Secure data management in a network computing environment
Techniques are provided for secure data management in a network computing environment. A security management system receives data from a device which operates in a device network that is managed by the security management system. The security management system performs a data classification process to determine a data sensitivity level of the received data. The security management system determines a type of encryption to apply to the received data based on the determined data sensitivity level. The type of encryption is determined from a plurality of different types of encryption that are supported by a cloud system. The security management system sends the received data to the cloud system to at least one of store the data and perform secured data analytic processing of the data, in a format according to the determined type of encryption.
1. A method, comprising:
communicating, by a security management system, with a cloud system to determine different types of data encryption services and secured data analytic services offered by the cloud system;
mapping, by the security management system, a plurality of different data sensitivity levels to respective ones of the data encryption services and the secured data analytic services determined to be offered by the cloud system, wherein the plurality of different data sensitivity levels comprises at least (i) a first sensitivity level, (ii) a second sensitivity level which is greater than the first sensitivity level, and (iii) a non-sensitive level;
receiving, by the security management system, data from a device which operates in a device network that is managed by the security management system;
performing, by the security management system, a data classification process to determine a given data sensitivity level of the received data, wherein the given data sensitivity level comprises one of the plurality of different data sensitivity levels;
determining, by the security management system, at least one of a data encryption service and a secured data analytic service mapped to the determined data sensitivity level of the received data; and
sending, by the security management system, the received data to the cloud system for at least one of (i) storing the data in an encrypted format and (ii) performing secured data analytic processing of the data, utilizing the at least one of the data encryption service and the secured data analytic service mapped to the given data sensitivity level of the received data.
2. The method of claim 1 , wherein the security management system is implemented in an edge computing system of an Internet of Things (IoT) device network.
3. The method of claim 1 , wherein performing the data classification process comprises utilizing, by the security management system, a set of security policies to determine the given data sensitivity level of the received data according to one or more security policies of the set of security policies.
4. The method of claim 3 , wherein the set of security policies include security rules that are at least one of user-defined and automatically generated by the security management system.
5. The method of claim 1 , wherein performing the data classification process comprises utilizing, by the security management system, data analytics usage information, which is derived by tracking data analytic jobs performed in the cloud system, to determine the given data sensitivity level of the received data based at least in part on the data analytics usage information.
6. The method of claim 1 , wherein the plurality of different data sensitivity levels further comprises at least one additional sensitivity level, which is different from each of the first sensitivity level, the second sensitivity level and the non-sensitive level.
7. The method of claim 1 , further comprising encrypting, by security management system, the received data according to a type of encryption which corresponds to the at least one of the data encryption service and the secured data analytic service mapped to the given data sensitivity level of the received data, prior to sending the received data to the cloud system.
8. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code is executable by one or more processors to implement a method comprising:
communicating, by a security management system, with a cloud system to determine different types of data encryption services and secured data analytic services offered by the cloud system;
mapping, by the security management system, a plurality of different data sensitivity levels to respective ones of the data encryption services and the secured data analytic services determined to be offered by the cloud system, wherein the plurality of different data sensitivity levels comprises at least (i) a first sensitivity level, (ii) a second sensitivity level which is greater than the first sensitivity level, and (iii) a non-sensitive level;
receiving, by the security management system, data from a device which operates in a device network that is managed by the security management system;
performing, by the security management system, a data classification process to determine a given data sensitivity level of the received data, wherein the given data sensitivity level comprises one of the plurality of different data sensitivity levels;
determining, by the security management system, at least one of a data encryption service and a secured data analytic service mapped to the determined data sensitivity level of the received data; and
sending, by the security management system, the received data to the cloud system for at least one of (i) storing the data in an encrypted format and (ii) performing secured data analytic processing of the data, utilizing the at least one of the data encryption service and the secured data analytic service mapped to the given data sensitivity level of the received data.
9. The article of manufacture of claim 8 , wherein the security management system is implemented in an edge computing system of an Internet of Things (IoT) device network.
10. The article of manufacture of claim 8 , wherein the program code for performing the data classification process comprises program code that is executable by the one or more processors to perform a method which comprises utilizing, by the security management system, a set of security policies to determine the given data sensitivity level of the received data according to one or more security policies of the set of security policies.
11. The article of manufacture of claim 10 , wherein the set of security policies include security rules that are at least one of user-defined and automatically generated by the security management system.
12. The article of manufacture of claim 8 , wherein the program code for performing the data classification process comprises program code that is executable by the one or more processors to perform a method which comprises utilizing, by the security management system, data analytics usage information, which is derived by tracking data analytic jobs performed in the cloud system, to determine the given data sensitivity level of the received data based at least in part on the data analytics usage information.
13. The article of manufacture of claim 8 , wherein the plurality of different data sensitivity levels further comprises at least one additional sensitivity level, which is different from each of the first sensitivity level, the second sensitivity level and the non-sensitive level.
14. The article of manufacture of claim 8 , further comprising program code that is executable by the one or more processors to perform a method which comprises encrypting, by security management system, the received data according to a type of encryption which corresponds to the at least one of the data encryption service and the secured data analytic service mapped to the given data sensitivity level of the received data, prior to sending the received data to the cloud system.
15. A system, comprising:
at least one processor; and
a system memory configured to store program code, wherein the program code is executable by the at least one processor to instantiate a security management system to manage a device network, wherein the security management system is configured to:
communicate with a cloud system to determine different types of data encryption services and secured data analytic services offered by the cloud system;
map a plurality of different data sensitivity levels to respective ones of the data encryption services and the secured data analytic services determined to be offered by the cloud system, wherein the plurality of different data sensitivity levels comprises at least (i) a first sensitivity level, (ii) a second sensitivity level which is greater than the first sensitivity level, and (iii) a non-sensitive level;
receive data from a device which operates in a device network that is managed by the security management system;
perform a data classification process to determine a given data sensitivity level of the received data, wherein the given data sensitivity level comprises one of the plurality of different data sensitivity levels;
determine at least one of a data encryption service and a secured data analytic service mapped to the determined data sensitivity level of the received data; and
send the received data to the cloud system for at least one of (i) storing the data in an encrypted format and (ii) performing secured data analytic processing of the data, utilizing the at least one of the data encryption service and the secured data analytic service mapped to the given data sensitivity level of the received data.
16. The system of claim 15 , wherein the security management system is implemented in an edge computing system of an Internet of Things (IoT) device network.
17. The system of claim 15 , wherein in performing the data classification process, the security management system is configured to utilize a set of security policies to determine the given data sensitivity level of the received data according to one or more security policies of the set of security policies, wherein the set of security policies include security rules that are at least one of user-defined and automatically generated by the security management system.
18. The system of claim 15 , wherein in performing the data classification process, the security management system is configured to utilize data analytics usage information, which is derived by tracking data analytic jobs performed in the cloud system, to determine the given data sensitivity level of the received data based at least in part on the data analytics usage information.
19. The system of claim 15 , wherein the plurality of different data sensitivity levels further comprises at least one additional sensitivity level, which is different from each of the first sensitivity level, the second sensitivity level and the non-sensitive level.
20. The system of claim 15 , wherein the security management system is further configured to encrypt the received data according to a type of encryption which corresponds to the at least one of the data encryption service and the secured data analytic service mapped to the given data sensitivity level of the received data, prior to sending the received data to the cloud system.