Methods and systems for operating secure digital management aware applications

[0001] This application is a continuation-in-part and claims the benefit under 35 U.S.C. § 120 of U.S. patent application Ser. No. 15/435,590 filed by the inventor of the present application on Feb. 17, 2017, and titled Method And System For Secure Digital Object Management which, in turn, claims the benefit under 35 U.S.C. § 119(e) of U.S. Provisional Patent Application Ser. No. 62/389,190 filed by the inventor of the present application on Feb. 19, 2016, and titled Method and System for Secure Digital Object and Document Management, the entire contents of each of which are incorporated herein by reference except to the extent that disclosure therein is inconsistent with disclosure herein.

[0002] The present invention relates to digital object architecture (DOA) and, more specifically, to systems and methods for maintaining the confidentiality, integrity, and availability of digital objects manipulated outside of a trusted computing environment.

[0003] Protecting confidential and sensitive digital objects (for example, digitally stored and manipulated information such as software, applications, Internet of Things (“IoT”) devices and endpoints, and other mechanisms that may contain information in digital form) has become increasingly challenging due to threats both internal and external to an entity that owns such digital objects. To deliver their intended value, these digital objects must remain available to be edited, shared, viewed, archived, and replicated. At the same time, the integrity of these digital objects must be maintained and their disclosure and/or loss must be prevented.

[0004] While known solutions in the art of automated document management, word processing, and information display provide basic security features such as access restrictions, authentication, authorization and encryption, such measures do not provide effective security mechanisms to prevent theft and/or copying of digital objects by insiders (i.e., persons and/or systems authorized to access stored objects) or by outsiders (i.e., persons and/or systems accessing these digital objects without authorization). As conducted by either an insider or an outsider, malicious leaking of digital objects may occur in the following forms:

• • [0005] a) Copying digital objects on a USB drive
  • [0006] b) Emailing digital objects to third parties
  • [0007] c) Uploading digital objects to a cloud storage or an FTP server not trusted by the entity to whom the digital objects belong
  • [0008] d) Copying the contents of a digital object and pasting those contents into a new digital object (e.g., an email)
  • [0009] e) Printing the contents of digital objects
  • [0010] f) Tampering or breaking into a hosting device and stealing storage media upon which digital objects are stored

[0011] Maintaining confidentiality of information becomes even more difficult when digital objects are shared (in editable form) among multiple users authorized to work on the digital objects in a collaborative manner. Existing approaches for access control and digital object sharing do not have the flexibility to share digital objects, such as documents, for limited time duration. Once shared, known solutions allow digital objects to be accessed by the receivers without workable limits. For example, revoking access to shared digital objects is possible in solutions where a centralized or cloud-based access control and management system is used and digital objects are shared from that system. However, this approach does not prevent the receiver from saving a copy of the digital object locally, from copying the contents to a new digital object on the local machine, and/or from emailing the contents to a third party.

[0012] Known access control approaches based on Access Control Lists (ACLs) and Role-based Access Control (RBAC) systems also fail to provide an effective line of defense against leaking of digital objects by a malicious insider who has the necessary authorizations to access the digital objects, or by an outsider who illicitly gains access to the digital objects.

[0013] This background information is provided to reveal information believed by the applicant to be of possible relevance to the present invention. No admission is necessarily intended, nor should be construed, that any of the preceding information constitutes prior art against the present invention.

[0014] With the above in mind, embodiments of the present invention are related to a method and system of protecting confidential and sensitive information stored in digital objects, such as software, applications, Internet of Things (“IoT”) devices and endpoints, and other mechanisms that may contain information in digital form. In certain embodiments, the present invention may provide the following advantages:

• • [0015] 1) Prevent loss and/or theft of digital objects due to either insiders or outsiders, and without perceptible loss of functionality relating to the digital objects. Such security includes the ability to identify, at an organizational level, certain threats at a particular location and/or a particular time instant or window, or both. Such security also employs patterns of access and/or usage as a library of patterns to assist in threat tracking and reaction/action based on context and threat levels.
  • [0016] 2) Employ tracking and analytics capability within a cloud to identify behaviors involving a particular digital object over time based on activities on system-generated tethers, and also on threat location, for possible offensive action in a coordinated manner.
  • [0017] 3) Allow proactive action with regard to threats to digital objects, including tracking of theft by insiders and/or outsiders, and also controlling destruction of a digital object prior to theft, loss, or disclosure. Both offensive and defensive approaches may be put in place through the use of analytics capabilities in the cloud.

[0018] The advantages described above are achieved by a secure data object management system, and associated methods, comprising a cloud-based host environment and a secure container on a local machine. The cloud-based host environment may create a controlled digital object from data and/or meta-data of a master digital object, and may store the master digital object to a cloud object store. The cloud-based host environment also may activate a tether associated with the controlled digital object. The tether may be adorned with at least one control condition, such as an access permission, an operation permission (e.g., view, delete, store, edit, and copy), and a command (e.g., timeout, destroy).

[0019] The secure container may receive the controlled digital object and store the controlled digital object to an isolated storage. The secure container may allow applications on the local machine to manipulate that controlled digital object only as permitted by the tether. For example, access to the controlled digital object may only be permitted upon detection of an access request satisfying the access permission of the tether. Similarly, manipulation of the controlled data object may only be permitted upon detection of an operation request satisfying the operation permission. Upon detection of certain conditions (e.g., timeout period reached, anomalous data access pattern detected), the secure container may delete the controlled digital object and/or the cloud-based host environment may sever the tether (e.g., set the state value equal to inactive, or the tether may be deleted or purged) to stop any further manipulation of the controlled data object.

[0045] The present invention will now be described more fully hereinafter with reference to the accompanying drawings, in which preferred embodiments of the invention are shown. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. Those of ordinary skill in the art realize that the following descriptions of the embodiments of the present invention are illustrative and are not intended to be limiting in any way. Other embodiments of the present invention will readily suggest themselves to such skilled persons having the benefit of this disclosure. Like numbers refer to like elements throughout.

[0046] Although the following detailed description contains many specifics for the purposes of illustration, anyone of ordinary skill in the art will appreciate that many variations and alterations to the following details are within the scope of the invention. Accordingly, the following embodiments of the invention are set forth without any loss of generality to, and without imposing limitations upon, the claimed invention.

[0047] In this detailed description of the present invention, a person skilled in the art should note that directional terms, such as “above,” “below,” “upper,” “lower,” and other like terms are used for the convenience of the reader in reference to the drawings. Also, a person skilled in the art should notice this description may contain other terminology to convey position, orientation, and direction without departing from the principles of the present invention.

[0048] Furthermore, in this detailed description, a person skilled in the art should note that quantitative qualifying terms such as “generally,” “substantially,” “mostly,” and other terms are used, in general, to mean that the referred to object, characteristic, or quality constitutes a majority of the subject of the reference. The meaning of any of these terms is dependent upon the context within which it is used, and the meaning may be expressly modified.

[0049] Referring to FIGS. 1-25, a secure digital object management (S-DOM) system according to an embodiment of the present invention is now described in detail. Throughout this disclosure, the present invention may be referred to as a digital object management system, a digital object protection system, a DOM system, a management system, a protection system, an access control system, a device, a system, a product, and a method. Those skilled in the art will appreciate that this terminology is only illustrative and does not affect the scope of the invention.

[0050] An embodiment of the invention, as shown and described by the various figures and accompanying text, provides a system and associated methods for employing tethers between a cloud-based host environment and a secure container on a local machine to achieve secure manipulation and management of digital objects. Those skilled in the art will appreciate that the present invention contemplates the use of computer instructions and/or systems configurations that may perform any or all of the operations involved in secure digital object management. The disclosure of computer instructions collectively identified by the named subsystems described herein is not meant to be limiting in any way. Also, the disclosure of systems configurations that include the named subsystems hosted in a cloud-based host environment and in some number of local machines is not meant to be limiting in any way. Those skilled in the art will readily appreciate that stored computer instructions and/or systems configurations may be configured in any way while still accomplishing the many goals, features and advantages according to the present invention.

[0051] Referring now to FIG. 1, for example, and without limitation, a secure digital object management (S-DOM) system, according to an embodiment of the present invention, may include a cloud-based host environment 100 configured in data communication with a local machine 102 (e.g., computer, or a smartphone) that may host a secure container 104 (e.g., implemented in software). The cloud-based host environment 100 may advantageously control the creation, lifecycle and destruction of digital objects (for example, and without limitation, data artifacts such as documents, software, video, images, music, and/or IoT devices). Such digital objects may be synchronized from the host environment 100 to the secure containers 104 hosted on the local machines 102, and also may be secured such that the digital objects may not be viewed, deleted, stored, edited, or copied without permission, knowledge and control of the host environment 100. The digital objects may be stored and replicated in the cloud-based host environment 100.

[0052] Continuing to refer to FIG. 1, and referring additionally to FIG. 2, an exemplary data analytics architecture of a cloud-based host environment 100 may include a cloud-object store 118 configured for storage of master digital objects 120. For example, and without limitation, the cloud-object store 118 may be implemented as a distributed file system (DFS). A document management service 116 may advantageously control the digital objects' 120 lifecycles. A meta-data database 124 within the host 100 may maintain information about the master digital objects 120 and their controlled instantiations of digital objects 212 (as described in more detail below), such as, for example, and without limitation, user IDs of the object owners, object creation timestamps, change logs recording changes in object state, transactions executed or attempted, and object permissions. An access-log 122 within the host 100 may record all digital object 120 accesses and transmissions.

[0053] The analytics and reporting engine 114 within the host 100 may employ big data tools and frameworks for batch or real-time analytics (as described in more detail below) on available databases and meta-databases, for instance, to analyze digital object access logs and network traffic and to identify anomalous data access and data transmission patterns. The host 100 may further include application programming interfaces (APIs) 110 for creating, updating, and deleting digital objects, and for operating authentication and authorization 112 and analytics and reporting 114 functions. These APIs 110 may be used for developing document management and analytics applications that operate within an organization's network. For implementing the components within the cloud-based host environment 100, micro-services architectures may be used whereby each service may perform a predefined set of actions and may communicate with other services through the use of inter-service communication mechanisms such as request-response (e.g. REST over HTTP), publish-subscribe (e.g. MQTT), remote procedure call (RPC) (e.g. Thrift), or notifications. In certain embodiments of the present invention, these services may be developed, deployed and scaled independently.

[0054] In certain embodiments of the present invention, security features for advantageously providing secure access to the cloud-based host environment 100 may include one or more of the following:

• • [0055] 1) Authorization Services: As a matter of definition, authorization refers to digitally specifying access rights to protected resources using access policies. The host 100 may include authorization services such as policy management, role management and role-based access control. A role-based access control framework may be used to provide access to master data objects 120 in the host 100 to users based on the assigned roles and data access policies. The host may support “OAuth,” an open standard for authorization that allows resource owners to share their private resources stored on one site with another site without handing out the credentials.
  • [0056] 2) Identity Management Services: Identity management services may provide consistent methods for identifying persons and maintaining associated identity attributes for users across multiple organizations. For example, and without limitation, Federated Identity Management (FidM) may be enforced for the host 100. FidM provides the ability to establish trust relationships between various security domains to enable the passing of authentication, authorization and privacy assertions.
  • [0057] 3) Authentication Services: The host 100 may support authentication services 112 configured to prevent digital objects from being accessed by unauthorized users. For example, and without limitation, authentication and authorization services 112 may include a Single Sign On (SSO) that may enable users to access multiple applications after signing in for a first time. In addition to SSO, One Time Password (OTP) security may also be enforced. OTPs may be delivered via SMS and email. One benefit of OTP is that such security regimes are not vulnerable to replay attacks.
  • [0058] 4) Data Encryption: The host 100 may adopt a data encryption standard such as the Advanced Encryption Standard (AES) for encrypting all data that is stored in the host. In addition to encryption of stored data, all transmission of data may be protected with Secure Socket Layer (SSL) encryption technology.

[0059] Referring now to FIG. 3, an exemplary data analytics architecture of a secure container 104 will now be discussed in detail. A secure container 104 may advantageously control access to digital objects 212. The secure container 104 may include a secure storage system 210 that may be isolated from the unsecured file system 216 of the local machine 102. Applications 214 on the local machine 102 may be configured to access and update digital objects 212 through a proxy or agent 200 included in and operated by the secure container 104. Digital objects 212 in the secure container 104 may be tethered 106 (through a two-way connection, as described in more detail below) to the host environment 100. Tethers 106 may be established between the objects 212 and the host environment 100 through the proxy 200. Tethers 106 may advantageously allow the host 100 to control access to and manipulation of objects 212 on the secure container 104.

[0060] Access rules and allowed operations 206 for the objects 212 on the local machine 102 may be determined by the host 100 and may be enforced using the tethers 106 through the proxy 200. Use of secure containers 104 having isolated storage 210 prevents unauthorized copying of objects 212 outside the containers 104 to the local storage 216. The access monitoring component 204 in the secure container 104 may log all object accesses and status changes (and/or attempted changes) and may report to the analytics engine 114 in the cloud-based host 100 through the tether connection(s) 106. Objects 212 may be automatically synchronized between the cloud-based host 100 and the secure container 104 by the file sync engine 208. Digital objects 212 may be deleted from the container 104 after access timeouts (computed, for example, and without limitation, as a delta between an object creation timestamp and a system date/time on the local machine 102).

[0061] Continuing to refer to FIG. 3, and a referring again to FIG. 2, for example, and without limitation, the tether 106 may be implemented as an identifiable two-way data connection (e.g., bi-directional communication link using TCP, UDP, Sockets, REST or other similar network/internet protocols, for instance) between a local object 212 on the local secure container 104 and a host object 120 on the cloud-based host environment 100. Tether identification may be accomplished using a unique tether identifier. Objects 212 may be coupled/connected via software pipes (or links over a network) to the host environment 100 through tethers 106. These two-way connections 106 may be used for control of objects 212 through conveyance of control conditions such as, for example, and without limitation, data, metadata, information and/or commands. Tether connections 106 may be of various kinds, including, for example, and without limitation, a persistent connection (TCP-based), UDP-based, or based on periodic data exchanges (REST-based), over wired and/or wireless networks. Objects 212 may be assigned unique IDs (either global, or only unique within a particular state, session or time context) which the host 100 may use for tracking through the tether connections 106. Object IDs may advantageously allow the host 100 to detect which objects 212 are false based on their ID and environment, and/or which objects 212 have been moved to new environments (either authorized or unauthorized). A group of digital objects 212 (for example, and without limitation, a group of documents in a single directory) may be associated with a single tether 106.

[0062] Tethers 106 between the objects 212 in local secure containers 104 and the host 100 may be established over an organization's network or networks approved by the organization. Tethers 106 may prevent false replays or other attacks where an attacker tries to create an impression that the object 212 is in a trusted environment (e.g., that object 212 is legitimate). Still referring to FIG. 2, in a direction of data communication from the container 104 to the host 100 over the tether 106, the secure container 104 may send object access monitoring data and object status changes and/or transactions data (executed or attempted) to the host 100. The container 104 may ping the host 100 for an active connection 106 (e.g., state value of “active”). Note: Objects 212 may self-destruct or may be locked at the direction of the secure container 104 if the tether 106 breaks or times out. The secure container 104 may send application 214 requests to the host 100 to approve or deny an operation and/or to rollback a change. In a direction of data communication from the host 100 to the container 104 over the tether 106, the host 100 may transmit commands to create, synchronize, update and/or delete digital objects 212 on the container 104.

[0063] Referring now to FIG. 4, exemplary subsystems of the analytics and reporting engine 114 of the cloud-based host environment 100 will now be discussed in detail. For example, and without limitation, an exemplary data analytics and reporting architecture may include raw data sources 130 that may comprise data access logs 146 and data streams 148 obtained from different tether connections 106. Data access connectors 132 may include tools and frameworks for collecting and ingesting data from various sources into the big data storage and analytics frameworks. In certain embodiments of the present invention, these frameworks may include source-sink connectors 150 (such as Apache Flume), publish-subscribe messaging frameworks 152 (such as Apache Kafka), database connectors 154 (such as Apache Sqoop), messaging queues (such as RabbitMQ) and custom connectors 156. A person of skill in the art will immediately recognize that the choice of the data connector may be driven by the type of data source. The data access connectors 132 may ingest data into a distributed filesystem 166 (such as HDFS) or a NoSQL database 168 (such as HBase). The data may be analyzed in batch mode or real-time mode. For batch analysis, frameworks such as MapReduce 158 (using Hadoop), scripting frameworks 162 (such as Pig), distributed acyclic graph frameworks 160 (such as Apache Spark), and machine learning frameworks 164 (such as Spark MLlib) may be used. For real-time analysis, stream processing frameworks 170 (such as Apache Storm) or in-memory processing frameworks 172 (such as Apache Spark) may be used. The analysis results may be stored by the connectors 140 either in relational 174 (SQL) or non-relational databases 176 (NoSQL). Alerting and reporting applications may be implemented using web frameworks 178 and visualization frameworks 180, and deployed on web and application servers 144 within the host environment 100.

[0064] Referring now to FIG. 5, a method aspect of the present invention for digital object creation is described in more detail. New objects 212 may be created within the secure container 104 only through the host 100. For example, and without limitation, at Step 1 (610) a user may create a digital object 120 (referred to as a master digital object) from the host 100. At Step 2 (620), the host 100 may create and distribute to the secure container 104 a controlled digital object 212. The controlled digital object 212 may be synchronized to the master digital object 120 on the host 100. The host 100 may, at Step 3 (630), setup a tether 106 for the object 212 between the secure container 104 and the host 100. At Step 4 (640), some user may access and manipulate (e.g., update) the digital object 212 on the secure container 104 through the proxy 200. Before any operation may be performed on the object 212, a check may be performed with the host environment 100 (over the tether connection 106). Objects may only be operated on in the presence of active tethers 106 and only the allowed operations (communicated over the tether 106) may be performed. Objects 212 may be disabled or destroyed and/or changes may be rolled back by commands sent by the host 100 over the tether 106. Other commands may also be sent by the host 100 via the tether 106. For example, and without limitation, modifications made to the digital object 212 on the secure container 104 may be synchronized with the host 100 (Step 5 (650)).

[0065] Referring now to FIG. 6, a method aspect of the present invention for digital object sharing is described in more detail. From the beginning at Step 1 (710), a digital object originator and/or owner (i.e., as shown, User A) may share an artifact (for example, and without limitation, a collaboratively drafted document) with other users (i.e., as shown, User B) by employing the host 100 to control the sharing of those objects. An object owner may set access timeouts while sharing digital objects. Owners may also revoke access permissions to shared objects (e.g., not necessarily involving deletion of a particular shared digital object). When an object is shared by User A, the object 212 may be synchronized in the receiver's local secure container 104 (Step 2 (720)) and a tether 106 may be established by the host 100 for the shared object 212 between the shared container 104 and the host 100 (Step 3 (730)). As collaborating users access and modify the controlled digital object 212 through the proxy 200 (Step 4 (740)), the host 100 may manage synchronization of the digital objects 212 within users' respective local secure containers 104. If the object owner (User A) specifies a timeout period, the tether 106 may become inactive (e.g., state value of “inactive”) after timeout (Step 5 (750)) and the local copies of the object 212 within the secure containers 104 of the receivers may be destroyed (Step 6 (760)). In this way, the tether 106 may advantageously prevent spoofing which seeks to allow an object 212 to continue to exist in an uncontrolled state.

[0066] Continuing to refer to FIG. 6, when a digital object 212 is shared among multiple users through the host 100, the object 212 may be synchronized with the respective secure containers 104 of each of the receivers of the object 212. For example, and without limitation, each local copy of the object 212 may have a separate tether 106 associated with it. Objects 212 may only be operated on by a user and/or an application in the presence of active tethers 106. In the absence of active tethers 106, the digital object 212 within the local secure container 104 may self-destruct after a timeout period. This measure of self-destruction in the absence of active tethers 106 may advantageously safeguard the digital objects 212 when a malicious party may break the local machine 102 and physically remove the hard drive containing the digital object 212.

[0067] Referring now to FIG. 7, and referring additionally to FIGS. 2 and 3, exemplary deployment approaches for secure containers 104 are described in detail. For example, and without limitation, the local secure containers 104 may be deployed as described in the following embodiments:

• • [0068] 1. Virtualization-based embodiment 300: In this approach, the secure container 104 may operate inside a virtual machine that may execute on top of a hypervisor installed in the host operating system (OS) on the local machine 102. The rendering software (such as word processing, spreadsheet application, published document viewers) may be pre-installed on the virtual machine image. The file system 210 of the virtual machine may be isolated from the file system 216 of the local machine 102.
  • [0069] 2. Container-based embodiment 302: In this approach, the secure container 104 may operate inside a container 104 (e.g., Docker or Linux Container) that may execute on top of a container engine installed in the host OS on the local machine 102. The rendering software may be pre-installed on the container storage 210. As in the case of virtual machines, the container file storage 210 may be isolated from the local machine file system 216.
  • [0070] 3. Remote Desktop-based embodiment 304: In this approach, the secure container 104 may operate inside a virtual machine in the cloud. The local machine 102 may establish a remote desktop connection to the virtual machine hosting the secure container 104. The rendering software may be pre-installed on the virtual machine image used for the secure container 104 instance in the cloud. Because the secure container 104 executes on separate instance, its file system 210 may be isolated from the local machine's file system 216.

[0071] Referring now to FIG. 8, and continuing to refer to FIG. 2, exemplary security layers for the present invention will be discussed in detail. Layer-1 400 may relate to the security of the cloud storage system 118. The security measures in this layer may include firewalls, authentication and authorization mechanisms, reporting of accesses and transmissions of digital objects and detection of suspicious activities and intrusions through the analysis of object access logs and network traffic. Layer-2 402 may relate to the security of the file system. The security measures in this layer may include tether connections for digital objects, the use of file permissions and access logs. Layer-3 404 may relate to the security of the local secure container 104. The security measures in this layer may include isolation of the secure container storage 210 from the local machine storage 216, access monitoring for digital objects and documents and the use of two-factor authentication mechanisms to access the secure container 104. Port blocking and software restriction policies may be setup to disable any form of internet access (browsing, emails, telnet, FTP, HTTP) to prevent leaks. The only enabled network connection may be between the secure container 104 and the host environment 100 in the cloud. To access a secure container 104, a user may authenticate with the container 104 using the user's credentials. Additional security may be enforced by the use of two-factor authentication. For example, and without limitation, the second factor may be one of the following:

• • [0072] A) Universal Two Factor (U2F) physical security key
  • [0073] B) Time-based OTP generated by an application (such as a smartphone app)
  • [0074] C) NFC tags/keys that authenticate with a smartphone application

[0075] Access to the objects 212 within the containers 104 may be secured by an additional layer through the use of tethers 106. Objects 212 may be accessed only in the presence of active tethers 106 and tethers 106 may be setup only in the allowed networks.

[0076] The secure containers 104 may log all the accesses to the objects 212 and the operations performed, as well as changes in status attempted or completed. The host 100 may monitor the lifecycle of tether connections 106 for all the objects 212. The analytics and reporting engine 114 in the host 100 may analyze these logs and available databases for detecting suspicious activities and intrusions.

[0077] FIG. 9 illustrates an example of digital object access meta-data 500 and FIG. 10 illustrates an example digital object access log 600. The host 100 may issue commands to the local container 104 to provide privileges (e.g., access and/or transaction priority) and/or to take action such as, for example, and without limitation, the following: delete or destroy digital objects 212, and track digital objects 212 or their environment (e.g., location, address, GPS, other sensor information in case of Internet of Things (IoT)). Tethers 106 may receive location, address information, GPS location, or other context information (e.g., proximity to other devices) from the secure container, which may have the ability to monitor its surroundings and those of users who are permitted to and/or are attempting to use the secure container's facilities. Tethers 106 may also link smartphones or other biometric devices to add to the security of the activities that are permitted. A tethered-application on an approved user's smartphone may be required to be present prior to anyone accessing or editing a digital object.

[0078] Referring now to FIG. 11, exemplary advantageous scenarios for the present invention are described in detail. For each scenario, the related security measures in the present invention are listed. These scenarios may hinge on advancing confidentiality, integrity and availability of information, and also on providing intelligence/counter-intelligence/information warfare (both defensive and offensive) capabilities.

[0079] Confidentiality measures in the present invention may advantageously protect sensitive information so that such information does not reach unauthorized parties. The following scenarios are related to confidentiality:

• • [0080] a) Prevent copying of digital objects to USB drive: A secure container's 104 file system 210 may be isolated from local machine's 102 file system 216. Digital objects 212 may not be copied/moved from the secure container 104 to the local machine 102. Applications on a local machine 102 may access and update the digital objects 212 through the proxy or agent 200 in the secure container 104. The digital objects 212 in a secure container 104 may be tethered (through two-way connections) 106 to the host environment 100 and may only be operated on by a user in the presence of active tethers 106.
  • [0081] b) Prevent uploading digital objects to cloud storage or FTP server: Port blocking may be executed on the secure container 104 to disable any form of internet access (browsing, emails, FTP) to prevent leaks (i.e., unauthorized dissemination of information as a result of intentional or unintentional acts or omissions). The only enabled internet or network connection may be between the secure container 104 and the host environment 100 in the cloud.
  • [0082] c) Prevent emailing of digital objects to third parties: Port blocking by the secure container 104 may prevent the digital objects 212 from being emailed to third parties.
  • [0083] d) Prevent copying of digital objects contents to another artifact (e.g., document or email): Clipboard sharing between local machine 102 and secure container 104 may be blocked. New digital objects 212 may be created within the secure container 104 only through the host 100.
  • [0084] e) Prevent unauthorized access and transmission of digital objects: A user may access only those digital objects 212 for which the user has permissions. Shared digital objects 212 may self-destruct when their tether(s) 106 become inactive. Digital objects 212 may only be operated on by a user or an application in the presence of active tethers 106. In the absence of active tethers 106 (e.g., state value of tether 106 is inactive), the digital objects 212 within the local secure container 104 may self-destruct after a timeout period. This capability may apply to any closed intranet system that does not communicate (and is not supposed to communicate) with any other system, and may address both internal and external attempts to illicitly transmit information.
  • [0085] f) Prevent screen capturing of documents: Screen captures may be discouraged by the secure container 104 overlaying a dynamic watermarking layer over the rendering application 214 (e.g. a moving watermark over the screen that contains user ID, name, etc.)
  • [0086] g) Prevent printing of documents: Port blocking and disabling spoolers by secure containers 104 may prevent printing of digital object 212 contents.

[0087] Integrity measures in the present invention may advantageously keep digitally-stored information accurate and reliable and prevent the information from being tampered or changed by unauthorized parties. The following scenario may be related to integrity:

• • [0088] a) Protect digital objects from being corrupted or updated by unauthorized, malicious or negligent users: The integrity of digital objects 212 may be protected by the use of tethers 106 and the document management service 116 of the cloud-based host environment 100. Authorized users may access and work on the digital objects 212 only when active tether connections 106 are present between the digital objects 212 and the host 100. Digital objects 120 may be securely saved on the host 100 and also replicated. Digital object versioning may be done within the host 100 so that multiple versions of the same digital object 120, 212 may be stored.

[0089] Availability measures in the present invention may advantageously ensure that the digitally-stored information is available to authorized parties when needed. The following scenario may be related to availability:

• • [0090] a) Protect digital objects from being deleted: In addition to stealing information, an insider or outsider may also seek to destroy information. Digital objects 212 may be replicated 120 on the cloud-based host environment 100 using the document management service 116. Such replication may minimize a bad actor's ability to destroy information.

[0091] Intelligence/counter-intelligence/information warfare measures in the present invention may advantageously collect and analyze information to detect suspicious activities and identify malicious insiders and/or external threats. Such measures also may advantageously gather information about an adversary through lawful injection of tracking or targeting programs on the adversary's systems. The following scenarios may be related to intelligence, counter-intelligence and information warfare:

• • [0092] a) Detect suspicious activities and intrusions: The access monitoring component 204 in a secure container 104 logs all object 212 accesses and reports to the analytics engine 114 in the cloud 100 through the tether connections 106. The cloud-based host environment 100 may employ big data analytics capabilities to analyze object access and detect any suspicious activities or intrusions.
  • [0093] b) Detect anomalous data access and data movement patterns: The host 100 may include analytics that may identify any behavior considered “anomalous”. Such behavior may include cutting and pasting large portions of files, copying large numbers of files, or any other behavior that may give rise to suspicion. The system may be flexible so that new analytics may be added or tweaked as intelligence or security officers identify new conduct that should be deemed anomalous or set different thresholds for what constitutes such behavior. When an anomaly occurs, the intelligence or security officer may be alerted and may then determine whether the conduct merits a follow-up investigation.
  • [0094] c) Identify potentially risky, malicious or negligent insiders: The big data analytics capabilities of the analytics and reporting engine 114 of the host 100 may be leveraged to identify potentially risky, malicious or negligent insiders. For each user, the system may compute a risk-score by analysis of the user's data access patterns and other behavior. Intelligence, counter-intelligence, or security officers may keep a strict vigil on the risky users so that corrective actions may be taken in a timely manner to prevent leaks.
  • [0095] d) Provide early warnings of data exfiltration: Any attempts for data exfiltration to unauthorized third parties may be identified by the analytics and reporting engine 114 of the host 100 through analysis of object access logs 122 and network traffic.
  • [0096] e) Provide offensive capabilities where intentional data leaks may be permitted to inject tracking or targeting programs on adversary systems: In certain circumstances (e.g., for the purposes of governments authorized by law to conduct such operations in accordance with applicable law such as, for example, and without limitation, pursuant to authorities in Title 10 (US Military activities) or Title 50 (US Intelligence Community activities), an agency may wish to permit the otherwise illicit transfer of certain files to clandestinely or covertly insert offensive, targeting or tracking programs on an adversary's systems. The document management service 116 of the cloud-based host 100 may provide such capability, which may include cyber weapons capability and/or an ability to collect data for law enforcement purposes (e.g., identify external threats). This is the manifestation of big-data analytics coupled with intelligence and counter-intelligence tradecraft, and information warfare doctrine.

[0097] An alternative embodiment of the present invention may complement certain features of the baseline embodiment described above (more specifically, in FIGS. 1 and 2) with support for processing of tether transactions using some combination of blockchain networks, encryption implementations, access patterns, and/or bidirectional authentication. Referring now to FIG. 12, for example, and without limitation, a secure digital object management (S-DOM) system employing any or all of these features, according to an embodiment of the present invention, may include a cloud-based host environment 100 configured in data communication with a local machine 102 that may host a secure container 104. Note: Features common both to the previously mentioned figures and to subsequently mentioned figures are consistently named and labeled hereinbelow.

[0098] As with the baseline embodiment of FIG. 2, the cloud-based host environment 100 of FIG. 12 may advantageously control the creation, lifecycle and destruction of digital objects by synchronizing and securing the digital objects from the host environment 100. The digital objects may be stored and replicated in the cloud-based host environment 100. An exemplary data analytics architecture of a cloud-based host environment 100 may include a cloud-object store 118 configured for storage of master digital objects 120. A document management service 116 may advantageously control the digital objects' 120 lifecycles. A meta-data database 124 within the host 100 may maintain information about the master digital objects 120 and their controlled instantiations of digital objects 212. An access-log 122 within the host 100 may record all digital object 120 accesses and transmissions.

[0099] The analytics and reporting engine 114 within the host 100 may employ big data tools and frameworks for batch or real-time analytics on available databases and meta-databases. The host 100 may further include application programming interfaces (APIs) 110 for creating, updating, and deleting digital objects, and for operating authentication and authorization 112 and analytics and reporting 114 functions. These APIs 110 may be used for developing document management and analytics applications that operate within an organization's network. For implementing the components within the cloud-based host environment 100, micro-services architectures may be used whereby each service may perform a predefined set of actions and may communicate with other services through the use of inter-service communication mechanisms as described above. In certain embodiments of the present invention, these services may be developed, deployed and scaled independently.

[0100] Still referring to FIG. 12, a secure container 104 may advantageously control access to digital objects 212. The secure container 104 may include a secure storage system 210 that may be isolated from the unsecured file system 216 of the local machine 102. Applications 214 on the local machine 102 may be configured to access and update digital objects 212 through a proxy or agent 200 included in and operated by the secure container 104. Digital objects 212 in the secure container 104 may be tethered 106 through a two-way connection to the host environment 100. Tethers 106 may be established between the objects 212 and the host environment 100 through the proxy 200. Tethers 106 may advantageously allow the host 100 to control access to and manipulation of objects 212 on the secure container 104.

[0101] Access rules and allowed operations 206 for the objects 212 on the local machine 102 may be determined by the host 100 and may be enforced using the tethers 106 through the proxy 200. Use of secure containers 104 having isolated storage 210 prevents unauthorized copying of objects 212 outside the containers 104 to the local storage 216. The access monitoring component 204 in the secure container 104 may log all object accesses and status changes (and/or attempted changes) and may report to the analytics engine 114 in the cloud-based host 100 through the tether connection(s) 106. Objects 212 may be automatically synchronized between the cloud-based host 100 and the secure container 104 by the file sync engine 208. Digital objects 212 may be deleted from the container 104 after access timeouts.

[0102] Continuing to refer to FIG. 12, the tether 106 may be implemented as an identifiable two-way data connection between a local object 212 on the local secure container 104 and a host object 120 on the cloud-based host environment 100. Tether identification may be accomplished using a unique tether identifier. Objects 212 may be coupled/connected via software pipes (or links over a network) to the host environment 100 through tethers 106. These two-way connections 106 may be used for control of objects 212 through conveyance of control conditions such as, for example, and without limitation, data, metadata, information and/or commands. Tether connections 106 may be of various kinds, including, for example, and without limitation, a persistent connection (TCP-based), UDP-based, or based on periodic data exchanges (REST-based), over wired and/or wireless networks. Objects 212 may be assigned unique IDs (either global, or only unique within a particular state, session or time context) which the host 100 may use for tracking through the tether connections 106. Object IDs may advantageously allow the host 100 to detect which objects 212 are false based on their ID and environment, and/or which objects 212 have been moved to new environments (either authorized or unauthorized). A group of digital objects 212 may be associated with a single tether 106.

[0103] Tethers 106 between the objects 212 in local secure containers 104 and the host 100 may be established over an organization's network or networks approved by the organization. Tethers 106 may prevent false replays or other attacks where an attacker tries to create an impression that the object 212 is in a trusted environment. Still referring to FIG. 12, in a direction of data communication from the container 104 to the host 100 over the tether 106, the secure container 104 may send object access monitoring data and object status changes and/or transactions data (executed or attempted) to the host 100. The container 104 may ping the host 100 for an active connection 106. Objects 212 may self-destruct or may be locked at the direction of the secure container 104 if the tether 106 breaks or times out. The secure container 104 may send application 214 requests to the host 100 to approve or deny an operation and/or to rollback a change. In a direction of data communication from the host 100 to the container 104 over the tether 106, the host 100 may transmit commands to create, synchronize, update and/or delete digital objects 212 on the container 104.

[0104] As a matter of definition, blockchain technology involves a distributed and public ledger which maintains records of all the transactions. Referring now to FIG. 15, for example, and without limitation, a blockchain network 900 is a truly peer-to-peer network in that it does not require a trusted central authority or intermediaries to authenticate and/or settle serviced transactions and/or to control the network infrastructure. Users may interact and transact with blockchain networks through Externally Owned Account (EOAs) 980, which are owned and controlled by the users. Each EOA has associated with it an account address 982, public-private keypair 984, and a balance 986 (in certain units of a cryptocurrency associated with the Blockchain network). EOAs do not have any associated code. All transactions on a blockchain network are initiated by EOAs. These accounts can send transactions 999 to other EOAs or contract accounts. Another type of accounts supported by second generation programmable Blockchain platforms are the Contract Accounts 988. A Contract Account 988 is created and owned by an EOA 980 and is controlled by the associated contract code 992 which is stored with the account. The contract code execution is triggered by transactions 999 sent by EOAs or messages sent by other contracts.

[0105] Blockchain networks can either be public or private. Public blockchain networks are free and open to all, and any user can create an account and participate in the consensus mechanism on a public blockchain and view all the transactions on the network. Private blockchain networks are usually controlled and operated by a single organization, and the serviced transactions can be viewed only by the users within the organization. Public blockchain networks are usually unpermissioned or permissionless, as any node can participate in consensus process. Some public blockchain networks adopt a permissioned model where the consensus process is controlled by a pre-selected set of nodes. Private blockchain networks usually adopt the permissioned model. While public blockchain networks can be considered as fully decentralized, private blockchain networks are partially decentralized.

[0106] Transactions sent to a blockchain network can be of two types: (1) transactions that transfer value from the sender account to another account, (2) transactions sent to a contract account to execute the contract code. When a transaction is sent to a blockchain network by a user, that transaction is cryptographically signed by the user's private key and is broadcast to the blockchain network. Nodes on the blockchain network, called ‘miners,’ validate the transactions and bundle the transactions into blocks. Blockchain networks use a distributed and decentralized consensus mechanism in which the nodes assemble the transactions into blocks and compete with each other (by performing computationally expensive calculations) to get their blocks added next to the blockchain. The consensus is based on choosing a block that has the most computation done upon it (i.e., the block with the highest total difficulty). The blocks produced by the miners are checked by other participating nodes for validity.

[0107] Because the miner nodes dedicate their computational resources for maintaining the blockchain network and mining new blocks, these nodes are given incentives in the form of some units of a cryptocurrency. The miners on a blockchain network compete to do a complex mathematical computation, and the miner that wins each round is the one whose block is added next to the chain. A mining reward is given to the miner whose block is added to the chain. The mining rewards serve two purposes: (1) they provide incentives to the nodes for supporting the network, and (2) they provide a way to generate and distribute new cryptocurrency into circulation as there is no central authority in the network to issue new cryptocurrency.

[0108] Continuing to refer to FIG. 12, a private and permissioned blockchain network 900 may be used for processing the transactions sent by the local proxy 200 to the cloud host 100 over tether connections 106. The blockchain service 902 within the cloud host may convert transaction requests received from the local proxy 200 into blockchain network specific transactions, and may process the results of these blockchain transactions so that the transaction results may be communicated back to the local proxy 200 over a tether connection 106.

[0109] Referring now to FIG. 16, a method aspect of the present invention for digital object creation is described in more detail. Note: Features common to both FIG. 5 and FIG. 16 are consistently named and labeled hereinbelow. FIG. 13 illustrates an example of digital object access meta-data 912 that features encryption key support as described below, and FIG. 14 illustrates an example digital object access log 914 of tether transactions records maintained by the cloud-based host environment, according to an embodiment of the invention.

[0110] Similar to the baseline embodiment described above (specifically, in FIG. 5), new controlled digital objects 212 may be created within the secure container 104 only through the host 100. For example, and without limitation, at Step 1 (610) a user may create a master digital object 120 from the host 100. Users registered with the secure digital object management system (S-DOM) can create objects from a host 100 dashboard. At Step 2 (612), the host 100 may create a new controlled digital object 212 on the cloud object store 118 and distribute the created controlled digital object 212 to the secure container 104. The controlled digital object 212 may be synchronized to the master digital object 120 on the host 100.

[0111] At this step (612), the meta-data associated with the controlled digital object 212 may be saved in a meta-data table within the meta-data database 124 in the host 100. The user may, at Step 3 (614), access a controlled digital object 212 using an S-DOM aware application installed on the local machine 102. As the controlled digital object 212 may be encrypted, the object 212 may be opened and interpreted only in the S-DOM aware application. When an object 212 is accessed in a S-DOM aware application, the application may cooperate with the local proxy 200 to setup a Tether connection. The local proxy 200, at Step 4 (616) then may setup a tether connection with the host 100. The local proxy 200, at Step 5 (618), may obtain the encryption key for the object 212 from the host 100 over the tether connection. After obtaining the encryption key, the object 212 may be decrypted and displayed in the S-DOM aware application. The object 212 may then be edited and saved. At Step 6 (620), the user may manipulate (e.g., update) the digital object 212 on the secure container using a S-DOM aware application.

[0112] Before an operation may be performed on the object 212, a check may be performed with the host environment 100 (over the tether connection 106). Objects may only be operated on in the presence of active tethers 106 and only the allowed operations (communicated over the tether 106) may be performed. Objects 212 may be disabled or destroyed and/or changes may be rolled back by commands sent by the host 100 over the tether 106. Other commands may also be sent by the host 100 via the tether 106.

[0113] When a file is edited and saved in the S-DOM aware application, the file may again by encrypted. At Step 8 (622), the local proxy may send a transaction for file update over the tether connection. At Step 9 (624), upon receiving the transaction, the cloud host 100 may create a blockchain transaction and may send the created transaction to the blockchain network 900. The blockchain network 900 may validate and process the transaction. When the transaction is approved by the blockchain network 900, the cloud-host may intimate the local proxy and the local syncher may then upload the object to the cloud host. At Step 9 (626) the cloud host may apply the updates to the master copy of the controlled digital object 120.

[0114] Consistency

[0115] Continuing to refer to FIG. 16, to ensure consistency of a shared digital object 120, where multiple users may access and modify the object, each event to update an object may be logged as a transaction on the blockchain network 900. These transactions may be sent over the tether connection 106 to the cloud host 100, which may create blockchain network specific transactions and may send the transaction to the blockchain network 900. The blockchain network 900 may validate and process the Tether transactions. Once a transaction to update a document is approved, the object may be synchronized from the local container 104 to the cloud host 100. The document management service 116 may compute and record the ‘deltas’ for the object 120 (i.e. changes from the previous version to the current version). The changes may then be applied to the master copy of the object 120 in the cloud host. The deltas for an object may allow rolling back an object to a previous version in a space-efficient manner. The blockchain network 900 may help in serializing the transactions for updating an object to ensure consistency when multiple users are working on the same object.

[0116] Dealing with Conflicting Updates

[0117] Continuing to refer to FIG. 16, conflicting updates can occur when two users simultaneously update the same controlled digital object 120. While processing a transaction for updating an object, the system may check if the transaction will result in a merge conflict. If so, the transaction may be denied. The user may then wait for the object to be synchronized again from the host 100 to the local secure container 104 and may reattempt the updates to the new version of the object. The use of Blockchain network 900 may add a consensus to the process of updating objects 120. A transaction to update an object may be approved only if there is consensus among the peers in the blockchain network 900.

[0118] Encryption Keys Management

[0119] Referring again to FIG. 12, creation, rotation and management of encryption keys using the present invention is described in more detail. The cloud host 100 may encrypt and store the controlled digital objects 120 in a cloud storage 118. The objects 120 may be encrypted and the cloud host service periodically may rotate the encryption keys. The cloud host 100 may distribute or synchronize the controlled digital objects 212 to a local secure container 104. Doing so may create local copies of these objects 212 in the local secure container 104. As the objects 212 are encrypted, these objects 212 cannot be interpreted in an application that is not S-DOM aware. Only an S-DOM aware application may open, interpret, edit and save the files in a local secure container 104, in the presence of active tether connections 106 from the local proxy 200 to the cloud host 100. The secure container 104 may allow applications on the local machine 102 to manipulate that controlled digital object 212 only as permitted by the tether 106. The key rotation policy may either be time-based rotation or session-based rotation. In time-based rotation, keys may be updated periodically. In session-based rotation, the keys may be updated for each new tether session.

[0120] Referring to FIG. 17, a method aspect of the present invention for key generation is described in more detail. An extension to Hierarchical Deterministic (HD) wallets, as illustrated, may add additional levels of security to counter leak of private extended keys. An HD wallet may contain a hierarchy of keys which may be derived in a tree structure. The master key in an HD wallet may be derived from a single root seed. HD wallets may use child key derivation (CKD) functions to derive children keys from parent keys. The children keys (public or private) may be derived from the parent keys, and a chain code which may add extra bits of entropy. The inputs to a CKD function may be a public or private key, a chain code and an index. The public or private and chain code may be combined to create an extended key (public or private). With a private extended key, it may be possible to derive the entire branch of keys in the sub-tree structure rooted at the private extended key. Whereas, with a public extended key only the public keys in the entire branch may be derived.

[0121] For each registered user in the S-DOM system, a ‘User HD Wallet’ may be created using the HD wallet mechanism described above. Next, for each object created by the user, a separate ‘Object HD Wallet’ may be created. The child keys in the Object HD Wallet 1004 may depend not just on their parent but also on the corresponding parent in the User HD Wallet 1002 (the key at the same path in the User HD wallet as the parent key).

[0122] Referring to FIG. 18, a method aspect of the present invention for the generation of child keys in the Object HD wallet 1004 is described in more detail. In a normal HD Wallet, the Child Key Derivation functions for private and public keys may be as follows:

• • [0123] CKDpriv((kpar, cpar), i) ? (ki, ci)
  • [0124] CKDpub((Kpar, cpar), i) ? (Ki, ci)
    where, child private key (ki) and child public key (Ki) depend on their parent's keys and the parent chain code.

[0125] For the Object HD Wallet 1004, enhanced child key derivation functions may be used as follows:

• • [0126] CKDprivTough((kpar, cpar), kparsuper, i) ? (ki, ci)
  • [0127] CKDpubTough((Kpar, cpar), Kparsuper, i) ? (Ki, ci)
    where, child private key (ki) and child public key (Ki) depend on their parent's keys, parent chain code and the corresponding key from the User HD Wallet 1002 (i.e., key at the same path as their parent).

[0128] For encrypting an object, a child private key may be used. The cloud host 100 may maintain a record of the path of the current child key being used for each object in the meta-data table. When the encryption key must be rotated, a new child key may be generated from the object's HD wallet and the derivation path of this new key may be updated in the meta-data table.

[0129] Benefits of using separate HD wallet for each user and each object may include the following:

[0130] Full encryption key need not be shared for an object from the cloud host 100 to the local proxy 200, over a tether connection. The cloud host may share the extended private key for the User HD wallet 1002 the first time the local proxy connects to the cloud host. The extended private key for the Object HD wallet 1004 may be shared when the object is first synced from the cloud host to the local secure container. Subsequently, the cloud host need only share the key derivation path over the tether connection with the local proxy. Given the knowledge of extended private keys for the User HD wallet 1002 and Object HD wallet 1004 and the key derivation path, the local proxy may generate the encryption key locally.

[0131] Because the child keys in the Object HD wallet 1004 depend not just on their parent but also on the corresponding parent in the User HD Wallet 1002, only the user who owns the object may generate the encryption key and decrypt the object.

[0132] Use of HD wallets may advantageously simplify the process for key rotation and management. When the key for an object must be rotated, a new child key in the object's HD wallet may be generated and the child key derivation path may be saved in the meta-data table. The new child key derivation path may be communicated to the local proxy over the tether connection.

[0133] Monitoring Access Patterns

[0134] Referring now to FIG. 12, a method aspect of the present invention for monitoring the access patterns for controlled digital objects is described in more detail. The cloud host 100, may monitor all tether connections 106 and may close the connections after a timeout period. Upon detection of certain conditions or patterns (for example, and without limitation, when a timeout period is reached or an anomalous data access pattern is detected), the cloud host 100 may sever the tether connection to stop any further manipulation of the controlled data object. When the tether connection 106 is closed, the secure container 200 may lock or delete the controlled digital object 212. The set of patterns may be added in the cloud host 100 in a pluggable manner. The set of patterns may be offered to end users as a subscription service.

[0135] Adaptive Patterns

[0136] Continuing to refer to FIG. 12, a method aspect of the present invention for adaptive learning of new patterns for detecting anomalous data access is described in more detail. The cloud host 100 may learn new patterns for detecting anomalous data access by analysis of data access logs 122. For example, and without limitation, the cloud host 100 may adopt an adaptive learning approach for learning new patterns by using inductive and deep learning methods. The set of patterns may be updated based on a weighted combination of short temporal window and long temporal window operations related to a single tether 106. The set of patterns may also be updated based on operations related to multiple tethers.

[0137] Securing Tethers

[0138] Continuing to refer to FIG. 12, a method aspect of the present invention for securing tether connections is described in more detail. A tether connection 106 may be implemented as an identifiable two-way data connection (e.g., bi-directional communication link using TCP, UDP, Sockets, REST or other similar network/internet protocols, for instance) between a local object 212 on the local secure container 104 and a host object 120 on the cloud host 100. Tether connections may be of various kinds, including, for example, and without limitation, a persistent connection (TCP-based), UDP-based, or based on periodic data exchanges (REST-based), over wired and/or wireless networks.

[0139] Referring now to FIG. 19, a method aspect of the present invention for bidirectional authentication to secure tether connections is described in more detail. To prevent spoofing of tether connections 106 and prevent man-in-the-middle attacks, bidirectional authentication may be used where the local proxy 200 and cloud host 100 authenticate each other. For example, and without limitation, a bidirectional authentication mechanism may involve the following data items:

[0140] User ID (UID)

[0141] Local Machine ID (MID)

[0142] Cipher Key (CK) may be used to encrypt the tether messages shared between the local proxy and cloud host.

[0143] Integrity Key (IK) may be used for integrity protection of the tether messages shared between the local proxy and cloud host.

[0144] Anonymity Key (AK) may be used in computing the Tether Authentication Number (TAN).

[0145] Sequence Number (SN)—A new SN may be generated on each Tether connection setup

[0146] Random Number (RN) may be generated using a random number generator

[0147] Message Authentication Code (MAC)

[0148] Tether Authentication Number (TAN)

[0149] At step 940, the local proxy 200 may initiate a tether session by sending a request to the cloud host 100 along with the User ID (UID) and Local Machine ID (MID). At step 942, the cloud host 100 may generate a random number (RN) and retrieves the next sequence number (SN). Referring now to FIG. 20 and continuing to refer to FIG. 19, a method aspect of the present invention for deriving authentication vectors at cloud host is described in more detail. The cloud host 100 may input the UID and RN to the authentication function f1 (960) and may feed the function f1 output to the authentication function f2 (962) to compute the RES field which may be used in a later process step. Similarly, the output of the authentication function f1 (960) may be given as input to authentication function f3 (964), f4 (966) and f5 (968) respectively to compute the Cipher Key (CK), Integrity Key (IK) and Anonymity Key (AK). Next the output of the authentication function f1 (960), Sequence Number (SN) and Local Machine ID (MID) may be given as input to the authentication function f6 (970) to compute the Message Authentication Code (MAC). The SN is then XORed with AK and concatenated to MID and MAC to compute the Tether Authentication Number (TAN). At step 942, the cloud host 100 may authenticate the host to the local proxy 200 by sending the RN and TAN.

[0150] Referring now to FIG. 21 and continuing to refer to FIG. 19, a method aspect of the present invention for deriving authentication vectors at the local proxy is described in more detail. At the local proxy, the UID and RN as given as input to the authentication function f1 (960) and its output may then be fed to authentication function f2 (962) to compute the RES field. Similarly, the output of the authentication function f1 (960) may be given as input to authentication function f3 (964), f4 (966) and f5 (968) respectively to compute the Cipher Key (CK), Integrity Key (IK) and Anonymity Key (AK). Next, the TAN and AK are XORed to get the SN. Next the output of the authentication function f1 (960), Sequence Number (SN) and Local Machine ID (MID) may be given as input to the authentication function f6 (970) to compute the Message Authentication Code (MAC). This MAC value may be compared with the MAC value obtained from the TAN field. If the MAC values match, the host 100 is successfully authenticated with the local proxy 200. At step 944, the local proxy may send the RES field that it computed to the cloud host 100. The cloud host 100 may compare the RES sent by local proxy 200 with own RES. If these RES values match, the local proxy is successfully authenticated with the cloud host 100. At step 946, the tether connection may be established and the cloud host 100 may send the tether ID to the local proxy 200. The local proxy and cloud host may then exchange messages securely over the tether connection. Each message may be encrypted by the Cipher Key (CK) and integrity protected by the Integrity Key (IK).

[0151] Use of Blockchain Network and Decentralized Storage Platform

[0152] Referring now to FIG. 22, a method aspect of the present invention for storing and managing the controlled digital objects using and a blockchain network and a decentralized storage platform is now described in more detail. In the blockchain based embodiment of the present invention, a private and permissioned blockchain network 900 may be used for processing the tether transactions and also for managing the controlled digital objects which may be stored in a decentralized storage platform. In this embodiment, the controlled digital objects may be stored on blockchain nodes 920 (or peers who participate in the blockchain network).

[0153] FIG. 22 shows an exemplary system for controlled digital object storage and management based on the Ethereum blockchain network 900 and blockchain nodes 920. Each blockchain node 920 may comprise an Ethereum client 922, a smart contracts compiler 924, Swarm client 926 and Whisper client 928. Swarm is a decentralized storage platform and content distribution service for the Ethereum blockchain platform. Swarm is designed to serve as a decentralized and redundant store of Ethereum's public record, and also to store and distribute Dapp code. Swarm is a peer-to-peer storage platform which is maintained by the peers who contribute their storage and bandwidth resources. Swarm is designed to dynamically scale up to serve popular content and, and features a mechanism to ensure the availability of the content which is not popular or frequently requested.

[0154] Blockchain based decentralized applications (Dapps) and smart contracts may be deployed on the blockchain nodes 920. The Dapps may use the Whisper communication protocol 930 to communicate with each other. With Whisper, Dapps may publish messages to each other. Whisper messages may be transient in nature and may feature a time-to-live (TTL) set. Each message may have one or more topics associated with it. The Dapps running on a node may inform the node about the topics to which they want to subscribe. Whisper may use topic-based routing where the nodes may advertise their topics of interest to their peers. Topics may be used for filtering the messages which may be delivered to a node which may then be distributed to the Dapps running on the node.

[0155] The consensus mechanism in the permissioned private blockchain network 900 may be controlled by a pre-selected set of nodes. Due to the permissioned model of consensus in a private chain, the consensus mechanism may be much faster than the consensus on public and unpermissioned blockchain networks. Benefits of using a private and permissioned blockchain network may include the following:

[0156] Immutable Record of Transactions: Blockchain is an immutable and durable data structure which may maintain a record of the transactions on a blockchain network. The transactions may be bundled into blocks and the blocks may be added to the blockchain through a consensus among the peers. Once a transaction is recorded in a block, that transaction cannot be altered or deleted as long as a majority of the computational power of the network is not controlled by peers who collude to alter the blockchain. The S-DOM system may use blockchain for recording and processing the tether transactions. The transactions logs may be used in system security audits and also identifying anomalous access patterns.

[0157] Secure and Transparent: Blockchain may provide greater security and transparency than centralized systems for device management. The transactions in a blockchain network may be viewed by any node in the network. Each node may keep a copy of all the transactions which may be bundled into blocks. While each miner on the network may create its own block, only the block which has a proof-of-work of a given difficulty is accepted to be added to the blockchain. The consensus mechanism may ensure that all the nodes agree on the same block to contain the canonical transactions. Blockchain may offer enhanced security as compared to centralized systems as every transaction is verified by multiple miners. The integrity of the transaction data recorded in the blocks may be protected through strong cryptography. In addition to the transaction data, each block may contain a cryptographic hash of itself and the hash of the previous block. Any attempts to modify a transaction would result in a change in the hash and would require all the subsequent blocks to be recomputed. This would be extremely difficult to achieve as long as the majority of miners do not cooperate to attack the network. Thus, blockchain when used for controlling updates to controlled digital objects may prevent the objects from being modified by unauthorized users. Any transactions sent by rogue or unauthorized users to update a controlled digital object will be rejected by the consensus mechanism on the blockchain.

[0158] Securing Data in Local Secure Container

[0159] Referring now to FIG. 23, a local secure container with enhanced data security features according to an embodiment of the invention, is described in more detail. In this embodiment of the local secure container, the encrypted controlled digital objects 212 may be broken down into fixed-size chunks and each chunk may then be encrypted and stored on the local filesystem. When an object 212 is synchronized from the host 100 to the local secure container 104, the data chunker 1202 may break the object into fixed size chunks. Each chunk may then be encrypted by the chunk encryptor 1204 and then stored on the local machine. The controlled digital objects 212 may be accessed using S-DOM aware applications 214 only. When a user accesses an object through the secure container's object browser 1212 using an S-DOM aware application 214, all the chunks associated with the object may be loaded, decrypted and assembled from the chunk store on the local file system to the in-memory container data store. The objects in the container data store may still be in an encrypted form. The local proxy then may setup a tether connection with the host 100. The local proxy 200 may obtain the encryption key for the object 212 from the host 100 over the tether connection. After obtaining the encryption key, the object 212 may be decrypted and displayed in the S-DOM aware application. The object 212 may then be edited and saved.

[0160] The secure container may provide a sandbox environment on a local machine. The local secure container may be implemented as a collection of software processes including the proxy/agent 200, an in-memory container data store 1200, data chunker 1202, chunk encryptor 1204, chunk decryptor 1208, chunk assembler 1210 and an object browser 1212. The secure container may additionally have S-DOM aware applications bundled into it.

[0161] While the applications which are not S-DOM aware may attempt to access the encrypted data chunks 1206 stored on the local file system, such applications would be unable to re-generate the objects 212 as the all the chunks are of a fixed size and such applications have no way to know the chunks that constitute an object. Furthermore, because the chunks themselves are encrypted, it adds to an additional level of security. Even if an attacker manages to identify the chunks that constitute an object and decrypt and assemble the chunks to generate an object 212, the resulting object would still be encrypted and the encryption key would have to be obtained from the host 100 over a valid tether connection. Thus copying, moving or sharing the encrypted data chunks 1206 would be of no use for an attacker or a malicious insider.

[0162] Micro-Control of S-DOM Aware Applications

[0163] Referring now to FIG. 22, a method aspect of the present invention for micro-control of features in S-DOM aware applications is described in more detail. When a controlled object 212 is accessed from a S-DOM aware application 214, the application may obtain the encryption key for the object from the host 100 via the tether connection. The host 100 may additionally send commands to enable or disable certain features (or operations) in the S-DOM aware application that accesses a controlled digital object 212. For example, and without limitation, the host 100 may send a command to disable the “Save” or “Print” options in the S-DOM aware application. When such commands are sent, the corresponding options may then be enabled or disabled S-DOM aware application. The menu options (and other operations) in the S-DOM aware applications may be tied to the commands sent over the tether connection such that these options may be enabled or disabled based on the context and allowed operations on an object. An S-DOM plugin or extension may be used within the application to allow such micro-control over the application features and operations.

[0164] In another embodiment, a set of keys (which are rotated periodically by the host) may be used for each object, where each key has a function (for example, and without limitation, to decrypt the object, enable/disable certain menu options, enable/disable allowed operations). The host may manage the keys for each object in the hierarchical structure. The host may share only those keys with the secure container which may be required to perform the allowed operations on an object. If certain operations are to be blocked (for example, editing or saving an object), the host may withhold the keys associated with such operations.

[0165] A skilled artisan will note that one or more of the aspects of the present invention may be performed on a computing device. The skilled artisan will also note that a computing device may be understood to be any device having a processor, memory unit, input, and output. This may include, but is not intended to be limited to, cellular phones, smart phones, tablet computers, laptop computers, desktop computers, personal digital assistants, etc. FIG. 25 illustrates a model computing device in the form of a computer 810 which is capable of performing one or more computer-implemented steps in practicing the method aspects of the present invention. Components of the computer 810 may include, but are not limited to, a processing unit 820, a system memory 830, and a system bus 821 that couples various system components including the system memory to the processing unit 820. The system bus 821 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI).

[0166] The computer 810 may also include a cryptographic unit 825. Briefly, the cryptographic unit 825 has a calculation function that may be used to verify digital signatures, calculate hashes, digitally sign hash values, and encrypt or decrypt data. The cryptographic unit 825 may also have a protected memory for storing keys and other secret data. In other embodiments, the functions of the cryptographic unit may be instantiated in software and run via the operating system.

[0167] A computer 810 typically includes a variety of computer readable media. Computer readable media can be any available media that can be accessed by a computer 810 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may include computer storage media and communication media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, FLASH memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer 810. Communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media.

[0168] The system memory 830 includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) 831 and random access memory (RAM) 832. A basic input/output system 833 (BIOS), containing the basic routines that help to transfer information between elements within computer 810, such as during start-up, is typically stored in ROM 831. RAM 832 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit 820. By way of example, and not limitation, FIG. 25 illustrates an operating system (OS) 834, application programs 835, other program modules 836, and program data 837.

[0169] The computer 810 may also include other removable/non-removable, volatile/nonvolatile computer storage media. By way of example only, FIG. 25 illustrates a hard disk drive 841 that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive 851 that reads from or writes to a removable, nonvolatile magnetic disk 852, and an optical disk drive 855 that reads from or writes to a removable, nonvolatile optical disk 856 such as a CD ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. The hard disk drive 841 is typically connected to the system bus 821 through a non-removable memory interface such as interface 840, and magnetic disk drive 851 and optical disk drive 855 are typically connected to the system bus 821 by a removable memory interface, such as interface 850.

[0170] The drives, and their associated computer storage media discussed above and illustrated in FIG. 25, provide storage of computer readable instructions, data structures, program modules and other data for the computer 810. In FIG. 25, for example, hard disk drive 841 is illustrated as storing an OS 844, application programs 845, other program modules 846, and program data 847. Note that these components can either be the same as or different from OS 833, application programs 833, other program modules 836, and program data 837. The OS 844, application programs 845, other program modules 846, and program data 847 are given different numbers here to illustrate that, at a minimum, they may be different copies. A user may enter commands and information into the computer 810 through input devices such as a keyboard 862 and cursor control device 861, commonly referred to as a mouse, trackball or touch pad. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit 820 through a user input interface 860 that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). A monitor 891 or other type of display device is also connected to the system bus 821 via an interface, such as a graphics controller 890. In addition to the monitor, computers may also include other peripheral output devices such as speakers 897 and printer 896, which may be connected through an output peripheral interface 895.

[0171] The computer 810 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 880. The remote computer 880 may be a personal computer, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer 810, although only a memory storage device 881 has been illustrated in FIG. 25. The logical connections depicted in FIG. 25 include a local area network (LAN) 871 and a wide area network (WAN) 873, but may also include other networks 140. Such networking environments are commonplace in offices, enterprise-wide computer networks, intranets and the Internet.

[0172] When used in a LAN networking environment, the computer 810 is connected to the LAN 871 through a network interface or adapter 870. When used in a WAN networking environment, the computer 810 typically includes a modem 872 or other means for establishing communications over the WAN 873, such as the Internet. The modem 872, which may be internal or external, may be connected to the system bus 821 via the user input interface 860, or other appropriate mechanism. In a networked environment, program modules depicted relative to the computer 810, or portions thereof, may be stored in the remote memory storage device. By way of example, and not limitation, FIG. 25 illustrates remote application programs 885 as residing on memory device 881.

[0173] The communications connections 870 and 872 allow the device to communicate with other devices. The communications connections 870 and 872 are an example of communication media. The communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. A “modulated data signal” may be a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Computer readable media may include both storage media and communication media.

[0174] Those skilled in the art will appreciate that the present invention contemplates the use of data structures that may store information supporting any or all of the operations involved in inventory management. The disclosure of the exemplary data structures above is not meant to be limiting in any way. Those skilled in the art will readily appreciate that data structures may include any number of additional or alternative real world data sources, and may be configured in any way while still accomplishing the many goals, features and advantages according to the present invention.

[0175] Some of the illustrative aspects of the present invention may be advantageous in solving the problems herein described and other problems not discussed which are discoverable by a skilled artisan.

[0176] While the above description contains much specificity, these should not be construed as limitations on the scope of any embodiment, but as exemplifications of the presented embodiments thereof. Many other ramifications and variations are possible within the teachings of the various embodiments. While the invention has been described with reference to exemplary embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the invention. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the invention without departing from the essential scope thereof. Therefore, it is intended that the invention not be limited to the particular embodiment disclosed as the best or only mode contemplated for carrying out this invention, but that the invention will include all embodiments falling within the scope of the appended claims. Also, in the drawings and the description, there have been disclosed exemplary embodiments of the invention and, although specific terms may have been employed, they are unless otherwise stated used in a generic and descriptive sense only and not for purposes of limitation, the scope of the invention therefore not being so limited. Moreover, the use of the terms first, second, etc. do not denote any order or importance, but rather the terms first, second, etc. are used to distinguish one element from another. Furthermore, the use of the terms a, an, etc. do not denote a limitation of quantity, but rather denote the presence of at least one of the referenced item.

[0177] Thus the scope of the invention should be determined by the appended claims and their legal equivalents, and not by the examples given.