Protected Key Store Bulk Import via Key References
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current key store systems, such as the Android Keystore, are inadequate in securely managing large numbers of secret keys and expose key materials to malicious parties due to limitations in import functionality and security protocols, particularly in handling thousands or millions of keys and supporting only asymmetric encryption, which is slow and vulnerable to attacks.
Innovation Solution
A method and system that encrypt key materials using compatible encryption credentials, import them en masse to a protected key store, and generate keys using key, bit, or byte offsets, ensuring non-exportability and accessibility only through key references, providing complete protection against unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If asymmetric encryption is used in key store systems, then security protection is provided, but the computation process becomes very slow and vulnerable to attacks
Solution Approach 1:
The patent segments the encryption approach by using symmetric encryption for bulk key material import and storage, while reserving asymmetric encryption for specific security-critical operations. This segmentation allows the system to achieve both high-speed import (via symmetric encryption) and strong security (via asymmetric encryption where needed), resolving the contradiction between security and computation speed.
2Device complexity
If the Android Keystore is designed to maintain only a few secret keys, then security management is simplified, but it cannot handle thousands or millions of keys required in real-world scenarios
Solution Approach 1:
The patent introduces a hierarchical dimension to key storage by organizing keys into key stores with key references, rather than maintaining only a flat list of secret keys. This dimensional change allows the system to scale from storing a few keys to storing millions of keys efficiently, while maintaining simplified security management through the abstracted key reference interface.
3Reliability
If the Android Keystore supports importing only one plain raw key at a time, then security control is maintained, but the import process is inefficient and potentially exposed to malicious parties
Solution Approach 1:
The patent applies preliminary action by encrypting key materials with symmetric encryption before import, and preparing the key store structure in advance to accept bulk encrypted key materials. This preliminary preparation allows efficient batch import of thousands or millions of keys while maintaining security control through pre-established encryption credentials and key reference mechanisms.
4Reliability
If key materials are made non-exportable from the key store, then complete protection against extraction is achieved, but key materials cannot be accessed by external applications
Solution Approach 1:
The patent introduces key references as an intermediary between the non-exportable key materials and external applications. The key reference acts as a secure pointer that allows applications to access and use key materials without being able to extract or copy the actual key material, thus maintaining both protection against extraction and ease of operation for authorized access.
Data Source
AI summary
Protecting usage of key store content at a given user device of an end user includes receiving the key store content at the given user device. The key store content includes key materials encrypted using encryption credentials compatible with the given user device. The key store content is in a format compatible with the given user device. The encrypted key materials of the key store content are imported to a protected key store of the given user device, wherein all the key materials of the key store content are imported at one go. The key materials are stored at the protected key store in the encrypted form, and are non-exportable from the key store. Internally within the protected key store, one or more key store integrated services of the given user device are allowed to access the non-exportable key materials for use, via key references only.