Protecting enterprise data through policy-based encryption of message attachments

• US 8,886,925 B2
• Filed: 10/10/2012
• Issued: 11/11/2014
• Est. Priority Date: 10/11/2011
• Status: Active Grant

• Current Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Original Assignee: Citrix Systems, Inc. (Cloud Software Group)
• Inventors: Qureshi, Waheed, McGinty, John M.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): WYSZYNSKI, AUBREY H
• Application Number:
  US13/649,064
• Publication Number:
  US 20140006772A1
• Time in Patent Office: 762 Days
• Field of Search: 713/150
• US Class Current: 713/150
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/14 against software analysis or reverse engineering, e.g. by obfuscation
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 8/53 Decompilation; Disassembly
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 : using geofenced areas
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/029 : Location-based management or tracking services

Abstract

A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user'"'"'s position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.

Claims

1. Non-transitory computer storage storing an executable component configured to provide functionality for selectively protecting attachment data addressed to a mobile device, the executable component comprising instructions that direct one or more computing devices to a process that comprises:

receiving, from an enterprise resource, an attachment to a message, the message addressed to the mobile device;

determining whether to encrypt the attachment based on one or more configurable access policies of an enterprise; and

when a determination is made to encrypt the attachment;

encrypting the attachment;

causing transmission of the encrypted attachment to the mobile device in place of the attachment;

encrypting an attachment key used to encrypt the attachment; and

causing transmission of the encrypted attachment key with the encrypted attachment to the mobile device.

2. The non-transitory computer storage of claim 1, wherein the determining is based at least partly on a role of a user of the mobile device in the enterprise.

3. The non-transitory computer storage of claim 1, wherein the determining is based at least partly on one or more properties of the mobile device.

4. The non-transitory computer storage of claim 3, wherein the determining is based at least partly on whether a particular mobile application is installed on the mobile device.

5. The non-transitory computer storage of claim 1, wherein the determining is based at least partly on one or more properties of the attachment.

6. The non-transitory computer storage of claim 5, wherein the one or more properties of the attachment comprise a keyword in the attachment, wherein the encrypting the attachment is in response to determining that the attachment comprises the keyword.

7. The non-transitory computer storage of claim 1, wherein the process comprises at least one of:

naming the encrypted attachment with a suffix that is different from the corresponding attachment prior to encryption of the attachment, wherein the mobile device is configured to detect that the encrypted attachment is encrypted based on the suffix; and

naming a link to the attachment with a suffix that is different from the corresponding link to the unencrypted attachment.

8. The non-transitory computer storage of claim 1, wherein the message is an email message.

9. The non-transitory computer storage of claim 8, wherein the encryption of the attachment is transparent to an email client of the mobile device.

10. The non-transitory computer storage of claim 1, wherein the process comprises:

modifying the one or more configurable access policies of the enterprise.

11. The non-transitory computer storage of claim 1, wherein causing transmission of the message with the encrypted attachment to the selected mobile device comprises causing transmission of the message via a firewall of an enterprise computing system.

12. The non-transitory computer storage of claim 1, wherein the process comprises:

when a determination is made not to encrypt the attachment, causing transmission of the attachment to the selected mobile device unencrypted.

13. The non-transitory computer storage of claim 1, wherein the process comprises:

receiving, from the mobile device, a request to forward the message;

decrypting the encrypted attachment; and

causing transmission of the message with the decrypted attachment to the enterprise resource.

14. The non-transitory computer storage of claim 13, wherein the decrypting is transparent to an email client installed on the mobile device.

15. The non-transitory computer storage of claim 13, wherein the process comprises:

determining whether to re-encrypt the attachment when the forwarded message is addressed to a different mobile device, based on whether at least one of the one or more configurable access policies of the enterprise indicate to encrypt the attachment for the different mobile device.

16. The non-transitory computer storage of claim 1, wherein the message is a short message service (SMS) message.

17. The non-transitory computer storage of claim 1, wherein the determining whether to encrypt the attachment based on the one or more configurable access policies of the enterprise comprises determining that a role in the enterprise of a user of the mobile device is associated with encrypting attachments by default.

18. A system comprising:

a data store configured to store one or more rules defining conditions under which to encrypt an attachment; and

one or more computing devices in communication with the data store, the one or more computing devices configured to;

monitor messages from an enterprise computing system that are addressed to a mobile device;

determine whether to encrypt an attachment to a selected one of the messages at least partly by comparing a condition associated with the selected message to a value associated with the condition in the one or more rules stored in the data store;

encrypt an attachment key used to encrypt the attachment, wherein the attachment key is encrypted such that only the mobile device is configured to decrypt the attachment key; and

cause transmission of the encrypted attachment key to the mobile device.

19. The system of claim 18, wherein the condition comprises a property of the mobile device.

20. The system of claim 18, wherein the condition comprises a property of a user associated with the mobile device.

21. The system of claim 18, wherein the condition comprises a property of the attachment.

22. The system of claim 18, wherein the message is an email message from an enterprise email server, the email message addressed to the mobile device.

23. The system of claim 22, wherein the one or more computing devices are configured to:

encrypt the attachment transparently to an email client of the mobile device.

24. The system of claim 22, wherein the monitored messages are formatted in accordance with an ActiveSync protocol.

25. The system of claim 18, wherein the one or more computing devices are configured to:

encrypt at least a portion of the selected message based on comparing the condition associated with the selected message to the value associated with the condition in the one or more rules stored in the data store.

26. The system of claim 18, wherein the one or more computing devices comprise at least one of a firewall server, an application server, a computing device configured to control a firewall server, and a computing device configured to control an application server.

27. The system of claim 18, wherein the one or more computing devices are configured to:

cause transmission of the encrypted attachment to the mobile device separate from transmission of the message to the mobile device.

28. The system of claim 18, wherein the one or more computing devices are configured to:

encrypt the attachment responsive to a determination to encrypt the attachment; and

cause transmission, to the mobile device, of the encrypted attachment in place of the attachment.

29. The system of claim 18, wherein the enterprise computing system sends the selected one of the messages, and the one or more computing devices configured to monitor the messages from the enterprise computing system are different from the enterprise computing system.

30. A method of selectively protecting email-attachment data addressed to a mobile device, the method comprising:

monitoring, by a computing device, email messages from an enterprise resource that are addressed to the mobile device;

detecting that data requested by the mobile device from the enterprise resource includes an attachment to a selected one of the email messages;

determining whether to encrypt the attachment to the selected one of the email messages for transmission to the mobile device at least partly based on whether a particular mobile application is installed on the mobile device; and

in response to determining to encrypt the attachment, causing encryption of the attachment.

31. Non-transitory computer storage storing an executable component that is configured to be installed on a mobile device to provide functionality for securely accessing data from an enterprise-computing system, the executable component comprising instructions that direct the mobile device to perform a process that comprises:

determining that an email message received by the mobile device includes an attachment that has been encrypted by a gateway associated with the enterprise-computing system;

prompting a user of the mobile device to provide access credentials; and

decrypting the attachment stored on the mobile device using a key obtained from the enterprise-computing system, the decrypting occurring transparently to an email client installed on the mobile device, the decrypting occurring transparently to an enterprise-email server of the enterprise-computing system,

wherein the decrypting is responsive to detecting that the access credentials received from the user indicate that the user is authorized to access the attachment according to one or more enterprise-access policies.

32. The non-transitory computer storage of claim 31, wherein the access credentials comprise a passcode.