Systems and methods for location-aware access to cloud data stores

1. A computer-implemented method for location-aware access to cloud data stores, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

obtaining a location policy that governs access to a cloud data store, the location policy specifying a location rule to be satisfied in order to access files in the cloud data store, the location rule including a location criterion that identifies a permitted data store location for the cloud data store as being distinct from a permitted request location from which requests to access the cloud data store are permitted;

receiving a request, from a client system, to access at least one file in the cloud data store;

verifying that the request satisfies the location rule and therefore complies with the location policy by verifying that the cloud data store is located within the permitted data store location;

providing to the client system, by a location service that is distinct from the cloud data store, and in response to verifying that the cloud data store is located within the permitted data store location, access to the file in the cloud data store by providing to the client system a cryptographic element;

after providing the cryptographic element to the client system by the location service, retrieving, by the client system, the file from the cloud data store; and

decrypting, by the client system, the file using the cryptographic element, wherein providing the cryptographic element to the client system enables the client system to download and decrypt the file directly from the cloud data store rather than receiving the file via the location service.

2. The computer-implemented method of claim 1 , further comprising initiating encryption of the file in the cloud data store by receiving, from a user, credentials to authenticate as the user to the cloud data store.

3. The computer-implemented method of claim 2 , wherein initiating encryption of the file in the cloud data store further comprises, in response to receiving the credentials, authenticating as the user to the cloud data store.

4. The computer-implemented method of claim 3 , wherein initiating encryption of the file in the cloud data store further comprises:

generating the cryptographic element for encrypting and decrypting the file in the cloud data store; and

encrypting the file in the cloud data store using the cryptographic element.

5. The computer-implemented method of claim 1 , wherein the location service is provided by a computing security service provider.

6. The computer-implemented method of claim 1 , wherein:

the location rule includes both:

the location criterion that identifies the permitted data store location for the cloud data store; and

an additional location criterion that identifies the permitted request location from which requests to access the cloud data store are permitted; and

verifying that the request satisfies the location rule comprises verifying that the location criterion and the additional location criterion are both satisfied.

7. The computer-implemented method of claim 4 , further comprising revoking access previously provided to the file in the cloud data store by:

using the credentials received from the user to authenticate as the user to the cloud data store;

generating at least one new cryptographic element for encrypting and decrypting the file in the cloud data store;

decrypting the file in the cloud data store using the cryptographic element; and

re-encrypting the file in the cloud data store using the new cryptographic element.

8. The computer-implemented method of claim 1 , wherein the location rule identifies the permitted data store location with an internet protocol address.

9. The computer-implemented method of claim 4 :

wherein the cryptographic element is part of an asymmetric key pair that includes both:

a public encryption key; and

a private decryption key; and

wherein encrypting the file in the cloud data store using the cryptographic element comprises providing the public encryption key to a cryptographic client to encrypt the file in the cloud data store.

10. The computer-implemented method of claim 9 , wherein the cryptographic client comprises at least one of:

the client system; and

the cloud data store.

11. The computer-implemented method of claim 1 , wherein the permitted data store location for the cloud data store comprises a permitted geographic location region for the cloud data store.

12. The computer-implemented method of claim 1 , wherein the location rule requires identification of the permitted data store location using either a geolocation identifier or a combination of two or more of the following:

an internet protocol address;

location information in a secure socket layer certificate;

a hardware attestation signature;

a media access control address;

an autonomous system number; and

border gateway protocol information.

13. A system for location-aware access to cloud data stores, the system comprising:

a policy module, stored in memory, that obtains, as part of a location service, a location policy that governs access to a cloud data store, the location policy specifying a location rule to be satisfied in order to access files in the cloud data store, the location rule including a location criterion that identifies a permitted data store location for the cloud data store as being distinct from a permitted request location from which requests to access the cloud data store are permitted;

a communication module, stored in memory, that receives, as part of the location service, a request, from a client system, to access at least one file in the cloud data store, the location service and the cloud data store being distinct;

a verification module, stored in memory, that verifies, as part of the location service, that the request satisfies the location rule and therefore complies with the location policy by verifying that the cloud data store is located within the permitted data store location;

an access module, stored in memory, that provides to the client system, as part of the location service, and in response to verifying that the cloud data store is located within the permitted data store location, access to the file in the cloud data store by providing to the client system a cryptographic element;

the client system that:

after receiving the cryptographic element from the location service, retrieves the file from the cloud data store; and

decrypts the file using the cryptographic element, wherein providing the cryptographic element to the client system enables the client system to download and decrypt the file directly from the cloud data store rather than receiving the file via the location service; and

at least one physical processor configured to execute the policy module, the communication module, the verification module, and the access module.

14. The system of claim 13 , further comprising an initiation module, stored in memory, that initiates encryption of the file in the cloud data store by receiving, from a user, credentials to authenticate as the user to the cloud data store.

15. The system of claim 14 , wherein the initiation module further initiates encryption of the file in the cloud data store by authenticating, in response to receiving the credentials, as the user to the cloud data store.

16. The system of claim 15 , wherein the initiation module further initiates encryption of the file in the cloud data store by:

generating the cryptographic element for encrypting and decrypting the file in the cloud data store; and

encrypting the file in the cloud data store using the cryptographic element.

17. The system of claim 11 , wherein the location service is provided by a computing security service provider.

18. The system of claim 13 , wherein:

the location rule includes both:

the location criterion that identifies the permitted data store location for the cloud data store; and

an additional location criterion that identifies the permitted request location from which requests to access the cloud data store are permitted; and

verifying that the request satisfies the location rule comprises verifying that the location criterion and the additional location criterion are both satisfied.

19. The system of claim 13 , wherein the location rule identifies the permitted data store location with an internet protocol address.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

obtain a location policy that governs access to a cloud data store, the location policy specifying a location rule to be satisfied in order to access files in the cloud data store, the location rule including a location criterion that identifies a permitted data store location for the cloud data store as being distinct from a permitted request location from which requests to access the cloud data store are permitted;

receive a request, from a client system, to access at least one file in the cloud data store;

verify that the request satisfies the location rule and therefore complies with the location policy by verifying that the cloud data store is located within the permitted data store location;

provide to the client system, by a location service that is distinct from the cloud data store, and in response to verifying that the cloud data store is located within the permitted data store location, access to the file in the cloud data store by providing to the client system a cryptographic element;

after providing the cryptographic element to the client system by the location service, retrieve, by the client system, the file from the cloud data store; and

decrypt, by the client system, the file using the cryptographic element, wherein providing the cryptographic element to the client system enables the client system to download and decrypt the file directly from the cloud data store rather than receiving the file via the location service.