# US 2021/0243199 A1 · Multi-modal access policy enforcement > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243199 A1 - Document ID: US20210243199A1 - Status: Published application - Kind: A1 - Application number: 17/048,747 - Filed: 2019-05-01 - Published: 2021-08-05 - Earliest claimed: 2018-05-01 - Assignees: Hotshots Technologies S.à.R.L. - Applicants: Hotshots Technologies S.á.R.L. - Inventors: Aaron Turner - Web page: https://patentgrep.com/patent/US20210243199A1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 63/102: {Entity profiles} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - G06F 2221/2105: Dual mode as a secondary aspect - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract For access policy enforcement, a method restricts access to a decryption key for private data on an electronic device. The private data is encrypted and includes group communications. The method determines an electronic device profile that includes a device time and a device location of the electronic device. The method releases the decryption key in response to the electronic device profile satisfying an access policy. The method decrypts the private data using the decryption key. ## Claims ### Claim 1 A method comprising: restricting, by use of a processor, access to a decryption key for private data on an electronic device, wherein the private data is encrypted and comprises group communications; determining an electronic device profile comprising a device time and a device location of the electronic device; releasing the decryption key in response to the electronic device profile satisfying an access policy; and decrypting the private data using the decryption key. ### Claim 2 (depends on 1) The method of claim 1, wherein the access policy is satisfied if the device location is within a specified geographic area. ### Claim 3 (depends on 1) The method of claim 1, wherein the access policy is satisfied if the device time is within a specified time range. ### Claim 4 (depends on 1) The method of claim 1, wherein the access policy is satisfied if the device location is within a specified geographic area and the device time is within a specified time range. ### Claim 5 (depends on 1) The method of claim 1, wherein the access policy is satisfied if a weighted difference between the electronic device profile and a device profile history is within a difference threshold. ### Claim 6 (depends on 1) The method of claim 1, wherein access to the decryption key is restricted by a remote management device. ### Claim 7 (depends on 1) The method of claim 1, the method further comprising deleting the private data on the electronic device in response to a claw back command from a remote management device. ### Claim 8 (depends on 1) The method of claim 1, wherein the electronic device profile further comprises one or more of a device orientation of the electronic device, a device proximity of the electronic device to a user, a device motion of the electronic device, and a device acceleration of the electronic device. ### Claim 9 (depends on 8) The method of claim 8, wherein the access policy is not satisfied if one or more of the device orientation exceeds an orientation threshold, the device proximity exceeds a proximity threshold, the device motion exceeds a motion threshold, and the device acceleration exceeds an acceleration threshold. ### Claim 10 (depends on 1) The method of claim 1, wherein restricting the decryption key is selected from the group consisting of encrypting the decryption key and restricting access to the decryption key in a memory. ### Claim 11 An apparatus comprising: a processor; a memory storing code executable by the processor to perform: restricting access to a decryption key for private data on an electronic device, wherein the private data is encrypted and comprises group communications; determining an electronic device profile comprising a device time and a device location of the electronic device; releasing the decryption key in response to the electronic device profile satisfying an access policy; and decrypting the private data using the decryption key. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the access policy is satisfied if the device location is within a specified geographic area. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the access policy is satisfied if the device time is within a specified time range. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein the access policy is satisfied if the device location is within a specified geographic area and the device time is within a specified time range. ### Claim 15 (depends on 11) The apparatus of claim 11, wherein the access policy is satisfied if a weighted difference between the electronic device profile and a device profile history is within a difference threshold. ### Claim 16 (depends on 11) The apparatus of claim 11, wherein access to the decryption key is restricted by a remote management device. ### Claim 17 (depends on 11) The apparatus of claim 11, the processor further deleting the private data on the electronic device in response to a claw back command from a remote management device. ### Claim 18 (depends on 11) The apparatus of claim 11, wherein the electronic device profile further comprises one or more of a device orientation of the electronic device, a device proximity of the electronic device to a user, a device motion of the electronic device, and a device acceleration of the electronic device. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the access policy is not satisfied if one or more of the device orientation exceeds an orientation threshold, the device proximity exceeds a proximity threshold, the device motion exceeds a motion threshold, and the device acceleration exceeds an acceleration threshold. ### Claim 20 A program product comprising a non-transitory computer readable storage medium storing code executable by a processor to perform: restricting access to a decryption key for private data on an electronic device, wherein the private data is encrypted and comprises group communications; determining an electronic device profile comprising a device time and a device location of the electronic device; releasing the decryption key in response to the electronic device profile satisfying an access policy; and decrypting the private data using the decryption key.