Systems and methods for controlling access to encrypted data stored on a mobile device
View Patent ↗Encrypted data on mobile devices is protected by remotely storing a decryption key. In order to decrypt the encrypted data on the mobile device, the mobile device obtains the decryption key from an access control system that is remote from the mobile device. The access control system can control access to the encrypted data by controlling access to the decryption key. For example, the access control system can implement user authentication as a condition for providing the decryption key. Access to the encrypted data can also be controlled by withholding the decryption key where, for instance, a mobile device has been reported to be lost or stolen, or once an individual's access privilege has been revoked, or at certain times of the day.
1. A method for accessing encrypted data with a mobile device, the method comprising:
prearranging a response to a prompt;
obtaining a decryption key from an access control system including receiving the prompt over a first communication channel from the access control system,
providing the response to the access control system, and
receiving by the mobile device the decryption key from the access control system; and
using the decryption key to decrypt the encrypted data with the mobile device.
2. The method of claim 1 wherein prearranging the response to the prompt includes establishing a password as the response.
3. The method of claim 1 wherein prearranging the response to the prompt includes establishing a biometric response as the response.
4. The method of claim 1 wherein the prompt comprises a personalized prompt.
5. The method of claim 1 wherein the prompt is one of a plurality of prompts.
6. The method of claim 1 wherein the response to the access control system is provided over the first communication channel.
7. The method of claim 1 wherein the response to the access control system is provided over a second communication channel.
8. The method of claim 1 wherein the response is a biometric response.
9. A method for controlling access to encrypted data stored on a mobile device, the method comprising:
sending a prompt to the mobile device over a first communication channel;
receiving a claimant response to the prompt;
determining a match between the claimant response and a response template associated with the prompt; and
sending the decryption key to the mobile device.
10. The method of claim 9 further comprising storing the response template in association with the prompt.
11. The method of claim 9 further comprising receiving a request for the decryption key from the mobile device before sending the prompt to the mobile device.
12. The method of claim 11 wherein the request includes an identification of the mobile device.
13. The method of claim 12 further comprising determining a permission for the mobile device.
14. The method of claim 9 further comprising determining a permission for the user.
15. The method of claim 9 wherein the claimant response to the prompt is received over the first communication channel.
16. The method of claim 9 wherein the claimant response to the prompt is received over a second communication channel.
17. The method of claim 9 wherein the claimant response is a biometric response.
18. A system comprising:
a computing system including logic including a microprocessor and programmed to
send a prompt over a first communication channel;
receive a claimant response to the prompt;
determine a match between the claimant response and a response template associated with the prompt; and
send the decryption key.
19. The system of claim 18 wherein the computing system includes logic further programmed to select a prompt from a plurality of prompts.
20. The system of claim 18 wherein the computing system includes logic further programmed to store the response template in association with the prompt.
21. The system of claim 18 wherein the computing system includes logic further programmed to determine a permission for the user.
22. The system of claim 18 wherein the computing system includes logic further programmed to determine a permission for the mobile device.
23. The method of claim 9 wherein sending the decryption key to the mobile device is performed in response to determining the match.