External-Memory Ciphertext Storage for Factory-Reset Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data in an external memory of an electronic device cannot be decrypted after a factory reset due to the deletion of the encrypted key stored in an erasable partition.
Innovation Solution
The method involves encrypting a first key using an eigenvalue of a first account identifier to generate a first ciphertext and encrypting this eigenvalue to create a second ciphertext, storing both in a non-erasable partition, allowing decryption post-factory reset.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If the encrypted key is stored in an erasable partition for security management, then the device can perform factory reset and clear data, but the encrypted key is deleted and external memory data cannot be decrypted
Solution Approach 1:
The storage partition is divided into an erasable partition and a non-erasable partition. The erasable partition stores data that needs to be cleared during factory reset, while the non-erasable partition stores the encrypted key that must be preserved. This segmentation allows the factory reset function to clear user data while maintaining the ability to decrypt external memory through the preserved encrypted key in the non-erasable partition.
2Reliability
If the encrypted key is stored in a non-erasable partition to preserve decryption capability, then data can be decrypted after factory reset, but the device cannot fully clear all data during factory reset
Solution Approach 1:
Different partitions are assigned different erasability properties based on their functional requirements. The erasable partition is designed to be cleared during factory reset for complete data sanitization, while the non-erasable partition is designed to preserve the encrypted key for decryption capability. This local quality differentiation allows each partition to serve its specific purpose without compromising the other.
3Reliability
If multiple encryption layers are implemented (first key encrypts second key, eigenvalue encrypts first key), then security is enhanced, but system complexity increases
Solution Approach 1:
The encryption system uses a nested structure where the first key encrypts the second key, and the eigenvalue (derived from account identifier) encrypts the first key. This nested encryption approach allows multiple security layers to be implemented in a structured manner, where each encryption layer protects the inner layer's key, achieving high security while maintaining manageable system complexity through hierarchical organization.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
This application provides a method for saving a ciphertext and an apparatus. The method includes: obtaining an encryption instruction, where the encryption instruction instructs to encrypt a file in an external memory; obtaining an eigenvalue of a first account identifier based on the encryption instruction; encrypting a first key by using the eigenvalue of the first account identifier to generate a first ciphertext, where the first key is used to encrypt a second key, and the second key is used to encrypt a first file in the external memory; encrypting the eigenvalue of the first account identifier to generate a second ciphertext; and storing the first ciphertext and the second ciphertext in a non-erasable partition. The foregoing method and apparatus can resolve a problem that data in an external memory cannot be decrypted after an electronic device performs a factory reset.