Method and system for destroying sensitive enterprise data on portable devices

Patent metadata

Field	Value
Publication number	US-10089484-B2
Application number	US-201514645393-A
Country	US
Kind code	B2
Filing date	Mar 11, 2015
Priority date	Mar 11, 2015
Publication date	Oct 2, 2018
Grant date	Oct 2, 2018

Abstract

Systems and methods for destroying sensitive enterprise data on portable devices are provided. Such systems and methods may include providing a portable device that includes a security agent for deleting sensitive enterprise data. The security agent on the portable device can be required to regularly be authenticated by a user through an authentication server. The authentication server provides a pre-determined timeframe for which the user would need to re-authenticate. Failure by the user to re-authenticate within the pre-determined timeframe can result in the security agent proceeding with deleting the sensitive enterprise data on the portable device.

First claim

What is claimed is:

1. A method for destroying sensitive enterprise data on a portable device, the method comprising:
downloading the sensitive enterprise data from an authentication server, the downloaded sensitive enterprise data being associated with a pre-determined authentication timeframe, wherein the sensitive enterprise data downloaded from the authentication server is characterized as a type of sensitive data;
storing the downloaded sensitive enterprise data into memory;
initially authenticating a security agent in the portable device with the authentication server associated with the downloaded sensitive enterprise data, wherein the initial authentication includes receiving a token from the authentication server, wherein the token includes information pertaining to what sensitive enterprise data may be destroyed and the pre-determined authentication timeframe by which a re-authentication of the security agent with the authentication server is to occur, wherein the initial authentication initiates the pre-determined authentication timeframe specifying that a next re-authentication be performed, wherein the pre-determined authentication timeframe corresponds to one or more parameters that relate to the type that characterizes the sensitive enterprise data;
accessing the token to determine the pre-determined authentication timeframe; and
triggering destruction of the downloaded sensitive enterprise data when the pre-determined authentication timeframe expires without re-authentication of the security agent with the authentication server.

2. The method of claim 1 , further comprising identifying when the pre-determined timeframe expires by:
measuring an elapsed time from a prior authentication to a current time; and
identifying that the elapsed time exceeds the predetermined authentication time-frame associated with the downloaded sensitive enterprise data, the pre-determined authentication time-frame specifying when a next re-authentication is to be performed.

3. The method of claim 1 , wherein triggering destruction of the downloaded sensitive enterprise data comprises deleting the downloaded sensitive enterprise data from memory of the portable device.

4. The method of claim 1 , further comprising encrypting the downloaded sensitive enterprise data prior to triggering destruction.

5. The method of claim 1 , wherein the pre-determined timeframe is based on at least one factor selected from the group consisting sensitivity level of the downloaded sensitive enterprise data, identity of a user of the portable device, reason for download, ability of the user to re-authenticate, and duration that the downloaded sensitive enterprise data can be used.

6. The method of claim 1 , further comprising initiating safety protocols when the portable device is detected as having been tampered with, wherein the safety protocols comprise at least one of disabling user access to the portable device, disabling user access to the downloaded sensitive enterprise data, and deleting at least part of the downloaded sensitive enterprise data from the portable device.

7. The method of claim 1 , further comprising providing a notification regarding a current pre-determined timeframe to a user of the portable device via a display.

8. The method of claim 1 , wherein the downloaded sensitive enterprise data includes a plurality of files, and wherein each of the files is associated with the different pre-determined authentication timeframe.

9. The method of claim 8 , wherein triggering destruction applies to a selected subset of the downloaded sensitive enterprise data, and wherein another subset of the downloaded sensitive enterprise data is not destroyed.

10. A method for securing sensitive enterprise data on a portable device, the method comprising:
downloading the sensitive enterprise data from an authentication server, the downloaded sensitive enterprise data being associated with a pre-determined authentication timeframe, wherein the sensitive enterprise data downloaded from the authentication server is characterized as a type of sensitive data;
storing the downloaded sensitive enterprise data into memory;
initially authenticating a security agent in the portable device with the authentication server associated with the downloaded sensitive enterprise data, wherein the initial authentication includes receiving a token from the authentication server, wherein the token includes information pertaining to what sensitive enterprise data may be destroyed and the pre-determined authentication timeframe by which a re-authentication of the security agent with the authentication server is to occur, wherein the initial authentication initiates the pre-determined authentication timeframe specifying that a next re-authentication be performed, wherein the pre-determined authentication timeframe corresponds to one or more parameters that relate to the type that characterizes the sensitive enterprise data;
accessing the token to determine the pre-determined authentication timeframe;
re-authenticating with the authentication server within the pre-determined authentication timeframe; and
renewing the pre-determined authentication timeframe specifying a next re-authentication to be performed.

11. The method of claim 10 , wherein re-authenticating is based on a user providing re-authentication information into the user portable device, and wherein re-authenticating further comprises forwarding the re-authentication information to the authentication server through use of the security agent.

12. A system for destroying sensitive enterprise data on a portable device, the system comprising:
an authentication server; and
a portable device, the portable device including a processor and memory, wherein the processor executes instructions stored in memory to:
download sensitive enterprise data from the authentication server, the downloaded sensitive enterprise data being associated with a pre-determined authentication timeframe, wherein the sensitive enterprise data downloaded from the authentication server is characterized as a type of sensitive data,
store the downloaded sensitive enterprise data in memory,
initially authenticate a security agent in the portable device with the authentication server associated with the downloaded sensitive enterprise data, wherein the initial authentication includes receiving a token from the authentication server, wherein the token includes information pertaining to what sensitive enterprise data may be destroyed and the pre-determined authentication timeframe by which a re-authentication of the security agent with the authentication server is to occur, wherein the initial authentication initiates the pre-determined authentication timeframe specifying that a next re-authentication be performed, wherein the pre-determined authentication timeframe corresponds to one or more parameters that relate to the type that characterizes the sensitive enterprise data,
access the token to determine the pre-determined authentication timeframe, and
trigger destruction of the downloaded sensitive enterprise data when the pre-determined authentication timeframe expires without re-authentication by the security agent with the authentication server.

13. The system of claim 12 , wherein the processor identifies when the pre-determined timeframe expires corresponds to by:
measuring an elapsed time from a prior authentication to a current time; and
identifying that the elapsed time exceeds the predetermined authentication time-frame associated with the downloaded sensitive enterprise data, the pre-determined authentication time-frame specifying when a next re-authentication

Assignees

• Quest Software Inc

Inventors

• Willis Tomas
• Tersteeg Peter Travis

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2221/2139

  Recurrent verification · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title