Encrypted Partition Access via Secure Element
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current electronic devices lack effective security measures to prevent users from accessing each other's data, even with multi-user interfaces, and existing encryption methods are limited by reliance on dedicated hardware, vulnerability to brute force attacks, and performance overhead.
Innovation Solution
Creating encrypted partitions for each user with keys stored on secure elements like IC Cards, which are used for decryption only when the user authenticates, ensuring that data is protected from unauthorized access and preventing decryption even if the device is stolen.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the whole memory content is encrypted to protect user data, then data security is improved, but read/write operations become slower and time-consuming
Solution Approach 1:
The memory is divided into multiple encrypted partitions, each associated with a specific user and encrypted with a unique key. Only the partition corresponding to the authenticated user is decrypted, while other partitions remain encrypted. This selective decryption approach maintains security while improving access speed for authorized data.
Solution Approach 2:
Different regions of the memory (partitions) have different encryption states based on user authentication. The authenticated user's partition is decrypted locally and quickly accessed, while other partitions maintain their encrypted state. This localized decryption optimizes performance without compromising overall security.
2Reliability
If a dedicated hardware TPM chip is used for encryption, then data protection is improved, but the electronic apparatus cannot protect data without or incompatible with such hardware
Solution Approach 1:
The encryption system uses software-based cryptographic operations that can run on general-purpose processors without requiring specialized TPM hardware. This makes the solution universally applicable to various electronic apparatuses regardless of their hardware configuration, while maintaining strong security through cryptographic protocols.
3Reliability
If the whole memory content is encrypted, then all user data is protected, but accessing data that does not require protection becomes slower
Solution Approach 1:
The memory is segmented into user-specific encrypted partitions. When a user authenticates, only their corresponding partition is decrypted, allowing efficient access to their data without the overhead of decrypting the entire memory space. This selective approach improves access efficiency while maintaining comprehensive protection.
4Ease of operation
If multi-user interface is implemented to separate user data, then user organization is improved, but security against unauthorized access is not provided
Solution Approach 1:
The system combines multi-user interface capabilities with encrypted partitions, where each user's data is organized in their own partition and protected by a unique cryptographic key. This provides both organizational structure and strong security, preventing unauthorized access even when multiple users have system access rights.
Solution Approach 2:
Cryptographic keys stored in secure elements act as intermediaries between users and their data. The keys are released only after successful authentication, providing an additional security layer that prevents unauthorized access while maintaining ease of legitimate access through the multi-user interface.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
The present invention relates to an access method to an electronic apparatus comprising a processor and a storage area including one or more encrypted partitions. The method includes the steps of: -providing a secure element (S1, S2, S3, SS) which stores at least a user key (K1) for decrypting one (P1) of the encrypted partitions (P1, P2, P3); - establishing a temporary secure channel (120) between the secure element (S1, SS) and the electronic apparatus (100); -authenticating in the electronic apparatus (100) a user (U1) which is associated to one (P1) of the encrypted partitions (P1, P2, P3); -transmitting an identification of the user authenticated (U 1) in the electronic apparatus (100) to the secure element (S1, S2, S3, SS) and transmitting the user key (K1) of the authenticated user (U1) from the secure element (S1, S2, S3, SS) to the electronic apparatus (100) over the temporary secure channel (120). The electronic apparatus (100) is programmed to decrypt the encrypted partition (P1) of the authenticated user (U1) with the user key (K1) transmitted over the temporary secure channel (120) and the encrypted partition (P1) of the authenticated user (U1) is not accessible to the authenticated user (U1) or to any other authenticated users in the electronic apparatus (100), if the user key (K1) of the authenticated user (U1) is not transmitted to the electronic apparatus (100).