Privacy management for tracked devices

• US 8,995,668 B2
• Filed: 12/12/2013
• Issued: 03/31/2015
• Est. Priority Date: 07/18/2008
• Status: Active Grant

• Current Assignee: Absolute Software Corporation
• Original Assignee: Absolute Software Corporation
• Inventors: McCarthy, Charles Chad, Loveland, Damien Gerard, Wiebe, Trevor
• Primary Examiner(s): SHOLEMAN, ABU S
• Application Number:
  US14/104,227
• Publication Number:
  US 20140164766A1
• Time in Patent Office: 474 Days
• Field of Search: 713/165, 713/176, 726/11, 726/1, 380/259, 380/277
• US Class Current: 380/277
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2109 Game systems
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/20 Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A system is disclosed that protects private data of users while permitting the monitoring or tracking of electronic devices that are shared for both business and private purposes. The electronic devices may be configured to selectively encrypt location data, and/or other types of data, before such data is transmitted to a monitoring center. For example, data collected or generated on a user device outside of work hours may be encrypted with a private key of the device'"'"'s user prior to transmission to the monitoring center, so that the data is not accessible to the employer. Data collected or generated during work hours may be transmitted without such encryption.

Claims

1. A method performed by a user computing device to enable data created on the user computer device (“

created data”

) to be stored on a remote storage system with protection of user privacy, the method comprising;

receiving, over a network, a conditional data encryption rule that specifies criteria for the user computing device to selectively encrypt the created data with a private key of a user of the device before transmitting the created data to the remote storage system, said criteria including time-based criteria to determine which elements of the created data are to be selectively encrypted based at least in part on whether each element was created during employment work hours of a user, wherein the time-based criteria include an employment work schedule of the user;

storing the conditional data encryption rule in a memory of the user computing device;

during both employment work hours and non-work hours of the user, sending the created data to the remote storage system according to the conditional data encryption rule, wherein sending the created data comprises;

identifying a set of created data to send to the remote storage system;

determining, based at least partly on whether the set of created data was created during employment work hours associated with the user, as determined using the time-based criteria, whether to encrypt the set of created data with the private key;

when a determination is made based at least in part on the time-based criteria to encrypt the set of created data with the private key, encrypting the set of created data with the private key to generate privacy-protected data, and transmitting the privacy-protected data via a network to the remote storage system; and

when a determination is made based at least in part on the time-based criteria not to encrypt the set of created data with the private key, transmitting the set of created data via the network to the remote storage system without first encrypting the set of created data with the private key;

wherein the method is performed under the control of program code executed by the user computing device.

2. The method of claim 1, wherein determining whether to encrypt the set of created data with the private key comprises comparing a creation day and time of the set of created data with the employment work schedule.

3. The method of claim 1, wherein the method is performed as a background task substantially invisibly to the user.

4. The method of claim 1, wherein the set of created data comprises a file.

5. The method of claim 1, wherein the set of created data comprises data created on the device by the user.

6. The method of claim 1, wherein the set of created data comprises location data reflective of a location of the device.

7. The method of claim 1, wherein the set of created data comprises a record of websites visited.

8. The method of claim 1, wherein the set of created data comprises an email message.

9. The method of claim 1, wherein the conditional data encryption rule is based in part on a vacation schedule of the user.

10. The method of claim 1, wherein the user computing device is owned by an employer of the user.

11. The method of claim 1, wherein the method is performed using a persistent agent installed on the device.

12. The method of claim 1, further comprising, when a determination is made based at least in part on the time-based criteria not to encrypt the set of created data with the private key of the user, encrypting the set of created data with an employer'"'"'s key for said transmission to the remote storage system.

13. A non-transitory computer readable medium which stores program code that instructs a user computing device to perform a method that comprises:

receiving over a network a conditional data encryption rule that specifies criteria for the user computing device to determine whether to encrypt data created on the device with a private key of a user of the device before transmitting said data to a remote storage system, said criteria including time-based criteria to determine which elements of the created data are to be selectively encrypted based at least in part on creation times of the elements and an employment work schedule of the user with an employer;

storing the conditional data encryption rule in a memory of the user computing device;

during both employment work hours and non-work hours of the user, sending the data to the remote storage system according to the conditional data encryption rule, wherein sending the data comprises;

identifying a set of data to send to the remote storage system, said set of data created on the user computing device;

determining, based at least partly on a schedule of work hours associated with the employer, as determined using the time-based criteria, whether the set of data is associated with an employment use of the user computing device;

when a determination is made based at least in part on the time-based criteria that the set of data is not associated with an employment use of the device, encrypting the set of data with the private key of the user to generate privacy-protected data, and transmitting the privacy-protected data via a network to the remote storage system; and

when a determination is made based at least in part on the time-based criteria that the set of data is associated with an employment use of the device, transmitting the set of data via the network to the remote storage system without first encrypting the set of data with the private key.

14. The non-transitory computer readable medium of claim 13, which stores further program code that instructs the user computing device to perform the method as a background task substantially invisibly to the user.

15. The non-transitory computer readable medium of claim 13, wherein the set of data comprises a file created on the device by the user.

16. The non-transitory computer readable medium of claim 13, wherein the method comprises, when a determination is made based at least in part on the time-based criteria that the set of data is associated with an employment use of the device, encrypting the set of data, for transmission to the remote storage system, with a key other than the private key of the user.