Mobile Device Cache Key Management for Enterprise Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise data on mobile devices is at risk due to lack of control over encryption/decryption keys, which can be unintentionally decrypted and exposed when stored on personal devices used outside the work environment.
Innovation Solution
Implementing a method where mobile computing devices temporarily store encryption/decryption keys in cache memory with a time-to-live threshold, requiring re-fetch from the enterprise network if not accessed within that time, ensuring secure access and deletion of keys to maintain data security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption/decryption tools are installed on the mobile computing device to encrypt and decrypt enterprise data, then data security is improved, but the risk of exposure increases because users can unintentionally decrypt data and make it available
Solution Approach 1:
The decryption key is extracted from permanent storage and placed in cache memory, a temporary storage location that is automatically cleared. This separates the key from the data and ensures the key does not persist on the device, eliminating the risk of unauthorized access to stored keys while maintaining decryption capability when needed.
Solution Approach 2:
The system dynamically manages the decryption key by loading it into cache memory only when needed for decryption operations and automatically removing it after use or when cache space is needed. This dynamic approach ensures the key is available when required but does not remain stored, balancing security and functionality.
2Speed
If decryption keys are stored permanently on the mobile computing device for quick access, then decryption speed is improved, but security control is lost as keys remain accessible outside work environments
Solution Approach 1:
The decryption key is treated as a short-lived object that exists only temporarily in cache memory during active use. Rather than creating a persistent copy on the device, the system uses the key only when needed and then discards it, ensuring fast decryption when required while preventing long-term exposure risks.
3Productivity
If enterprise data is stored on personal mobile devices to enable productivity enhancements, then employee productivity is improved, but control over data access is reduced when devices are used outside work environments
Solution Approach 1:
Cache memory serves as an intermediary between the encrypted enterprise data and the decryption key. The key is introduced temporarily to perform the decryption function and then removed, allowing data access on personal devices while maintaining enterprise control through the temporary nature of key availability.
Data Source
AI summary
Embodiments include method, systems and computer program products for securing enterprise data in a mobile computing environment. Aspects include receiving a request to access the enterprise data stored on the mobile computing device in an encrypted format and determining whether a decryption key is stored in a cache memory of the mobile computing device. Based on determining that the decryption key is not stored in a cache memory of the mobile computing device, aspects include transmitting a request to an enterprise network for the decryption key and receiving the decryption key and storing the decryption key in the cache memory. Aspects also include decrypting the enterprise data using the decryption key and deleting the decryption key from the cache memory based on a determination that the decryption key has not been accessed for a period of time greater than a threshold time.