Method and devices for providing secure data backup from a mobile communication device to an external computing device

• US 9,594,916 B2
• Filed: 05/15/2015
• Issued: 03/14/2017
• Est. Priority Date: 06/15/2007
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Matton, Maxime, Brown, Michael Kenneth, Bocking, Andrew Douglas, Totzke, Scott William, Tapuska, David Francis, Zinn, Ronald Scotte, Hardy, Michael Thomas, Dos Santos, George, Runstedler, Christopher James
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/713,010
• Publication Number:
  US 20150248562A1
• Time in Patent Office: 669 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 2201/80 Database-specific techniques
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

A method and devices for providing secure data backup from a mobile communication device to an external computing device is described. In one embodiment, there is provided a method of backing up data from a mobile communication device, the method comprising: receiving from an enterprise server an information technology (IT) policy message which includes an encryption key; storing the encryption key in a protected memory of the mobile communication device; receiving a request to backup data stored on the mobile communication device; encrypting the data using the encryption key stored in the protected memory; and transferring the encrypted data from the mobile communication device to an electronic device for storage.

Claims

1. A method performed by a mobile communication device of backing up data, the method comprising:

receiving from an enterprise server a first information technology (IT) policy message which includes an encryption key for encrypting backup data;

receiving from the enterprise server a second IT policy message including a first IT policy rule, the first IT policy rule specifying data stored on the mobile communication device which is to be encrypted during a backup;

storing the encryption key in a protected portion of a hardware memory of the mobile communication device;

receiving a request to backup data stored on the mobile communication device;

encrypting data which is to be encrypted in accordance with the first IT policy rule using the encryption key stored in the protected portion of the hardware memory; and

transferring the encrypted data from the mobile communication device to an electronic device for storage.

2. The method of claim 1, wherein access to the protected portion of the hardware memory is restricted.

3. The method of claim 1, wherein access to the protected portion of the hardware memory is restricted to authorized applications.

4. The method of claim 1, wherein access to the protected portion of the hardware memory is restricted to authorized applications such that storing, updating, or deleting the encryption key is restricted to IT policy messages received from the enterprise server.

5. The method of claim 1, wherein the encryption key is a symmetric Encryption key used for encryption and decryption.

6. The method of claim 1, further comprising:

receiving from the enterprise server a third IT policy message which includes a decryption key; and

storing the decryption key in the protected portion of the hardware memory.

7. The method of claim 1, further comprising:

receiving from the enterprise server a third IT policy message including a second IT policy rule, the second IT policy rule restricting the data which can be backed up.

8. The method of claim 7, wherein the second IT policy rule in the third IT policy message restricts the data which can be backed up to personal, non-enterprise data.

9. The method of claim 7, wherein the first IT policy message, the second IT policy message and the third IT policy message are the same IT policy message.

10. The method of claim 1, further comprising:

transferring the data stored on the mobile communication device which the first IT policy rule does not specify is not to be encrypted in unencrypted form to the electronic device for storage.

11. The method of claim 1, wherein the first IT policy message and the second IT policy message are the same IT policy message.

12. The method of claim 1, wherein the electronic device is a remote server.

13. The method of claim 1, wherein the electronic device is a computer to which the mobile communication device is connected.

14. The method of claim 1, wherein the data comprises a plurality of databases, and wherein the protected portion of the hardware memory includes a plurality of encryption keys, each encryption key being associated with a respective database, wherein each database is encrypted using the associated encryption key with the respective database.

15. A mobile communication device, comprising:

a processor;

a communication interface coupled to the processor;

a hardware memory coupled to the processor, the hardware memory storing executable instructions that, when executed by the processor, cause the processor to;

receive from an enterprise server an information technology (IT) policy message which includes an encryption key for encrypting backup data;

receive from the enterprise server an IT policy message including a first IT policy rule, the first IT policy rule specifying data stored on the mobile communication device which is to be encrypted during a backup;

store the encryption key in a protected portion of the hardware memory of the mobile communication device;

receive a request to backup data stored on the mobile communication device;

encrypt data which is to be encrypted in accordance with the first IT policy rule using the encryption key stored in the protected portion of the hardware memory; and

transfer the encrypted data from the mobile communication device to an electronic device for storage.

16. A non-transitory machine readable medium having tangibly stored thereon executable instructions that, when executed by a processor of a mobile communication device, cause the mobile communication device to:

receive from an enterprise server an information technology (IT) policy message which includes an encryption key for encrypting backup data;

receive from the enterprise server an IT policy message including a first IT policy rule, the first IT policy rule specifying data stored on the mobile communication device which is to be encrypted during a backup;

store the encryption key in a protected portion of a hardware memory of the mobile communication device;

receive a request to backup data stored on the mobile communication device;

encrypt data which is to be encrypted in accordance with the first IT policy rule using the encryption key stored in the protected portion of the hardware memory; and

transfer the encrypted data from the mobile communication device to an electronic device for storage.

17. A method performed by a mobile communication device of restoring backup data, the method comprising:

receiving from an enterprise server an information technology (IT) policy message which includes a decryption key for decrypting encrypted backup data;

receiving from the enterprise server an IT policy message including a first IT policy rule, the first IT policy rule specifying data stored on the mobile communication device which is to be encrypted during a backup;

storing the decryption key in a protected portion of a hardware memory of the mobile communication device;

receiving a request to restore backup data from another electronic device to the mobile communication device;

receiving backup data, including encrypted backup data, from the other electronic device;

decrypting the encrypted data using the decryption key stored in the protected portion of the hardware memory; and

storing the decrypted data in the hardware memory of the mobile communication device.

18. The method of claim 17, wherein the backup data also includes unencrypted data, the method further comprising:

storing the unencrypted data in the hardware memory of the mobile communication device.

19. A mobile communication device, comprising:

a processor;

a communication interface coupled to the processor;

a hardware memory coupled to the processor, the hardware memory storing executable instructions that, when executed by the processor, cause the processor to;

receive from an enterprise server an information technology (IT) policy message which includes a decryption key for decrypting encrypted backup data;

receive from the enterprise server an IT policy message including a first IT policy rule, the first IT policy rule specifying data stored on the mobile communication device which is to be encrypted during a backup;

store the decryption key in a protected portion of the hardware memory of the mobile communication device;

receive a request to restore backup data from another electronic device to the mobile communication device;

receive backup data, including encrypted backup data, from the other electronic device;

decrypt the encrypted data using the decryption key stored in the protected portion of the hardware memory; and

store the decrypted data in the hardware memory of the mobile communication device.

20. A non-transitory machine readable medium having tangibly stored thereon executable instructions that, when executed by a processor of a mobile communication device, cause the mobile communication device to:

receive from an enterprise server an information technology (IT) policy message which includes a decryption key for decrypting encrypted backup data;

receive from the enterprise server an IT policy message including a first IT policy rule, the first IT policy rule specifying data stored on the mobile communication device which is to be encrypted during a backup;

store the decryption key in a protected portion of a hardware memory of the mobile communication device;

receive a request to restore backup data from another electronic device to the mobile communication device;

receive backup data, including encrypted backup data, from the other electronic device;

decrypt the encrypted data using the decryption key stored in the protected portion of the hardware memory; and

store the decrypted data in the hardware memory of the mobile communication device.