Removable Drive Recovery Key Escrow for Off-Network Encryption Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to manage and enforce removable drive encryption policies effectively when mobile devices are outside the enterprise network, leading to potential loss of data due to unknown recovery keys and insecure password management.
Innovation Solution
A cloud-based unified endpoint management (UEM) system manages and secures removable drive recovery keys through a UEM service, enabling encryption and recovery key management across public networks, using a UEM agent to enforce policies and obscure recovery keys from user access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If recovery keys are stored in a domain system of record, then centralized key management is achieved, but access to recovery keys is lost when devices are outside the enterprise network
Solution Approach 1:
A cloud-based key service acts as an intermediary between the domain system of record and client devices. The key service receives drive encryption information from the domain, retrieves recovery keys, and provides them to authorized users through a web interface, enabling key access outside the enterprise network while maintaining centralized control.
Solution Approach 2:
The system transitions from purely on-premises domain-based key storage to a multi-dimensional architecture that includes cloud-based key service, web interface, and mobile device support. This allows users to access recovery keys through multiple channels (web browser, mobile device) regardless of network location.
2Reliability
If drive encryption is enforced on removable drives, then data security is improved, but user access to encrypted drives is lost if passwords are forgotten
Solution Approach 1:
The system performs preliminary actions by automatically capturing and storing recovery keys at the time of drive encryption, before the user might forget their password. The key service proactively retrieves and secures the recovery key, making it available for future recovery scenarios without requiring user intervention at encryption time.
Solution Approach 2:
The system provides a safety net by storing recovery keys in advance, cushioning against the potential harm of forgotten passwords. Users can retrieve these pre-stored recovery keys through the web interface or mobile device, preventing permanent loss of drive access while maintaining the security benefits of encryption.
3Adaptability or versatility
If BYOD policies are implemented, then device flexibility and cost savings are achieved, but security control over removable drives is reduced
Solution Approach 1:
The system implements feedback mechanisms where the key service monitors and tracks recovery key usage, drive encryption status, and user access patterns. This allows the organization to maintain awareness of encrypted drives on personal devices and respond to security events, ensuring continued enforcement of encryption policies in BYOD environments.
Data Source
AI summary
A management service manages recovery keys. The management service receives a removable drive recovery key, a recovery key identifier, and a removable drive identifier from a management agent executed on a client device. The management service stores the information, reads the removable drive recovery key from the removable drive recovery key escrow, and transmits this to the management agent as a verification of accurate storage of the removable drive recovery key within the removable drive recovery key escrow.