Passive Encryption for Legacy Data Without Usability Loss
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Companies face challenges in maintaining control over confidential data stored on personal computing devices used for work, as existing encryption methods often interfere with device usability and may not effectively encrypt files created before a data protection policy is implemented.
Innovation Solution
A passive encryption system that uses techniques like 'encrypt on close,' 'encrypt on open,' 'encrypt without exclusive access,' and 'encrypt location' to encrypt files based on specific conditions, ensuring data protection without significantly impacting device operation, by detecting file access and usage patterns to determine the optimal encryption time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted immediately when a data protection policy is implemented, then data security is improved, but device usability and program operation are worsened due to interference with active file access
Solution Approach 1:
The system performs preliminary detection of file access patterns and program usage before encryption. It monitors which programs are currently accessing files and queues encryption operations for when files are not in use, thus preparing the encryption action in advance without immediately interfering with active operations
Solution Approach 2:
The encryption timing is made dynamic rather than static. The system continuously monitors file access states and adjusts encryption timing based on real-time conditions, encrypting files when they transition to an inaccessible state rather than forcing immediate encryption that would disrupt ongoing operations
2Ease of operation
If files are encrypted only when not accessed by programs, then device usability is improved, but data security is worsened due to potential delays in encryption
Solution Approach 1:
The system implements continuous feedback monitoring of file access states. It tracks which programs are accessing which files and uses this feedback information to determine the optimal encryption moment, ensuring files are encrypted as soon as they become unavailable without requiring manual intervention or造成 significant delays
Solution Approach 2:
The encryption system serves itself by automatically detecting when files are ready for encryption and initiating the encryption process without external intervention. The system monitors its own conditions and autonomously decides when to encrypt, eliminating the need for user input while maintaining both security and usability
3Reliability
If encryption is performed on files created before data protection policy implementation, then comprehensive data protection is improved, but system complexity increases due to detecting and managing legacy files
Solution Approach 1:
The encryption system is designed to universally handle both legacy files (created before policy implementation) and new files (created after policy implementation) through the same monitoring and encryption mechanism. The system does not require separate handling logic for different file types, simplifying the overall system architecture while achieving comprehensive protection
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A data protection policy is implemented on a computing device, the data protection policy indicating how organization data on the computing device is to be protected. Protection of the organization data includes encrypting the organization data, and allowing the organization data to be decrypted only by particular programs and/or under particular circumstances (as indicated by the data protection policy). When implementing a data protection policy, files already stored on the computing device are encrypted using a passive encryption technique. The passive encryption technique can include one or more of an encrypt on close technique, an encrypt on open technique, an encrypt without exclusive access technique, and an encrypt location technique.