KEY MANAGEMENT TO PROTECT ENCRYPTED DATA OF AN ENDPOINT COMPUTING DEVICE

• US 20100303240A1
• Filed: 05/28/2009
• Published: 12/02/2010
• Est. Priority Date: 05/28/2009
• Status: Active Grant

• Current Assignee: Micro Focus Software, Inc. (Open Text Corporation)
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Smith, Merrill K., Beachem, Brent R.
• Granted Patent: US 8,588,422 B2
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities

Abstract

Methods and apparatus involve protecting encrypted data of endpoint computing assets by managing decryption keys. The endpoint has both a traditional operating system for applications, and the like, and another operating system during a pre-boot phase of operation. During use, the pre-boot operating system prevents users of the endpoint from accessing the encrypted data and the key. Upon determining the encrypted data has been compromised, the key is disassociated from the encrypted data. Disassociation can occur in a variety of ways including deleting or scrambling the key and/or data or re-encrypting the encrypted data with a new key. Key escrowing and updating through the pre-boot is further contemplated. The pre-boot phase also contemplates a limited computing connection between the endpoint and a specified authentication server and approved networking ports, USB devices and biometric equipment. Security policies and enforcement modules are also disclosed as are computer program products, computing arrangements, etc.

Claims

1. In a computing system environment, a method of protecting encrypted data of an endpoint computing device, the encrypted data able to be decrypted with a key located at the endpoint computing device, comprising:

determining whether the encrypted data has been compromised;

upon a subsequent booting of the endpoint, launching a pre-boot phase of operation during which time a pre-boot operating system prevents a user of the endpoint from accessing the encrypted data and the key, the pre-boot phase of operation further including,

determining whether the key requires disassociation from the encrypted data; and

if so, disassociating the key.

2. The method of claim 1, wherein the disassociating the key further includes deleting an existence of the key from the endpoint.

3. The method of claim 1, further including authenticating the endpoint back to a networked server in the computing system environment.

4. The method of claim 1, further including updating a security policy of the endpoint.

5. The method of claim 1, deploying a new key to the endpoint and re-encrypting the compromised encrypted data with said new key.

6. The method of claim 1, further including re-associating the disassociated key with the encrypted data at the endpoint in the event the encrypted data was not compromised and the key was said disassociated.

7. In a computing system environment, a method of protecting encrypted data of an endpoint computing device, the encrypted data saved in memory and or disk of the endpoint and able to be decrypted with a key located in a trusted platform module at the endpoint computing device, comprising:

upon a booting of the endpoint, launching a pre-boot phase of operation during which time a pre-boot operating system prevents a user of the endpoint from accessing the encrypted data and the key, the pre-boot phase of operation further including,

determining whether the encrypted data has been compromised;

if so, locating the key in the trusted platform module; and

deleting an existence of the key from the trusted platform module.

8. The method of claim 7, further including pushing a security policy to the endpoint from a networked computing device in the computing system environment, the security policy instructing the endpoint to said delete the existence of the key.

9. The method of claim 7, further including pushing a security policy to the endpoint from a networked computing device in the computing system environment, the security policy requiring the endpoint to have three factors of authentication before accessing the encrypted data.

10. In a computing system environment, a method of protecting encrypted data of an endpoint computing device, the encrypted data saved in memory and or disk of the endpoint and able to be decrypted with a key located at the endpoint computing device, comprising:

upon a booting of the endpoint, launching a pre-boot phase of operation during which time a pre-boot operating system prevents a user of the endpoint from accessing the encrypted data and the key and enforces a limited computing connection between the endpoint and one of a specified authentication server networked to the endpoint in the computing system environment, approved networking ports of the endpoint, approved USB devices connected to the endpoint, and approved biometric devices, the pre-boot phase of operation further including,

determining whether the encrypted data has been compromised; and

if so, disassociating the key from the encrypted data.

11. The method of claim 10, wherein a predefined security policy identifies the limited computing connection to the endpoint.

12. The method of claim 10, further including locating the key in a trusted platform module of the endpoint.

13. The method of claim 10, wherein the disassociating the key from the encrypted data further includes deleting an existence of the key, deleting an existence of the encrypted data, scrambling the key, scrambling the data, or re-encrypting the encrypted data with a new key.

14. An endpoint computing device, comprising:

a hardware platform including a processor, memory and disk;

encrypted data configured for storage in the memory and or disk;

a key stored on the hardware platform to decrypt the encrypted data;

a policy enforcement module on the hardware platform to carry out predefined security policies between the key and the encrypted data; and

a computing operating system and a pre-boot operating system configured to act on the processor such that upon launching a pre-boot phase of operation the policy enforcement module requires the pre-boot operating system to prevent a user of the endpoint from accessing the encrypted data and the key and requires the disassociation of the key from the encrypted data upon a determination that the encrypted data has been compromised.

15. The endpoint computing device of claim 14, further including a trusted platform module as part of the hardware platform to store the key.

16. The endpoint computing device of claim 14, wherein the policy enforcement module is further configured during the pre-boot phase of operation to require a limited computing connection between the endpoint and one of a specified authentication server networked to the endpoint in a computing system environment, approved networking ports of the endpoint, approved USB devices connected to the endpoint, and approved biometric devices.

17. The endpoint computing device of claim 14, wherein the policy enforcement module is further configured to enforce deletion of an existence of the key, deletion of an existence of the encrypted data, scrambling the key, scrambling the data, or re-encrypting the encrypted data with a new key upon said determination that the encrypted data has been compromised.

18. A computer program product for loading on a endpoint computing device to protect encrypted data thereof, the encrypted data configured to be saved in memory and or disk of the endpoint and able to be decrypted with a key located at the endpoint computing device, the computer program product having executable instructions that launch a pre-boot phase of operation during which time a pre-boot operating system of the endpoint prevents a user of the endpoint from accessing the encrypted data and the key, the executable instructions further configured to disassociate the key from the encrypted data upon a determination that the encrypted data has been compromised.

19. The computer program product of claim 18, further including executable instructions that during the pre-boot phase of operation open a limited computing connection between the endpoint and one of a specified authentication server networked to the endpoint in a computing system environment, approved networking ports of the endpoint, approved USB devices connected to the endpoint, and approved biometric devices.

20. The computer program product of claim 18, further including executable instructions that during the pre-boot phase of operation locate the key in a trusted platform module of the endpoint and delete an existence of the key from the module upon said determination that the encrypted data has been compromised.