Perimeter Encryption for Outbound File Attachments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for improved endpoint security using encryption to prevent data leakage and other negative consequences for compromised endpoints in enterprise networks, as existing methods are inadequate in securing sensitive information from malicious actors.
Innovation Solution
A computer program product and method that creates portable encrypted content by encrypting files with a cryptographic key, including an encryption key and a decryption key, and combines the encrypted file with an object containing the decryption key, providing a user interface for decryption using either a password or remote key server access, ensuring secure distribution over networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted with cryptographic keys and decryption keys are managed remotely, then security against data leakage is improved, but system complexity increases
Solution Approach 1:
A remote key server acts as an intermediary between endpoints and decryption keys. The key server stores and manages decryption keys, allowing endpoints to encrypt files locally while maintaining security through centralized key management. This resolves the contradiction by introducing a mediator that handles the complex key management infrastructure remotely, reducing local system complexity while maintaining high security standards.
Solution Approach 2:
The encryption system is segmented into separate components: local encryption/decryption operations at endpoints, remote key storage and management at the key server, and secure key transmission channels. This segmentation allows each component to be optimized independently - endpoints focus on encryption operations while the key server handles key management complexity, resolving the contradiction between security and system complexity.
2Speed
If decryption keys are stored locally with encrypted files, then access speed is improved, but security against compromised endpoints is worsened
Solution Approach 1:
The remote key server serves as an intermediary that stores decryption keys securely, eliminating the need to store them locally with encrypted files. When access is needed, the key server provides decryption keys through authenticated requests. This maintains security by keeping keys separate from encrypted data while enabling fast access through efficient key retrieval operations.
Solution Approach 2:
The system moves key storage from the same dimension (local endpoint) to a different dimension (remote key server). This spatial separation allows decryption keys to be stored securely away from encrypted files while still enabling fast access through networked retrieval, resolving the contradiction between access speed and security.
3Reliability
If encryption is applied to all outbound files, then data leakage prevention is improved, but processing time increases
Solution Approach 1:
The system applies encryption selectively rather than universally - encrypting only outbound files that require protection while allowing unencrypted transmission for files that don't need security. This partial application of encryption maintains data leakage prevention for sensitive files while reducing overall processing time by avoiding unnecessary encryption operations on all files.
Solution Approach 2:
Encryption keys are pre-established and stored securely before file transmission is needed. The key management infrastructure is set up in advance, allowing rapid encryption operations when files need to be protected. This preliminary preparation reduces processing time during actual file encryption by eliminating key generation and management overhead at the moment of encryption.
4Reliability
If remote key server access is required for decryption, then security control is improved, but ease of operation is worsened
Solution Approach 1:
The system implements self-service decryption where authorized users can automatically retrieve decryption keys from the remote key server without manual intervention. The key server authenticates users and provides decryption keys through automated processes, maintaining strict security control while making decryption operationally simple for authorized personnel.
Solution Approach 2:
The key server implements feedback mechanisms that track and log all decryption key access requests. This creates an audit trail that enhances security control by monitoring who accesses decryption keys and when, while the automated feedback loop streamlines the decryption process for authorized users, resolving the contradiction between security control and ease of operation.
Data Source
AI summary
Rules are applied at a network perimeter to outbound network communications that contain file attachments. The rules may, in a variety of circumstances, require wrapping of an outbound file from the endpoint in a portable encrypted container. The network perimeter may be enforced locally at the endpoint, or at any network device between the endpoint and a recipient.