Coerced encryption on connected devices

• US 9,141,811 B2
• Filed: 08/01/2013
• Issued: 09/22/2015
• Est. Priority Date: 08/01/2013
• Status: Active Grant

• Current Assignee: Dropbox, Inc.
• Original Assignee: Dropbox, Inc.
• Inventors: Byrne, Sean
• Primary Examiner(s): Jeudy, Josnel
• Application Number:
  US13/957,003
• Publication Number:
  US 20150040235A1
• Time in Patent Office: 782 Days
• Field of Search: 380/30, 380277-280
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

Techniques for coercing users to encrypt synchronized content stored at their personal computing devices. In some aspects, one or more computing devices receive, from a personal computing device, an indication of whether data stored in at least a portion of a storage device of the personal computing device is protected by disk encryption. In response to determining, based on the indication, that the portion of the storage device is not protected by encryption, synchronization data for synchronizing a copy of one or more synchronized content items stored in the portion of the storage device with another copy of the synchronized content items stored at one or more server computing devices is withheld from the personal computing device until disk encryption on the personal computing device is enabled so as to coerce the user to enable disk encryption on the personal computing device.

Claims

1. One or more computing devices, comprising:

one or more processors;

memory; and

one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including instructions for;

receiving, from a personal computing device having a storage device, an indication of whether at least a portion of the storage device is protected by disk encryption;

wherein the portion of the storage device stores one or more synchronized content items;

determining, based on the indication, whether synchronization data for synchronizing the one or more synchronized content items stored in the portion of the storage device with one or more synchronized content items stored on one or more server computing devices should be withheld from the personal computing device;

if the synchronization data should be withheld, then

withholding the synchronization data from the personal computing device, and sending data to the personal computing device instructing a user of the personal computing device how to enable disk encryption for at least the portion of the storage device; and

if the synchronization data should not be withheld, then sending the synchronization data to the personal computing device after any other conditions on sending the synchronization data to the personal computing device have been met.

2. The one or more computing devices of claim 1, the one or more programs further comprising instructions for:

after withholding the synchronization data;

receiving, from the personal computing device, another indication of whether at least the portion of the storage device is protected by disk encryption;

determining, based on the other indication, whether the synchronization data should still be withheld from the personal computing device;

if the synchronization data should not still be withheld, then sending the synchronization data to the personal computing device after any other conditions on sending the synchronization data to the personal computing device have been met.

3. The one or more computing devices of claim 1, the one or more programs further comprising instructions for:

if the synchronization data should be withheld, then sending data to the personal computing device identifying one or more content items, of the one or more content items stored in the portion of the storage device, to be removed from the storage device.

4. The one or more computing devices of claim 1, the one or more programs further comprising instructions for:

prior to receiving the indication from the personal computing device, receiving configuration data for configuring a disk encryption policy associated with the personal computing device, the configuration data indicating that disk encryption of at least the portion of the storage device is required in order to receive synchronization data for synchronizing the one or more synchronized content items stored in the portion of the storage device with the one or more synchronized content items stored on one or more server computing devices.

5. The one or more computing devices of claim 4, wherein the disk encryption policy is associated in a database with a record of the personal computing device, an account record of the user of the personal computing device, or a record of a group of accounts of which one account belongs to the user of the personal computing device.

6. The one or more computing devices of claim 1, wherein the withheld synchronization data pertains to changes to the one or more synchronized content items stored on the one or more server computing devices, the changes having been made since a last successful synchronization between the one or more synchronized content items stored in the portion of the storage device and the one or more synchronized content items stored on the one or more server computing devices.

7. The one or more computing devices of claim 1, the one or more programs further comprising instructions for providing a user interface that allows an administrator to configure a disk encryption policy applicable to the personal computing device.

8. The one or more computing devices of claim 7, wherein the user interface allows the administrator to apply the configured disk encryption policy to the personal computing device, to the user of the personal computing device, or to a group of users of which the user of the personal computing device is a member.

9. The one or more computing devices of claim 1, wherein the indication is received from a synchronization client application installed on the personal computing device.

10. A method performed by one or more computing devices having at least a processor and memory, the method comprising:

receiving, from a personal computing device having a storage device, an indication of whether at least a portion of the storage device is protected by disk encryption;

wherein the portion of the storage device stores one or more synchronized content items;

determining, based on the indication, whether synchronization data for synchronizing the one or more synchronized content items stored in the portion of the storage device with one or more synchronized content items stored on one or more server computing devices should be withheld from the personal computing device;

if the synchronization data should be withheld, then

withholding the synchronization data from the personal computing device, and

sending data to the personal computing device instructing a user of the personal computing device how to enable disk encryption for at least the portion of the storage device; and

if the synchronization data should not be withheld, then sending the synchronization data to the personal computing device after any other conditions on sending the synchronization data to the personal computing device have been met.

11. The method of claim 10, further comprising:

after withholding the synchronization data;

receiving, from the personal computing device, another indication of whether at least the portion of the storage device is protected by disk encryption;

determining, based on the other indication, whether the synchronization data should still be withheld from the personal computing device;

if the synchronization data should not still be withheld, then sending the synchronization data to the personal computing device after any other conditions on sending the synchronization data to the personal computing device have been met.

12. The method of claim 10, further comprising:

if the synchronization data should be withheld, then sending data to the personal computing device identifying one or more content items, of the one or more content items stored in the portion of the storage device, to be removed from the storage device.

13. The method of claim 10, further comprising:

prior to receiving the indication from the personal computing device, receiving configuration data for configuring a disk encryption policy associated with the personal computing device, the configuration data indicating that disk encryption of at least the portion of the storage device is required in order to receive synchronization data for synchronizing the one or more synchronized content items stored in the portion of the storage device with the one or more synchronized content items stored on one or more server computing devices.

14. The method of claim 13, wherein the disk encryption policy is associated in a database with a record of the personal computing device, an account record of the user of the personal computing device, or a record of a group of accounts of which one account belongs to the user of the personal computing device.

15. The method of claim 10, wherein the withheld synchronization data pertains to changes to the one or more synchronized content items stored on the one or more server computing devices, the changes having been made since a last successful synchronization between the one or more synchronized content items stored in the portion of the storage device and the one or more synchronized content items stored on the one or more server computing devices.

16. The method of claim 10, further comprising providing a user interface that allows an administrator to configure a disk encryption policy applicable to the personal computing device.

17. The method of claim 16, wherein the user interface allows the administrator to apply the configured disk encryption policy to the personal computing device, to the user of the personal computing device, or to a group of users of which the user of the personal computing device is a member.

18. The method of claim 10, wherein the indication is received from a synchronization client application installed on the personal computing device.