DISCRIMINATING DATA PROTECTION SYSTEM

• US 20100287619A1
• Filed: 05/05/2010
• Published: 11/11/2010
• Est. Priority Date: 05/05/2009
• Status: Active Grant

• Current Assignee: Absolute Software Corporation
• Original Assignee: Absolute Software Corporation
• Inventors: Chase, Robert
• Granted Patent: US 8,419,806 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A data protection system selectively deletes data from an electronic device when the device is reported as lost or stolen, or when another data protection triggering event occurs. Different data files may, for example, be treated differently depending on when such files were created. For example, data files that were created while the computing device was known to be in the owner'"'"'s possession may be deleted, while data files created after the electronic device left the owner'"'"'s possession may be left intact (since they may have been created by an innocent user). Data files created between these two points in time may be quarantined so that they later be restored, if appropriate.

Claims

1. A computer readable medium having stored thereon an agent program that instructs an electronic computing device to at least:

determine, in response to a trigger, a first point in time associated with a reported theft or loss of the electronic computing device;

identify a first set of files on the device that were created prior to said first point of time;

identify a second set of files on the device that were created after said first point of time, and which were therefore potentially created by an innocent user after the reported theft or loss of the device; and

execute, in connection with the reported theft or loss, a discriminating data protection policy that treats the first set of files differently from the second set of files.

2. The computer readable medium of claim 1, wherein the agent program further instructs the electronic computing device to:

determine, in response to said trigger, a second point in time associated with the reported theft or loss of the electronic computing device, wherein the second point in time is after the first point in time;

identify a third set of files on the device that were created after the second point in time; and

discriminate, in executing the discriminating data protection policy, between;

(1)the first set of files stored on the computing device that were created before the first point in time, (2) the second set of files stored on the computing device that were created between the first point in time and the second point in time, and (3) the third set of files stored on the computing device that were created after the second point in time.

3. The computer readable medium of claim 2, wherein the second point in time is a reported date of theft or loss of the device.

4. The computer readable medium of claim 1, wherein the agent program instructs the electronic computing device to delete the first set of files, and to encrypt or quarantine the second set of files.

5. The computer readable medium of claim 1, wherein the agent program instructs the electronic computing device to delete the first set of files only.

6. The computer readable medium of claim 1, wherein the agent program instructs the electronic computing device to:

transmit the second set of files to the monitoring centre in encrypted or unencrypted form, and to then delete the second set of files from the device;

delete the first set of files from the computing device without first transmitting the first set of files to the monitoring centre; and

leave the third set of files intact on the device.

7. The computer readable medium of claim 1, wherein the first point in time is a date of last known authorized use of the device prior to the reported theft or loss of the device.

8. The computer readable medium of claim 1, wherein the trigger is one of:

a. an elapse of a predetermined time interval during which a communication over a network with a monitoring centre is not made;

b. use of the electronic computing device without connection to the internet;

c. use of the device without input of a correct password;

d. input of a predetermined number of incorrect passwords;

or

e. a combination of an elapse of a predetermined time interval during which a communication over a network with a monitoring centre is not made and the input of a predetermined number of incorrect passwords.

9. A system for protecting data, the system comprising:

an electronic computing device having a processor and a memory, the electronic computing device configured to;

determine, in response to a trigger, a first point in time associated with a reported theft or loss of the electronic computing device;

identify a first set of files on the device that were created prior to said first point of time;

identify a second set of files on the device that were created after said first point of time, and which were therefore potentially created by an innocent user after the reported theft or loss of the device; and

execute, in connection with the reported theft or loss, a discriminating data protection policy that treats the first set of files differently from the second set of files.

10. The system of claim 9, wherein the electronic computing device is configured to communicate over a network with a monitoring centre to implement the discriminating data protection policy.

11. The system of claim 10, wherein the electronic computing device is configured to receive, from the monitoring centre, a notification of the reported theft or loss, said notification identifying said first point in time.

12. The system of claim 10, in combination with the monitoring centre.

13. The system of claim 9, wherein the electronic computing device is further configured to:

determine, in response to said trigger, a second point in time associated with the reported theft or loss of the electronic computing device, wherein the second point in time is after the first point in time;

identify a third set of files on the device that were created after the second point in time; and

discriminate, in executing said discriminating data protection policy, between;

(1) the first set of files stored on the computing device that were created before the first point in time, (2) the second set of files stored on the computing device that were created between the first point in time and the second point in time, and (3) the third set of files stored on the computing device that were created after the second point in time.

14. A method for protecting data stored on an electronic computing device until ownership of the data can be determined, the method comprising:

by the electronic computing device under control of an agent program;

determining, in response to a trigger, a first point in time associated with a reported theft or loss of the electronic computing device;

identifying a first set of files on the device that were created prior to said first point of time;

identifying a second set of files on the device that were created after said first point of time, and which were therefore potentially created by an innocent user after the reported theft or loss of the device; and

executing, in connection with the reported theft or loss, a discriminating data protection policy that treats the first set of files differently from the second set of files.

15. The method of claim 14, further comprising the steps of:

determining, in response to said trigger, a second point in time associated with the reported theft or loss of the electronic computing device, wherein the second point in time is after the first point in time;

identifying a third set of files on the device that were created after the second point in time; and

executing, in connection with the reported theft or loss, a discriminating data protection policy that discriminates between;

(1) the first set of files stored on the computing device that were created before the first point in time, (2) the second set of files stored on the computing device that were created between the first point in time and the second point in time, and (3) the third set of files stored on the computing device that were created after the second point in time.