Preventing content data leak on mobile devices
Preventing enterprise or other protected content data from “leaking” from being under secure management on a device, for example by virtue of being viewed using an untrusted app on the device, is disclosed. An indication is received that a content to be provided to a first mobile application on a mobile device is to be protected against unauthorized access at the mobile device using unauthorized applications other than the first mobile application. The content is encrypted while in transit to the mobile device, using a key associated with a second mobile application authorized to be used to access the content at the mobile device.
1. A method of protecting content data, comprising:
receiving at a node an indication that content to be provided to a first mobile application on a mobile device from a content provider is to be protected against unauthorized access at the mobile device;
determining, by the node, whether the mobile device is authorized to receive the content;
in the event the mobile device is authorized to receive the content, encrypting the content using a key associated with a second mobile application on the mobile device authorized to be used to access the content at the mobile device, wherein the second mobile application is configured to allow a user to view and/or edit the content; and
in the event the mobile device is not authorized to receive the content, performing protective measures to the content in a communication message prior to delivering the communication message to the mobile device.
2. The method of claim 1 , wherein the key is associated with one or more of the following: a user of the mobile device, a mobile application on the mobile device, the content, and the mobile device.
3. The method of claim 1 , further comprising generating the key and providing the key to a security node configured to encrypt the content in transit to the mobile device and to the second mobile application.
4. The method of claim 3 , wherein the key is provided to the second mobile application via a management agent installed on the mobile device.
5. The method of claim 1 , wherein the second mobile application is configured to use the key to decrypt the content at the mobile device.
6. The method of claim 1 , wherein the second mobile application is configured to store the content persistently at the mobile device only in encrypted form.
7. The method of claim 1 , further comprising associating the content with a secure content type.
8. The method of claim 7 , wherein the second mobile application is configured to register itself to be used to access content of the secure content type.
9. The method of claim 7 , wherein the secure content type comprises one or more of a file extension and a MIME type.
10. The method of claim 1 , further comprising configuring the second mobile application to use the key to provide authorized access to the content.
11. The method of claim 1 , wherein the content comprises one or more of an email attachment, a document, a file, and a stored content object.
12. The method of claim 1 , wherein the content comprises an email message and encrypting the content includes selectively encrypting one or more of a message header, a message body, and at least a selected subset of email attachments comprising the email message.
13. The method of claim 1 , wherein the key associated with a second mobile application is encrypted prior to being sent to the mobile device and a Common Access Card or other physical article must be connected to the mobile device to enable the second mobile application to access and use the key to decrypt the content at the mobile device.
14. The method of claim 1 , wherein the protective measures include stripping the content from the communication message.
15. The method of claim 1 , wherein the protective measures include replacing the content in the communication message.
16. The method of claim 1 , wherein in the event the mobile device is not authorized to receive the content the first mobile application provides an indication that access is not permitted.
17. The method of claim 1 , further comprising including in or with the content a tag or other metadata indicating one or more of an action authorized to be performed with respect to the content at the mobile device using the second mobile application and an action not authorized to be performed with respect to the content at the mobile device using the second mobile application.
18. The method of claim 17 , wherein the second mobile application is configured to sue the tag or other metadata to determine at the mobile device, in response to a request to perform a requested action, whether the requested action is permitted to be performed with respect to the content at the mobile device.
19. A system comprising:
a communication interface configured to receive an indication that content to be provided to a first mobile application on a mobile device from a content provider is to be protected against unauthorized access at the mobile device; and
a processor coupled to the communication interface and configured to:
determine whether the mobile device is authorized to receive the content;
in the event the mobile device is authorized to receive the content, encrypt the content using a key associated with a second mobile application on the mobile device authorized to be used to access the content at the mobile device, wherein the second mobile application is configured to allow a user to view and/or edit the content; and
in the event the mobile device is not authorized to receive the content, perform protective measures to the content in a communication message prior to delivering the communication message to the mobile device.
20. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving at a node an indication that content to be provided to a first mobile application on a mobile device from a content provider is to be protected against unauthorized access at the mobile device;
determining, by the node, whether the mobile device is authorized to receive the content;
in the event the mobile device is authorized to receive the content, encrypting the content using a key associated with a second mobile application on the mobile device authorized to be used to access the content at the mobile device, wherein the second mobile application is configured to allow a user to view and/or edit the content; and
in the event the mobile device is not authorized to receive the content, performing protective measures to the content in a communication message prior to delivering the communication message to the mobile device.