Data access control systems and methods
Various hardware and software configurations are described herein which provide improved security and control over protected data. In some embodiments, a computer includes a main motherboard card coupled to all input/output devices connected to the computer, and a trusted operating system operates on the main motherboard which includes an access control module for controlling access to the protected data in accordance with rules. The trusted operating system stores the protected data in an unprotected form only on the memory devices on the main motherboard. The computer may also have a computer card coupled to the main motherboard via a PCI bus, on which is operating a guest operating system session for handling requests for data from software applications on the computer. A tamper detection mechanism is provided in the computer for protecting against attempts to copy the unprotected form of the protected data onto memory devices other than the one or more memory devices used by the motherboard or computer card.
1. A method for controlling access to protected content or data, the method comprising:
receiving, at a computer device from a remote user device, a request to access the protected content or data, wherein the request comprises—
credentials associated with the remote user device and a user, the credentials including a user identifier associated with the user of the remote user device and a network resource identifier; and
an indication of an electronic ticket granted to the user, wherein the electronic ticket is separate from the credentials, and wherein the electronic ticket defines access control rules, the access control rules including a time range rule and at least one of a network resource rule or a user identifier rule;
comparing, at the computer device, as defined by the access control rules, the access control rules with (a) a time associated with the received request, and (b) the user identifier from the credentials and/or the network resource identifier from the credentials; and
determining, at the computer device, whether the request to access the protected content or data should be granted based on a result of the comparing,
wherein—
when it is determined that the request should be granted, enabling access to the protected content or data, and
when it is determined that the request should not be granted, denying access to the protected content or data.
2. The method of claim 1 wherein the electronic ticket is a first version of the electronic ticket and wherein the method further comprises:
retrieving, at the computer device, a second version of the electronic ticket,
wherein the second version of the electronic ticket is stored in a portion of memory that is not accessible by the remote user device when access is granted and further includes state information associated with the second version of the electronic ticket that is not in the first version of the electronic ticket.
3. The method of claim 2 , further comprising:
determining, at the computer device, in response to the request, that the first version of the electronic ticket is valid based on the state information.
4. The method of claim 1 wherein the access control rules include both the user identifier rule and the network resource rule.
5. The method of claim 1 wherein the received request is encrypted using a public key associated with the computer device, and wherein the method further comprises:
decrypting, by the computer device, the received request using a private key stored in a portion of memory that is not accessible to the remote user device when access is granted.
6. The method of claim 1 wherein the network resource identifier further comprises a file sharing protocol identifier and a document identifier.
7. The method of claim 1 wherein enabling access to the protected content or data includes enabling an input or output hardware device on the remote user device to access the protected content or data.
8. The method of claim 1 wherein the protected content or data is encrypted, and wherein enabling access to the protected content or data includes providing one or more decryption keys to the remote user device.
9. The method of claim 1 , further comprising recording the request to access the protected content or data in an audit log at the computer device.
10. A non-transitory computer-readable storage medium storing content that, when executed by a computer device, causes the computer device to perform operations for protecting data, the operations comprising:
receiving, from a remote user device, a request to access protected content or data on the computer device, wherein the request comprises—
credentials associated with the remote user device and a user, the credentials including a user identifier associated with the user of the remote user device and a network resource identifier; and
an indication of an electronic ticket granted to the user, wherein the electronic ticket is separate from the credentials, and wherein the electronic ticket defines access control rules, the access control rules including a time range rule, a user identifier rule, and a network resource rule;
comparing as defined by the access control rules, the access control rules with (a) a time associated with the received request, and (b) at least one of (i) the user identifier from the credentials or (ii) the network resource identifier from the credentials; and
determining whether the request to access the protected content or data should be granted based on a result of the comparing,
wherein—
when it is determined that the request should be granted, enabling access to the protected content or data, and
when it is determined that the request should not be granted, denying access to the protected content or data.
11. The non-transitory computer-readable storage medium of claim 10 wherein the electronic ticket is a first version of the electronic ticket and wherein the operations further comprise:
retrieving, at the computer device, a second version of the electronic ticket, wherein the second version of the electronic ticket is stored in a portion of memory that is not accessible by the remote user device when access is granted and further includes state information associated with the second version of the electronic ticket that is not in the first version of the electronic ticket.
12. The non-transitory computer-readable storage medium of claim 11 wherein the operations further comprise:
determining, at the computer device, in response to the request, that the electronic ticket granted to the user is valid based on the state information.
13. The non-transitory computer-readable storage medium of claim 10 wherein enabling access to the protected content or data includes disabling access to one or more hardware devices at the computer device.
14. The non-transitory computer-readable storage medium of claim 10 wherein the user identifier comprises an IP address of the remote user device, wherein the user identifier rule comprises an IP address range, and wherein comparing the user identifier and the access control rules further comprises determining if the IP address of the remote user device is within the IP address range.
15. The non-transitory computer-readable storage medium of claim 10 wherein the network resource identifier further comprises a file sharing protocol identifier and a document identifier.
16. The non-transitory computer-readable storage medium of claim 10 wherein enabling access to the protected content or data further comprises transmitting the received request to a server computing device associated with the network resource identifier.
17. A computing system, comprising:
one or more processors;
at least one memory; and
an access control component configured to perform operations for protecting data, the operations comprising—
receiving, at the computing system and from a remote device, a request to access protected content or data, wherein the request comprises:
credentials associated with the remote device and a user of the remote device, the credentials including a user identifier and a network resource identifier; and
an indication of an electronic ticket granted to the user, wherein the electronic ticket is separate from the credentials, and wherein the electronic ticket defines access control rules, the access control rules including a time range rule, a user identifier rule, and a network resource rule;
comparing, at the computing system, as defined by the access control rules, the access control rules with (a) a time associated with the received request, and (b) the user identifier from the credentials and/or the network resource identifier from the credentials; and
determining, at the computing system, whether the request to access the protected content or data should be granted based on a result of the comparing,
wherein—
when it is determined that the request should be granted, enabling access to the protected content or data on the computing system, and
when it is determined that the request should not be granted, denying access to the protected content or data or data on the computing system.
18. The computing system of claim 17 wherein the electronic ticket is a first version of an electronic ticket, wherein the operations further comprise retrieving a second version of the electronic ticket, and wherein the second version of the electronic ticket is stored in a portion of the at least one memory that is not accessible by the remote user device when access is granted and further includes state information associated with the second version of the electronic ticket that is not in the first version of the electronic ticket.
19. The computing system of claim 18 wherein the operations further comprise determining that the electronic ticket granted to the user is valid based on the state information.
20. The computing system of claim 17 wherein enabling access to the protected content or data includes disabling an input or output hardware device on the remote device from accessing the protected content or data.