System-level data security based on environmental properties
Data is frequently protected by securing the data within containers that are only accessible using a specific security application. Once such data is transferred, all protections provided by the security application are lost. Methods and systems provide secured access to data by intercepting requests for access to a data files accessed via an IHS (Information Handling System) by applications operating within the operating system of the IHS. Based on condition settings stored in the data files, access privileges are determined for applications. The conditions settings include environmental conditions required for providing access to the data. If the IHS satisfies the environmental conditions specified by a data file, access to the data file may be granted. The data requests may be intercepted by a kernel process of the operating system of the IHS. The environmental conditions may specify requirements on the networks, display devices and/or software utilized by the IHS.
1. An Information Handling System (IHS) configured to support data security based on environmental properties, the IHS comprising:
one or more processors;
a data storage device storing a plurality of data files, wherein each of the data files comprise access conditions that are part of a respective data file and that specify a plurality of environmental conditions required for providing access to data stored in the respective data file, wherein the environment conditions specify one or more software applications other than a requesting software application that must be running on the IHS in order to access the data stored in the respective data file; and
a memory device coupled to the one or more processors, the memory device storing computer-readable instructions that, upon execution by the one or more processors, cause the IHS to:
intercept a request from the requesting software application for access to a first data file of the plurality of data files stored on the data storage device, wherein the request from the requesting software application is intercepted by a protected kernel process;
determine whether the environmental conditions required for accessing the data in the first data file are satisfied, wherein the environment conditions are specified in the access conditions that are part of the first data file, wherein the environmental conditions required for providing access to the data of the respective data file specify a specific version of the protected kernel process that must be utilized in order to access the data stored in the respective data file; and
provide the requesting software application with access to the data stored in the first data file, when the software applications other than the requesting software application are confirmed as running on the IHS.
2. The IHS of claim 1 , wherein the data storage device is formatted using a file system that provides access to the plurality of data files and that queries the access conditions that are part of each of the data files in order to determine whether the environmental conditions required for accessing the data in each data file are satisfied.
3. The IHS of claim 1 , wherein the environmental conditions required for providing access to the data stored in the respective data file specify a type of network that must be used by the requesting software application in order to access the data stored in the respective data file.
4. The IHS of claim 1 , wherein the one or more software applications other than a requesting software application that must be running on the IHS in order to access the data stored in the respective data file comprise a specific security application that must be running on the IHS.
5. A method for providing secured access to data via an Information Handling System (IHS), the method comprising:
intercepting a request from the requesting software application for access to a data file accessed via the IHS, wherein the request is intercepted by a kernel process of the IHS;
determining a plurality of conditions for accessing data of the data file by querying access conditions that are part of the data file that specify a plurality of environmental conditions required for providing access to the data stored in the data file, wherein the environment conditions specify one or more software applications other than the requesting software application that must be running on the IHS in order to access the data stored in the data file, wherein the environmental conditions required for providing access to the data file comprise requiring a specific version of the kernel process to be used in order to access the data file;
determining whether the environmental conditions required for accessing the data in the data file are satisfied, wherein the environment conditions are specified in the access conditions that are part of the data file; and
providing the requesting software application with access to the data stored in the data file, when the software applications other than the requesting software application are confirmed as running on the IHS.
6. The method of claim 5 , wherein the data file is stored in a data storage device that is formatted using a file system that provides access to the plurality of data files and that queries the access conditions that are part of each data file in order to determine whether the environmental conditions required for accessing the data in each data file are satisfied.
7. The method of claim 5 , wherein the version of the kernel process is determined based on a signature calculated from a plurality of files that comprise the kernel process.
8. The method of claim 5 , wherein the environmental conditions required for providing access to the data of the data file specify a type of network that must be used by the requesting software application in order to access the data of the data file.
9. The method of claim 5 , wherein the one or more software applications other than a requesting software application that must be running on the IHS in order to access the data stored in the respective data file comprise a specific security application that must be running on the IHS.
10. The method of claim 5 , wherein the environmental conditions required for providing access to the data stored in the data file further comprise conditions requiring the IHS use a single display device.
11. A computer-readable storage device having instructions stored thereon for providing secured access to data stored by an a first IHS (Information Handling System), wherein execution of the instructions by one or more processors of the first IHS causes the one or more processors to:
intercept a request from the requesting software application for access to a data file stored by a data storage device of the first IHS, wherein the request is intercepted by a kernel process running on the first IHS;
determine a plurality of environmental conditions for accessing data stored in the data file by querying access conditions that are part of the data file that specify one or more software applications other than the requesting software application that must be running on the IHS in order to access the data stored in the data file, wherein the environmental conditions required for providing access to the data file comprise requiring a specific version of the kernel process to be used in order to access the data file;
when the environmental conditions specified in the access conditions that are part of the data file are not satisfied, determine remediation procedures that will result in the environmental conditions being satisfied; and
present the remediation procedures to a user of the first IHS, wherein the remediation procedures comprise initiating the one or more software applications other than the requesting software application that must be running on the IHS in order to access the data stored in the data file.
12. The computer-readable storage device of claim 11 , wherein the data storage device is formatted using a file system that provides access to the plurality of data files and that queries the access conditions that are part of each file in order to determine whether the environmental conditions required for accessing the data in the data files are satisfied.
13. The computer-readable storage device of claim 11 , wherein the version of the kernel process is determined based on a signature calculated from a plurality of files that comprise the kernel process.
14. The computer-readable storage device of claim 11 , wherein the environmental conditions required for providing access to the data file specify a type of network that must be used by the requesting software application in order to access the first data file.
15. The computer-readable storage device of claim 12 , wherein the request is intercepted by a driver used to interface with the data storage device that is formatted to query the access conditions that are part of the data files.
16. The computer-readable storage device of claim 11 , wherein the environmental conditions required for providing access to the data stored in the data file further require the first IHS to utilize a single display device.
17. The computer-readable storage device of claim 11 , wherein the one or more software applications other than a requesting software application that must be running on the first IHS in order to access the data stored in the respective data file comprise a specific anti-virus application that must running in the operating system of the first IHS.