System and method to provide server control for access to mobile client data

• US 9,135,465 B2
• Filed: 08/09/2012
• Issued: 09/15/2015
• Est. Priority Date: 03/02/2012
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Cheng, Pau-Chen, Gates, Stephen C., Koved, Lawrence, Teiken, Wilfried
• Primary Examiner(s): LEE, JASON T
• Application Number:
  US13/570,816
• Publication Number:
  US 20130232543A1
• Time in Patent Office: 1,132 Days
• Field of Search: 726/1, 726/4, 726/22
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Systems and methods for protecting a data item include, upon initiation of transfer of the data item from a server to a client device, determining a sensitivity score and a current protection level of the data item. A policy is applied to determine an appropriate protection for the data item based upon the sensitivity score and the current protection level. A protected data item is provided to the client device by applying the appropriate protection to the data item.

Claims

1. A system for protecting a data item, comprising:

a hardware processor;

a sensitivity determination module configured to determine a sensitivity score of the data item and a current protection level of the data item upon initiation of transfer of the data item from a server to a client device;

a policy decision module configured to apply a policy, using the processor, to determine an appropriate protection for the data item based upon the sensitivity score, the current protection level, and features of the client device, wherein the features of the client device include one or more of a history of compromises, an ownership status, an operating system, a version of the operating system, applications stored on the client device, a patch status, suspected malware, a status of a network connected to the client device, and an application of the client device used to access the data item; and

a secure migration manager module configured to provide a protected data item to the client device by applying the appropriate protection to one or more data items, wherein a unique encryption key is employed for each application of a protection technique on each of the one or more data items.

2. The system as recited in claim 1, wherein sensitivity determination module is further configured to:

determine sensitivity scores for classes of data on the server;

determine a class of the data item from the classes of data on the server; and

assign a sensitivity score corresponding to the class of the data item as the sensitivity score of the data item.

3. The system as recited in claim 1, wherein the policy decision module is further configured to determine the appropriate protection based upon one or more of features of the data item.

4. The system as recited in claim 3, wherein features of the data item include one or more of type, creator, and indicator of the data item.

5. The system as recited in claim 1, wherein the secure migration manager module is further configured to provide a link referring to the protected data item.

6. The system as recited in claim 1, wherein the initiation of transfer includes at least one of a request from the client device and a server initiated transfer of the data item.

7. The system as recited in claim 6, wherein the request from the client device is due to at least one of a user request, a scheduled request, a signal received by a sensor of the client device, and an event external from the client device.

8. The system as recited in claim 6, wherein the server initiated transfer is due to at least one of a request from the client device, a request from a second device, receiving data from the second device, and a scheduled transfer.

9. The system as recited in claim 1, wherein the secure migration manager module is further configured to apply at least one of encryption, redaction, invertible obfuscation, and non-invertible obfuscation.

10. The system as recited in claim 1, wherein the protected data item includes more than one copy of the data item, wherein at least two of the more than one copy of the data item are protected by different methods of protection.

11. The system as recited in claim 1, wherein the client device is a mobile device.

12. The system as recited in claim 1, further comprising a data protection server including the sensitivity determination module, the policy decision module, and the secure migration manager module.

13. A system for protecting a data item, comprising:

a hardware processor;

a sensitivity determination module configured to determine a sensitivity score of the data item and a current protection level of the data item using a data protection server upon initiation of transfer of the data item from a server to a mobile device;

a policy decision module configured to apply a policy, using the processor, to determine an appropriate protection for the data item using the data protection server, wherein the appropriate protection is based upon the sensitivity score, the current protection level, features of at least one of the data item and the mobile device, wherein the features of the mobile device include one or more of a history of compromises, an ownership status, an operating system, a version of the operating system, applications stored on the client device, a patch status, suspected malware, a status of a network connected to the client device, and an application of the client device used to access the data item; and

a secure migration manager module configured to provide one or more protected data items to the mobile device by applying the appropriate protection to the one or more data items using the data protection server, wherein a unique encryption key is employed for each application of a protection technique on each of the one or more data items.

14. A system for accessing one or more protected data items, comprising:

a hardware processor;

a policy decision module configured to determine, using the processor, a level of confidence that a user of a client device is an authorized user of the client device to determine eligibility of the user to access the one or more protected data items in response to a request to access the one or more protected data items, wherein the level of confidence is based on one or more of a context of the client device, an authentication history of the client device, and an access history of the user of the client device, wherein the context of the client device includes one or more of a current location, a location history, a history of compromises, an ownership status, an operating system, a version of the operating system, an application stored on the client device, a patch status, suspected malware, and a security status of a network connected to the client device; and

an authentication manager module configured to provide access to the one or more protected data items to the client device in accordance with the level of confidence, such that a level of confidence needed to access the protected data item is based upon a sensitivity score of the one or more protected data items, wherein a unique encryption key is employed for each application of a protection technique on each of the one or more protected data items.

15. The system as recited in claim 14, wherein the level of confidence is based on a context of the user, wherein the context of the user includes one or more of a management status, a business role, an access history to sensitive data items, a history of device loss, and an access history of the user.

16. The system as recited in claim 14, wherein the policy decision module is further configured to:

assign a score to each authentication option;

determine an accumulated score by accumulating scores for each authentication option provided by the client device; and

compare the accumulated score with a minimum score needed to access the protected data item.

17. The system as recited in claim 16, wherein the policy decision module is further configured to modify the score for one or more authentication options provided by the client device based on one or more of a context of the client device at a time of authentication, contexts of the client device since authentication, and an amount of time passed since authentication.

18. The system as recited in claim 14, wherein the policy decision module is configured to request additional authentication information from the user based on the level of confidence by:

providing a list of one or more additional authentication options to the client device such that a set of one or more of the additional authentication options will make the user eligible to access the protected data item; and

receiving one or more additional authentication options.

19. The system as recited in claim 14, further comprising an authentication challenge module configured to send authentication challenges to the client device in accordance with the level of confidence.

20. The system as recited in claim 14, further comprising an authentication challenge module configured to request additional authentication information by contacting a third party to verify an identity of the user.

21. The system as recited in claim 14, wherein the authentication manager module is further configured to send to the client device one or more of a decryption key and obfuscation inversion function corresponding to an appropriate level of redaction of the protected data item, wherein the appropriate level of redaction is based on the access history of the user of the client device and the context of the client device.

22. The system as recited in claim 14, further comprising a data protection server including the policy decision module and the authentication manager module.

23. A system for accessing one or more protected data items, comprising:

a hardware processor;

a policy decision module configured to determine, using the processor, a level of confidence that a user of a mobile device is an authorized user of the mobile device to determine eligibility of the user to access the one or more protected data items using a data protection server in response to a request to access the one or more protected data items, wherein the level of confidence is based on one or more of a context of the client device, an authentication history of the client device, and an access history of the user of the client device, wherein the context of the client device includes one or more of a current location, a location history, a history of compromises, an ownership status, an operating system, a version of the operating system, an application stored on the client device, a patch status, suspected malware, and a security status of a network connected to the client device; and

an authentication manager module configured to provide access to the one or more protected data items to the client device using the data protection system in accordance with the level of confidence, such that a level of confidence needed to access the one or more protected data items is based upon sensitivity of the one or more protected data items, wherein a unique encryption key is employed for each application of a protection technique on each of the one or more protected data items.