Application-Level Ticket Authorization for Mobile Key Store Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile computing and communication devices require repeated user password input for applications to access the key store, leading to inefficiencies for trusted users while maintaining security against unauthorized access.
Innovation Solution
Implementing application-level tickets generated by a security manager, which are securely associated with applications to grant access to key store entries, reducing the need for repeated password prompts by using one-way hash values and potentially referencing base tickets for multiple key store entries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If repeated password prompts are used for key store access, then device security is maintained, but user operation efficiency deteriorates
Solution Approach 1:
The system performs preliminary authentication by obtaining user credentials once during application installation or initial use. This authentication result is then cached and reused for subsequent key store access operations, eliminating the need for repeated password prompts while maintaining security for trusted users.
Solution Approach 2:
An intermediary authentication mechanism is introduced between the application and the key store. Instead of direct repeated authentication, the system uses cached authentication tokens or session information as an intermediary to grant access to trusted applications, reducing the frequency of user password input while preserving security controls.
2Ease of operation
If application-level tickets are implemented, then user operation efficiency is improved, but system complexity increases
Solution Approach 1:
The authorization system is segmented into distinct components: application registration module, ticket generation module, ticket validation module, and key store access module. This segmentation allows each component to handle specific tasks independently, making the overall complex system more manageable and maintainable while providing efficient ticket-based authorization.
Solution Approach 2:
The ticket-based authorization system is designed as a universal mechanism that can serve multiple applications and multiple key store access scenarios. Instead of implementing separate authentication logic for each application, the universal ticket system provides a standardized approach that works across different applications and access types, reducing overall system complexity through reuse.
Data Source
AI summary
A method and system for authorization of applications executing on a device having a key store. Applications obtain an application-level ticket to permit access to one or more key values located in the key store. Each ticket is securely associated with an application and being generated on the determination that the application is a trusted application. Tickets are potentially associated with one key value in the key store, with a subset of key values in the key store, or with all key values in the key store. Access to key values by an application is possible independently of a user providing a password for each such access.