METHOD OF RESTRICTING CORPORATE DIGITAL INFORMATION WITHIN CORPORATE BOUNDARY

[0001] The disclosed technology relates generally to data security and, more particularly, to techniques for preventing sensitive information leakage from a user endpoint while enforcing an organization's data use policies.

[0002] In order to stay informed, connected, and productive in their professional lives as well as their personal lives, employees tend to use a number of popular, yet diverse, products such as smartphones and tablet computing devices to access and take advantage of any of a number of social networking and instant messaging technologies. These products, and the applications associated therewith, can be challenging to an information technology (IT) group, particularly since employees increasingly want to use their favorite mobile device for both personal and professional use. That is, users tend to store personal data and install Internet-based games on the same devices that can be used to access enterprise applications and data

[0003] User demand for an always-on environment with anytime/anywhere access has been fundamentally changing support and service requirements. Indeed, these consumer technologies and tools are effectively breaking down traditional IT barriers. The benefits of corporate information sharing on open client based channels often results in undesirable information leakage when employees and other users bring their personal devices, e.g., iPads, into certain areas, regardless of whether they have permission to do so. Comingling of personal and corporate applications heightens risk to data. While the primary concern is often email, there are many other target areas such as web access, file sharing, and social media that uses the web to share data. Also, companies often experience an increase in targeted phishing and corporate espionage attacks by cybercriminals and insider threats taking advantage of such comingling.

[0004] Current attempts to monitor, track, and police sensitive data during rest and transit as it moves throughout an organization, including to destinations outside of the enterprise, tend to run into a number of limitations, such as malicious data movement that bypasses and IT department's visibility, e.g., advanced persistent threats such as Aurora, copying to USB devices as in Wiki-leaks, etc. Also, data typically needs to be decrypted at an end user's platform during viewing, where it often becomes vulnerable to various threats, e.g., screen scraping tools. Such attempts are not without an impact on both performance and usability. For example, in order to protect data, an IT group may run a number of policing software applications and suites such as antivirus (AV) software, firewall(s), host-based intrusion protection systems (RIPS), file integrity monitoring (FIM) applications, application control, encryption, etc. However, all of these protective measures may consume the client device's processing capability and battery power. Also, because of changing regulatory environments, compliance with such can be expensive.

[0011] FIG. 1 is a block diagram illustrating an example of a typical environment 100 in which embodiments of the disclosed technology may be implemented. In the example, a company has various employees 102 that may access company resources 104 such as intranet websites, email servers, and any of a number of devices or applications storing or facilitating access to sensitive data, information, content, or any combination thereof. The employees 102 may work with any of a number of contractors 106 and/or temporary visitors 108 that may be allowed to enter company premises during the course of normal business operation. However, the company may not want to provide the contractors 106 or temporary visitors 108 with certain access, be it full or even limited or restricted, to the company resources 104.

[0012] In the example, a virtual corporate boundary 110 is implemented to protect the company resources 104 and, more particularly, sensitive data stored thereon from cybercriminals 114 who seek to access and/or disrupt such data. Should the cybercriminals 114 access or copy any of the sensitive data stored by the company resources 104, they may then seek to sell or otherwise transfer such data or information to third parties 116 such as competitors, the press, etc. Alternatively or in addition thereto, there may be business partners 112 to whom the company would like to send certain data or information or provide with access to such data, which may include sensitive data.

[0013] Embodiments of the disclosed technology may provide companies or groups such as information technology (IT) departments with capabilities and greater control to overcome the many limitations of current attempts at solutions. Embodiments may serve to protect corporate and/or sensitive digital content, such as text/documents, video, audio, etc., at the user endpoint, e.g., desktop or laptop computer, tablet computing device, or smartphone, such that an audit & access control server (AAS) cannot be bypassed.

[0014] For example, whenever a user accesses sensitive content, the user's identity and device may be authenticated by an IT department's AAS to ensure that access is limited to authorized users having an IT department-approved device, for example. The device may be owned by the IT department or it may be personal property of the user. Accordingly, the deployment of a bring-your-own-device (BYOD) model within a company may be facilitated and effectively maintained.

[0015] In certain embodiments where sensitive data or content is released to a user's device in an encrypted format, a key to decrypt the encrypted data may be provided by the IT department's AAS. In such embodiments, the sensitive data or content may always reside on the client device in the encrypted format. Such implementations may greatly reduce the risk of information leak should the user's laptop be stolen, for example.

[0016] In situations involving unauthorized copying of sensitive data or content by an unauthorized user and/or unauthorized device, implementations may interfere with or even prevent the content from being viewed, printed, etc. by the unauthorized user and/or device in the absence of an authentication and access check by the AAS. Consequently, in such embodiments, any attempted movement of sensitive data or content from device to device may not be able to bypass the IT department's AAS.

[0017] In certain implementations of the disclosed technology, the protection of sensitive data or content on a client device is orthogonal to vulnerabilities in other applications on the client device. As a result, the need for monitoring software and associated cost, performance, and. battery demands is reduced, often substantially. Such implementations may also result in greater employee flexibility with regard to devices of choice and consumerization.

[0018] In certain embodiments, additional watermarking may be added to data or content in order to discourage filming and distribution by malicious user, for example.

[0019] Implementations of the disclosed technology may include a secure element. As used herein, a secure element generally refers to a malware and/or hardware attack-resistant execution environment that may be used to attest to the remote party properties of the execution environment.

[0020] Implementations of the disclosed technology may also include a secure sprite. As used herein, a secure sprite refers to an ability to display bitmaps securely on the screen of a device such that it cannot be scraped from the screen by malware, for example. A secure sprite may include, but is not limited to, protected audio/video path (PAVP) and/or high bandwidth digital content protection (HDCP) techniques.

[0021] In certain embodiments, any of a number of authentication methods may be used for validating a user's identity. Such authentication techniques may be implemented individually or in combination as required by a data policy.

[0022] Embodiments of the disclosed technology may be implemented in any of a number of different ways depending on the capabilities of the secure element and the display protection technology, for example.

[0023] Consider an example in which a user named John needs to access certain acquisition-related documents from his company's intranet site strategy.acme.com. John has an IT-approved tablet device that has been provisioned with strong authentication technology. John has access to encrypted data that is shared on the intranet site strategy.acme.com about a planned acquisition. The documents in the repository are encrypted and released after authenticating user's identity & checking access permissions. As a result of a spear phishing attack, however, John's tablet device may now have a rootkit or other undesirable and/or malicious software thereon.

[0024] FIG. 2 is a block diagram illustrating a first example of a secure system 200 implementing a virtual corporate boundary in accordance with embodiments of the disclosed technology. The system 200 includes a network site 202, such as a company internal website or intranet, e.g., strategy.acme.com. The network site 202 may store encrypted content, information, or data 204, such as a bitmap file, video stream, or virtually any other type of data, content, or information that may be encrypted and stored on a machine such as a server.

[0025] The system 200 also includes a client device 210, such as a tablet computing device or smartphone. The client device 210 has associated therewith a display 220 for presenting information visually to the user. The display 220 may be integrated with the client device 210 or it may be situated remotely from the client device 210, e.g., connected to the client device 210 via a wireless connection.

[0026] In the example, a user is using the client device 210, which connects to the network site 202. Responsive to the user's interaction with the client device 210, e.g., using a web browser 212 or other application on the client device 210, the client device 210 may send a request for sensitive information, such as a sensitive document or content, from the network site 202, as indicated by 230.

[0027] The user's identity may be authenticated to the web application via any of a number of standard authentication methods. For example, on the server side, an access control system may be used to check that the user is permitted to access a particular acquisition document. Based on a positive result of the check, the server may then send a response to activate certain client protection features. For example, the web browser 212 may have an extension that invokes an application in a secure element 214, as indicated by 232.

[0028] In certain embodiments, a session key may be established, as indicted by 234. In the example, the secure element 214 verifies the identity of the network site 202 and then establishes an ephemeral protected audio/video path (PAVP) session key (Ks) between the web application on the network site 202 and a graphics chipset 216 on the client device 210. The session key Ks may be established over a secure channel that is established using a secret on the client device 210. In certain embodiments, this can be pre-provisioned. The client device 210 may inform the server of its capability and identity.

[0029] In the example, the server-side application may render the sensitive content 204 on the server, e.g., from .pdf, .doc, or other format, as indicated by 236. In the example, this rendered bitmap is encrypted using the session key Ks and is subsequently sent to the web browser 212 on the client device 210.

[0030] An extension of the web browser 212 on the client device 210 may send the encrypted content to the graphics chipset 216 on the client device 210, as indicated by 240, in order for the content to be presented to the user on the display 220 via high bandwidth digital content protection (HDCP), for example, as indicated by 242. The page 222 may then be displayed to the user in-line with the non-secure content on the display 220.

[0031] In certain embodiments, a client device may have scalable secure element capabilities such as a PAVP channel with graphics. In such embodiments, graphics to be displayed may be protected by a protective measure such as HDCP, for example. Sensitive content on a network such as a company intranet may be composed directly within a secure element and delivered to a graphics subsystem of the client device by the secure element.

[0032] FIG. 3 is a block diagram illustrating a second example of a secure system 300 implementing a virtual corporate boundary in accordance with embodiments of the disclosed technology. In the example, the system 300 includes a network site 302, such as a company's intranet, and a client device 310, such as a handheld computing device, tablet device, or smartphone. As with the client device 210 of FIG. 2, the client device 310 of FIG. 3 has associated therewith a display 320 that may be integrated with or separate from the client device 310, e.g., connected to the client device 310 via a wireless connection.

[0033] In the example, a user needs to access the latest status on certain acquisition negotiations. Using his or her client device 310, such as a laptop or tablet computer or smartphone, the user connects to the company intranet 302 or other network site and sends a request for information or content 304 pertaining to the acquisition negotiations, as indicated by 330. The information requested may include sensitive documents or other types of information, data, or content.

[0034] Once a connection has been established at 330, an authentication and access check may be performed using a secure element 314, as indicated by 332. For example, the user's identity may be authenticated to a web application 312 or other application on the client device 310 via any of a number of known authentication techniques. On the server side, an access control system may confirm whether the user is permitted to access the requested acquisition document. The server may subsequently send a response to activate certain client protection features, and an extension of the web browser 312 on the client device 310 may invoke an application in the secure element 314.

[0035] In the example, a client-web application secure session key (Ks) may be established, as indicated by 334. The secure element 314 may verify the identity of the network site 302. Once the secure element 314 attests to the network site 302, it may establish an encrypted channel. between the web application on the network site 302 and the secure element 314. The web application on the network site 302 may send the sensitive content to the secure element 314 over an encrypted channel, e.g., using a secure socket layer (SSL) connection. The client device 310 may inform the server of its capability and identity.

[0036] The secure element 314 may establish an ephemeral PAVP session key (KS) for the graphics chipset 316 on the client device 310, as indicated by 336. The secure element 314 may utilize an application to render sensitive content, e.g., from .pdf or .doc format, on the client device 310.

[0037] In the example, the secure element 314 may encrypt a rendered bitmap using the session key (Ks) and send the resulting data to the graphics chipset 316 on the client device 310, as also indicated by 336, for secure display to the user on the screen 320 via HDCP, for example, as indicated by 338.

[0038] FIG. 4 is a flowchart illustrating a first example 400 of enforcing a virtual corporate boundary in accordance with embodiments of the disclosed technology. At 402, a user uses a client device, such as a tablet computing device, to request sensitive data from a network site such as the user's company intranet. The requested data may include any of a number of data types, file formats, multimedia content, etc.

[0039] At 404, an authentication and access check is performed. For example, a server-side access control system may perform a check to determine whether the user and/or client device is permitted to access the requested information. Upon a determination that such authorization exists, the server may send a response to activate client protection features and the web browser application on the client device may invoke an application in a secure element on the client device.

[0040] At 406, a session key is established. For example, the secure element on the client device may verify the identity of the network site and establish a session key, e.g., a PAVP session key, between a web application on the server device and the graphics chipset on the client device. The client device may inform the server of it capability and identity.

[0041] At 408, the server-side application renders the sensitive content on the server. The rendered data is encrypted using the session key and then sent to the browser application on the client device, as indicated at 410. A browser extension sends the encrypted content to the graphics chipset to be visually presented to a user via a display, as indicated at 412. The display may be integrated with or physically separate from the client device. The content may be displayed using a content protection technique, such as HDCP, such that the page is displayed to the user in-line with the non-secure content.

[0042] FIG. 5 is a flowchart illustrating a second example 500 of enforcing a virtual corporate boundary in accordance with embodiments of the disclosed technology. At 502, a user uses a client device, such as a tablet computing device, to request sensitive content from a network site such as the user's company intranet. At 504, an authentication and access check is performed. This is similar to the processing that occurs at 404 of the method 400 of FIG. 4.

[0043] At 506, a client-web application secure session key is established. For example, a secure element on the client device may verify the identity of the network site. The secure element on the client device establishes an encrypted channel between a web application on the server device and the secure element itself, as indicated by 508.

[0044] At 510, the web application on the server device sends the sensitive content to the secure element over the encrypted channel, e.g., using SSL. The client device may inform the server device of its capability and identity.

[0045] At 512, the secure element on the client device establishes a session key for the graphics chipset on the client device. The secure element then renders the sensitive content on the client device, as indicated by 514. The secure element encrypts the rendered content and sends it to the graphics chipset on the client device, as indicated by 516.

[0046] At 518, the content is visually presented to the user via a display. The display may be integrated with or physically separate from the client device. For example, the display may be connected to the client device via a wireless communication channel. The content may be displayed using a content protection technique such as HDCP.

[0047] Embodiments of the disclosed technology may be incorporated in various types of architectures. For example, certain embodiments may be implemented as any of or a combination of the following: one or more microchips or integrated circuits interconnected using a motherboard, a graphics and/or video processor, a multicore processor, hardwired logic, software stored by a memory device and executed by a microprocessor, firmware, an application specific integrated circuit (ASIC), and/or a field programmable gate array (FPGA). The term “logic” as used herein may include, by way of example, software, hardware, or any combination thereof.

[0048] Although specific embodiments have been illustrated and described herein, it will be appreciated by those of ordinary skill in the art that a wide variety of alternate and/or equivalent implementations may be substituted for the specific embodiments shown and described without departing from the scope of the embodiments of the disclosed technology. This application is intended to cover any adaptations or variations of the embodiments illustrated and described herein. Therefore, it is manifestly intended that embodiments of the disclosed technology be limited only by the following claims and equivalents thereof.