Patent Application
20160078247
Controlling and securing information may be difficult because content owners lose control of a document whenever they send or give the document to anyone else. Systems and methods described herein may secure documents to ensure access to the documents and/or information contained therein is restricted only to those authorized to access it. Unauthorized viewing, printing, and/or editing of documents may be restricted and/or prevented. For example, network printers, which may be shared by multiple individuals, may provide differing levels of access to sensitive information. The systems and methods described herein may be used to secure network printers to prevent unauthorized document printing. Additionally, the systems and methods described herein may secure other devices that can access documents (e.g., PCs, smartphones, scanners, etc.) to prevent unauthorized document access of any kind Document control may foster compliance not only with enterprise/organizational security policies, but also with legal confidentiality standards, for example.
Documents protected by the disclosed systems and methods may include any electronic or physical representation of data in whole or in part, such as databases, photos, files, emails, financial exchanges, images, etc., or any part thereof. For example, some embodiments described herein may secure regulated and/or sensitive information (RSI) to ensure access to the information is restricted only to those authorized to access it. RSI may include any sensitive information, such as payment card information (PCI), electronic voting data, financial, SOX, HIPAA, or other regulatory or sensitive information, for example. RSI may be stored in one or more electronic files, and may only be part of a file in some cases. A holistic approach to security may be provided wherein access to RSI may be controlled by the data owner and limited to authorized devices and individuals. RSI activity may be monitored and logged. RSI may be protected even if transferred between physical and digital media and/or accessed or obtained by an unauthorized entity. For example, even if an unauthorized person obtains physical access to RSI, they may be unable to read, utilize, or exploit the RSI. The approach described herein may provide a complete ecosystem for protecting RSI. In some embodiments, the described approach may be phased in, incrementally enhancing security as components of the ecosystem are developed and rolled out.
The systems and methods described herein may provide some or all of the following security features: authentication (ability to specifically identify individuals and/or devices), authorization (ability to specify, restrict, and/or enforce access rights), nonrepudiation (any changes or access may be recorded such that the change or access cannot be denied after the fact), data confidentiality (assurance that protected information is only available to those authorized to access it), data integrity (assurance that data has not been changed without authorization), and/or data availability (assurance that the protected information is available for authorized use).
Systems and methods described herein may comprise one or more computers, which may also be referred to as processors. A computer may be any programmable machine or machines capable of performing arithmetic and/or logical operations. In some embodiments, computers may comprise processors, memories, data storage devices, and/or other commonly known or novel components. These components may be connected physically or through network or wireless links. Computers may also comprise software which may direct the operations of the aforementioned components. Computers may be referred to with terms that are commonly used by those of ordinary skill in the relevant arts, such as servers, PCs, mobile devices, routers, switches, data centers, distributed computers, and other terms. Computers may facilitate communications between users and/or other computers, may provide databases, may perform analysis and/or transformation of data, and/or perform other functions. It will be understood by those of ordinary skill that those terms used herein are interchangeable, and any computer capable of performing the described functions may be used. Computers may be linked to one another via a network or networks. A network may be any plurality of completely or partially interconnected computers wherein some or all of the computers are able to communicate with one another. It will be understood by those of ordinary skill that connections between computers may be wired in some cases (e.g., via Ethernet, coaxial, optical, or other wired connection) or may be wireless (e.g., via Wi-Fi, WiMax, or other wireless connections). Connections between computers may use any protocols, including connection-oriented protocols such as TCP or connectionless protocols such as UDP. Any connection through which at least two computers may exchange data can be the basis of a network. In some embodiments, the computers used in the described systems and methods may be special purpose computers configured specifically for document security. For example, a device may be equipped with specialized processors, memory, communication components, etc. that are configured to work together to evaluate and secure documents and/or perform other functions described herein.
The systems and methods described herein may secure documents in one or more systems based on the Quantum Security Model (QSM). QSM is a security measurement and comparison methodology. QSM may provide a normalized methodology of breaking down a system and evaluating primitive components in a consistent manner, which may allow interdependencies to be more accurately understood and measured. QSM may provide a method to normalize the resultant evaluation of the primitive components to a quantifiable score. QSM may allow a resource owner to specify what evaluating (signing) authorities they recognize and accept. QSM methods may be used to evaluate both the current and probabilistic future security state of a system or device. QSM may allow individual resource owners to specify and verify an asset's security score prior to granting access. QSM may enable assets with computational ability to mutually authenticate each other prior to sharing resources or services. In the systems and methods described herein, QSM may be used to control access to individual files (“protected documents”) or collections of files.
In QSM, a common measurement may be reached through an evaluation process conducted on a device, system, or entity (the “asset”) where an agreed upon, reproducible, independently verifiable security level determination is desired. A quantum security unit symbolized as (“qS”) and pronounced (“qSec”) may be a standard unit of measure for security of a system based on the QSM. A qSec may be a temporal value similar to the position of a particle in quantum physics such that it may only be estimated at best and best known at the moment a measurement is conducted by an observer. After measurement, the position of a particle may only be probabilistically determined with a degrading precision over time. A qSec, being a quantum measurement, may share this characteristic. It may be postulated that systems may be viewed as wave-like systems from the perspective of security and the principles of quantum mechanics can be applied. The security of a system is a property of that system. The passage of time, along with the normal functioning and operation of the system and its environment may all affect the security of a system. As a result, the security of a system may be dynamic and the known state of the security may be transient by nature. Similar to the position of a particle, the security of a system may be quantifiably defined for a precise moment in time. The measurement results may provide a security measure represented in quantum security units, where a value of zero represents the complete lack of any security in a system, and increasing values indicate higher security.
The value that one qSec represents may be derived from criteria to be evaluated during the system security measurement process. Each criteria may have a common value range related to their impact to security. Also, each criteria may have an associated evaluation process that produces a result within that range. A criteria weighting method may be applied to each criteria, and the common value range may become a security value scale for what a quantum security measurement represents as denoted in qSecs. For example, the qSec value may represent an eigenvalue in matrix mechanics. Different observers at different periods of time may theoretically interpret this value differently depending on their perspective and may desire to apply their own probabilistic filters to a qSec value or conduct their own measurement process to determine the qSec value of a system. Thus, the value may be predetermined in order to utilize qSec measurement in a meaningful way when classifying system security. The predetermination may be done automatically, may be set by a user, and/or may be set at or before system initialization.
Referring back to
Utilizing NSS, objective score sets, and derived security rules along with cryptographic techniques such as public-private key certificates, digital assets may securely store their security level along with the time the evaluation of the asset was performed in a Base Security Score Certificate (BSSC).
To take into account the transient nature of security, meaning security may have a high probability of degrading post measurement, a security rate of decay (ROD) algorithm may be used to factor in probabilistic security degradation that has occurred since the last NSS evaluation noted in the BSSC was conducted. The ROD may be used to determine a realistic security score for a system given the time that has passed since a BSSC was initially issued. The algorithm for calculating the ROD may be dependent upon the metrics chosen for scoring the system. By using the NSS and objective score sets as inputs along with the time of the last evaluation (and optionally other security rules or recorded asset usage history), a new NSS score may be calculated and used for more accurate common security comparisons.
In order to allow assets to maintain a history of significant events, the QSM may support the concept of certificate chains, or Security Score Chain (SSC). The BSSC may provide a base certificate in any SSC. The asset can modify the score and sign a new certificate with the BSSC, thereby creating the SSC. When creating an SSC, the asset may include a record of why the modification is being made. In
The NSS may provide a metric that can be used to evaluate the security posture of a given asset over time (ΔT). This score may be used to authenticate the asset, authorize access, compare the security utility of assets, or determine where improvements should be made to a given asset, for example. A NSS may be calculated as follows: NSS=(BSST*SRW)−(ROD*ΔT). Thus, a NSS for the example of
This computed NSS may be compared against the stored min NSS value, if it is above the min NSS value, it may be approved. In the above example, since the calculated NSS of 4.6 is less than the SRC permits (5.0), the device would be rejected.
The NSS values may be compared and contrasted allowing a security level index to be applied to the security of an asset.
Utilizing the NSS and the objective score set, extended security comparisons may be conducted that may commonly measure more specific security attributes of an asset.
The SOS may provide a probabilistic based evaluation determined by computing security metrics which may describe the probability of a compromise. This probabilistic equation may be expressed as SOS=P(Compromise|Security Measures≠Threats). The SOS is the probabilistic likelihood of a compromise of the asset due to the implemented security measures not safeguarding against threats, where threats are a probabilistic expression over time that an actor with a given motivation may utilize an exploit. Threats=P(Time|Actor|Motivation|Exploit). Time may be pulled out and carried in the BSSC, represented as the ROD, to allow the SOS to be a set of values. The ROD may indicate how sensitive the SOS is to time exposure. A higher ROD may indicate that the threat against the asset increases more over time than a ROD that is lower.
For example, a NSS may have a range of 0 to 10, with zero being no security and 10 being completely secure. If a given asset has a shelf life (or time until a patch or update is required) of 770 days and no other factors contribute to reducing or extending this shelf life, one way of calculating the ROD may be by taking the maximum NSS value of 10 and dividing it by 770 days. ROD=10 (Max NSS value)/(days until 100% likelihood of compromise)=10/ 770=0.013/day. By reducing the calculated NSS by the ROD times the change in time (days), regardless of the security of the system, at the end of the 770 days the score would be zero. In other words, the system may be regarded as unsecure without some action. In practice, there may be some minimal value somewhere above zero at which the system may be considered unsecure, and this value may be represented as the minimum NSS in the SRC.
Another example may involve an ammo bunker at a military installation. The vault door on the bunker may contribute to one component (“SI”) of security. Let the vault be rated at a 6 hour penetration level and let the vendor testing indicate a 60% penetration rate for a skilled attacker with unrestricted access after the 6 hour time period increasing by 5% every hour thereafter. Thus, SI is 0.95 with a ROD step at 6 hours to 0.6 and a steady 0.05 decay per hour after that. With this clearly spelled out in the vault's BSS, the commander may order a guard to roam past the bunker every 3 hours (essentially resetting the ROD for the door). These two factors together may contribute a SI for the door of a consistent 0.95.
The SRC may specify which signatories are recognized and accepted by a resource when evaluating the BSSC of an asset looking to gain access to the resource. This may protect the resource against an attempt to falsify security scores by generating a BSSC signed by an unauthorized signatory. In addition, the ability to specify trusted signatories may allow for variation in the security metrics used and the evaluation scale for NSS. For example, security metrics may be based on the Sandia RAM series evaluations and the specification of such may allow a conversion from the Sandia RAM series evaluations to the NSS in a range from 0-100. Likewise, another embodiment may use the CARVER methodology or some pair-wise comparison evaluation and may use a QSM 0-10 scale. Similarly, an embodiment can utilize proprietary metrics and a scale of 0.00 to 1.00. Any and all of the above combinations may be utilized in the evaluation of a complex system, the NSS and QSM methodology may allow for their inclusion. QSM may take known shortcomings in methodologies into account by increasing the rate of decay and reducing the NSS due to the uncertainty of the metrics. Thus, existing systems and evaluations may be leveraged in the short term until a valid QSM evaluation may be performed.
Enhanced authentication and authorization processes between assets may take advantage of the common security measuring and comparison methods described above. This may be done by forcing a real-time evaluation to derive the NSS and objective score set of an asset or utilizing the information stored in BSSC from a past evaluation as well as optionally using the rate-of-decay algorithm of an asset. Additional security rules such as the ones stored in BSSC may also be used as authentication or authorization security criteria. The security level validation may be conducted one-way for one of the assets engaged in the authentication or authorization process, as shown in the example security verifications described above. In some embodiments two-way validation (or all-way validation when two or more assets are trying to authenticate or authorize each other) may be performed, wherein each asset validates the security level of the other.
In some embodiments, a security rule enforcement during the verification process may prompt a reevaluation of one or more of the assets participating in an authentication or authorization.
QSM evaluation of devices with built-in processing power, such as servers, PCs, and routers may be performed automatically. This may be accomplished by running a QSM process that utilizes a combination of backend databases, scans of configuration information on the computer, and/or automated penetration-testing tools to generate a NSS. This may allow a service provider or network to require at least a minimal security posture for devices that wish to connect to their services that may not have undergone a full QSM evaluation.
This automation may be taken a step further to pre-emptively protect QSM devices. If a new exploit or other threat is identified, a backend database may search for registered devices that are susceptible and take preemptive action. This action may be to lower their NSS, revoke their cert, and/or advise the asset owner that they should disable a particular service or install a patch or update or advise the system administrator of the threat, for example. Due to the nature of many computer networks, these preemptive services may require periodic communication between the devices and the backend services in some embodiments.
Automated evaluation and certificate generation may also allow for real-time evaluations to be performed for access to systems that may have a particularly high security requirement where a certificate that is even a few days old may not be acceptable, for example. These high security systems may require a certificate that is current (e.g., that day, that week, etc.). This may be handled automatically in some embodiments. An automated QSM evaluation process may allow systems to require reevaluation and recertification at every request to utilize system resources in some embodiments.
The following additional examples illustrate scenarios wherein the QSM may be used for authentication and/or authorization. For the purposes of this section, it may be assumed that devices within the QSM have an SSC. Devices or systems that have their own computing resources may also be assumed to have an SRC. An example of a device which may not have an SRC is a USB memory stick. Since many USB memory sticks do not have their own computing resources, they may be unable to compare their SRC to an SSC they receive, so there may be no reason for them to have an SRC. In addition, the SSC for a device without its own computing resource may simply be the BSSC since the device cannot update the SSC from the BSSC.
Devices using QSM may leverage the SSC in order to perform device authentication and authorize network access. This authentication and authorization may be mutual, allowing for each entity to authenticate and authorize the other, as described above. Utilizing an automated QSM evaluation tool, this mutual authentication may be expanded to external devices that may require temporary or occasional access to network resources, such as joining a Wi-Fi access point at a corporate office, accessing an online merchant, etc. A resource owner may not be able to require a physical assessment of every device that may require occasional access to their resources, where requiring the download or access of a QSM evaluation tool as part of the registration or signup process may be feasible. The QSM tool may then generate an automated BSSC based on an automated scan as discussed above, and then the device may participate in a mutual authentication exchange prior to being granted access to network resources.
Furthermore, since the SSC may be updated occasionally, system administrators may permit devices to join less secure networks. The device's SSC may be updated to indicate which insecure network it had joined. Due to the resulting decrease in the SSC, the enterprise network may force the device to be re-evaluated before allowing it to re-join the network. For example, such techniques may be useful when employees travel with their laptops. In addition, users or system administrators may leverage the SSC of the network to authorize which device resources a network may be allowed to access. For example, the device's firewall may prevent networks not meeting certain security levels from being permitted to access file shares or web servers running on the device.
Devices may also utilize the SSC for allowing access to sensitive information on the device itself For example, a device with a trusted computing space may be configured to only grant access to encrypted information on the device if the SSC meets certain criteria. The trusted computing processor may detect an attempt to access an encrypted volume and then determine whether the current SSC meets the criteria for that encrypted volume. Even if the user knows the decryption keys, the device may prevent them from decrypting the information because the device (which may have been compromised) is no longer trusted. This may enable specially designed computing devices that leverage separate components for sensitive storage, which may require an SSC to comply with a SRC. Essentially, the sensitive storage component may be seen by the system as a separate device.
Hardware and software products may utilize a user provided SRC and desired SSC (within an available range) to automatically configure parameters and settings to establish SOSs to ensure compliance. Removing the burden from the user to determine what combination of parameters available in the product configuration may provide functionality and security. Likewise, resource owners may require certain services or devices to be disabled or stopped while accessing their resources. Leveraging both the auto configuration and QSM auto evaluation processes may allow for this type of dynamic configuration to match security requirements.
SSC may provide product purchasing information. A product manufacturer may provide the SSC for a product online, allowing for consumers to perform a direct comparison between products in their particular security environment. Similarly, web sites could allow potential consumers to submit an SRC in order to learn what products meet their security requirements. This may allow consumers to judge which product produces the desired security enhancement or performance prior to making the purchase. It may even be possible to develop systems to run simulations of systems in order to learn how implementing new products or configurations may impact overall security. Manufacturers may be able to quantify the amount of security they can provide to a user, and show how much security they will add over their competitors for a given security SRC.
Protected documents may be encrypted using a public/private key pair for an authorized recipient or a group of recipients. The private key may be created and stored on a specially designated QSM authorizer. The authorizer may be, for example, a security module 100 whose permissions module 136 and/or other elements are configured to process the enhanced SRC 2200 and associated document control methods described below. The public/private key pair may be stored in a database along with a Globally Unique ID (GUID). Protected documents may be configured in the form of a compressed archive containing the file(s) to be protected along with an SRC, for example. A set of permission key-value pairs may be used to define permissions for each GUID. In addition, the SRC may specify which applications are allowed to act on the protected file, for example by validating the BSSC of the application and the BSSC of the host device.
With QSM, the system requirements for displaying protected documents may be as broad as QSM score or as narrow as users, systems, QSM score, and physical location, for example. When setting authorized viewer and system permissions, the use of a QSM application for display may be required. Permissions for viewing may be granted by a document owner on a user, viewing system, or combination basis, for example. Document owners may say which users are permitted to view a document and on which system. When a user wants to view a protected QSM document, the entire protected document (encrypted version along with SRC) may be sent to the QSM authorizer along with information about the user who requested the view. The protected document may be encrypted with a key only known to the QSM authorizer, forcing the viewer to leverage the authorizer in order to decrypt the message. This may prevent a compromised viewer system or a system whose QSM score has dropped below the required level from being able to bypass security measures for the document.
In the verification 2400 of
In many situations, similar information may be disseminated to multiple audiences, often with differing degrees of “need-to-know”. QSM documents may be leveraged to secure documents at a content or paragraph level rather than simply at a document level. Content markings (e.g., paragraph classifications) may automatically encrypt information based upon the author's markings Users attempting to view or print documents may only see segments of the document that they are authorized to access. This “redaction” may occur either transparently (i.e., making unauthorized segments completely vanish) or non-transparently (i.e., black-out text). Security verification as described above may be performed, and a document may be encrypted as required by the viewer's security level before the document is presented to the viewer.
For example,
Additionally, document access may be restricted based on a number of times a given document is allowed be viewed, where the viewing computer is geographically located, which network a viewer is on when viewing the document, etc. For example, viewing a document may be restricted to an enterprise computer while on the enterprise network.
Editing of protected documents may be similar in nature to viewing a document. In some embodiments, in order to ensure QSM protections are maintained, a specialized editor may be required. Document controls metadata may restrict users to only being able to edit particular regions or pages. When leveraging QSM document control for editing, versioning may also be controlled. In order to allow for file size optimization, users may be able to control how many versions of the document to maintain. Versioning could be set to −1 (no versioning), 0 (unlimited versions), n (number of versions to maintain besides the current version), for example.
QSM may also control document printing and/or reproduction. When setting printing permissions, the use of QSM applications for viewing and editing may be required in some embodiments. Permissions for printing may be granted by a document owner on a user, printer, or combination basis, for example. Owners may say which users are permitted to print the document. Owners may also say which printers (or set of printers) are allowed to print the document. QSM score and/or QSM certificates may be used to determine authorization. In addition, certain users may be permitted to print only on certain printers.
Enterprises and organizations may establish information classifications using a Security Level Definitions Certificate (SLDC). The SLDC may contain the security requirements for each classification along with a label for each classification. The SLDC may be loaded into QSM-enabled applications and devices which generate QSM protected documents. In addition, the SLDC may dictate whether the documents should be protected in their entirety or partitions. For example, users may be able to manually select the classification of the document (or portions of the document) and the application may automatically apply the required security measures. Furthermore, the applications and devices themselves may automatically recognize sensitive information and then either automatically protect the information or prompt the user to verify the classification. The SLDC may be able to ensure minimum security is in place for a document and may be modified by users to increase the security (e.g., by classifying some portions of a document as higher security). Security levels may be pre-defined and/or may be customizable by users. When applications and devices apply the SLDC settings to a protected document, they may use the actual requirements, rather than relying upon the user-friendly labels. This may allow the document to be opened (or restricted) on various platforms which may apply labels in different ways.
Hardware designed to create or process documents may be configured to directly handle QSM Protected Documents. For example, printers, imaging devices, and fax machines may all be configured to natively support QSM Document Control. A simple implementation of anti-tamper may be a mechanism configured such that an attempt to access the processing area of a printer would render the secure storage area (where the BSSC and SRC are stored) unusable.
Specialized QSM devices may include a secure processor and storage area with tamper resistance security measures. An example secure processor and storage area which may be suitable for use in a QSM device is disclosed in U.S. patent application Ser. No. 14/523,577, entitled “Autonomous Control Systems and Methods,” which is incorporated by reference herein. The secure processor may provide a physical layer of security including monitoring and action modules configured to constantly analyze connection states in real time between any number of devices or systems and act against pre-programmed out of bounds states. Using the secure processor to monitor for QSM protected documents may be a secure method to filter out unauthorized attempts to access or process protected documents.
For example, printers (e.g., any device that produces a hard or physical representation of a digital image or document, such as copiers, printers, fax machines, registers, etc.) may be QSM enabled. QSM document control may allow the protected document itself to carry and maintain the security controls within the document. QSM enabled printers may handle QSM protected documents by providing the document and the printer BSSC to the associated authorizer. After the authorizer has confirmed that the device is allowed to print the document, the authorizer may leverage mutually authenticated SSL protocols to transmit the decrypted document back to the printer and update the document's SRC. Alternately, if the printer has its own asymmetric key pair, the authorizer may encrypt the document with the printer's public key and transmit the document to the device. The printer's secure processor may then decrypt and print the document and clear the document off the device.
In some embodiments, printers may have secured segmented storage. Secure print jobs may be printed without being monitored and then collected by the user after they enter the required pin (or use a physical key) to unlock the storage tray. In some embodiments, printers may be configured to embed an invisible watermark, for example indicating the user and printer that printed the hardcopy. This may allow leaked documents to be tracked back to their origins. In some embodiments, printers may leverage specialized paper and/or inks which may react to the bright light of scanners and copiers, causing the originals (and any copies) to become unreadable.
Imaging devices (e.g., any device that captures an image and generates a file containing the image, such as digital cameras; fax machines, scanners/copiers, and medical imagers such as MRI, X-RAY and CT scanners) may also be QSM enabled. QSM enabled digital imaging devices may automatically generate protected documents. Users may be able to protect a single document and/or or an entire “session” automatically, causing the imaging device to encrypt the images as soon as they are taken. A “session” may last either until the user chooses to end the QSM session or until the imaging device is powered off or goes to sleep, for example. QSM imaging devices may be registered with an authorizer, allowing the user to generate the necessary public and private key pairs. For example, the imaging device may encrypt images (and optionally metadata) with the public key registered to the device. This may allow only the user to access the images until such time they decide to authorize additional users or devices. Besides being useful for securing images, QSM enabled images may assist users in maintaining copyright and licensing protection and proving ownership of their work.
Communication devices such as fax machines may also be QSM enabled. QSM enabled fax machines may allow shared fax machines (such as those found in offices or a commercial office services retail location) to securely send and receive documents. As part of the fax negotiation process, both machines may present their BSSC. If either of the devices does not have a BSSC, or the BSSC does not have a high enough score, the devices may either reject the connection or allow the user to fallback to a standard fax protocol. The user or an administrator may control this behavior.
When sending a fax from a QSM enabled fax machine, the process may proceed as follows. The user may enter the recipient phone number along with either a pre-shared PIN or the recipient's public QSM certificate. The user may scan the cover page and the protected document.
When receiving faxes, the QSM enabled fax machine may save the faxes as QSM protected documents.
Hardware designed to create or process documents may be designed or retrofitted to directly handle protected documents. For example, specialized lenses (e.g., glasses, goggles, or view screens) may be provided, such as QSM-enhanced lenses that have input and output capabilities via physical or wireless connection to a computer that physically modifies the optical properties of the lenses or coordinates with the computer to partially display information on the lens and partially on a specialized monitor or printed page, in such a manner where both lens and monitor or specialized printed medium are required to be able to render the protected information.
Similar to imaging, documents created on a computer may be protected at creation and similar to portion marking in a classified document, each element, paragraph, image, HIPAA item, RSI, etc. may be identified and “tagged” appropriately. These elements may then be controlled through the ACL maintained within the enhanced SRC. Likewise, fields in a database or a digital form may be identified, and any information entered may automatically be protected by that form or record's ACL. The protected information may be maintained and carried with the document from that point forward.
Point of Sale Devices (POSD) may be modified to protect documents, so scanning a credit card or accepting payment from some other device may not expose the RSI to an unauthorized individual or device. The POSD may have an isolated and encrypted secure storage area containing a QSM certificate to guarantee to the customer and the retailer that the device has not been tampered with and/or is genuine. For example,
Protection of documents may be extended to physical cards, such as credit cards, government IDs, and access badges that contain RSI. Information may be stored in a protected form on physical media, so if the card is lost, stolen, or copied, it may not provide access to the RSI. Furthermore, to ensure that the card is authentic, some form of cryptographic watermark, tag, or identifier may be embedded into the card that links the card issuer and the identity of the individual to which the card was issued.
Plug-ins or add-ons may be applied to corporate mail servers, mail clients, web servers, web browsers, and other applications commonly used to transmit, view, or process sensitive data. These plug-ins may enforce QSM controls on data based upon the SLDC. The plug-ins may prevent employees from sending (either purposefully or accidentally) sensitive information without first properly securing it. For instance, a social security number or credit card number typed into an e-mail may automatically be protected and routed to a QSM-enabled application or secure mail application. In some embodiments, specific types of information typed into documents (e.g., social security numbers) may be detected automatically and cause the program to prompt a user to apply a certain level of protection because that type of information is present in the document.
Specialized monitors may be used for processing protected documents. These monitors may have a system-modifiable electroluminescent (or similar) glass or filter which may alter or mask protected documents in a manner that prohibits an unauthorized user from viewing or photographing it. In such a monitor, non-RSI may always be visible on the screen, but RSI content may be invisible to unauthorized users. The monitor may have built-in biometric or proximity detection such that it will only display protected documents when an authenticated user is present. For a proximity tag implementation, a transmitting device (such as an NFC tag built into an access badge) may have a user's identity information that may be securely transmitted to the monitor. The monitor may present challenge questions to further verify identity before displaying protected documents, for example. As a further step, a verification code may also be sent to a user's mobile phone, and the user may be required to enter the code before starting a viewable protected session. The sessions may end when proximity is no longer detected. In another embodiment, an authorized user wearing a specialized lens system that is cryptographically authenticated with the system may be required to process or modify the displayed information on the monitor to properly render the protected documents. Alternately, the protected documents may be sent to the lenses, and a synchronization process may align the displayed page with the field of view of the lens such that the protected documents projected onto the lenses would be in line with non-protected data displayed on the monitor. In some embodiments of a monitor-only implementation, a combination of visible and non-visible components may be displayed which may cause an automatic digital camera to increase its shutter speed to a point where the shutter is quicker than the rendering of the document (i.e., the document may be presented in two or more “interlaced” or “phased” portions that may be blended by a viewer's brain into a single image but captured incomplete by the photo). Should the camera be manually set to a slower shutter speed, the non-protected components may over saturate the image, again making the RSI unreadable.
In order to reduce costs, enterprises and/or individuals often share printers. This may result in sensitive information being left on printers, exposing the information to individuals who should not have access to it. QSM document control combined with specialized QSM printers may prevent access to printed material except by the authorized individual. Printers may either wait to print the document until the user is at the printer (by requiring a PIN) or store larger print jobs in secured trays only accessible with the proper PIN or physical key. QSM document control may also provide non-repudiation of print jobs. Customers may be unable to dispute how many pages they printed in a given period of time since printer logs may be cryptographically backed.
QSM document control may allow commercial printer services to provide customers with quantifiable security. Customers may not need to worry about an employee stealing soft copies of their material, since the material may be secured so only the printers at the service could access them. Even if an employee stole the file, the authorizer may prevent the employee from actually doing anything with it. Furthermore, while a malicious printing service employee could try to steal physical copies of documents, the likelihood of this happening may be greatly reduced. QSM controls may limit the number of copies that could be printed, causing the malicious employee to need to physically take a hard copy to another location to copy. In addition, the store may leverage physically controlled printers to prevent employees from accessing printed materials without the intended recipient being present.
QSM document control may be leveraged to secure health records in accordance with HIPAA requirements. Documents may be broken into differing levels of access (similar to government compartmentalization) based upon an actual need to know. Insurance companies may be granted access to see that certain tests had actually been performed, but not the results of the tests, for example. QSM protected documents may be prevented from being opened on untrusted computers. Doctors may be able to access their e-mail from personal computers, but mayneed to be on a trusted computer or even physically at the hospital on their secure QSM network to access sensitive patient records or attachments.
QSM enabled closed-circuit television (CCTV) imaging devices may automatically encrypt photographs or video feeds, preventing them from being viewed by unapproved users. Imaging devices may be configured to only allow certain users access or restrict access to certain computers. Besides providing secure transmissions of CCTV feeds, QSM document control may also provide cryptographic evidence of where and when photographs were taken. This may prove useful for criminal or civil legal cases where an image's authenticity comes into question.
Similar to securing CCTV feeds, the fact the authenticity of a QSM document is cryptographically provable may be useful when analyzing logs secured with QSM document control or when using them as legal evidence. Each log entry may be individually protected automatically, ensuring logs are not modified or altered. Note that while QSM document control may maintain document authenticity, it may not directly maintain the accuracy of the logs. However, since the QSM score of the device at the time a log entry was created may be known, the relative integrity of the log may also be known.
Entities, such as government entities for example, may use multiple security classifications that may be leveraged to determine which individuals have access to which information. QSM document control may allow documents to maintain their security regardless of their environment. A document's classification level may prevent it from being viewed on machines that have not been authorized access. For example, a top secret document may not be accidently viewed on a machine only rated for secret information. This may protect against inadvertent leakage and deliberate compromise by insider threats. A QSM-enabled machine may not allow a user to create an unprotected version of a document. Consequently, a non-QSM machine may not be able to decrypt the information, as only the QSM authorizer may have the required keys. For classified networks and information, the QSM authorizer may only be accessible from the classified network, meaning the document may not be decrypted if it is removed from the classified network. Due to the sensitivity of classified documents, QSM authorizers may enforce both QSM machine and QSM user/group authorization. Users may have certificates associated with their logins which may be leveraged by QSM authorizers to verify whether the user has the necessary clearance level.
For the case of viewing physical documents with protected RSI, consider a document such that the non-RSI is viewable in plain text but any protected RSI is only seen as an encrypted string, a “QR” code as shown in the example of
While various embodiments have been described above, it should be understood that they have been presented by way of example and not limitation. It will be apparent to persons skilled in the relevant art(s) that various changes in form and detail can be made therein without departing from the spirit and scope. In fact, after reading the above description, it will be apparent to one skilled in the relevant art(s) how to implement alternative embodiments.
In addition, it should be understood that any figures which highlight the functionality and advantages are presented for example purposes only. The disclosed methodology and system are each sufficiently flexible and configurable such that they may be utilized in ways other than that shown.
Although the term “at least one” may often be used in the specification, claims and drawings, the terms “a”, “an”, “the”, “said”, etc. also signify “at least one” or “the at least one” in the specification, claims and drawings.
Finally, it is the applicant's intent that only claims that include the express language “means for” or “step for” be interpreted under 35 U.S.C. 112(f). Claims that do not expressly include the phrase “means for” or “step for” are not to be interpreted under 35 U.S.C. 112(f).
This disclosure claims priority from U.S. Provisional Application No. 62/051,251, entitled “Leveraging Security Metrics for Document Control,” filed Sep. 16, 2014 and U.S. Provisional Application No.62/078,143, entitled “Secure Transaction Ecosystem,” filed Nov. 11, 2014; the entirety of each of which is incorporated by reference herein. U.S. patent application Ser. No. 14/523,577, entitled “Autonomous Control Systems and Methods,” filed Oct. 24, 2014 and U.S. patent application Ser. No. 14/634,562, entitled “Security Evaluation Systems and Methods,” filed Feb. 27, 2015 are also incorporated by reference in their entirety herein.
| Number | Date | Country | |
|---|---|---|---|
| 62051251 | Sep 2014 | US | |
| 62078143 | Nov 2014 | US |
