iOS Keychain Credential Segmentation via Secure Element
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The iOS operating system lacks secure methods to protect credentials and private keys, making user passwords and RSA private keys vulnerable to attacks once the device is compromised.
Innovation Solution
A mechanism and method for managing credentials using a certificate object and password object within the iOS keychain, where a thumbprint associates the private key with its corresponding certificate, enabling secure storage, digital signing, and decryption of email messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the iOS operating system uses the keychain container to store passwords and credentials, then the ease of operation is improved, but the security is worsened because the system remains vulnerable to attacks once the device is compromised
Solution Approach 1:
The patent segments the credential storage system into two separate components: a secure element (hardware-based secure storage) and a keychain (software-based container). Sensitive credentials are divided into portions, with critical parts stored in the secure element and less sensitive metadata stored in the keychain. This segmentation allows the system to maintain ease of operation through keychain accessibility while improving security through hardware-based protection of the most sensitive data.
2Ease of manufacture
If the iOS operating system provides password protection and limited file encryption, then the ease of manufacture is improved, but the security is worsened because private keys and credentials remain vulnerable to attacks
Solution Approach 1:
The patent implements a nested structure where the keychain container is embedded within the secure element. The secure element acts as an outer container providing hardware-based security, while the keychain serves as an inner container for metadata and less sensitive information. This nesting allows the system to maintain ease of manufacture by building upon existing keychain infrastructure while adding a layer of hardware-based security around it.
3Device complexity
If the device stores credentials in the keychain container, then the device complexity is reduced, but the security is worsened because any compromised device allows access to all user passwords and RSA private keys
Solution Approach 1:
The patent introduces a secure element as an intermediary between the keychain and the external environment. This secure element acts as a mediator that controls access to sensitive credentials, providing authentication and authorization functions. The secure element mediates between the convenience of keychain access and the security requirements of protecting private keys, allowing the system to maintain reduced device complexity while improving security through this intermediate security layer.
Data Source
AI summary
A mechanism and method for managing credentials on an electronic device configured with an iOS based operating system. The iOS based device includes a “keychain” configured in device memory. According to an embodiment, the electronic device comprises an application configured to generate a public certificate object in the keychain and a password object in the keychain. The public certificate object is configured to store a public certificate, and the password object is configured to store a private key. The password object further includes a label or thumbprint for associating the private key with the corresponding public certificate. According to an embodiment, the application stores the private key in an encrypted container in the password object to provide an additional layer of security. The application is configured to unlock the encrypted container utilizing a password provided the user. According to a further aspect, the user password is not stored in memory on the device. According to an embodiment, the private key is generated and provided by a credential management system operatively coupled to the electronic device for digitally signing an email message.