Application-Specific Data Protection With Device-Bound Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software architectures on electronic devices often fail to adequately secure data from unauthorized access between different software applications, particularly during updates, leading to potential substitution attacks.
Innovation Solution
A method involving an electronic device receiving a software module with a public key, generating an encryption key based on a secret device key and the public key, and using this key to encrypt or sign data associated with the application, storing it in a secure memory portion, while authenticating the module using a verification process to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software applications share common data storage areas, then ease of operation and data accessibility are improved, but security and data protection are worsened
Solution Approach 1:
The patent segments data storage by creating application-specific secure storage areas, where each application's data is encrypted with its own unique encryption key. This segmentation prevents one application from accessing another application's data while maintaining ease of access within the same application.
Solution Approach 2:
The patent implements local quality by applying different security levels to different data storage locations. Each application's data storage area has its own encryption key and access controls, allowing data to be easily accessible within its designated area while being protected from unauthorized access by other applications.
2Device complexity
If software applications use common encryption keys, then device complexity is reduced, but data protection between applications is worsened
Solution Approach 1:
The patent segments encryption keys by creating a unique encryption key for each application. The key management system generates and stores multiple encryption keys, each associated with a specific application, thereby preventing one application from decrypting another application's data while maintaining manageable complexity through automated key generation and storage.
Solution Approach 2:
The patent adds a new dimension to key management by introducing application identifiers as an additional parameter in the encryption key generation process. Instead of using a single key or simple key hierarchy, the system generates keys that are unique combinations of device secrets and application-specific identifiers, creating a multi-dimensional key space that provides both security and manageability.
3Adaptability or versatility
If software modules are updated frequently, then adaptability and functionality are improved, but vulnerability to substitution attacks is worsened
Solution Approach 1:
The patent implements preliminary action by establishing cryptographic authentication mechanisms before software updates are applied. The system verifies the authenticity of update packages using digital signatures and encryption keys before installing them, preventing substitution attacks by ensuring that only authorized updates from legitimate sources can be installed.
Solution Approach 2:
The patent implements feedback through cryptographic verification processes that confirm the integrity and authenticity of software updates. The system uses digital signatures and encryption to provide feedback on whether an update package is genuine and has not been tampered with, allowing the update process to proceed only when verification succeeds.
Data Source
Figure 1~2
Figure 3~4
AI summary
The present description relates to a method comprising: a) receiving, by an electronic device, a software module of a first application, the software module comprising a public key associated with the first application; b) generating, by a cryptographic circuit of the electronic device, an encryption key on the basis of a secret key of the electronic device and one of: the public key and an identification value derived from the public key; c) generating one or more protected data by applying a cryptographic operation, by the cryptographic circuit, on one or more first data associated with the first application and on the basis of the encryption key; and d) storing the one or more protected data in a first part of a memory of the electronic device.