Method and apparatus for sharing data from a secured environment
A method for sharing data from within a secure network perimeter includes providing a sharing folder associated with a first user for transferring data therefrom to destinations outside the secure perimeter. Data stored within the sharing folder is stored in a secured fashion. Semi-trusted applications are provided an ability to retrieve the secured data in a unsecured fashion for sharing of same. The semi-trusted applications are other than able to retrieve and share secured data from at least a folder other than the sharing folder in unsecured form.
1. A method comprising:
providing a security layer for maintaining security within a security perimeter;
providing a first set of folders having first secured data stored therein;
providing a sharing folder having second secured data stored therein;
providing a trusted application for accessing the stored first secured data from within the first set of folders, the stored first secured data stored in a ciphered form and deciphered by the security layer when accessed by the trusted application;
providing a semi-trusted application for accessing the second secured data from within the sharing folder, the second secured data stored in a ciphered form and deciphered by the security layer when accessed by the semi-trusted application, wherein the semi-trusted application is for sharing the deciphered second secured data with a destination outside the security perimeter and wherein the semi-trusted application is not authorized to access stored secured data deciphered by the security layer from within the first set of folders;
accessing a first data file by the trusted application, the first data file forming at least a portion of the stored first secured data stored within the first set of folders;
using the trusted application, storing a second data file within the sharing folder, the second data file based on the first data file and forming at least a portion of the second secured data stored within the sharing folder;
accessing the second data file by the semi-trusted application, wherein the security layer deciphers the second data file when accessed by the semi-trusted application; and
using the semi-trusted application, sharing the deciphered second data file outside the security perimeter.
2. The method as defined in claim 1 wherein the first secured data comprises stored ciphered data secured with a cipher key.
3. The method as defined in claim 2 wherein the semi-trusted application is provided access to deciphered data from a ciphered data file by the security layer when the cipher data file is stored within the sharing folder and is other than provided access to a deciphered version of an exact same data file as the ciphered data file by the security layer when the exact same data is stored outside the sharing folder.
4. The method as defined in claim 3 wherein the security layer acts to decipher data for the trusted application and to only decipher data for the semi-trusted application when that data is stored within the sharing folder.
5. The method as defined in claim 1 wherein the security perimeter is a virtual security perimeter defining a virtual communication network having data secured therein.
6. The method as defined in claim 1 comprising:
generating a log entry upon storing of the second data file within the sharing folder by the trusted application.
7. A method according to claim 1 wherein storing the second data file within the sharing folder by the trusted application comprises:
requesting user authorization data,
verifying the user authorization data, and
in response to verifying the user authorization data, authorizing the storing operation.
8. A method comprising:
providing a security layer for maintaining security within a security perimeter;
providing a set of folders having secured data stored therein;
providing a trusted application for accessing stored secured data from within the set of folders, the stored secured data stored in a ciphered form and deciphered by the security layer when accessed by the trusted application and re-secured when stored by the trusted application, the security layer configured to not cipher data stored by the trusted application in a first predetermined file type;
providing a non-trusted application for accessing data stored in plain text and not for accessing data deciphered by the security layer;
accessing a first data file by the trusted application, the first data file forming at least a portion of the stored secured data and being a second predetermined file type, wherein the first predetermined data type is not the same as the second predetermined data type; and
using the trusted application, storing a second data file of the first predetermined file type, the second data file based on the first data file,
the security layer for securing the first data file when saved and for other than securing the second data file.
9. The method as defined in claim 8 comprising accessing the second data file by the non-trusted application.
10. The method as defined in claim 8 comprising verifying the storing of the second data file of the first predetermined file type against policy data to determine an authorization result, and in response to determining that the storing should not be authorized, preventing the storing of the second data file.
11. The method as defined in claim 10 wherein verifying comprises analyzing a content of the second data file against an expected content of the second data file.
12. The method as defined in claim 8 comprising, in response to storing the second data file of the first predetermined file type, generating a log entry.
13. The method as defined in claim 8 wherein the first predetermined file type is an exception defined by the security layer.