Controlling access to application data
A method, system and computer-readable storage medium for controlling access to application data associated with an application configured on a computing device. The method comprises: storing data comprising, for each of a plurality of access levels associated with the application, first data indicative of a combination of one or more credentials associated with the respective access level and an access level key corresponding to the respective access level, the access level key being encrypted by the combination of one or more credentials associated with the respective access level; determining, based on the first data, an access level in the plurality of access levels corresponding to a combination of one or more credentials available to the application; decrypting the access level key in the stored data corresponding to the determined access level using the combination of one or more credentials available to the application; and providing access to encrypted application data associated with the application and corresponding to the determined access level using, at least in part, the decrypted access level key corresponding to the determined access level.
1. A method, comprising:
generating, by an application runtime of an application having a current authentication state, application data, wherein:
the application defines a plurality of data categories for data in the application data,
the application data includes a plurality of containers into which the application data is segregated and securely stored in encrypted format to prevent unauthorized access, and
the current authentication state is associated with one or more credentials that are currently available to the application runtime;
requesting, by the application runtime, access to data associated with a particular one of the plurality of data categories;
determining, by the application runtime, whether the current authentication state includes a credential combination corresponding to the particular one of the plurality of data categories;
in response to determining that the current authentication state includes the credential combination corresponding to the particular one of the plurality of data categories, obtaining, by the application runtime, an access level key corresponding to one access level of a plurality of access levels associated with the current authentication state, wherein the access level key is encrypted by one or more credentials associated with the one access level;
decrypting, by the application runtime, an encrypted container key corresponding to the one access level by using the access level key;
decrypting, by the application runtime, application data stored in a particular one of the plurality of containers by using the decrypted container key; and
providing access to the decrypted application data in the particular one of the plurality of containers.
2. The method of claim 1 , further comprising:
obtaining one or more subordinate access level keys corresponding to one or more access levels that are subordinate to the one access level;
decrypting one or more encrypted subordinate container keys corresponding to the one or more subordinate access level keys; and
decrypting subordinate application data stored in one or more subordinate containers by using the one or more decrypted subordinate container keys.
3. The method of claim 1 , wherein the obtaining the access level key comprises:
receiving one or more credentials available to the application;
determining the one access level in the plurality of access levels based on the received one or more credentials available to the application; and
decrypting the access level key corresponding to the one access level by using the received one or more credentials available to the application.
4. The method of claim 1 , further comprising:
storing information along with the access level key, the information indicating a credential type for each of the one or more credentials that is used to encrypt the access level key.
5. The method of claim 4 , wherein the information comprises credential meta-data associated with the access level and the credential type.
6. A device, comprising:
at least one hardware processor; and
a non-transitory computer-readable storage medium coupled to the at least one hardware processor and storing programming instructions for execution by the at least one hardware processor, wherein the programming instructions, when executed, cause the at least one hardware processor to perform operations comprising:
generating application data using an application runtime of an application having a current authentication state, wherein:
the application defines a plurality of data categories for data in the application data,
the application data includes a plurality of containers into which the application data is segregated and securely stored in encrypted format to prevent unauthorized access, and
the current authentication state is associated with one or more credentials that are currently available to the application runtime;
requesting access to data associated with a particular one of the plurality of data categories;
determining whether the current authentication state includes a credential combination corresponding to the particular one of the plurality of data categories;
in response to determining that the current authentication state includes the credential combination corresponding to the particular one of the plurality of data categories, obtaining an access level key corresponding to one access level of a plurality of access levels associated with the current authentication state, wherein the access level key is encrypted by one or more credentials associated with the one access level;
decrypting an encrypted container key corresponding to the one access level by using the access level key;
decrypting application data stored in a particular one of the plurality of containers by using the decrypted container key; and
providing access to the decrypted application data in the particular one of the plurality of containers.
7. The device of claim 6 , the operations further comprising:
obtaining one or more subordinate access level keys corresponding to one or more access levels that are subordinate to the one access level;
decrypting one or more encrypted subordinate container keys corresponding to the one or more subordinate access level keys; and
decrypting subordinate application data stored in one or more subordinate containers by using the one or more decrypted subordinate container keys.
8. The device of claim 6 , wherein the obtaining the access level key comprises:
receiving one or more credentials available to the application;
determining the one access level in the plurality of access levels based on the received one or more credentials available to the application; and
decrypting the access level key corresponding to the one access level by using the received one or more credentials available to the application.
9. The device of claim 6 , wherein the operations performed by the at least one hardware processor further comprise:
storing information along with the access level key, the information indicating a credential type for each of the one or more credentials that is used to encrypt the access level key.
10. The device of claim 9 , wherein the information comprises credential meta-data associated with the access level and the credential type.
11. A non-transitory computer-readable medium storing instructions which, when executed, cause a computing device to perform operations comprising:
generating application data using an application runtime of an application having a current authentication state, wherein:
the application defines a plurality of data categories for data in the application data,
the application data includes a plurality of containers into which the application data is segregated and securely stored in encrypted format to prevent unauthorized access, and
the current authentication state is associated with one or more credentials that are currently available to the application runtime;
requesting access to data associated with a particular one of the plurality of data categories;
determining whether the current authentication state includes a credential combination corresponding to the particular one of the plurality of data categories;
in response to determining that the current authentication state includes the credential combination corresponding to the particular one of the plurality of data categories, obtaining an access level key corresponding to one access level of a plurality of access levels associated with the current authentication state, wherein the access level key is encrypted by one or more credentials associated with the one access level;
decrypting an encrypted container key corresponding to the one access level by using the access level key;
decrypting application data stored in a particular one of the plurality of containers by using the decrypted container key; and
providing access to the decrypted application data in the particular one of the plurality of containers.
12. The non-transitory computer-readable medium of claim 11 , wherein the operations performed by the computing device further comprise:
obtaining one or more subordinate access level keys corresponding to one or more access levels that are subordinate to the one access level;
decrypting one or more encrypted subordinate container keys corresponding to the one or more subordinate access level keys; and
decrypting subordinate application data stored in one or more subordinate containers by using the one or more decrypted subordinate container keys.
13. The non-transitory computer-readable medium of claim 11 , wherein the obtaining the access level key comprises:
receiving one or more credentials available to the application;
determining the one access level in the plurality of access levels based on the received one or more credentials available to the application; and
decrypting the access level key corresponding to the one access level by using the received one or more credentials available to the application.
14. The non-transitory computer-readable medium of claim 11 , wherein the operations performed by the computing device further comprise:
storing information along with the access level key, the information indicating a credential type for each of the one or more credentials that is used to encrypt the access level key.