Context-Based Mobile Data Access via Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile device encryption systems lack flexibility in controlling access to sensitive data based on context, such as device state and settings, which can lead to unauthorized access or inconvenient access restrictions.
Innovation Solution
A context-based access control system utilizing a security coprocessor to manage encryption keys and data protection classes, allowing access to encrypted data only when specific conditions like device unlock state, passcode strength, location, and time are met, ensuring secure and timely access to sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional encryption systems are used on mobile devices, then data security is maintained through basic lock/unlock mechanisms, but access control flexibility based on context (location, time, device state) is lacking
Solution Approach 1:
The patent segments the encryption key into multiple parts and stores them in different security domains within the secure element. Each context condition (location, time, device state) is associated with specific key segments that are released only when conditions are met, enabling flexible access control without requiring a monolithic complex system
Solution Approach 2:
The system dynamically evaluates context conditions (current location, time, device state) at runtime to determine which encryption key segments to release. This dynamic adaptation allows the system to provide different levels of access control flexibility based on real-time conditions without hardcoding complex rules
2Reliability
If context-based access control is implemented, then data can be accessed only at approved times and locations, but the system complexity increases due to multiple evaluation conditions
Solution Approach 1:
The patent introduces a context evaluation module as an intermediary between the secure element and the application processor. This mediator handles the complex logic of evaluating multiple context conditions (location, time, device state) and translating them into appropriate key release decisions, thereby isolating the complexity from the core security functions
Solution Approach 2:
The system performs preliminary evaluation of context conditions before releasing encryption keys. By pre-defining context policies and evaluating conditions in advance, the system ensures reliable security control while reducing runtime complexity and avoiding ad-hoc decision-making during critical decryption operations
3Reliability
If multiple context conditions are evaluated for data access, then unauthorized access is prevented, but user convenience is reduced due to stricter access restrictions
Solution Approach 1:
The system automatically evaluates context conditions and makes access decisions without requiring user intervention. The secure element self-manages the release of encryption key segments based on predefined policies and current context, eliminating the need for users to manually approve or deny each access request while maintaining strong security
4Adaptability or versatility
If context-based key release is implemented, then data can be accessed by approved persons at approved times and places, but the device complexity increases due to additional security layers
Solution Approach 1:
The patent implements a nested security architecture where the secure element (a secure enclave within the device) contains the encryption keys and context evaluation logic. This nested structure allows the complex context-based access control system to be contained within a dedicated security domain, isolating its complexity from the rest of the device while providing high adaptability
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In some implementations, encrypted data (e.g., application data, keychain data, stored passwords, etc.) stored on a mobile device can be accessed (e.g., decrypted, made available) based on the context of the mobile device. The context can include the current device state (e.g., locked, unlocked, after first unlock, etc.). The context can include the current device settings (e.g., passcode enabled/disabled). The context can include data that has been received by the mobile device (e.g., fingerprint scan, passcode entered, location information, encryption key received, time information).