Method and apparatus for sharing data from a secured environment
A method for sharing data from within a secure network perimeter includes providing a sharing folder associated with a first user for transferring data therefrom to destinations outside the secure perimeter. Data stored within the sharing folder is stored in a secured fashion. Semi-trusted applications are provided an ability to retrieve the secured data in a unsecured fashion for sharing of same. The semi-trusted applications are other than able to retrieve and share secured data from at least a folder other than the sharing folder in unsecured form.
1. A method comprising:
providing a security layer for maintaining security within a security perimeter;
providing a sharing folder within the security perimeter;
providing a first ciphered data file stored within the security perimeter outside the sharing folder, the first ciphered data file secured according to a first security protocol and accessible to trusted applications, and the first ciphered data file not accessible to semi-trusted applications in a deciphered form;
providing a second ciphered data file stored within the security perimeter and within the sharing folder, the second ciphered data file secured according to the first security protocol and accessible to semi-trusted applications in a deciphered form; and
using a semi-trusted application, transmitting the second ciphered data file in the deciphered form to a destination outside the secure system;
wherein ciphering and deciphering of files is performed by the security layer, the security layer supporting access control based on a location of a ciphered file and a trust level of an application accessing said file,
wherein the first ciphered data file and the second ciphered data file are exact copies of each other stored in each of two different locations, and
wherein the semi-trusted applications are provided access to the first ciphered data file in its ciphered form.
2. The method as defined in claim 1 wherein the security perimeter is a virtual security perimeter defining a virtual communication network having data secured therein.
3. The method as defined in claim 1 wherein the trusted applications are provided access to the second ciphered data file in its deciphered form.
4. The method as defined in claim 1 comprising:
initiating copying of the first ciphered data file from within the security perimeter outside the sharing folder to within the security perimeter within the sharing folder; and
in response to copying of the first ciphered data file, generating a log entry.
5. The method as defined in claim 1 comprising:
initiating copying of the first ciphered data file from within the security perimeter outside the sharing folder to within the security perimeter within the sharing folder; and
in response to initiating copying of the first ciphered data file, requesting user authorization data, the user authorization data for authorizing a copying operation.
6. The method as defined in claim 1 comprising:
initiating copying of the first ciphered data file from within the security perimeter outside the sharing folder to within the security perimeter within the sharing folder; and
in response to initiating copying of the first ciphered data file, requesting user authorization data, verifying the user authorization data; and in response to verifying the user authorization data, authorizing the initiated copying operation.
7. The method as defined in claim 1 comprising:
initiating copying of the first ciphered data file from within the security perimeter outside the sharing folder to within the security perimeter within the sharing folder; and
in response to initiating copying of the first ciphered data file, verifying the operation against policy data to determine an authorization result for the copy operation;
in response to determining that the copying should other than be authorized, preventing the initiated copying operation; and
in response to determining that the copying should be authorized, authorizing the initiated copying operation.
8. The method as defined in claim 7 wherein verifying the operation against policy data comprises determining if a maximum number of file copy operations to the sharing folder is exceeded.
9. The method as defined in claim 7 wherein verifying the operation against policy data comprises determining if a given file is sharable.
10. The method as defined in claim 7 wherein verifying the operation against policy data comprises determining if a given individual has authorization to share a given file.
11. The method as defined in claim 7 wherein verifying the operation against policy data comprises determining if sharing of the file is being performed within suitable sharing hours.
12. The method as defined in claim 1 comprising generating a log entry when a first ciphered data file is one of moved and copied to the sharing folder within the security perimeter.
13. The method as defined in claim 1 wherein the semi-trusted applications support file communication for sharing of deciphered file data outside the security perimeter.