SECURING ENTERPRISE DATA ON MOBILE DEVICES

• US 20170156057A1
• Filed: 03/10/2016
• Published: 06/01/2017
• Est. Priority Date: 11/29/2015
• Status: Active Grant

• Current Assignee: Green Market Square Limited
• Original Assignee: International Business Machines Corporation
• Inventors: ABDIRASHID, MOHAMMAD, DEGILIO, FRANK J.
• Granted Patent: US 10,028,135 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/08 Access security

Abstract

Embodiments include method, systems and computer program products for securing enterprise data in a mobile computing environment. Aspects include receiving a request to access the enterprise data stored on the mobile computing device in an encrypted format and determining whether a decryption key is stored in a cache memory of the mobile computing device. Based on determining that the decryption key is not stored in a cache memory of the mobile computing device, aspects include transmitting a request to an enterprise network for the decryption key and receiving the decryption key and storing the decryption key in the cache memory. Aspects also include decrypting the enterprise data using the decryption key and deleting the decryption key from the cache memory based on a determination that the decryption key has not been accessed for a period of time greater than a threshold time.

Claims

1. A computer-implemented method for securing enterprise data in a mobile computing environment, the method comprising:

receiving, by a processor, a request to access an enterprise data stored on a mobile computing device in an encrypted format;

determining whether a decryption key is stored in a cache memory of the mobile computing device;

based on determining that the decryption key is not stored in a cache memory of the mobile computing device;

transmitting a request to an enterprise network for the decryption key; and

receiving the decryption key and storing the decryption key in the cache memory;

decrypting the enterprise data using the decryption key; and

deleting the decryption key from the cache memory based on a determination that the decryption key has not been accessed for a period of time greater than a threshold time.

2. The computer-implemented method of claim 1, wherein the mobile computing device is configured to only store the decryption key in the cache memory.

3. The computer-implemented method of claim 1, further comprising denying the request to access the enterprise data based on a determination that the decryption key was not received from the enterprise network and that the decryption key is not stored in the cache memory.

4. The computer-implemented method of claim 1, further comprising providing access to the enterprise data in a decrypted format to an application on the mobile computing device.

5. The computer-implemented method of claim 4, further comprising:

updating the enterprise data in the decrypted format by the application to create updated enterprise data;

receiving a request to store the updated enterprise data in an encrypted format;

determining whether an encryption key is stored in a cache memory of the mobile computing device;

based on determining that the encryption key is not stored in a cache memory of the mobile computing device;

transmitting a request to the enterprise network for the encryption key; and

receiving the encryption key and storing the encryption key in the cache memory;

encrypting the enterprise data using the decryption key; and

deleting the encryption key from the cache memory based on a determination that the encryption key has not been accessed for the period of time greater than a threshold time.

6. The computer-implemented method of claim 5, wherein the mobile computing device is configured to only store the encryption key in the cache memory.

7. The computer-implemented method of claim 5, further comprising denying the request to store the updated enterprise data in the encrypted format based on a determination that the encryption key was not received from the enterprise network and that the encryption key is not stored in the cache memory.