Key management to protect encrypted data of an endpoint computing device
View Patent ↗Methods and apparatus involve protecting encrypted data of endpoint computing assets by managing decryption keys. The endpoint has both a traditional operating system for applications, and the like, and another operating system during a pre-boot phase of operation. During use, the pre-boot operating system prevents users of the endpoint from accessing the encrypted data and the key. Upon determining the encrypted data has been compromised, the key is disassociated from the encrypted data. Disassociation can occur in a variety of ways including deleting or scrambling the key and/or data or re-encrypting the encrypted data with a new key. Key escrowing and updating through the pre-boot is further contemplated. The pre-boot phase also contemplates a limited computing connection between the endpoint and a specified authentication server and approved networking ports, USB devices and biometric equipment. Security policies and enforcement modules are also disclosed as are computer program products, computing arrangements, etc.
1. In a computing system environment, a method of protecting encrypted data of an endpoint computing device, the encrypted data able to be decrypted with a key located at the endpoint computing device, comprising:
determining according to an enterprise computing policy whether the endpoint computing device has been compromised;
upon a subsequent booting of the endpoint computing device, launching a pre-boot phase of operation during which time a pre-boot operating system prevents a user of the endpoint computing device from accessing the encrypted data and the key and enforces a limited computing capability of the endpoint computing device sufficient to determine whether the encrypted data has been compromised and whether the key requires disassociation from the encrypted data;
determining according to the enterprise computing policy whether the key requires disassociation from the encrypted data; and
if so, disassociating the key.
2. The method of claim 1 , wherein the disassociating the key further includes deleting an existence of the key from the endpoint computing device.
3. The method of claim 1 , wherein the determining whether the key requires disassociation from the encrypted data includes authenticating the endpoint computing device back to a networked server in the computing system environment.
4. The method of claim 1 , further including updating a security policy of the endpoint computing device per the enterprise computing policy.
5. The method of claim 1 , deploying a new key to the endpoint computing device and re-encrypting the compromised encrypted data with said new key.
6. The method of claim 1 , further including re-associating the disassociated key with the encrypted data at the endpoint computing device in the event the encrypted data was not compromised and the key was disassociated.
7. In a computing system environment, a method of protecting encrypted data of an endpoint computing device, the encrypted data saved in memory and or disk of the endpoint and able to be decrypted with a key located in a trusted platform module at the endpoint computing device, comprising:
upon a booting of the endpoint computing device, launching a pre-boot phase of operation during which time a pre-boot operating system prevents a user of the endpoint computing device from accessing the encrypted data and the key and enforces a limited computing capability of the endpoint computing device sufficient to determine whether the key requires disassociation from the encrypted data;
determining according to an enterprise computing policy whether the encrypted data has been compromised and whether the key requires disassociation from the encrypted data;
if so, locating the key in the trusted platform module; and
deleting an existence of the key from the trusted platform module.
8. The method of claim 7 , further including pushing a security policy per the enterprise computing policy to the endpoint computing device from a networked computing device in the computing system environment, the security policy instructing the endpoint computing device to delete the existence of the key.
9. The method of claim 7 , further including pushing a security policy per the enterprise computing policy to the endpoint computing device from a networked computing device in the computing system environment, the security policy requiring the endpoint computing device to have three factors of authentication before accessing the encrypted data.
10. In a computing system environment, a method of protecting encrypted data of an endpoint computing device, the encrypted data saved in memory and or disk of the endpoint and able to be decrypted with a key located at the endpoint computing device, comprising:
upon a booting of the endpoint computing device, launching a pre-boot phase of operation during which time a pre-boot operating system prevents a user of the endpoint computing device from accessing the encrypted data and the key and enforces a limited computing connection between the endpoint computing device and one of a specified authentication server networked to the endpoint computing device in the computing system environment, approved networking ports of the endpoint computing device, approved Universal Serial Bus (USB) devices connected to the endpoint computing device, and approved biometric devices, the pre-boot phase of operation further including,
determining according to an enterprise computing policy whether the encrypted data has been compromised;
determining according to the enterprise computing policy relating to the one of the specified authentication server, the approved networking ports, the approved USB devices, and the approved biometric devices whether the key requires disassociation from the encrypted data: and if so,
disassociating the key from the encrypted data.
11. The method of claim 10 , wherein a predefined security policy per the enterprise computing policy identifies the limited computing connection to the endpoint computing device.
12. The method of claim 10 , further including locating the key in a trusted platform module of the endpoint computing device.
13. The method of claim 10 , wherein the disassociating the key from the encrypted data further includes deleting an existence of the key, deleting an existence of the encrypted data, scrambling the key, scrambling the data, or re-encrypting the encrypted data with a new key.
14. An endpoint computing device, comprising:
a hardware platform including a processor, memory and disk;
encrypted data configured for storage in the memory and or disk;
a key stored on the hardware platform to decrypt the encrypted data;
a policy enforcement module on the hardware platform to carry out predefined security policies according to enterprise computing policy between the key and the encrypted data; and
a computing operating system and a pre-boot operating system configured to act on the processor such that upon launching a pre-boot phase of operation the policy enforcement module requires the pre-boot operating system to prevent a user of the endpoint computing device from accessing the encrypted data and the key, enforces a limited computing connection with at least one other computing device to determine whether the encrypted data has been compromised and whether the key requires disassociation from the encrypted data, requires a determination of whether the key requires disassociation from the encrypted data, and if so requires a disassociation of the key from the encrypted data upon a determination according to the predefined security policies that the encrypted data has been compromised.
15. The endpoint computing device of claim 14 , further including a trusted platform module as part of the hardware platform to store the key.
16. The endpoint computing device of claim 14 , wherein the policy enforcement module is further configured during the pre-boot phase of operation to require a limited computing connection between the endpoint computing device and one of a specified authentication server networked to the endpoint computing device in a computing system environment, approved networking ports of the endpoint computing device, approved Universal Serial Bus (USB) devices connected to the endpoint computing device, and approved biometric devices.
17. The endpoint computing device of claim 14 , wherein the policy enforcement module is further configured to enforce deletion of an existence of the key, deletion of an existence of the encrypted data, scrambling the key, scrambling the encrypted data, or re-encrypting the encrypted data with a new key upon said determination that the encrypted data has been compromised.
18. A non-transitory computer program product for loading on an endpoint computing device to protect encrypted data thereof, the encrypted data configured to be saved in memory and/or disk of the endpoint computing device and able to be decrypted with a key located at the endpoint computing device, the computer program product having executable instructions that launch a pre-boot phase of operation during which time a pre-boot operating system of the endpoint computing device prevents a user of the endpoint computing device from accessing the encrypted data and the key and enforces a limited computing connection of the endpoint computing device with at least one other computing device, the executable instructions further configured to determine whether the encrypted data has been compromised and the key requires disassociation from the encrypted data, and if so, disassociate the key from the encrypted data upon a determination according to an enterprise computing policy that the encrypted data has been compromised.
19. The computer program product of claim 18 , further including executable instructions that during the pre-boot phase of operation open a limited computing connection between the endpoint computing device and one of a specified authentication server networked to the endpoint computing device in a computing system environment, approved networking ports of the endpoint computing device, approved Universal Serial Bus (USB) devices connected to the endpoint computing device, and approved biometric devices.
20. The computer program product of claim 18 , further including executable instructions that during the pre-boot phase of operation locate the key in a trusted platform module of the endpoint computing device and delete an existence of the key from the module upon said determination that the encrypted data has been compromised.