Data protection using encryption and inserted execution code
Data protection techniques are provided that use encryption and inserted execution code. One method comprises obtaining, by a user device, a request from a user to access data, wherein the requested data comprises (i) an environment-based signature indicating an environment where the data can be accessed and (ii) execution code that interacts with a data protection agent; in response to the request to access the data: determining whether the user device comprises a data protection agent; and providing, via the data protection agent, the requested data based on an evaluation of an environment-based signature generated by the data protection agent relative to the environment-based signature included in the requested data. The requested data may be created by a given data protection agent that generates the environment-based signature using identifiers of hardware elements, software elements and/or network elements associated with a device that executes the given data protection agent.
1. A method, comprising:
obtaining, by a particular user device, at least one request from a user to access data, wherein the requested data is encrypted and comprises (i) a first environment-based signature indicating an environment where the data can be accessed and (ii) execution code that is used to determine whether at least one data protection agent is executing on the particular user device;
performing the following steps, in response to the at least one request to access the data:
executing the execution code, obtained from the requested data, on the particular user device to determine whether the particular user device comprises a first data protection agent executing on the particular user device;
deriving, by the first data protection agent executing on the particular user device, a decryption key based at least in part on the first environment-based signature included in the requested data to decrypt the encrypted requested data;
generating, by the first data protection agent executing on the particular user device, a second environment-based signature; and
providing, by the first data protection agent executing on the particular user device, the requested data to the user based at least in part on an evaluation of the second environment-based signature generated by the first data protection agent relative to the first environment-based signature included in the requested data;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 , wherein the requested data is created by a second data protection agent that generates the first environment-based signature using one or more identifiers of one or more of hardware elements, software elements and network elements associated with a device that executes the second data protection agent.
3. The method of claim 2 , further comprising, by the second data protection agent, encrypting at least a portion of the requested data using an encryption key based at least in part on one or more of the first environment-based signature and the second environment-based signature.
4. The method of claim 2 , further comprising, by the second data protection agent, digitally signing a file-dependent value associated with the requested data.
5. The method of claim 2 , wherein the second data protection agent comprises one or more of a same data protection agent and a different data protection agent relative to the first data protection agent.
6. The method of claim 1 , wherein the requested data further comprises a digital signature and further comprising, by the first data protection agent, verifying the digital signature.
7. The method of claim 1 , further comprising performing one or more automated remedial actions based at least in part on a result of one or more of (i) the determining the whether the particular user device comprises the first data protection agent and (ii) the evaluation of the second environment-based signature.
8. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps:
obtaining, by a particular user device, at least one request from a user to access data, wherein the requested data is encrypted and comprises (i) a first environment-based signature indicating an environment where the data can be accessed and (ii) execution code that is used to determine whether at least one data protection agent is executing on the particular user device;
performing the following steps, in response to the at least one request to access the data:
executing the execution code, obtained from the requested data, on the particular user device to determine whether the particular user device comprises a first data protection agent executing on the particular user device;
deriving, by the first data protection agent executing on the particular user device, a decryption key based at least in part on the first environment-based signature included in the requested data to decrypt the encrypted requested data;
generating, by the first data protection agent executing on the particular user device, a second environment-based signature; and
providing, by the first data protection agent executing on the particular user device, the requested data to the user based at least in part on an evaluation of the second environment-based signature generated by the first data protection agent relative to the first environment-based signature included in the requested data.
9. The apparatus of claim 8 , wherein the requested data is created by a second data protection agent that generates the first environment-based signature using one or more identifiers of one or more of hardware elements, software elements and network elements associated with a device that executes the second data protection agent.
10. The apparatus of claim 9 , further comprising, by the second data protection agent, encrypting at least a portion of the requested data using an encryption key based at least in part on one or more of the first environment-based signature and the second environment-based signature.
11. The apparatus of claim 9 , further comprising, by the second data protection agent, digitally signing a file-dependent value associated with the requested data.
12. The apparatus of claim 9 , wherein the second data protection agent comprises one or more of a same data protection agent and a different data protection agent relative to the first data protection agent.
13. The apparatus of claim 8 , wherein the requested data further comprises a digital signature and further comprising, by the first data protection agent, verifying the digital signature.
14. The apparatus of claim 8 , further comprising performing one or more automated remedial actions based at least in part on a result of one or more of (i) the determining the whether the particular user device comprises the first data protection agent and (ii) the evaluation of the second environment-based signature.
15. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
obtaining, by a particular user device, at least one request from a user to access data, wherein the requested data is encrypted and comprises (i) a first environment-based signature indicating an environment where the data can be accessed and (ii) execution code that is used to determine whether at least one data protection agent is executing on the particular user device;
performing the following steps, in response to the at least one request to access the data:
executing the execution code, obtained from the requested data, on the particular user device to determine whether the particular user device comprises a first data protection agent executing on the particular user device;
deriving, by the first data protection agent executing on the particular user device, a decryption key based at least in part on the first environment-based signature included in the requested data to decrypt the encrypted requested data;
generating, by the first data protection agent executing on the particular user device, a second environment-based signature; and
providing, by the first data protection agent executing on the particular user device, the requested data to the user based at least in part on an evaluation of the second environment-based signature generated by the first data protection agent relative to the first environment-based signature included in the requested data.
16. The non-transitory processor-readable storage medium of claim 15 , wherein the requested data is created by a second data protection agent that generates the first environment-based signature using one or more identifiers of one or more of hardware elements, software elements and network elements associated with a device that executes the second data protection agent.
17. The non-transitory processor-readable storage medium of claim 16 , further comprising, by the second data protection agent, encrypting at least a portion of the requested data using an encryption key based at least in part on one or more of the first environment-based signature and the second environment-based signature.
18. The non-transitory processor-readable storage medium of claim 16 , further comprising, by the second data protection agent, digitally signing a file-dependent value associated with the requested data.
19. The non-transitory processor-readable storage medium of claim 15 , wherein the requested data further comprises a digital signature and further comprising, by the first data protection agent, verifying the digital signature.
20. The non-transitory processor-readable storage medium of claim 15 , further comprising performing one or more automated remedial actions based at least in part on a result of one or more of (i) the determining the whether the particular user device comprises the first data protection agent and (ii) the evaluation of the second environment-based signature.