Discriminating data protection system

• US 8,925,100 B2
• Filed: 04/11/2013
• Issued: 12/30/2014
• Est. Priority Date: 05/05/2009
• Status: Active Grant

• Current Assignee: Absolute Software Corporation
• Original Assignee: Absolute Software Corporation
• Inventors: Chase, Robert
• Primary Examiner(s): LEWIS, LISA C
• Application Number:
  US13/860,895
• Publication Number:
  US 20140047550A1
• Time in Patent Office: 628 Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A data protection system selectively deletes data from an electronic device when the device is reported as lost or stolen, or when another data protection triggering event occurs. Different data files may, for example, be treated differently depending on when such files were created. For example, data files that were created while the computing device was known to be in the owner'"'"'s possession may be deleted, while data files created after the electronic device left the owner'"'"'s possession may be left intact (since they may have been created by an innocent user). Data files created between these two points in time may be quarantined so that they later be restored, if appropriate.

Claims

1. A non-transitory computer readable medium having stored thereon an agent program that instructs an electronic device to at least:

determine, in response to a trigger that represents a need to take a data protection measure, a first point in time prior to the trigger, said first point in time being of a last known authorized use of the electronic device, the trigger related to a theft or loss of the electronic device;

identify first data on the electronic device that was created prior to said first point in time;

identify second data on the electronic device that was created between said first point in time and the trigger; and

execute a discriminating data protection policy that treats the first data differently from the second data.

2. The computer readable medium of claim 1, wherein the agent program further instructs the electronic device to:

determine, in response to said trigger, a second point in time that is after the first point in time, said second point in time being of known lack of authorized possession of the electronic device, wherein the second data was created prior to the second point in time;

identify third data on the device that was created after the second point in time; and

discriminate, in executing the discriminating data protection policy, between the first data, the second data, and the third data.

3. The computer readable medium of claim 2, wherein the second point in time comprises a date on which a theft or loss of the electronic device was reported.

4. The computer readable medium of claim 2, wherein the trigger is a receipt of a communication that specifies the first and second points in time.

5. The computer readable medium of claim 2, wherein the agent program instructs the electronic device to:

transmit the second data to a monitoring center in encrypted or unencrypted form, and to then delete the second data from the electronic device;

delete the first data from the electronic device without first transmitting the first data to the monitoring center; and

leave the third data intact on the electronic device.

6. The computer readable medium of claim 1, wherein the agent program instructs the electronic device to delete the first data, and to encrypt or quarantine the second data.

7. The computer readable medium of claim 1, wherein the agent program instructs the electronic device to delete the first data only.

8. The computer readable medium of claim 1, wherein the trigger is one of:

an elapse of a predetermined time interval during which a communication over a network with a monitoring center is not made;

use of the electronic device without connection to the internet;

use of the electronic device without input of a correct password;

input of a predetermined number of incorrect passwords;

a combination of an elapse of a predetermined time interval during which a communication over a network with a monitoring center is not made and the input of a predetermined number of incorrect passwords;

receipt of a communication indicating that the electronic device is lost or stolen;

receipt of a communication comprising an instruction to execute the discriminating data protection policy.

9. The computer readable medium of claim 1, wherein the first point in time is a predetermined amount of time before the trigger.

10. The computer-readable medium of claim 1, wherein the trigger is an event in which a client component running on the electronic device detects, based on usage of the electronic device, a likely theft of the electronic device.

11. A system for protecting data, the system comprising:

an electronic device having a processor and a memory, the electronic device configured to;

determine, in response to a trigger that represents a need to take a data protection measure, a first point in time prior to the trigger, said first point in time being of a last known authorized use of the electronic device, the trigger related to a theft or loss of the electronic device;

identify first data on the electronic device that was created prior to said first point in time;

identify second data on the electronic device that was created between said first point in time and the trigger; and

execute a discriminating data protection policy that treats the first data differently from the second data.

12. The system of claim 11, wherein the electronic device is configured to communicate over a network with a monitoring center to implement the discriminating data protection policy.

13. The system of claim 12, wherein the trigger comprises the electronic device receiving, from the monitoring center, a notification of theft or loss of the electronic device, said notification identifying said first point in time.

14. The system of claim 11, wherein the electronic device is further configured to:

determine, in response to said trigger, a second point in time that is after the first point in time, said second point in time being of known lack of authorized possession of the electronic device, wherein the second data was created prior to the second point in time;

identify third data on the electronic device that was created after the second point in time; and

discriminate, in executing said discriminating data protection policy, between the first data, the second data, and the third data.

15. The system of claim 14 further comprising a monitoring center configured to:

receive input of, or determine, one or more of said first point in time and said second point in time; and

communicate said received input of, or determination of, said one or more of the first point in time and the second point in time to the electronic device.

16. A method for protecting data stored on an electronic device until ownership of the data can be determined, the method comprising:

by the electronic device under control of an agent program;

determining, in response to a trigger that represents a need to take a data protection measure, a first point in time prior to the trigger, said first point in time being of a last known authorized use of the electronic device, the trigger related to a theft or loss of the electronic device;

identifying first data on the electronic device that was created prior to said first point in time;

identifying second data on the electronic device that was created between said first point in time and said trigger, said first and second data therefore potentially belonging to different owners; and

executing a discriminating data protection policy that treats the first data differently from the second data.

17. The method of claim 16, further comprising the steps of:

determining, in response to said trigger, a second point in time that is after the first point in time, said second point in time being of known lack of authorized possession of the electronic device, wherein the second data was created prior to the second point in time;

identifying third data on the electronic device that was created after the second point in time; and

executing, in connection with the theft or loss, a discriminating data protection policy that discriminates between the first data, the second data, and the third data.

18. The method of claim 16, wherein the first point in time is based on one of:

a last connection established between the electronic device and a monitoring center; and

a last interne connection established by the electronic device.

19. The method of claim 16, wherein the trigger is an event in which the agent program detects, based on usage of the electronic device, a likely theft of the electronic device.