Hybrid Security for Mobile Private Keys via OS and Whitebox Layers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems for mobile devices are vulnerable to key exposure and compromise, especially when the operating system is rooted or jailbroken, as they rely on software-based encryption and cryptographic protection schemes that can be breached.
Innovation Solution
A hybrid security solution that combines OS security services, such as Secure Enclave or Keystore, with software-based whitebox cryptographic security solutions, such as a Secure Key Box (SKB), and dynamic protection using server-side cryptography, ensuring that keys stored on devices are not jeopardized.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software-based encryption and cryptographic protection schemes are used, then ease of operation is improved, but reliability deteriorates when the OS is rooted or jailbroken
Solution Approach 1:
The patent divides the security system into multiple independent components: OS security services (Secure Enclave/Keystore) and whitebox cryptographic security service (SKB). Each component operates independently with its own key management, so compromise of one does not necessarily compromise the other. The private key is split into two parts stored in different security domains, and both parts are required for cryptographic operations, ensuring reliability even when the OS is compromised.
2Ease of operation
If OS security services are used, then ease of operation is improved, but security deteriorates when the OS is compromised
Solution Approach 1:
The patent introduces a whitebox cryptographic security service (SKB) as an intermediary layer between the application and the OS security services. The SKB acts as a mediator that protects the private key portion stored in software, using whitebox cryptography techniques to prevent extraction and analysis. This intermediary protects against OS compromise while maintaining ease of operation through standardized interfaces.
3Object-affected harmful factors
If whitebox cryptographic security service is used, then security is improved against OS compromise, but device portability deteriorates
Solution Approach 1:
The patent implements dynamic binding between the SKB and device characteristics. The whitebox cryptographic security service is configured with device-specific parameters and bindings that tie it to the particular device's hardware and software environment. This dynamic adaptation allows the security service to maintain its protective function while enabling legitimate use across different devices through proper provisioning and configuration.
Data Source
AI summary
This disclosure relates to, among other things, electronic device security systems and methods. Certain embodiments disclosed herein provide for protection of cryptographic keys and/or associated operations using both an operating system security service and a software-based whitebox cryptographic security service executing on a device. Leveraging operating system security services and software-based whitebox cryptographic security services may provide enhanced security when compared to using either service alone to protect cryptographic keys and associated operations. In additional embodiments, server-side cryptographic security solutions may be further used to enhance device security implementations.