Information security systems and methods
Systems and methods for governing derived electronic resources are provided. In one embodiment, a digital resource is associated with one or more rules and a set of one or more computations, wherein the rules correspond to one or more conditions for accessing the digital resource and the computations operate upon the digital resource in order to provide a specific view of the digital resource that differs from the digital resource.
1. A method for governing the use of a digital resource, the method comprising:
receiving one or more programs associated with at least one user, wherein the one or more programs are configured to operate upon the digital resource when executed to generate a derived digital resource;
associating one or more rules with the digital resource, wherein the rules correspond to one or more conditions for accessing the digital resource;
associating the one or more programs with the digital resource; and
receiving a request to generate the derived digital resource from a system associated with the at least one user;
executing the one or more programs to generate the derived digital resource by performing at least one computation on information contained in the digital resource, wherein the at least one computation comprises a mathematical transformation performed on at least a portion of the digital resource, which transformation comprises calculating an average of the at least a portion of the digital resource and which obscures the at least a portion of the digital resource and the digital resource contains information that is not included in the generated derived digital resource, and wherein executing the one or more programs comprises enforcing the one or more conditions for accessing the digital resource in connection with execution of the one or more programs; and
transmitting the derived digital resource to the system associated with the at least one user.
2. The method of claim 1 , in which at least one program is associated with a set of users rather than an individual user.
3. The method of claim 2 , in which the set of users is specified by explicitly listing the users for whom the at least one program applies.
4. The method of claim 2 , in which the set of users is specified by providing an attribute common to the set of users, such that the at least one program is required for any user to whom said attribute applies.
5. The method of claim 1 , in which the generated derived resource is dependent upon at least one user, a set of users, or another principal to whom at least one program applies.
6. The method of claim 1 , further comprising:
receiving a new set of programs configured to operate upon the digital resource; and
receiving a request for associating the new set of programs with the digital resource.
7. The method of claim 6 , further comprising:
approving the request for associating the new set of programs with the digital resource.
8. The method of claim 1 , further comprising:
cryptographically associating the one or more programs with the digital resource.
9. The method of claim 8 , in which the association is made by creating a digitally signed document consisting of the pairing of a unique representation of the digital resource and a unique representation of the one or more programs to be associated with the digital resource.
10. The method of claim 9 , in which the representation of the digital resource is the result of applying a one-way function.
11. A method for governing the use of a digital resource, the method comprising:
receiving one or more programs associated with at least one user, wherein the one or more programs are configured to operate upon the digital resource when executed to generate a derived digital resource by performing at least one computation on information contained in the digital resource;
associating one or more rules with the digital resource, wherein the rules correspond to one or more conditions for accessing the digital resource;
associating the one or more programs with the digital resource; and
receiving a request to generate the derived digital resource from a system associated with the at least one user;
executing the one or more programs to generate the derived digital resource based on the digital resource, wherein the one or more programs comprise at least one computation that obscures at least a portion of the digital resource based in part on obfuscation information that is determined based on deterministic seed information such that a same principal receives a same generated derived digital resource, and the digital resource containing information that is not included in the generated derived digital resource, and wherein executing the one or more programs comprises enforcing the one or more conditions for accessing the digital resource in connection with execution of the one or more programs; and
transmitting the derived digital resource to the system associated with the at least one user.
12. The method of claim 11 , in which at least one program is associated with a set of users rather than an individual user.
13. The method of claim 12 , in which the set of users is specified by explicitly listing the users for whom the at least one program applies.
14. The method of claim 12 , in which the set of users is specified by providing an attribute common to the set of users, such that the at least one program is required for any user to whom said attribute applies.
15. The method of claim 11 , in which the generated derived resource is dependent upon at least one user, a set of users, or another principal to whom at least one program applies.
16. The method of claim 11 , further comprising:
receiving a new set of programs configured to operate upon the digital resource; and
receiving a request for associating the new set of programs with the digital resource.
17. The method of claim 16 , further comprising:
approving the request for associating the new set of programs with the digital resource.
18. The method of claim 11 , further comprising:
cryptographically associating the one or more programs with the digital resource.
19. The method of claim 18 , in which the association is made by creating a digitally signed document consisting of the pairing of a unique representation of the digital resource and a unique representation of the one or more programs to be associated with the digital resource.
20. The method of claim 19 , in which the representation of the digital resource is the result of applying a one-way function.
21. The method of claim 19 , in which the representation of the digital resource is a unique identifier associated with the digital resource.
22. The method of claim 21 , in which the unique identifier associated with the digital resource was assigned by a trusted third party.