Stateful access control of data
An intermediate device enforces security rules on cloud data accesses. Network traffic between a client application and a cloud application is routed to the intermediate device. The intermediate device tags data that is stored in the cloud application in order to track the data and encrypts the data including the tags such that the intermediate device can only decrypt the encrypted data and tags in one or more trusted zones. The cloud application stores the encrypted data. When a data request is received by the intermediate device, the intermediate device uses a set of rules to decide whether the requesting user is allowed access to the data from the cloud application.
1 . A method, comprising:
receiving, by an intermediate device, a data storage request from a first user device across a network, the data storage request requesting a cloud application to store data included in the data storage request;
inserting, by the intermediate device, tag information in the data in the data storage request, wherein the tag information includes information associated with any combination of: data source identification, user identification, user device identification, or user device location;
encrypting, by the intermediate device, the data including the tag information, the data including the tag information encrypted by the intermediate device using a key that is available only within one or more specific trusted zones;
forwarding, by the intermediate device, the data storage request with the encrypted data to the cloud application, the cloud application stores the encrypted data;
wherein the tag information is used to determine whether a second user device has permission to access the data.
2 . The method as recited in claim 1 , further comprising:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, whether the second user device has permission to access the decrypted data using the stored information and the tag information.
3 . The method as recited in claim 1 , further comprising:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, whether the second user device has permission to access the decrypted data using the stored information and the tag information;
upon determining that the second user device has permission to access the decrypted data, sending, by the intermediate device, a message to the second user device that includes the decrypted data with the tag information removed.
4 . The method as recited in claim 1 , further comprising:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, whether the second user device has permission to access the decrypted data using the stored information and the tag information;
upon determining that the second user device does not have permission to access the decrypted data, sending, by the intermediate device, a message to the second user device denying the application data request.
5 . The method as recited in claim 1 , further comprising:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules;
applying, by the intermediate device, the one or more access rules to the stored information and the tag information to determine whether the second user device has permission to access the decrypted data.
6 . The method as recited in claim 1 , further comprising:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules;
determining, by the intermediate device, one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules, the one or more access rules define the one or more specific trusted zones where the decrypted data may be accessed;
applying, by the intermediate device, the one or more access rules to the stored information and the tag information to determine whether the second user device has permission to access the decrypted data.
7 . One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of:
receiving, by the intermediate device, a data storage request from a first user device across a network, the data storage request requesting a cloud application to store data included in the data storage request;
inserting, by the intermediate device, tag information in the data in the data storage request, wherein the tag information includes information associated with any combination of: data source identification, user identification, user device identification, or user device location;
encrypting, by the intermediate device, the data including the tag information, the data including the tag information encrypted by the intermediate device using a key that is available only within one or more specific trusted zones;
forwarding, by the intermediate device, the data storage request with the encrypted data to the cloud application, the cloud application stores the encrypted data;
wherein the tag information is used to determine whether a second user device has permission to access the data.
8 . The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the one or more sequences of instructions, which when executed by one or more processors cause further performance of:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, whether the second user device has permission to access the decrypted data using the stored information and the tag information.
9 . The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the one or more sequences of instructions, which when executed by one or more processors cause further performance of:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, whether the second user device has permission to access the decrypted data using the stored information and the tag information;
upon determining that the second user device has permission to access the decrypted data, sending, by the intermediate device, a message to the second user device that includes the decrypted data with the tag information removed.
10 . The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the one or more sequences of instructions, which when executed by one or more processors cause further performance of:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, whether the second user device has permission to access the decrypted data using the stored information and the tag information;
upon determining that the second user device does not have permission to access the decrypted data, sending, by the intermediate device, a message to the second user device denying the application data request.
11 . The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the one or more sequences of instructions, which when executed by one or more processors cause further performance of:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules;
applying, by the intermediate device, the one or more access rules to the stored information and the tag information to determine whether the second user device has permission to access the decrypted data.
12 . The one or more non-transitory computer-readable storage media as recited in claim 7 , wherein the one or more sequences of instructions, which when executed by one or more processors cause further performance of:
receiving, by the intermediate device, an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing, by the intermediate device, information associated with the application data request;
forwarding, by the intermediate device, the application data request to the cloud application;
receiving, by the intermediate device, a response message that includes the encrypted data from the cloud application;
decrypting, by the intermediate device, the encrypted data from the response message;
extracting, by the intermediate device, the tag information from the decrypted data;
determining, by the intermediate device, one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules;
determining, by the intermediate device, one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules, the one or more access rules define the one or more trusted zones where the decrypted data may be accessed;
applying, by the intermediate device, the one or more access rules to the stored information and the tag information to determine whether the second user device has permission to access the decrypted data.
13 . An apparatus, comprising:
one or more processors; and
a memory storing instructions, which when executed by the one or more processors, cause the one or more processors to perform:
receiving a data storage request from a first user device across a network, the data storage request requesting a cloud application to store data included in the data storage request;
inserting tag information in the data in the data storage request, wherein the tag information includes information associated with any combination of: data source identification, user identification, user device identification, or user device location;
encrypting the data including the tag information, the data including the tag information encrypted by the apparatus using a key that is available only within one or more specific trusted zones;
forwarding the data storage request with the encrypted data to the cloud application, the cloud application stores the encrypted data;
wherein the tag information is used to determine whether a second user device has permission to access the data.
14 . The apparatus as recited in claim 13 , wherein the instructions, which when executed by the one or more processors, cause the one or more processors to further perform:
receiving an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing information associated with the application data request;
forwarding the application data request to the cloud application;
receiving a response message that includes the encrypted data from the cloud application;
decrypting the encrypted data from the response message;
extracting the tag information from the decrypted data;
determining whether the second user device has permission to access the decrypted data using the stored information and the tag information.
15 . The apparatus as recited in claim 13 , wherein the instructions, which when executed by the one or more processors, cause the one or more processors to further perform:
receiving an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing information associated with the application data request;
forwarding the application data request to the cloud application;
receiving a response message that includes the encrypted data from the cloud application;
decrypting the encrypted data from the response message;
extracting the tag information from the decrypted data;
determining whether the second user device has permission to access the decrypted data using the stored information and the tag information;
upon determining that the second user device has permission to access the decrypted data, sending a message to the second user device that includes the decrypted data with the tag information removed.
16 . The apparatus as recited in claim 13 , wherein the instructions, which when executed by the one or more processors, cause the one or more processors to further perform:
receiving an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing information associated with the application data request;
forwarding the application data request to the cloud application;
receiving a response message that includes the encrypted data from the cloud application;
decrypting the encrypted data from the response message;
extracting the tag information from the decrypted data;
determining whether the second user device has permission to access the decrypted data using the stored information and the tag information;
upon determining that the second user device does not have permission to access the decrypted data, sending a message to the second user device denying the application data request.
17 . The apparatus as recited in claim 13 , wherein the instructions, which when executed by the one or more processors, cause the one or more processors to further perform:
receiving an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing information associated with the application data request;
forwarding the application data request to the cloud application;
receiving a response message that includes the encrypted data from the cloud application;
decrypting the encrypted data from the response message;
extracting the tag information from the decrypted data;
determining one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules;
applying the one or more access rules to the stored information and the tag information to determine whether the second user device has permission to access the decrypted data.
18 . The apparatus as recited in claim 13 , wherein the instructions, which when executed by the one or more processors, cause the one or more processors to further perform:
receiving an application data request from a second user device across the network, the application data request requesting the encrypted data from the cloud application;
storing information associated with the application data request;
forwarding the application data request to the cloud application;
receiving a response message that includes the encrypted data from the cloud application;
decrypting the encrypted data from the response message;
extracting the tag information from the decrypted data;
determining one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules;
determining one or more access rules for the application data request by matching a pattern in the application data request with a pattern associated with one or more access rules among a plurality of access rules, the one or more access rules define the one or more specific trusted zones where the decrypted data may be accessed;
applying the one or more access rules to the stored information and the tag information to determine whether the second user device has permission to access the decrypted data.