store is a function of at least one of: the identity of the requesting entity; and an attribute of the secure file.
11. The computer program product of claim 10 , wherein at least one of: a) the location information regarding the secure file, and b) the information regarding the location of the first system comprises location data that is a function of a Global Positioning System signal.