Systems and methods for data lifecycle protection

1. A method for metadata processing in a computer system, the method comprising acts of:

receiving application data and associated first metadata, wherein the computer system includes a host processor configured to use the application data;

identifying one or more first policies according to which the first metadata was created;

determining, based at least in part on the one or more first policies identified, whether the first metadata is compatible with one or more second policies being enforced in the computer system; and

in response to determining that the first metadata is not compatible with the one or more second policies being enforced in the computer system, processing the first metadata to obtain second metadata to be associated with the application data for use in enforcing the one or more second policies in the computer system.

2. The method of claim 1 , wherein:

the method further comprises an act of obtaining a mapping to transform metadata for the one or more first policy into metadata for the one or more second policy; and

the second metadata is obtained at least in part by applying the mapping to the first metadata.

3. The method of claim 2 , wherein:

the one or more first policies comprise a first policy;

the one or more second policies comprise a second policy;

the act of obtaining a mapping to transform metadata for the one or more first policy into metadata for the one or more second policy comprises:

determining whether the first policy is a newer version of the second policy; and

in response to determining that the first policy is a newer version of the second policy, querying a server for a mapping to transform metadata for the first policy into metadata for the second policy.

4. The method of claim 1 , wherein:

the first metadata is received in encrypted form; and

the act of processing the first metadata comprises:

decrypting the first metadata to produce first metadata in decrypted form, and

processing the first metadata in decrypted form to obtain the second metadata.

5. The method of claim 1 , further comprising acts of:

receiving a cryptographic signature corresponding to the application data and the first metadata;

determining whether the application data and the first metadata are correctly bound to each other, comprising:

using a cryptograph public key to check whether the cryptographic signature was generated based on the application data and the first metadata, wherein the cryptographic public key is associated with a source of the application data.

6. The method of claim 1 , wherein:

the received first metadata includes respective metadata values for multiple of the one or more first policies;

the metadata values comprise a first metadata value for one of the one or more first policies; and

the act of processing the first metadata to obtain the second metadata comprises processing the first metadata value to obtain a second metadata value for one of the one or more second policies.

7. The method of claim 1 , wherein:

the first metadata indicates a first classification level; and

the method further comprises acts of:

determining whether an agent on the computer system is authorized at a classification level at or above the first classification level indicated in the first metadata; and

permitting the agent to access the application data associated with the first metadata in response to determining that the agent is authorized at a classification level at or above the first classification level indicated in the first metadata.

8. The method of claim 7 , wherein:

the agent comprises a processing thread executing on the computer system.

9. The method of claim 7 , wherein:

the application data is received in encrypted form;

the first metadata indicates that the application data in encrypted form has the first classification level; and

the first metadata further indicates that the application data, when decrypted, has a second classification level higher than the first classification level.

10. The method of claim 1 , wherein:

the computer system comprises a first computer system; and

the application data and the first metadata are received from a system selected from a group consisting of: a persistent storage within the first computer system, a network-attached storage outside the first computer system, and a second computer system connected to the first computer system via at least one network.

11. The method of claim 1 , further comprising an act of:

in response to determining that the first metadata is compatible with the one or more second policies being enforced in the computer system, updating the first metadata based, at least in part, on the one or more second policies and an operation performed on the application data by the computer system.

12. The method of claim 11 , wherein:

the first metadata is received in encrypted form,

the method further comprises decrypting the first metadata to produce first metadata in decrypted form; and

the act of updating the first metadata comprises updating the first metadata in decrypted form to obtain updated first metadata in decrypted form.

13. The method of claim 12 , further comprising acts of:

encrypting the updated first metadata in decrypted form to obtain updated first metadata in encrypted form; and

transmitting the updated first metadata in encrypted form to a source system from which the first metadata in encrypted form is received.

14. A computer system comprising circuitry and/or one or more processors programmed by executable instructions, wherein the circuitry and/or the one or more programmed processors are configured to perform a method for metadata processing, the method comprising acts of: receiving application data and associated first metadata, wherein the computer system includes a host processor configured to use the application data;

identifying one or more first policies according to which the first metadata was created;

determining, based at least in part on the one or more first policies identified, whether the first metadata is compatible with one or more second policies being enforced in the computer system; and

in response to determining that the first metadata is not compatible with the one or more second policies being enforced in the computer system, processing the first metadata to obtain second metadata to be associated with the application data for use in enforcing the one or more second policies in the computer system.

15. The computer system of claim 14 , wherein:

the method further comprises an act of obtaining a mapping to transform metadata for the one or more first policy into metadata for the one or more second policy; and

the second metadata is obtained at least in part by applying the mapping to the first metadata.

16. The computer system of claim 15 , wherein:

the one or more first policies comprise a first policy;

the one or more second policies comprise a second policy;

the act of obtaining a mapping to transform metadata for the one or more first policy into metadata for the one or more second policy comprises:

determining whether the first policy is a newer version of the second policy; and

in response to determining that the first policy is a newer version of the second policy, querying a server for a mapping to transform metadata for the first policy into metadata for the second policy.

17. The computer system of claim 14 , wherein:

the first metadata is received in encrypted form; and

the act of processing the first metadata comprises:

decrypting the first metadata to produce first metadata in decrypted form, and

processing the first metadata in decrypted form to obtain the second metadata.

18. The computer system of claim 14 , wherein the method further comprises acts of:

receiving a cryptographic signature corresponding to the application data and the first metadata;

determining whether the application data and the first metadata are correctly bound to each other, comprising:

using a cryptograph public key to check whether the cryptographic signature was generated based on the application data and the first metadata, wherein the cryptographic public key is associated with a source of the application data.

19. The computer system of claim 14 , wherein:

the received first metadata includes respective metadata values for multiple of the one or more first policies;

the metadata values comprise a first metadata value for one of the one or more first policies; and

the act of processing the first metadata to obtain the second metadata comprises processing the first metadata value to obtain a second metadata value for one of the one or more second policies.

20. The computer system of claim 14 , wherein:

the first metadata indicates a first classification level; and

the method further comprises acts of:

determining whether an agent on the computer system is authorized at a classification level at or above the first classification level indicated in the first metadata; and

permitting the agent to access the application data associated with the first metadata in response to determining that the agent is authorized at a classification level at or above the first classification level indicated in the first metadata.

21. The computer system of claim 20 , wherein:

the agent comprises a processing thread executing on the computer system.

22. The computer system of claim 20 , wherein:

the application data is received in encrypted form;

the first metadata indicates that the application data in encrypted form has the first classification level; and

the first metadata further indicates that the application data, when decrypted, has a second classification level higher than the first classification level.

23. The computer system of claim 14 , wherein:

the computer system comprises a first computer system; and

the application data and the first metadata are received from a system selected from a group consisting of: a persistent storage within the first computer system, a network-attached storage outside the first computer system, and a second computer system connected to the first computer system via at least one network.

24. The computer system of claim 14 , wherein the method further comprises an act of:

in response to determining that the first metadata is compatible with the one or more second policies being enforced in the computer system, updating the first metadata based, at least in part, on the one or more second policies and an operation performed on the application data by the computer system.

25. The computer system of claim 24 , wherein:

the first metadata is received in encrypted form,

the method further comprises decrypting the first metadata to produce first metadata in decrypted form; and

the act of updating the first metadata comprises updating the first metadata in decrypted form to obtain updated first metadata in decrypted form.

26. The computer system of claim 25 , wherein the method further comprises acts of:

encrypting the updated first metadata in decrypted form to obtain updated first metadata in encrypted form; and

transmitting the updated first metadata in encrypted form to a source system from which the first metadata in encrypted form is received.

27. At least one non-transitory computer-readable storage medium having stored thereon

executable instructions, which, when executed by at least one processor in a computer system, cause the at least one processor to perform a method for metadata processing, the method comprising acts of:

receiving application data and associated first metadata, wherein the computer system includes a host processor configured to use the application data;

identifying one or more first policies according to which the first metadata was created;

determining, based at least in part on the one or more first policies identified, whether the first metadata is compatible with one or more second policies being enforced in the computer system; and

in response to determining that the first metadata is not compatible with the one or more second policies being enforced in the computer system, processing the first metadata to obtain second metadata to be associated with the application data for use in enforcing the one or more second policies in the computer system.

28. At least one non-transitory computer-readable medium having stored thereon at least one hardware description for circuitry configured to perform a method for metadata processing in a computer system, the method comprising acts of:

receiving application data and associated first metadata, wherein the computer system includes a host processor configured to use the application data;

identifying one or more first policies according to which the first metadata was created;

determining, based at least in part on the one or more first policies identified, whether the first metadata is compatible with one or more second policies being enforced in the computer system; and

in response to determining that the first metadata is not compatible with the one or more second policies being enforced in the computer system, processing the first metadata to obtain second metadata to be associated with the application data for use in enforcing the one or more second policies in the computer system.

29. The at least one computer-readable medium of claim 28 , wherein the at least one hardware description, when synthesized, produces at least one netlist for the circuitry configured to perform the method for metadata processing in the computer system.