System and method for controlling user access to encrypted data
Disclosed are systems, methods and computer program products for providing user access to encrypted data. In one example, a system is configured to receive a security policy for the user device, wherein the security policy includes data access conditions and data encryption conditions for one or more users of the user device; identify one or more user accounts in the OS of the user device as specified in the data access conditions; create a pre-boot authentication account (PBA) for the identified user accounts based on the data access conditions, for storing pre-boot authentication credentials for authenticating a user before booting of the OS on the user device; and encrypt at least a portion of data stored on the user device based on the data encryption conditions, wherein access to the encrypted portion of data is granted to the user upon entry of the correct pre-boot authentication credentials.
1. A method for providing user access to encrypted data on a user device, comprising:
receiving a security policy for the user device, wherein the security policy includes data access conditions and data encryption conditions specified for each of a plurality of users of the user device;
creating and saving on an operating system (OS) of the user device a plurality of user accounts for the plurality of users, respectively, wherein the plurality of user accounts contain credentials for the plurality of users to access data files on the user device based on the respective data access conditions;
receiving an encryption policy from a security center that identifies at least one of the plurality of user accounts in the OS of the user device; and
encrypting at least a portion of the data files on the user device associated with the identified at least one user account based on the data encryption conditions specified in the received encryption policy for the user of the identified at least one user account.
2. The method of claim 1 , wherein encrypting at least a portion of the data files associated with the identified at least one user account includes encrypting one or more files or folders containing data of a user associated with each identified user account.
3. The method of claim 1 , wherein receiving the security policy for the user device further includes receiving encryption and decryption keys for the user device.
4. The method of claim 3 , wherein the encryption and decryption keys are stored on the user device in a container encrypted by a public key of a security server.
5. The method of claim 4 , further comprising:
sending the encrypted container to the security server for a decryption of the container using the public key of the security server; and
receiving from the security server encryption and decryption keys decrypted by the security server.
6. The method of claim 1 , wherein the encryption policy that identifies the at least one of the plurality of user accounts in the OS of the user device includes analyzing one or more of: registry branch HKEY_USERS, unloaded registry branches, directory of user accounts, and file “/etc/passwd”.
7. A system for providing user access to encrypted data on a user device, comprising:
a processor being configured to:
receive a security policy for the user device, wherein the security policy includes data access conditions and data encryption conditions specified for each of a plurality of users of the user device;
create and save on an operating system (OS) of the user device a plurality of user accounts for the plurality of users, respectively, wherein the plurality of user accounts contain credentials for the plurality of users to access data files on the user device based on the respective data access conditions;
receive an encryption policy from a security center that identifies at least one of the plurality of user accounts in the OS of the user device; and
encrypt at least a portion of the data files on the user device associated with the identified at least one user account based on the data encryption conditions specified in the received encryption policy for the user of the identified at least one user account.
8. The system of claim 7 , wherein the processor is further configured to encrypt at least a portion of the data files associated with the identified at least one user account including one or more files or folders containing data of a user associated with each identified user account.
9. The system of claim 7 , wherein the received security policy for the user device further contains encryption and decryption keys for the user device.
10. The system of claim 9 , wherein the encryption and decryption keys are stored on the user device in a container encrypted by a public key of a security server.
11. The system of claim 10 , wherein the processor is further configured to send the encrypted container to the security server for a decryption of the container using the public key of the security server; and receive from the security server encryption and decryption keys decrypted by the security server.
12. The system of claim 7 , wherein the encryption policy that identifies the at least one of the plurality of user accounts in the OS of the user device, the processor is further configured to analyze one or more of: registry branch HKEY_USERS, unloaded registry branches, directory of user accounts, and file “/etc/passwd”.
13. A computer program product stored on a non-transitory computer-readable storage medium, the computer program product comprising computer-executable instructions for providing user access to encrypted data on a user device, including instructions for:
receiving a security policy for the user device, wherein the security policy includes data access conditions and data encryption conditions specified for each of a plurality of users of the user device;
creating and saving on an operating system (OS) of the user device a plurality of user accounts for the plurality of users, respectively, wherein the plurality of user accounts contain credentials for the plurality of users to access data files on the user device based on the respective data access conditions;
receiving an encryption policy from a security center that identifies at least one of the plurality of user accounts in the OS of the user and
encrypting at least a portion of the data files on the user device associated with the identified at least one user account based on the data encryption conditions specified in the received encryption policy for the user of the identified at least one user account.
14. The product of claim 13 , wherein instructions for encrypting at least a portion of data files stored on the user device include instructions for encrypting one or more files or folders containing data of a user associated with each identified user account.
15. The product of claim 13 , wherein instructions for receiving the security policy for the user device further include instructions for receiving encryption and decryption keys for the user device.
16. The product of claim 15 , wherein the encryption and decryption keys are stored on the user device in a container encrypted by a public key of a security server.
17. The product of claim 16 , further comprising instructions for:
sending the encrypted container to the security server for a decryption of the container using the public key of the security server; and
receiving from the security server encryption and decryption keys decrypted by the security server.
18. The product of claim 13 , wherein encryption policy that identifies the at least one of the plurality of user accounts in the OS of the user device include instructions for analyzing one or more of: registry branch HKEY_USERS, unloaded registry branches, directory of user accounts, and file “/etc/passwd”.