Digital data asset protection policy using dynamic network attributes
Various systems and methods for determining whether to allow or continue to allow access to a protected data asset are disclosed herein. For example, one method involves receiving a request to access a protected data asset, wherein the request is received from a first user device; determining whether to grant access to the protected data asset, wherein the determining comprises evaluating one or more criteria associated with the first user device, and the criteria comprises first information associated with a first policy constraint; and in response to a determination that access to the protected data asset is to be granted, granting access to the protected data asset.
1. A method comprising:
receiving a request to access a protected data asset, wherein
the request is received from a first user device, and
a member of a first user group has logged into the first user device;
determining whether to grant access to the protected data asset, wherein
the determining comprises
evaluating first location information describing a first location associated with the first user device and first user group information describing the first user group,
evaluating confirmation location information describing a confirmation location associated with a second user device associated with the member of the first user group, and
evaluating second location information describing a second location associated with a third user device and second user group information describing a second user group associated with the third user device, wherein
a member of a second user group has logged into the third user device, and
the second user group has a different permission level than the first user group, and
in response to evaluating the first location information, the first user group information, the second location information, the second user group information, and the confirmation location information, determining whether the member of the first user group has permission to access the protected data asset from the first location;
in response to a determination that the member of the first user group has permission to access the protected data asset from the first location, granting access to the protected data asset;
subsequent to the granting the access, receiving updated location information describing a new location, wherein
the new location is associated with at least one of the first user device and the second user device; and
in response to receiving the updated location information, revoking access to the protected data asset, wherein
the access is revoked in response to determining that the member of the first user group does not have permission to access the protected data asset from the new location.
2. The method of claim 1 , wherein
the first location information indicates a geographic location of the first user device, and
the confirmation location information indicates a geographic location of the third user device.
3. The method of claim 2 , wherein
a plurality of user groups comprises the first user group and the second user group,
the first user group is associated with a first plurality of locations,
the second user group is associated with a second plurality of locations, and
the first plurality of locations is not identical to the second plurality of locations.
4. The method of claim 1 , wherein
the protected data asset is encrypted, and
the granting access comprises providing decryption information for the protected data asset.
5. The method of claim 1 , wherein
the access to the protected data asset is granted to the first user device but access to the protected data asset is denied to at least a fourth user device.
6. The method of claim 1 , wherein
the access is limited to a predetermined time period.
7. The method of claim 1 , further comprising:
subsequent to the granting access,
receiving the updated location information from at least one of the first user device, the second user device, or the third user device, and
using the updated location information to determine whether to revoke access to the protected data asset.
8. A system comprising:
a microprocessor; and
a non-transient computer-readable storage medium, comprising computer instructions executable by the microprocessor, wherein the computer instructions are configured to perform a method comprising the steps of:
receiving a request to access a protected data asset, wherein
the request is received from a first user device, and
a member of a first user group has logged into the first user device;
determining whether to grant access to the protected data asset, wherein
the determining comprises
evaluating first location information describing a first location associated with the first user device and first user group information describing the first user group,
evaluating confirmation location information describing a confirmation location associated with a second user device associated with the member of the first user group, and
evaluating second location information describing a second location associated with a third user device and second user group information describing a second user group associated with the third user device, wherein
a member of a second user group has logged into the third user device, and
the second user group has a different permission level than the first user group, and
in response to evaluating the first location information, the first user group information, the second location information, the second user group information, and the confirmation location information, determining whether the member of the first user group has permission to access the protected data asset from the first location;
in response to a determination that the member of the first user group has permission to access the protected data asset from the first location, granting access to the protected data asset;
subsequent to the granting the access, receiving updated location information describing a new location, wherein
the new location is associated with at least one of the first user device and the second user device; and
in response to receiving the updated location information, revoking access to the protected data asset, wherein
the access is revoked in response to determining that the member of the first user group does not have permission to access the protected data asset from the new location.
9. The system of claim 8 , wherein
the first location information indicates a geographic location of the first user device, and
the confirmation location information indicates a geographic location of the third user device.
10. The system of claim 9 , wherein
a plurality of user groups comprises the first user group and the second user group,
the first user group is associated with a first plurality of locations,
the second user group is associated with a second plurality of locations, and
the first plurality of locations is not identical to the second plurality of locations.
11. The system of claim 8 , wherein
the protected data asset is encrypted, and
the granting access comprises providing decryption information for the protected data asset.
12. The system of claim 8 , wherein
the access to the protected data asset is granted to the first user device but access to the protected data asset is denied to at least a fourth user device.
13. The system of claim 8 , wherein
the access is limited to a predetermined time period.
14. The system of claim 8 , wherein the method further comprises the steps of:
subsequent to the granting access,
receiving the updated location information from at least one of the first user device, the second user device, or the third user device, and
using the updated location information to determine whether to revoke access to the protected data asset.
15. A computer program product, comprising a plurality of instructions stored on a non-transient computer-readable storage medium, wherein the instructions are configured to execute a method comprising the steps of:
receiving a request to access a protected data asset, wherein
the request is received from a first user device, and
a member of a first user group has logged into the first user device;
determining whether to grant access to the protected data asset, wherein
the determining comprises
evaluating first location information describing a first location associated with the first user device and first user group information describing the first user group,
evaluating confirmation location information describing a confirmation location associated with a second user device associated with the member of the first user group, and
evaluating second location information describing a second location associated with a third user device and second user group information describing a second user group associated with the third user device, wherein
a member of a second user group has logged into the third user device, and
the second user group has a different permission level than the first user group, and
in response to evaluating the first location information, the first user group information, the second location information, the second user group information, and the confirmation location information, determining whether the member of the first user group has permission to access the protected data asset from the first location;
in response to a determination that the member of the first user group has permission to access the protected data asset from the first location, granting access to the protected data asset;
subsequent to the granting the access, receiving updated location information describing a new location, wherein
the new location is associated with at least one of the first user device and the second user device; and
in response to receiving the updated location information, revoking access to the protected data asset, wherein
the access is revoked in response to determining that the member of the first user group does not have permission to access the protected data asset from the new location.
16. The computer program product of claim 15 , wherein
the first location information indicates a geographic location of the first user device, and
the confirmation location information indicates a geographic location of the third user device.
17. The computer program product of claim 16 , wherein
a plurality of user groups comprises the first user group and the second user group, the first user group is associated with a first plurality of locations,
the second user group is associated with a second plurality of locations, and
the first plurality of locations is not identical to the second plurality of locations.
18. The computer program product of claim 15 , wherein
the protected data asset is encrypted, and
the granting access comprises providing decryption information for the protected data asset.
19. The computer program product of claim 15 , wherein
the access to the protected data asset is granted to the first user device but access to the protected data asset is denied to at least a fourth user device; and
the access is limited to a predetermined time period.
20. The computer program product of claim 15 , wherein the method further comprises the steps of:
subsequent to the granting access,
receiving the updated location information from at least one of the first user device, the second user device, or the third user device, and
using the updated location information to determine whether to revoke access to the protected data asset.