Application Key Derivation via Public Key for Secure Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for encrypting data face challenges in generating encryption keys that can be securely shared among multiple applications on a computing device without compromising security, particularly when different types of files require different application codes and user authentication is needed frequently.
Innovation Solution
A computing device generates a data access application key using a public/private key pair, where the first application derives the key as a function of the public key and other unique device or user-related values, allowing secure decryption without requiring application identifiers from the operating system and preventing spoofing by other applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a user-entered password is used as an encryption key for secure storage, then data security is improved, but user convenience deteriorates due to frequent authentication requirements
Solution Approach 1:
The system performs preliminary authentication by obtaining user credentials once, then generates and stores application-specific encryption keys in advance. This allows multiple applications to access encrypted data without requiring repeated user authentication, resolving the contradiction between security and convenience.
2Ease of operation
If the same encryption key is used for each application, then user convenience is improved, but data security deteriorates
Solution Approach 1:
The system segments the encryption key generation process by creating distinct application-specific encryption keys for each application that needs to access encrypted data. Each key is derived from user credentials combined with application-unique identifiers, ensuring that compromise of one application's key does not affect others, thus maintaining security while enabling convenient access.
3Device complexity
If application identifiers from the operating system are used for key derivation, then the system becomes simpler, but security deteriorates due to easy spoofing
Solution Approach 1:
The system introduces an intermediary authentication mechanism that obtains application identifiers through a secure authentication process rather than directly using operating system identifiers. This intermediary step verifies the legitimacy of applications through cryptographic signatures and secure channels, preventing spoofing while maintaining reasonable system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computing device has a first application and a second application. The first application generates a data access application key for use by the second application to enable decryption of data that is stored in encrypted form on the computing device using the data access application key. In operation, the second application generates a public/private key pair. The second application sends a request to the first application for the first application to send the second application a data access application key, the request including the public key. The first application derives the requested data access application key as a function of at least the public key. The first application sends the derived data access application key to the second application.