Patent ID: 8689349

Claim:
A method, comprising: specifying, by an application residing in an un-trusted source software environment in a local computing device, a data protection policy defined by a first set of security tags to govern access to protected data stored in a first memory page of a plurality of memory pages in the local computing device; maintaining a tag database for the plurality of memory pages in the local computing device, the tag database identifying which memory pages of the plurality of memory pages are protected and comprising a plurality of tags, wherein a given tag of the plurality of tags is associated with a given memory page of the plurality of memory pages; mapping, by a tag policy conversion module executed in a trusted software environment of the local computing device, the first set of security tags defining the data protection policy specified by the application residing in the un-trusted software environment to a second set of security tags that are different from the first set of security tags and define a separate, enforceable system-level data protection policy managed by an Information Flow Tracking and Protection (IFTP) logic on the local computing device to convert the specified data protection policy to the enforceable system-level data protection policy; tagging the first memory page containing the protected data; enforcing the specified data protection policy for the first memory page containing the protected data using the IFTP logic and the enforceable system-level data protection policy; coupling (i) one or more tags of the plurality of tags associated with the protected data and (ii) the data protection policy to a network packet; and transferring the protected data from the local computer system to a remote computer system across a network in the network packet.