Device State Based Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile devices face challenges in securely managing encryption keys, particularly in transitioning between locked and unlocked states, where sensitive data requires different security approaches and access restrictions, and existing solutions do not effectively manage key generation and access during these states.
Innovation Solution
A method and apparatus for device state-based encryption keys, where an application transmits data commands to an encryption driver in the kernel space, determining authentication based on an access policy, and using a cryptographic library to perform encrypted operations using public and private keys, ensuring secure data access and management across locked and unlocked states.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file system encryption is implemented to protect sensitive data, then data security is improved, but key management complexity increases
Solution Approach 1:
The system segments key management by creating distinct key storage locations (secure element, trusted execution environment, or encrypted storage) and associating each encrypted file or directory with a specific encryption key identifier. This allows keys to be managed independently and selectively accessed based on authorization policies, reducing overall management complexity while maintaining security.
Solution Approach 2:
The patent introduces an intermediary key management component that sits between the encryption system and the application. This intermediary handles key generation, storage, retrieval, and rotation automatically, mediating between the security requirements and the application's data access needs, thereby reducing the complexity burden on both ends.
2Reliability
If encryption keys are stored securely in the device, then unauthorized access is prevented, but access speed to encrypted data decreases
Solution Approach 1:
The system performs preliminary actions by pre-generating encryption keys and securely storing them in the device before actual data access occurs. When data needs to be accessed, the pre-stored keys can be quickly retrieved and used for decryption, eliminating the need for time-consuming key generation or external retrieval during the actual data access operation.
Solution Approach 2:
Different storage locations within the device offer different security-speed trade-offs. The system allows selection of appropriate key storage locations based on specific access requirements: highly secure but slower access for critical keys, or faster access for less critical operations, optimizing the balance between security and speed for different scenarios.
Data Source
AI summary
An apparatus and a method for encrypting and decrypting data in a device are provided. The apparatus includes a processor and a memory. The processor is configured to transmit a data command from an application to an encryption driver that executes in a kernel space, determine if the application is authenticated to perform the data command based on an access policy, transmit, when the application is authenticated, a first key to a cryptographic library that executes in an application space, and perform the data command based on the first key after receiving a response via the cryptographic library. The first key is stored in an encryption driver in the kernel space and is not available to applications in the application space.