Securing enterprise data on mobile devices

• US 10,038,551 B2
• Filed: 11/29/2015
• Issued: 07/31/2018
• Est. Priority Date: 11/29/2015
• Status: Active Grant

• Current Assignee: Green Market Square Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Abdirashid, Mohammad, Degilio, Frank J.
• Primary Examiner(s): Dada, Beemnet
• Assistant Examiner(s): GUNDRY, STEPHEN T
• Application Number:
  US14/953,351
• Publication Number:
  US 20170155505A1
• Time in Patent Office: 975 Days
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/08 Access security

Abstract

Embodiments include method, systems and computer program products for securing enterprise data in a mobile computing environment. Aspects include receiving a request to access the enterprise data stored on the mobile computing device in an encrypted format and determining whether a decryption key is stored in a cache memory of the mobile computing device. Based on determining that the decryption key is not stored in a cache memory of the mobile computing device, aspects include transmitting a request to an enterprise network for the decryption key and receiving the decryption key and storing the decryption key in the cache memory. Aspects also include decrypting the enterprise data using the decryption key and deleting the decryption key from the cache memory based on a determination that the decryption key has not been accessed for a period of time greater than a threshold time.

Claims

1. A computer program product for securing enterprise data in a mobile computing environment, the computer program product comprising:

a non-transitory storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

receiving a request to access an enterprise data stored on a mobile computing device in an encrypted format;

determining whether a decryption key is stored in a cache memory of the mobile computing device;

based on determining that the decryption key is not stored in a cache memory of the mobile computing device;

transmitting a request to an enterprise network for the decryption key; and

receiving the decryption key and storing the decryption key in the cache memory;

decrypting the enterprise data using the decryption key;

deleting the decryption key from the cache memory based on a determination that the decryption key has not been accessed for a period of time greater than a threshold time; and

deleting the decryption key from the cache memory based on a determination that the mobile computing device has lost communication with the enterprise network.

2. The computer program product of claim 1, wherein the mobile computing device is configured to only store the decryption key in the cache memory.

3. The computer program product of claim 1, the method further comprising denying the request to access the enterprise data based on a determination that the decryption key was not received from the enterprise network and that the decryption key is not stored in the cache memory.

4. The computer program product of claim 1, the method further comprising providing access to the enterprise data in a decrypted format to an application on the mobile computing device.

5. The computer program product of claim 4, the method further comprising:

updating the enterprise data in the decrypted format by the application to create updated enterprise data;

receiving a request to store the updated enterprise data in an encrypted format;

determining whether an encryption key is stored in a cache memory of the mobile computing device;

based on determining that the encryption key is not stored in a cache memory of the mobile computing device;

transmitting a request to the enterprise network for the encryption key; and

receiving the encryption key and storing the encryption key in the cache memory;

encrypting the enterprise data using the encryption key; and

deleting the encryption key from the cache memory based on a determination that the encryption key has not been accessed for the period of time greater than a threshold time.

6. The computer program product of claim 5, wherein the mobile computing device is configured to only store the encryption key in the cache memory.

7. The computer program product of claim 5, the method further comprising denying the request to store the updated enterprise data in the encrypted format based on a determination that the encryption key was not received from the enterprise network and that the encryption key is not stored in the cache memory.

8. A mobile computing device for securely accessing enterprise data, comprising:

a processor in communication with one or more types of memory, the processor configured to;

receive a request to access an enterprise data stored on the mobile computing device in an encrypted format;

determine whether a decryption key is stored in a cache memory of the mobile computing device;

based on determining that the decryption key is not stored in a cache memory of the mobile computing device;

transmit a request to an enterprise network for the decryption key; and

receive the decryption key and store the decryption key in the cache memory;

decrypt the enterprise data using the decryption key;

delete the decryption key from the cache memory based on a determination that the decryption key has not been accessed for a period of time greater than a threshold time; and

delete the decryption key from the cache memory based on a determination that the mobile computing device has lost communication with the enterprise network.

9. The mobile computing device of claim 8, wherein the processor is further configured to deny the request to access the enterprise data based on a determination that the decryption key was not received from the enterprise network and that the decryption key is not stored in the cache memory.

10. The mobile computing device of claim 8 wherein the processor is further configured to provide access to the enterprise data in a decrypted format to an application on the mobile computing device.

11. The mobile computing device of claim 10, wherein the processor is further configured to:

update the enterprise data in the decrypted format by the application to create updated enterprise data;

receive a request to store the updated enterprise data in an encrypted format;

determine whether an encryption key is stored in a cache memory of the mobile computing device;

based on determining that the encryption key is not stored in a cache memory of the mobile computing device;

transmit a request to the enterprise network for the encryption key; and

receive the encryption key and store the encryption key in the cache memory;

encrypt the enterprise data using the encryption key; and

delete the encryption key from the cache memory based on a determination that the encryption key has not been accessed for the period of time greater than a threshold time.

12. The mobile computing device of claim 11, wherein the mobile computing device is configured to only store the encryption key and the decryption key in the cache memory.

13. The mobile computing device of claim 11, wherein the processor is further configured to deny the request to store the updated enterprise data in the encrypted format based on a determination that the encryption key was not received from the enterprise network and that the encryption key is not stored in the cache memory.