Patent ID: 10594654

Abstract:
The invention relates to the field of data processing in a distributed environment, and more particularly control of movement of data and processes so as to achieve a protection that ensures that sensitive data and processes is not moved to untrusted domains. This is achieved by a method and apparatus for tagging of data with a trust level, comprising configuring a data analysis policy for mapping data elements to one of a number of trust levels; receiving a data flow; inspecting the data flow and identifying data elements to be tagged; for a data element to be tagged, analyzing the data element and mapping it to a trust level according to the data analysis policy; and adding the mapped trust level to the data element. This is further achieved by a method and apparatus for data protection, comprising: within a domain as defined by a boundary (10) within which controlled trust levels prevail, starting a service request with associated data to be processed; inspecting a trust level of the data; locating a processing unit (PU) having an associated trust level. Depending on the location of the processing unit within or without the domain, and on the trust level of the located processing unit relative to the trust level of the data, the data is sent out from the domain to the processing unit for processing; or sent to the processing unit configured inside the domain for processing; or the trust level of the data is downgraded to be equal or less than the trust level of the processing unit, and the downgraded data is sent out from the domain to the processing unit for processing.