Protecting enterprise data through policy-based encryption of message attachments
View Patent ↗A system is disclosed that includes components and features for enabling enterprise users to securely access enterprise resources (documents, data, application servers, etc.) using their mobile devices. An enterprise can use some or all components of the system to, for example, securely but flexibly implement a BYOD (bring your own device) policy in which users can run both personal applications and secure enterprise applications on their mobile devices. The system may, for example, implement policies for controlling mobile device accesses to enterprise resources based on device attributes (e.g., what mobile applications are installed), user attributes (e.g., the user's position or department), behavioral attributes, and other criteria. Client-side code installed on the mobile devices may further enhance security by, for example, creating a secure container for locally storing enterprise data, creating a secure execution environment for running enterprise applications, and/or creating secure application tunnels for communicating with the enterprise system.
1. Non-transitory computer storage storing an executable component configured to provide functionality for selectively protecting attachment data addressed to a mobile device, the executable component comprising instructions that direct one or more computing devices to a process that comprises:
receiving, from an enterprise resource, an attachment to a message, the message addressed to the mobile device;
determining whether to encrypt the attachment based on one or more configurable access policies of an enterprise; and
when a determination is made to encrypt the attachment:
encrypting the attachment;
causing transmission of the encrypted attachment to the mobile device in place of the attachment;
encrypting an attachment key used to encrypt the attachment; and
causing transmission of the encrypted attachment key with the encrypted attachment to the mobile device.
2. The non-transitory computer storage of claim 1 , wherein the determining is based at least partly on a role of a user of the mobile device in the enterprise.
3. The non-transitory computer storage of claim 1 , wherein the determining is based at least partly on one or more properties of the mobile device.
4. The non-transitory computer storage of claim 3 , wherein the determining is based at least partly on whether a particular mobile application is installed on the mobile device.
5. The non-transitory computer storage of claim 1 , wherein the determining is based at least partly on one or more properties of the attachment.
6. The non-transitory computer storage of claim 5 , wherein the one or more properties of the attachment comprise a keyword in the attachment, wherein the encrypting the attachment is in response to determining that the attachment comprises the keyword.
7. The non-transitory computer storage of claim 1 , wherein the process comprises at least one of:
naming the encrypted attachment with a suffix that is different from the corresponding attachment prior to encryption of the attachment, wherein the mobile device is configured to detect that the encrypted attachment is encrypted based on the suffix; and
naming a link to the attachment with a suffix that is different from the corresponding link to the unencrypted attachment.
8. The non-transitory computer storage of claim 1 , wherein the message is an email message.
9. The non-transitory computer storage of claim 8 , wherein the encryption of the attachment is transparent to an email client of the mobile device.
10. The non-transitory computer storage of claim 1 , wherein the process comprises:
modifying the one or more configurable access policies of the enterprise.
11. The non-transitory computer storage of claim 1 , wherein causing transmission of the message with the encrypted attachment to the selected mobile device comprises causing transmission of the message via a firewall of an enterprise computing system.
12. The non-transitory computer storage of claim 1 , wherein the process comprises:
when a determination is made not to encrypt the attachment, causing transmission of the attachment to the selected mobile device unencrypted.
13. The non-transitory computer storage of claim 1 , wherein the process comprises:
receiving, from the mobile device, a request to forward the message;
decrypting the encrypted attachment; and
causing transmission of the message with the decrypted attachment to the enterprise resource.
14. The non-transitory computer storage of claim 13 , wherein the decrypting is transparent to an email client installed on the mobile device.
15. The non-transitory computer storage of claim 13 , wherein the process comprises:
determining whether to re-encrypt the attachment when the forwarded message is addressed to a different mobile device, based on whether at least one of the one or more configurable access policies of the enterprise indicate to encrypt the attachment for the different mobile device.
16. The non-transitory computer storage of claim 1 , wherein the message is a short message service (SMS) message.
17. The non-transitory computer storage of claim 1 , wherein the determining whether to encrypt the attachment based on the one or more configurable access policies of the enterprise comprises determining that a role in the enterprise of a user of the mobile device is associated with encrypting attachments by default.
18. A system comprising:
a data store configured to store one or more rules defining conditions under which to encrypt an attachment; and
one or more computing devices in communication with the data store, the one or more computing devices configured to:
monitor messages from an enterprise computing system that are addressed to a mobile device;
determine whether to encrypt an attachment to a selected one of the messages at least partly by comparing a condition associated with the selected message to a value associated with the condition in the one or more rules stored in the data store;
encrypt an attachment key used to encrypt the attachment, wherein the attachment key is encrypted such that only the mobile device is configured to decrypt the attachment key; and
cause transmission of the encrypted attachment key to the mobile device.
19. The system of claim 18 , wherein the condition comprises a property of the mobile device.
20. The system of claim 18 , wherein the condition comprises a property of a user associated with the mobile device.
21. The system of claim 18 , wherein the condition comprises a property of the attachment.
22. The system of claim 18 , wherein the message is an email message from an enterprise email server, the email message addressed to the mobile device.
23. The system of claim 22 , wherein the one or more computing devices are configured to:
encrypt the attachment transparently to an email client of the mobile device.
24. The system of claim 22 , wherein the monitored messages are formatted in accordance with an ActiveSync protocol.
25. The system of claim 18 , wherein the one or more computing devices are configured to:
encrypt at least a portion of the selected message based on comparing the condition associated with the selected message to the value associated with the condition in the one or more rules stored in the data store.
26. The system of claim 18 , wherein the one or more computing devices comprise at least one of a firewall server, an application server, a computing device configured to control a firewall server, and a computing device configured to control an application server.
27. The system of claim 18 , wherein the one or more computing devices are configured to:
cause transmission of the encrypted attachment to the mobile device separate from transmission of the message to the mobile device.
28. The system of claim 18 , wherein the one or more computing devices are configured to:
encrypt the attachment responsive to a determination to encrypt the attachment; and
cause transmission, to the mobile device, of the encrypted attachment in place of the attachment.
29. The system of claim 18 , wherein the enterprise computing system sends the selected one of the messages, and the one or more computing devices configured to monitor the messages from the enterprise computing system are different from the enterprise computing system.
30. A method of selectively protecting email-attachment data addressed to a mobile device, the method comprising:
monitoring, by a computing device, email messages from an enterprise resource that are addressed to the mobile device;
detecting that data requested by the mobile device from the enterprise resource includes an attachment to a selected one of the email messages;
determining whether to encrypt the attachment to the selected one of the email messages for transmission to the mobile device at least partly based on whether a particular mobile application is installed on the mobile device; and
in response to determining to encrypt the attachment, causing encryption of the attachment.
31. Non-transitory computer storage storing an executable component that is configured to be installed on a mobile device to provide functionality for securely accessing data from an enterprise-computing system, the executable component comprising instructions that direct the mobile device to perform a process that comprises:
determining that an email message received by the mobile device includes an attachment that has been encrypted by a gateway associated with the enterprise-computing system;
prompting a user of the mobile device to provide access credentials; and
decrypting the attachment stored on the mobile device using a key obtained from the enterprise-computing system, the decrypting occurring transparently to an email client installed on the mobile device, the decrypting occurring transparently to an enterprise-email server of the enterprise-computing system,
wherein the decrypting is responsive to detecting that the access credentials received from the user indicate that the user is authorized to access the attachment according to one or more enterprise-access policies.
32. The non-transitory computer storage of claim 31 , wherein the access credentials comprise a passcode.