Endpoint Encryption Key Isolation for Compromised Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for improved endpoint security using encryption to prevent data leakage and other negative consequences for compromised endpoints in enterprise networks, as existing methods are inadequate in securing sensitive information from malicious actors.
Innovation Solution
A system and method for creating portable encrypted content, where an endpoint encrypts local files with a key, revokes access if compromised, and provides a secondary key for open files to isolate data while maintaining accessibility, using a remote key server and user authentication to manage encryption and decryption processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted with a single key on the endpoint, then security is improved, but accessibility and continued operation after key revocation deteriorate
Solution Approach 1:
The patent divides the encryption key management into multiple independent keys (first key and second key). The first key is used for initial file encryption, while the second key is specifically generated for re-encrypting open files after key revocation. This segmentation allows the system to maintain security by isolating key usage while preserving accessibility through the second key that can decrypt re-encrypted files without requiring the original first key.
Solution Approach 2:
The patent performs preliminary action by proactively re-encrypting open files with a second key before the original key needs to be revoked. This advance preparation ensures that when security compromise is detected and the first key is revoked, the open files are already protected by the second key, allowing continued operation without interruption. The system anticipates the need for key rotation and prepares accordingly.
2Reliability
If encryption keys are dynamically managed to prevent data leakage, then security is improved, but system complexity increases
Solution Approach 1:
The patent introduces a key management server as an intermediary that handles the complexity of cryptographic key generation, distribution, and revocation. Instead of implementing complex key management logic directly in the endpoint application, the system delegates these functions to a dedicated server that can securely generate keys, associate them with file identifiers, and manage key lifecycle. This intermediary absorbs the system complexity while providing simple interfaces to the endpoint.
Solution Approach 2:
The patent extracts the complex key management functionality from the endpoint application and places it in a separate key management server. This extraction removes the burden of managing cryptographic key lifecycles, security policies, and revocation procedures from the endpoint system, concentrating this complexity in a specialized component that can be independently managed and updated without affecting the endpoint application.
3Reliability
If all files are re-encrypted with a new key when security compromise is detected, then security is improved, but productivity and performance deteriorate
Solution Approach 1:
The patent applies partial action by re-encrypting only the subset of files that are currently open or actively being accessed when a security compromise is detected, rather than re-encrypting the entire file repository. This selective approach focuses computational resources on protecting the most critical files that users are actively working with, while leaving other files encrypted with the original key structure. This partial re-encryption significantly reduces the performance impact while still providing security for active operations.
Data Source
AI summary
An endpoint encrypts local files with a key to protect file contents. If the endpoint or processes on the endpoint becomes exposed to potentially harmful locations or resources, the key can be revoked to prevent access to encrypted files on the endpoint. In order to facilitate continued operation of the endpoint, files that are currently open can be encrypted with a second key so that the corresponding data is isolated from the other encrypted files while remaining accessible to current users.