Secure App Ecosystem with Enterprise Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The bring-your-own-device model poses challenges for enterprises in securely managing confidential information on personal computing devices, as existing technologies fail to effectively limit unauthorized access and enforce enterprise information control policies across multiple apps.
Innovation Solution
A secure ecosystem is created on mobile computing devices, where apps securely exchange encrypted data according to an enterprise's information control policy, using an ecosystem agent that manages a directory with policy and identification information, generates asymmetric key pairs, and employs symmetric encryption to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If enterprises allow employees to use personal devices for work (bring-your-own-device model), then employee convenience and device familiarity are improved, but enterprise control over confidential information and security enforcement are worsened
Solution Approach 1:
The system segments the device environment into distinct ecosystem boundaries, separating enterprise apps from non-enterprise apps. Each ecosystem has its own encrypted data space and policy enforcement mechanisms, allowing personal devices to run both personal and enterprise apps without compromising enterprise control over confidential information.
Solution Approach 2:
The system applies different security policies and encryption mechanisms to different apps and data based on their ecosystem affiliation. Enterprise apps operate under strict enterprise policies with encrypted data storage, while personal apps operate under different policies, allowing each app to have appropriate security characteristics for its purpose.
2Productivity
If multiple apps access the same confidential data on personal devices, then data interchange and productivity are improved, but unauthorized access and policy compliance enforcement are worsened
Solution Approach 1:
The system introduces an intermediary security layer that manages data exchange between apps. The ecosystem infrastructure acts as a mediator, controlling which apps can access which data based on enterprise policies, while still enabling necessary data interchange for productivity. Apps cannot directly access each other's data without going through the controlled ecosystem interfaces.
Solution Approach 2:
The system performs preliminary security checks and policy validations before allowing any data access or interchange between apps. Enterprise policies are enforced in advance, determining which apps are authorized to access specific confidential data before the actual data exchange occurs, preventing unauthorized access from the outset.
3Reliability
If enterprises implement strict information control policies, then security and confidentiality are improved, but app functionality and user flexibility are worsened
Solution Approach 1:
The system implements dynamic policy enforcement that adapts to different app contexts and data types. Rather than applying uniform restrictions to all apps, the ecosystem allows policies to be selectively applied based on the specific app's needs, the sensitivity of the data, and the operational context, maintaining both security and app functionality.
4Adaptability or versatility
If personal devices are used for multiple employers with separate information control needs, then user flexibility is improved, but security isolation and policy enforcement are worsened
Solution Approach 1:
The system creates separate, isolated ecosystems for each employer or organization on the same personal device. Each ecosystem has its own encrypted data space, key pairs, and policy enforcement mechanisms, ensuring that data from one employer cannot be accessed by apps belonging to another employer, even though they coexist on the same physical device.
Data Source
AI summary
Multiple apps of an ecosystem on a computer securely exchange encrypted data according to an information control policy of an enterprise, without allowing unauthorized access from outside of the ecosystem. An ecosystem agent creates an ecosystem directory, which contains policy information and identification information concerning each specific app in the ecosystem, including the ecosystem agent. Each ecosystem app generates an asymmetric key pair, the public key of which it shares only with apps in the ecosystem through the directory. The ecosystem agent's private key is used to encrypt the directory. Data is securely communicated between apps in the ecosystem, by encrypting and decrypting messages and data objects with the appropriate ecosystem app keys. Each specific app in the ecosystem complies with enterprise information control policy. Ecosystem apps can read a policy from the directory, and receive policy updates from the enterprise.