Patent Application
20180205762
The embodiments herein relate to data protection and containerization and, more particularly, to securing of data automatically based on geolocation, network or device parameters.
Most of the companies nowadays offer a Bring Your Own Device (BYOD) facility, which allows employees to use their own devices (laptops, tablets, mobile phones and so on) for official use. This can be considered to be good for the company, as they do not have to invest much for providing resources to the employees. From the employee perspective, this option is useful as they can access data even if they are out of office.
However, BYOD option gives rise to data security concerns. Work related information is normally of a confidential nature, and BYOD allows users to access the confidential data from anywhere. Further, malware threats also add to the data security concerns. In any organization, network security mechanisms are employed in the form of anti-virus software, anti-malware applications and so on to protect the network and devices from any imminent threats. However, personal devices of the employees may not be equipped with such security means, and are prone to malware attacks, which in turn may result in data loss.
Data leak prevention means can be used as a solution to this problem. This mechanism is intended to restrict user access to data under certain circumstances. Data containerization technique is used to separate enterprise data from personal data, in the user device, and in a way, may lock down access to the enterprise data, by securing the enterprise data. However, the current systems, which are being used for data containerization and securing data, provide limited options for customizing the data securing options. The existing containerization systems containerize the whole device or the whole application, thus causing inconvenience to the users. Further, the existing containerization systems need to be manually turned ON, and are not proactive in nature.
The embodiments herein will be better understood from the following detailed description with reference to the drawings, in which:
The embodiments herein and the various features and advantageous details thereof are explained more fully with reference to the non-limiting embodiments that are illustrated in the accompanying drawings and detailed in the following description. Descriptions of well-known components and processing techniques are omitted so as to not unnecessarily obscure the embodiments herein. The examples used herein are intended merely to facilitate an understanding of ways in which the embodiments herein may be practiced and to further enable those of skill in the art to practice the embodiments herein. Accordingly, the examples should not be construed as limiting the scope of the embodiments herein.
The embodiments herein disclose a mechanism for securing data by using a data security management system. Referring now to the drawings, and more particularly to
The data management engine 101 can communicate with the user device 103 through the communication channel 102, to manage data security on the user device 103. In an embodiment herein, the user device 103 can secure the data on the user device, based on one or more communications received from the data management engine 101. In an embodiment herein, the user device 103 can secure the data itself, based on performing a comparison with one or more policies stored locally.
The tracking module 201 can receive/fetch information from the sensor(s) and/or modules (hereinafter referred to as trigger inputs). The trigger inputs can comprise of the geolocation of the user device 103, information related to one or more networks serving the user device 103, information collected related to the user device 103, and so on. The tracking module 201 can communicate the trigger inputs to the communication interface 203.
The communication interface 203 can comprise of one or more interfaces that enable the user device 103 to communicate with external entities, such as the data management engine 101. The communication interfaces 203 can use a wired and/or a wireless means for communicating with the external entities. The communication interface 203 can communicate with the tracking module 201 to collect the trigger inputs. The communication interface 203 can communicate the trigger inputs received from the tracking module to the data management engine 101. The communication interface 203 can also receive one or actions to be performed by the user device 101 from the data management engine 101.
The data module 202 can perform at least one action that is required to secure data in the user device 103, as instructed by the data management engine 101. The communication interface 203 can perform selected action(s) for securing the data, as instructed by the data management engine 101.
In an embodiment herein, the data module 202 can process the trigger inputs, identify and select at least one action to be triggered so as to perform the data securing process. If the data management engine 101 has provided a key, the data module 202 can use the key to decrypt/encrypt the data, based on the communication from the data management engine 101.
The device 103 can comprise of a data storage means, which can be used to store all or at least a portion of the policies and any other information required to perform the data securing process. This can be useful in scenario such as the user device 103 being unable to communicate with the data management engine 101.
In an embodiment herein, the data module 202 can process the trigger inputs based on at least one policy stored in the local data storage means. The data module 202, by processing the trigger inputs, can identify and select at least one action to be triggered so as to perform the data securing process. Examples of the action can be, but not limited to, deletion of the data, hiding the data, secure wiping of the data, DRM protection of the data, lockdown/scrambling of the data, blocking of user access to the data, containerization of the data, or any other equivalent means to secure the data.
The data module 202 can fetch the policy from another entity such as the data management engine 101, a remote server, the Cloud, a data server, and so on. On fetching the policy, the data module can store the policy. The data module 202 can update the policy, as required, wherein the updation can include addition, deletion, editing of the policy, and so on.
For example, if the policy states that the data has to be accessed only when the user device 103 is present in an office premises, then the data module 202 can check if the current location of the device 103 is within the office premises. If the device 103 is within the office premises, the data module 202 can decrypt the data and enable the user of the user device 103 to access the data. If the device 103 is not within the office premises, the control module 401 can encrypt the data and block access to the data.
The I/O interface 304 may include a variety of software and hardware interfaces, for example, a web interface, a graphical user interface such as a display screen, a camera interface for the camera sensor (such as the back camera and the front camera on the user device 103), and the like.
The I/O interface 304 may allow the user device 103 to communicate with other devices, such as the data management engine 101. The I/O interface 304 may facilitate multiple communications within a wide variety of networks and protocol types, including wired networks, for example, Local Area network (LAN), cable, etc., and wireless networks, such as Wireless LAN, cellular, Device to Device (D2D) communication network, Wi-Fi networks and so on. The modules 308 include routines, programs, objects, components, data structures, and so on, which perform particular tasks, functions or implement particular abstract data types.
In one implementation, the modules 308 may include a device operation module 310. The device operation module 310 can be configured to perform at least one action such as securing at least some or all of the data 312, present in the user device 103.
In an embodiment herein, the device operation module 310 can be configured to secure the data, based on one or more instructions/actions received from the data management engine 101. The device operation module can be configured to execute one or more tasks such as collecting information from one or more sensors present in the user device 103 and sharing the collected information with the data management engine 101. The device operation module can be configured to execute one or more tasks corresponding to the application on the user device 103 in accordance with the instructions received from the data management engine 101.
In an embodiment herein, the device operation module 310 can process the trigger inputs based on at least one policy stored in the memory 306. The data module 202, by processing the trigger inputs, can identify and select at least one action to be triggered so as to perform the data securing process. Examples of the action can be, but not limited to, deletion of the data, hiding the data, secure wiping of the data, DRM protection of the data, lockdown/scrambling of the data, blocking of user access to the data, containerization of the data, or any other equivalent means to secure the data.
The modules 308 may include programs or coded instructions that supplement applications and functions of the user device 103. The data 312, amongst other things, serves as a repository for storing data processed, received, and generated by one or more of the modules 308. The device operation module 310 can secure the data 312, based on instructions received from the data management engine 101. Further, the names of the other components and modules of the user device 103 are illustrative and need not be construed as a limitation.
The control module 401 can be configured to receive the trigger inputs from the user device 103 and process the received trigger inputs based on at least one policy stored in the policy database 403. The control module 401, by processing the trigger inputs, can identify and select at least one action to be triggered so as to perform the data securing process. Examples of the action can be, but not limited to, deletion of the data, hiding the data, secure wiping of the data, DRM protection of the data, lockdown/scrambling of the data, blocking of user access to the data, containerization of the data, or any other equivalent means to secure the data.
For example, if the policy states that the data has to be accessed only when the user device 103 is present in an office premises, then the control module 401 can check if the current location of the device 103 is within the office premises. If the device 103 is within the office premises, the control module 401 can communicate to the device 103 to decrypt the data and enable the user of the user device 103 to access the data. If the device 103 is not within the office premises, the control module 401 can communicate to the device 103 to encrypt the data and block access to the data.
The KM 402 can generate at least one key, which can be used to encrypt and/or decrypt data in the user device 103, if encryption/decryption is selected as the action to be triggered for data securing purpose. In another embodiment, the keys generated by the KM 402 can be used for data containerization. In another embodiment herein, the keys generated can be used for creating DRM (Digital Rights Management) schemes, which can be used to protect the data. In another embodiment herein, the keys generated can be used for providing secure access, such as blocking a user from accessing the server at network or machine level. The control module 401 can communicate the selected action(s) to the user device 103, with the generated key(s).
The control module 401 or the communication interface 203 compares (504) the trigger input with policies stored in the policy database 403. In an embodiment, each policy may refer to a rule or a set of rules that define type of action to be triggered corresponding to the trigger input received. For example, one policy may define data securing mode to be adopted corresponding to location of the user device 103, such as securing a portion of the data when the location of the user is determined to be in China, Libya, or any other country where the data may be at risk. In another example, the policy can define securing the data, when the IP and/or MAC address of the device is not approved. While comparing the trigger input with the policy, the control module 401 may compare location of the device as indicated by the trigger input, with location as defined by the policy, and then identifies (506) and selects at least one action as indicated by the policy. For example, the action to be triggered could be any of, or a suitable combination of wiping, secure wiping, hiding, encrypting, containerizing, DRM protection or lockdown. In an embodiment, such actions may be pre-defined and pre-configured by any authorized person such as an administrator, as per requirements. Various examples of actions that may be triggered by the control module 401 are, but not limited to wiping, secure wiping, hiding, encrypting, containerizing, DRM protection, and lockdown. Further, information about the selected action(s) to be triggered is sent to the user device 103 as instruction(s).
The communication interface 203 in the user device 103 receives the instruction, and further instructs the data module 202 to trigger the action(s) as instructed by the data management engine 101. The data module 202 then triggers (508) the selected action (s). In an embodiment, the data module 202 may be associated with suitable hardware and/or software means to execute any action that is supported by the data management engine 101, for the purpose of securing the data in the user device 103. For example, if the action to be triggered for the purpose of securing the data is encryption of the data in the user device 103, the data module 202 may be equipped with at least one means for encrypting the data. Further, the data module 202 may support encryption of different types of data such as but not limited to file, folder, image, contact, email, and any metadata associated with the data.
The various actions in method 500 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in
The various actions in method 600 may be performed in the order presented, in a different order or simultaneously. Further, in some embodiments, some actions listed in
The embodiments disclosed herein can be implemented through at least one software program running on at least one hardware device and performing network management functions to control the network elements. The network elements shown in
The foregoing description of the specific embodiments will so fully reveal the general nature of the embodiments herein that others can, by applying current knowledge, readily modify and/or adapt for various applications such specific embodiments without departing from the generic concept, and, therefore, such adaptations and modifications should and are intended to be comprehended within the meaning and range of equivalents of the disclosed embodiments. It is to be understood that the phraseology or terminology employed herein is for the purpose of description and not of limitation. Therefore, while the embodiments herein have been described in terms of preferred embodiments, those skilled in the art will recognize that the embodiments herein can be practiced with modification within the spirit and scope of the embodiments as described herein.
