Patent Application
20170149826
To protect mobile devices existing security solutions such as encryption, anti-virus, cyber protection tools are used.
For mobile phones, once it is detected that they are lost or stolen data can be erased or the device locked.
Pin codes are being used to activate the device.
There are no method to enforce a flexible policy based on the data type, employee type and the device status.
There are no methods to protect against a careless behavior of a misbehavior of the employee.
System calls may be converted to calls to protection handler, which based on picking the right protection policy will decide based on information on the data type, user type and device status on how to handle the data.
The following description describes a system for protecting corporate data residing in employee mobile devices from undesired operations on the corporate data by applications on the mobile device side.
This may be just modifying the data or transferring it.
Under the first embodiment, a system call target conversion mechanism as described in patent application Ser. No. 13/846,953 and patent application 20100175104 is used. All application calls to a certain system call are being converted to another address.
The system is based on a corporate server 1 and multiple mobile devices 10. An employee might have multiple such devices.
The server may have in multiple corporate protection policies 2.
A policy selector will select the appropriate policy based on a user personal descriptor 17 and device descriptor 18. It is possible that for the same user there will be different policies depending on the device descriptor—is this a notebook or a phone? Where is it?
It is also possible that there will be a single policy for the company with references to the descriptors.
If an application is referencing a certain data file, it will be redirected through the applet wrapper to the handler driver. It will read the file descriptor and the relevant company policy indicated by the descriptor and will decide based on the data descriptor and the policy if to allow the system call. It can jus prevent it or cause another system call instead.
In the mobile device 10 an application 11 will be activated. It may issue a system call SYS11 which refers to data file 15. The data file may 1 have a data descriptor attached to it, if it is protected.
A call converter 12 might be activated due to Sys1 call. In any case, if the method is capable of detecting and handling a call, the call will be converted to a call to data protection handler 13. The call converter will not be activated by other system calls, such as Sys2.
The handler will examine the following information:
1. Calling application
2. System call type
3. Data descriptor (what type of data, to which company the data belongs—it is possible the user is working for multiple companies)
4. User personal information (type of job, years in the company, grade etc.
5. Device data—this includes type of device, ownership, time, location.
6. Protection policies—the user may be working for multiple companies, potentially a policy per each.
The handler will pick the appropriate policy based on the data file ownership, and based on the policy and the descriptors will decide if to which processing driver 14 to call. This may be the original target or system call or any other type of service—this may be jus a message which will instruct the user it is not allowed to do such an operation. It may allow the call to path, ignore it, convert it to another system call or do data processing.
Also, per patent application 61/865,152 a system and method are described where different sections of a file have each a different encryption key, such that per user or condition different segments can be encrypted. If the data file was prepared in such a way than the handler will have a list of such keys and it may activate decryption software and send it the appropriate key. In such a way, if the data file is for example the company contact list, certain contacts may be visible to design engineers and other to marketing people.
If the application is referencing a file without a file descriptor this will mean that this is a reference to non protected data, and the handler will issue a call to the original system call SYS1
Under a second embodiment a system and method for system call conversion as described in patent application Ser. No. 13/846,953 is being described. In this system, an applet is generated for certain applications and certain system calls from this application are intercepted and converted to another target for special handling.
Application121 in
Applet122 was generated to handle system calls made by application121.
It will take Sys1 call and convert it to a call to data protection handler 13, which will handle it as described above using descriptor information as described above
Application 29 is an unprotected application with no applet attached to it. Sys3 calls issued by it will go uninterrupted.
