Systems and methods of context based data access control of encrypted files

摘要

In some implementations, encrypted data (e.g., application data, keychain data, stored passwords, etc.) stored on a mobile device can be accessed (e.g., decrypted, made available) based on the context of the mobile device. The context can include the current device state (e.g., locked, unlocked, after first unlock, etc.). The context can include the current device settings (e.g., passcode enabled/disabled). The context can include data that has been received by the mobile device (e.g., fingerprint scan, passcode entered, location information, encryption key received, time information).

主权项

1. A method of controlling access to an encrypted file stored on a mobile device, comprising:
receiving, by the mobile device, a request for access to an encrypted file, the encrypted file including encrypted file content which is associated with encrypted file metadata; decrypting the encrypted file metadata, wherein the decryption is performed using a key derived by the mobile device; determining, by the mobile device, an encrypted file content key and data protection class information; retrieving, using the data protection class information, an encrypted class key and a policy associated with the data protection class and the encrypted file content, the policy specifying a required context comprising a state or configuration of the mobile device for enabling access to the encrypted file content, and the class key, when decrypted, enables decryption of the encrypted file content key; determining a current context of the mobile device; comparing the current context to the required context; enabling access to the encrypted file content when the current context corresponds to the required context.