Organization Data Protection via Selective Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Companies face challenges in maintaining control over confidential data on personal computing devices used by employees, as existing methods for data protection often result in the deletion of all data, including personal files, when corporate data is wiped.
Innovation Solution
An organization data protection system exposes an API that allows applications to encrypt data with organization-specific keys and manage decryption keys, ensuring that only organization data can be decrypted, while personal data remains accessible.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a wipe command is sent to delete all data on the device, then corporate data protection is improved, but user convenience deteriorates because personal data is also deleted
Solution Approach 1:
The patent segments data on the device into corporate data and personal data using separate encryption keys. Corporate data is encrypted with a corporate key that can be wiped, while personal data retains its accessibility. This segmentation allows selective deletion of corporate data without affecting personal data, resolving the contradiction between data protection and user convenience.
Solution Approach 2:
The patent extracts the corporate data from the general data storage and applies a separate encryption mechanism. By taking out corporate data and encrypting it with a dedicated key, the system enables independent management of corporate data, allowing it to be wiped without deleting personal data, thus maintaining both security and user convenience.
2Ease of operation
If encryption keys are stored on the device, then data accessibility is improved, but security deteriorates because keys can be compromised
Solution Approach 1:
The patent introduces a key management service as an intermediary between the device and the encryption keys. Instead of storing keys directly on the device, the system uses a remote key management service that can provide keys to authorized devices. This intermediary enables secure key distribution while maintaining data accessibility, as keys are only available to authenticated devices needing access.
Data Source
AI summary
An application on a device can communicate with organization services. The application accesses a protection system on the device, which encrypts data obtained by the application from an organization service using an encryption key, and includes with the data an indication of a decryption key usable to decrypt the encrypted data. The protection system maintains a record of the encryption and decryption keys associated with the organization. The data can be stored in various locations on at least the device, and can be read by various applications on at least the device. If the organization determines that data of the organization stored on a device is to no longer be accessible on the device (e.g., is to be revoked from the device), a command is communicated to the device to revoke data associated with the organization. In response to this command, the protection system deletes the decryption key.