Method for Ensuring Data Localization on an Ad Hoc Moving Data Network

Abstract

The present disclosure provides methods operable in a balloon network. The method can include determining that a balloon is at a location associated with a legally-defined geographic area. An area profile of the legally-defined geographic area may identify geographically-restricted data that must not be removed from the legally-defined geographic area. The method can also include determining that the balloon contains at least some of the geographically-restricted data. The method can also include determining that the balloon is likely to move out of the legally-defined geographic area. The method can also include removing the geographically-restricted data from the memory of the balloon.

We claim: 
     
         1 . A computer-implemented method comprising:
 determining that a first balloon is at a location associated with a legally-defined geographic area, wherein a balloon network provides service in a plurality of legally-defined geographic areas, and wherein an area profile identifies geographically-restricted data that must not be removed from the legally-defined geographic area;   determining that the first balloon contains at least some of the geographically-restricted data;   determining that the first balloon is likely to move out of the legally-defined geographic area; and   responsively removing the geographically-restricted data from the memory of the first balloon prior to the first balloon leaving the legally-defined geographic area.   
     
     
         2 . The method of  claim 1 , wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the method further comprising:
 responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon.   
     
     
         3 . The method of  claim 2 , wherein the device receiving the geographically-restricted data from the first balloon is a second balloon located in the legally-defined geographic area. 
     
     
         4 . The method of  claim 2 , wherein the device receiving the geographically-restricted data from the first balloon is a ground-based station located in the legally-defined geographic area. 
     
     
         5 . The method of  claim 2 , wherein the geographically-restricted data is transferred via a RF air-interface. 
     
     
         6 . The method of  claim 2 , wherein the geographically-restricted data is transferred via a free-space optical link. 
     
     
         7 . The method of  claim 1 , wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the method further comprising:
 determining if a second balloon located in the legally-defined geographic area contains the geographically-restricted data;   responsive to the determination that the second balloon does not include the geographically-restricted data, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon.   
     
     
         8 . The method of  claim 1 , wherein determining the first balloon is likely to move out of the legally-defined geographic area comprises:
 determining a direction in which the first balloon is travelling;   based on the direction in which the first balloon is travelling, determining a probability that the first balloon will move out of the legally-defined geographic area; and   determining that the probability that the first balloon will move out of the legally-defined geographic area is greater than a threshold probability.   
     
     
         9 . A method operable by a first balloon in a balloon network, the method comprising:
 receiving at least a portion of geographically-restricted data when the first balloon enters a legally-defined geographic area;   determining that the legally-defined geographic area has an area profile that identifies geographically-restricted data that must not be removed from the legally-defined geographic area;   determining that the first balloon is likely to move out of the legally-defined geographic area; and   responsively removing the geographically-restricted data from the memory of the first balloon prior to the first balloon leaving the legally-defined geographic area.   
     
     
         10 . The method of  claim 9 , wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the method further comprising:
 responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon.   
     
     
         11 . The method of  claim 9 , wherein the device receiving the geographically-restricted data from the first balloon is a second balloon located in the legally-defined geographic area. 
     
     
         12 . The method of  claim 9 , wherein the device receiving the geographically-restricted data from the first balloon is a ground-based station located in the legally-defined geographic area. 
     
     
         13 . The method of  claim 9 , wherein the geographically-restricted data is transferred via a RF air-interface. 
     
     
         14 . The method of  claim 9 , wherein the geographically-restricted data is transferred via a free-space optical link. 
     
     
         15 . The method of  claim 9 , wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the method further comprising:
 determining if a second balloon located in the legally-defined geographic area contains the geographically-restricted data;   responsive to the determination that the second balloon does not include the geographically-restricted data, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon.   
     
     
         16 . The method of  claim 9 , wherein determining the first balloon is likely to move out of the legally-defined geographic area comprises:
 determining a direction in which the first balloon is travelling;   based on the direction in which the first balloon is travelling, determining a probability that the first balloon will move out of the legally-defined geographic area; and   determining that the probability that the first balloon will move out of the legally-defined geographic area is greater than a threshold probability.   
     
     
         17 . A non-transitory computer-readable medium storing instructions that, when executed by one or more processors in a computing device, cause that computing device to perform functions, the functions comprising:
 determining that a first balloon is at a location associated with a legally-defined geographic area, wherein a balloon network provides service in a plurality of legally-defined geographic areas, and wherein an area profile identifies geographically-restricted data that must not be removed from the legally-defined geographic area;   determining that the first balloon contains at least some of the geographically-restricted data;   determining that the first balloon is likely to move out of the legally-defined geographic area; and   responsively removing the geographically-restricted data from the memory of the first balloon prior to the first balloon leaving the legally-defined geographic area.   
     
     
         18 . The non-transitory computer-readable medium of  claim 17 , wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the functions further comprising:
 responsive to the determination that the first balloon is likely to move out of the legally-defined geographic area, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon.   
     
     
         19 . The non-transitory computer-readable medium of  claim 17 , wherein the area profile further requires that the geographically-restricted data be saved in at least one location in the legally-defined geographic area, the functions further comprising:
 determining if a second balloon located in the legally-defined geographic area contains the geographically-restricted data;   responsive to the determination that the second balloon does not contain the geographically-restricted data, transferring the geographically-restricted data from the first balloon to a device that is located in the legally-defined geographic area, before removing the geographically-restricted data from the memory of the first balloon.   
     
     
         20 . The non-transitory computer-readable medium of  17 , wherein determining the first balloon is likely to move out of the legally-defined geographic area comprises the functions of:
 determining a direction in which the first balloon is travelling;   based on the direction in which the first balloon is travelling, determining a probability that the first balloon will move out of the legally-defined geographic area; and   determining that the probability that the first balloon will move out of the legally-defined geographic area is greater than a threshold probability.