METHOD AND DEVICES FOR PROVIDING SECURE DATA BACKUP FROM A MOBILE COMMUNICATION DEVICE TO AN EXTERNAL COMPUTING DEVICE

• US 20150248562A1
• Filed: 05/15/2015
• Published: 09/03/2015
• Est. Priority Date: 06/15/2007
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael Kenneth, Bocking, Andrew Douglas, Totzke, Scott William, Tapuska, David Francis, Zinn, Ronald Scotte, Hardy, Michael Thomas, Runstedler, Christopher James, Matton, Maxine, Dos Santos, George
• Granted Patent: US 9,594,916 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1448 Management of the data involved in backup or backup restore
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 2201/80 Database-specific techniques
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning

Abstract

A method and devices for providing secure data backup from a mobile communication device to an external computing device is described. In one embodiment, there is provided a method of backing up data from a mobile communication device, the method comprising: receiving from an enterprise server an information technology (IT) policy message which includes an encryption key; storing the encryption key in a protected memory of the mobile communication device; receiving a request to backup data stored on the mobile communication device; encrypting the data using the encryption key stored in the protected memory; and transferring the encrypted data from the mobile communication device to an electronic device for storage.

Claims

1. A method of backing up data from a mobile communication device, the method comprising:

receiving from an enterprise server an information technology (IT) policy message which includes an encryption key;

storing the encryption key in a protected memory of the mobile communication device;

receiving a request to backup data stored on the mobile communication device;

encrypting the data using the encryption key stored in the protected memory; and

transferring the encrypted data from the mobile communication device to an electronic device for storage.

2. The method of claim 1, wherein access to the protected memory is restricted.

3. The method of claim 1, wherein access to the protected memory is restricted to authorized applications.

4. The method of claim 1, wherein access to the protected memory is restricted to authorized applications such that storing, updating, or deleting the encryption key is restricted to IT policy messages received from the enterprise server.

5. The method of claim 1, wherein the encryption key is a symmetric encryption key used for encryption and decryption.

6. The method of claim 1, further comprising:

receiving from the enterprise server an IT policy message which includes a decryption key; and

storing the decryption key in the protected memory.

7. The method of claim 1, further comprising:

receiving from the enterprise server an IT policy message including a rule restricting the data which can be backed up.

8. The method of claim 7, wherein the rule restricts the data which can be backed up to personal, non-enterprise data.

9. The method of claim 7, wherein the IT policy message including the encryption key and the IT policy message including the rule are the same IT policy message.

10. The method of claim 1, further comprising:

receiving from the enterprise server an IT policy message including a rule specifying data stored on the mobile communication device which is to be encrypted and data stored on the mobile communication device which is not to be encrypted; and

transferring the data stored on the mobile communication device which is not to be encrypted in unencrypted form to the electronic device for storage.

11. The method of claim 10, wherein which is not to be encrypted is the IT policy message including the encryption key and the IT policy message including the rule are the same IT policy message.

12. The method of claim 1, wherein the electronic device data is a remote server.

13. The method of claim 1, wherein the electronic device data is a computer to which the mobile communication device is connected.

14. The method of claim 1, wherein the data comprises a plurality of databases, and wherein the protected memory includes a plurality of encryption keys, each encryption key being associated with a respective database, wherein each database is encrypted using the associated encryption key with the respective database.

15. A mobile communication device, comprising:

a processor;

a communication interface coupled to the processor;

a memory coupled to the processor, the memory storing executable instructions that, when executed by the processor, cause the processor to;

receive from an enterprise server an information technology (IT) policy message which includes an encryption key;

store the encryption key in a protected memory of the mobile communication device;

receive a request to backup data stored on the mobile communication device;

encrypt the data using the encryption key stored in the protected memory; and

transfer the encrypted data from the mobile communication device to an electronic device for storage.

16. A non-transitory machine readable medium having tangibly stored thereon executable instructions that, when executed by a processor, cause the processor to perform a method of backing up data from a mobile communication device, the method comprising:

receiving from an enterprise server an information technology (IT) policy message which includes an encryption key;

storing the encryption key in a protected memory of the mobile communication device;

receiving a request to backup data stored on the mobile communication device;

encrypting the data using the encryption key stored in the protected memory; and

transferring the encrypted data from the mobile communication device to an electronic device for storage.

17. A method of restoring backup data to a mobile communication device, the method comprising:

receiving from an enterprise server an information technology (IT) policy message which includes a decryption key;

storing the decryption key in a protected memory of the mobile communication device;

receiving a request to restore backup data from another electronic device to the mobile communication device;

transferring backup data, including encrypted data, from the other electronic device to the mobile communication device;

decrypting the encrypted data using the decryption key stored in the protected memory; and

storing the decrypted data in a memory of the mobile communication device.

18. The method of claim 17, wherein the backup data also includes unencrypted data, the method further comprising:

storing the unencrypted data in the memory of the mobile communication device.

19. A mobile communication device, comprising:

a processor;

a communication interface coupled to the processor;

a memory coupled to the processor, the memory storing executable instructions that, when executed by the processor, cause the processor to;

receive from an enterprise server an information technology (IT) policy message which includes a decryption key;

store the decryption key in a protected memory of the mobile communication device;

receive a request to restore backup data from another electronic device to the mobile communication device;

transfer backup data, including encrypted data, from the other electronic device to the mobile communication device;

decrypt the encrypted data using the decryption key stored in the protected memory; and

store the decrypted data in a memory of the mobile communication device.

20. A non-transitory machine readable medium having tangibly stored thereon executable instructions that, when executed by a processor, cause the processor to perform a method of restoring backing up data to a mobile communication device, the method comprising:

receiving from an enterprise server an information technology (IT) policy message which includes a decryption key;

storing the decryption key in a protected memory of the mobile communication device;

receiving a request to restore backup data from another electronic device to the mobile communication device;

transferring backup data, including encrypted data, from the other electronic device to the mobile communication device;

decrypting the encrypted data using the decryption key stored in the protected memory; and

storing the decrypted data in a memory of the mobile communication device.