Perimeter Encryption Enforcement for Outbound File Attachments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for improved endpoint security using encryption to prevent data leakage and other negative consequences for compromised endpoints in enterprise networks, as existing methods are inadequate in securing sensitive information from malicious actors.
Innovation Solution
A computer program product and method that creates portable encrypted content by receiving a file selection from a user, requesting a token from a remote identity and access management system, obtaining a cryptographic key from a remote key server, encrypting the file with the encryption key, and combining it with an encrypted decryption key, providing a user interface for local or remote decryption, ensuring secure distribution over a network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted with remote key management, then security against compromised endpoints is improved, but system complexity increases due to token management and remote key server integration
Solution Approach 1:
The patent introduces a remote key server and identity and access management system as intermediaries between the endpoint and the encrypted files. These intermediaries manage cryptographic keys and tokens, allowing the endpoint to encrypt and decrypt files without storing sensitive key material locally, thereby improving security while managing complexity through centralized key management infrastructure.
Solution Approach 2:
The encryption system is segmented into distinct functional components: local encryption/decryption operations on the endpoint, remote key management on the key server, and identity verification through the identity and access management system. This segmentation allows each component to be optimized independently and reduces the security burden on any single device.
2Ease of operation
If decryption keys are stored locally for fast access, then ease of operation is improved, but security is worsened because compromised endpoints can access the keys
Solution Approach 1:
The remote key server acts as an intermediary that provides decryption keys only after verifying the endpoint's identity through the identity and access management system. This eliminates the need to store sensitive key material locally while maintaining fast access through authenticated retrieval, resolving the contradiction between operational convenience and security.
Solution Approach 2:
The system performs preliminary identity verification and authentication through the identity and access management system before providing decryption keys. This preliminary action ensures that only authorized endpoints can access encrypted files, maintaining security while enabling fast authenticated access for legitimate users.
3Reliability
If encryption is applied to all outbound files, then data leakage prevention is improved, but productivity decreases due to additional encryption steps
Solution Approach 1:
The system applies encryption selectively based on risk assessment and file sensitivity rather than universally to all files. The identity and access management system can determine which files require encryption and which can be transmitted in plaintext, reducing the overhead while maintaining security for sensitive data.
Solution Approach 2:
The encryption and decryption processes are designed to be transparent to users, with automatic key management and authentication handled by the system infrastructure. Users simply attach and send files as usual, while the background services automatically apply encryption where needed and handle key management, minimizing impact on productivity.
Data Source
AI summary
Rules are applied at a network perimeter to outbound network communications that contain file attachments. The rules may, in a variety of circumstances, require wrapping of an outbound file from the endpoint in a portable encrypted container. The network perimeter may be enforced locally at the endpoint, or at any network device between the endpoint and a recipient.