Endpoint File Encryption with Remote Key Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for improved endpoint security using encryption to prevent data leakage and other negative consequences for compromised endpoints in enterprise networks, as existing methods are inadequate in dynamically securing and remediating threats.
Innovation Solution
A system and method for creating portable encrypted content, where newly detected files are dynamically encrypted, and if an endpoint is compromised, encryption is suspended until the compromise is resolved, using a remote key server for cryptographic keys and user authentication to ensure secure file access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are dynamically encrypted on an endpoint, then data security is improved, but if the endpoint is compromised, encryption operations may fail or leak data
Solution Approach 1:
A remote key server acts as an intermediary between the endpoint and cryptographic keys. The key server stores encryption keys securely and provides them to authorized applications. This separates key storage from the potentially compromised endpoint, ensuring that even if malware is present on the endpoint, it cannot access or exfiltrate the keys needed to decrypt sensitive data.
Solution Approach 2:
The system performs preliminary actions by pre-establishing security policies, authentication mechanisms, and key management protocols before encryption operations begin. The endpoint must authenticate with the key server and establish trusted relationships before any file encryption or decryption occurs, ensuring that compromised endpoints cannot perform unauthorized operations.
2Speed
If encryption operations are performed locally on the endpoint, then access speed is improved, but security control and key management become more complex
Solution Approach 1:
The system extracts key management functionality from the endpoint and places it on a dedicated remote key server. This separates the complex key management operations from the local encryption operations, allowing the endpoint to focus on fast local encryption/decryption while the server handles key storage, distribution, and security policies.
Solution Approach 2:
The system moves key management from a single-dimension local process to a multi-dimensional distributed architecture involving endpoint, key server, and security policies. This adds the network communication dimension but resolves the complexity by distributing functions across different layers of the system architecture.
3Difficulty of detecting and measuring
If the endpoint continuously monitors for compromise, then security detection capability is improved, but system performance and resource usage increase
Solution Approach 1:
The system implements feedback mechanisms where the endpoint periodically reports its security state to the key server, and the key server responds with authorization decisions. This continuous feedback loop enables compromise detection without requiring constant intensive monitoring, as the endpoint only needs to report when state changes occur or at scheduled intervals.
Data Source
AI summary
On an endpoint that encrypts local files to protect against data leakage and other harmful malware events, newly detected files are dynamically encrypted when they are detected as long as the endpoint is not compromised. If a compromised state is detected, the newly detected file will not be added to the encrypted files until the endpoint can be remediated and the compromised state resolved.