File System Inode Entropy for Cryptographic Key Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting shared secrets on mobile devices are vulnerable to cloning, as malicious users can recreate the encryption key by copying data and entropy sources, compromising security and authentication.
Innovation Solution
Generating a key based on unique file system attributes, such as inode numbers, to encrypt shared secrets, which changes upon copying, preventing key recreation on another device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If traditional entropy sources (device ID, CPU ID, keyboard timings) are used to generate encryption keys, then key generation is simple and straightforward, but the encryption key can be reconstructed by cloning applications that copy these entropy sources
Solution Approach 1:
The patent extracts the file system attribute (inode number) from the file system structure and uses it as an entropy source for key generation. This attribute is taken out from the general file metadata and specifically utilized for cryptographic purposes, making it difficult for cloning applications to replicate since the inode number is tied to the original device's file system structure
Solution Approach 2:
The patent introduces file system attributes as an intermediary between the device hardware and the encryption key generation process. Instead of directly using hardware identifiers or user inputs, the inode number serves as an intermediate value that is difficult to replicate but can be consistently accessed by authorized applications on the original device
2Adaptability or versatility
If all entropy sources are copied to a cloning device, then the cloning device can recreate the encryption key, but this compromises the security of the shared secret
Solution Approach 1:
The patent changes the parameter used for key generation from easily copyable data (device ID, CPU ID) to file system attributes (inode numbers) that have different properties on cloned devices. The inode number is a parameter that is assigned by the file system and is not directly transferable, so when files are copied to a cloning device, they receive new inode numbers, thereby changing the entropy source and preventing key recreation
3Reliability
If file system attributes are used as entropy sources, then cloning prevention is achieved, but the system complexity increases
Solution Approach 1:
The patent implements self-service by having the application query the file system for inode numbers using standard file system interfaces. The existing file system structure and its attribute storage mechanisms are utilized without requiring additional hardware or complex external systems, thereby achieving cloning prevention while maintaining relatively simple implementation
Data Source
AI summary
Techniques are disclosed for protecting cryptographic secrets stored locally in a device, such as a mobile phone. A client device creates or downloads a shared secret to be used in a server transaction. To protect this shared secret locally, the client device encrypts the shared secret using a key generated a file system attributes value, along with other sources of entropy. The file system attributes value may correspond to the inode of a file in a UNIX-based file system. Thereafter, when the shared secret is required for logical computation, the client device reconstructs the key using the file system attributes value and the other previous sources of entropy. The client device may use the key to decrypt the information and use the shared secret for its required purpose, e.g., in generating a one-time password for a login session.