LOCATION-BASED DATA SECURITY
In an example, a system and method are disclosed for location-based security for devices such as portable devices. A portable device may be provided with a short-range transceiver (such as RIFD) that is detectable when a user enters or exits an area. The device may also include an encrypted storage divided into a plurality of discrete units. Upon entering an area, the devices identity and location are provided to a policy server. In response, the policy server may wirelessly provide security tokens to the portable device that enable decryption of specific storage units authorized for access in that area. When a user passes back through a portal to the area, the security tokens are revoked, so that access to secured units of the storage is restricted.
1 . An apparatus comprising:
a storage having at least one secure partition;
a network interface; and
logic, at least partly implemented in hardware for carrying out a method comprising:
receiving over the network interface a security token that corresponds to a location of the apparatus; and
applying the security token to the secure partition to provide access to the secure partition based at least in part on the location of the apparatus.
2 . The apparatus of claim 1 , further comprising a proximity trigger operable to identify the apparatus upon crossing a security portal.
3 . The apparatus of claim 2 , wherein the proximity trigger is further operable to determine the apparatus's location upon crossing the security portal.
4 . The apparatus of claim 2 , wherein the proximity trigger is a short-range wireless communication device.
5 . The apparatus of claim 2 , wherein the proximity trigger is a radio frequency identification (RFID) device.
6 . The apparatus of claim 2 , wherein the proximity trigger is further configured to provide at least some functions of the network interface.
7 . The apparatus of claim 1 , wherein the storage has a plurality of secure partitions, and wherein the logic further comprises a data structure for correlating the plurality of secure partitions to a plurality of locations.
8 . The apparatus of claim 6 , further comprising a sector-level security driver operable to provide access to the secure partition at a higher privilege level than a file system driver.
9 . The apparatus of claim 1 , further comprising a security driver at least partly embedded in firmware operable to provide access to the secure partition.
10 . The apparatus of claim 1 , wherein the secure partition is encrypted.
11 . The apparatus of claim 10 , wherein the security token comprises a decryption key.
12 . The apparatus of claim 10 , wherein the security token comprises a shared key.
13 . The apparatus of claim 1 , wherein the network interface is a wireless network interface operable for operation on an encrypted wireless channel.
14 . The apparatus of claim 1 , further comprising a firmware operable to perform a security action on the secure partition if the security token expires without being renewed.
15 . The apparatus of claim 12 , wherein the firmware is embedded in the storage.
16 . One or more computer-readable mediums having stored thereon software instructions operable to instruct a processor for:
receiving a security token that corresponds to a location of a storage device; and
applying the security token to a secure partition of the storage to provide access to the secure partition.
17 . The one or more mediums of claim 16 , further comprising a data structure for correlating access to a plurality of secure partitions to a plurality of locations.
18 . The one or more mediums of claim 17 , wherein providing access to the secure partitions comprises decrypting the secure partitions.
19 . The one or more mediums of claim 16 , wherein the security token comprises a decryption key.
20 . The one or more mediums of claim 16 , wherein the security token comprises a shared key.
21 . The one or more mediums of claim 16 , wherein the network interface is a wireless network interface operable for operation on an encrypted wireless channel.
22 . The one or more mediums of claim 16 , wherein the logic is further operable for performing a security action on the secure partition if the security token expires without being renewed.
23 . The one or more mediums of claim 22 , wherein the logic for performing a security action on the secure partition is resident on the storage.
24 . The one or more mediums of claim 16 , wherein the logic is further operable for registering upon an apparatus entering a location.
25 . The one or more mediums of claim 16 , wherein receiving the security token is operable to occur over a radio frequency identification (RFID) device.
26 . A secure encryption server comprising:
a network interface; and
logic, at least partly implemented in hardware, operable to:
receive a token request from a device on the network interface;
authenticate a the device;
generate a security token for the device; and
send the security token over the network interface.