Key Manager for Secure Data Storage in Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing frequency of data processing in mobile devices, particularly for sensitive information, has led to a rise in security threats, necessitating the use of cryptographic techniques for secure storage and management of keys to prevent unauthorized access and malicious software attacks.
Innovation Solution
A key manager system is implemented, comprising a main controller, cipher unit, hash unit, decrypted key memory, and encrypted key memory, which processes commands to generate, encrypt, and decrypt keys, utilizing a one-time programmable memory and random number generator to create encrypted keys, while preventing unauthorized access by separating decrypted and encrypted key storage and allowing only authorized access during normal operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cryptographic techniques are used to secure key storage, then security against unauthorized access and malware attacks is improved, but device complexity increases due to the need for key manager apparatus with multiple components
Solution Approach 1:
The key manager apparatus implements a hierarchical key structure where a first key (master key) is used to encrypt a second key (data encryption key), which in turn encrypts actual data. This nested encryption approach provides multiple layers of security protection while maintaining a relatively compact architectural design, as each encryption layer builds upon the previous one rather than requiring completely separate security subsystems.
Solution Approach 2:
The key manager apparatus segments key management functions into distinct operational modes (normal mode and test mode) and separate storage areas (first key storage and second key storage). This segmentation allows the system to maintain high security through mode-based access control while keeping the overall device complexity manageable by organizing functions into discrete, well-defined modules with clear interfaces.
2Reliability
If keys are stored in encrypted form to prevent key sniffing attacks, then security is improved, but access speed and operational efficiency deteriorate due to decryption requirements
Solution Approach 1:
The system performs preliminary key encryption by encrypting the second key with the first key during key generation, creating a pre-encrypted structure. When data needs to be accessed, the system retrieves this pre-encrypted key structure and performs decryption only when necessary. This preliminary encryption approach ensures that keys are stored in secure encrypted form by default, while minimizing decryption operations to only when actual data access is required, thus balancing security with access speed.
3Reliability
If separate storage areas for decrypted and encrypted keys are implemented, then security against key corruption attacks is improved, but device complexity increases
Solution Approach 1:
The key manager apparatus divides key storage into distinct segments: a first key storage area for storing the master key (first key) and a second key storage area for storing encrypted data encryption keys (second keys). This segmentation physically separates different types of cryptographic materials, preventing a single point of failure and protecting against key corruption attacks. The segmented storage structure is implemented through dedicated memory regions or registers, providing security through spatial separation while maintaining manageable complexity through clear functional boundaries.
Data Source
AI summary
A method and apparatus for managing a key for secure storage of data. The apparatus includes a main controller configured to process a command, a cipher unit configured to encrypt a first key to form an encrypted key or encrypt data to form encrypted data based on a result of the main controller processing the command, and decrypt the encrypted key or the encrypted data based on the result of the main controller processing the command, a hash unit configured to hash the first key according to control of the main controller, a decrypted key memory configured to store the first key, and an encrypted key memory configured to store the encrypted key.