Systems and methods for controlling access to encrypted data stored on a mobile device
View Patent ↗Encrypted data on mobile devices is protected by remotely storing a decryption key. In order to decrypt the encrypted data on the mobile device, the mobile device obtains the decryption key from an access control system that is remote from the mobile device. The access control system can control access to the encrypted data by controlling access to the decryption key. For example, the access control system can implement user authentication as a condition for providing the decryption key. Access to the encrypted data can also be controlled by withholding the decryption key where, for instance, a mobile device has been reported to be lost or stolen, or once an individual's access privilege has been revoked, or at certain times of the day.
1. A method for accessing encrypted data with a mobile device, the method comprising:
prearranging a response to a prompt;
obtaining a decryption key from an access control system including
receiving a prompt for a claimant target,
submitting the claimant target,
receiving the prompt over a first communication channel from the access control system,
providing the response to the access control system, and
receiving by the mobile device the decryption key from the access control system; and
using the decryption key to decrypt the encrypted data with the mobile device.
2. The method of claim 1 wherein prearranging the response to the prompt includes establishing a password as the response.
3. The method of claim 1 wherein prearranging the response to the prompt includes establishing a biometric response as the response.
4. The method of claim 1 wherein the prompt comprises a personalized prompt.
5. The method of claim 1 wherein the prompt is one of a plurality of prompts.
6. The method of claim 1 wherein the response to the access control system is provided over the first communication channel.
7. The method of claim 1 wherein the response to the access control system is provided over a second communication channel.
8. The method of claim 1 wherein the response is a biometric response.
9. A method for controlling access to encrypted data stored on a mobile device, the method comprising:
sending a first prompt for a claimant target to the mobile device,
receiving the claimant target,
sending a second prompt to the mobile device over a first communication channel;
receiving a claimant response to the second prompt;
determining a match between the claimant response and a response template associated with the second prompt; and
sending a decryption key to the mobile device after determining the match.
10. The method of claim 9 further comprising storing the response template in association with the second prompt.
11. The method of claim 9 further comprising receiving a request for the decryption key from the mobile device before sending the second prompt to the mobile device.
12. The method of claim 11 wherein the request includes an identification of the mobile device.
13. The method of claim 12 further comprising determining a permission for the mobile device.
14. The method of claim 9 further comprising determining a permission for the user.
15. The method of claim 9 wherein the claimant response to the second prompt is received over the first communication channel.
16. The method of claim 9 wherein the claimant response to the second prompt is received over a second communication channel.
17. The method of claim 9 wherein the claimant response is a biometric response.
18. A system comprising:
a computing system including logic, including a microprocessor, programmed to
send a first prompt for a claimant target,
receive the claimant target,
send a second prompt over a first communication channel;
receive a claimant response to the second prompt;
determine a match between the claimant response and a response template associated with the second prompt; and
send a decryption key after determining the match between the claimant response and a response template.
19. The system of claim 18 wherein the computing system includes logic further programmed to select the second prompt from a plurality of prompts.
20. The system of claim 18 wherein the computing system includes logic further programmed to store the response template in association with the second prompt.
21. The system of claim 18 wherein the computing system includes logic further programmed to determine a permission for the user.
22. The system of claim 18 wherein the computing system includes logic further programmed to determine a permission for the mobile device.